Linus Torvalds [Tue, 8 Jun 2010 00:09:03 +0000 (17:09 -0700)]
Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
ahci: redo stopping DMA engines on empty ports
sata_sil24: fix kernel panic on ARM caused by unaligned access in sata_sil24
ahci: add pci quirk for JMB362
sata_via: explain the magic fix
Tejun Heo [Mon, 7 Jun 2010 13:15:08 +0000 (15:15 +0200)]
ahci: redo stopping DMA engines on empty ports
Commit 96d60303fd (ahci: Turn off DMA engines when there's no device)
implemented stopping DMA engines on empty ports but it used single
sampling of status registers to determine device presence which led to
disabling of DMA engines on occupied ports. Do it after all EH
actions are complete using device presence state determined by EH.
This avoids spurious disabling of DMA engines and simplifies the code.
Signed-off-by: Tejun Heo <tj@kernel.org> Tested-by: Marc Dionne <marc.c.dionne@gmail.com> Cc: Matthew Garrett <mjg@redhat.com> Cc: Robert Hancock <hancockrwd@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Colin Tuckley [Fri, 4 Jun 2010 14:19:51 +0000 (16:19 +0200)]
sata_sil24: fix kernel panic on ARM caused by unaligned access in sata_sil24
The sata_sil24 driver has six 16-bit registers that are initialised with
32-bit writes. This cause a kernel panic on ARM due to the unaligned
accesses which result.
This patch changes the accesses to the correct 16-bit ones.
Signed-off-by: Colin Tuckley <colin.tuckley@arm.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Tejun Heo [Thu, 3 Jun 2010 09:57:04 +0000 (11:57 +0200)]
ahci: add pci quirk for JMB362
JMB362 is a new variant of jmicron controller which is similar to
JMB360 but has two SATA ports instead of one. As there is no PATA
port, single function AHCI mode can be used as in JMB360. Add pci
quirk for JMB362.
Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Aries Lee <arieslee@jmicron.com> Cc: stable@kernel.org Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
The code used to multiply the character offset by "vc->vc_cols", and
that's actually correct, because 'd' itself is an 'unsigned short'. So
the pointer arithmetic already takes the size of a VGA character into
account. Changing it to use vc_size_row (which is just "vc_cols"
shifted up to take the size of the character into account) ends up
multiplying with the VGA character size twice.
This got reported as bugs for various other subsystems, because what it
actually results in is writing the 16-bit vc_video_erase_char pattern
(usually 0x0720: 0x07 is the default attribute, 0x20 is ASCII space)
into some random other allocation.
So Markus ended up reporting this as a ext4 bug, while to Torsten Kaiser
it looked like a problem with KMS or libata. Jeff Chua saw it in
different places.
And finally - Justin Mattock had slab poisoning enabled, and saw it as a
slab poison overwritten. And bisected and reverted this to verify the
buggy commit.
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de> Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com> Reported-by: Jeff Chua <jeff.chua.linux@gmail.com> Reported-by: Justin P. Mattock <justinmattock@gmail.com> Reported-bisected-and-tested-by: Justin P. Mattock <justinmattock@gmail.com> Acked-by: Dave Airlie <airlied@redhat.com> Cc: Frank Pan <frankpzh@gmail.com> Cc: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Chris Wilson [Wed, 2 Jun 2010 07:30:48 +0000 (08:30 +0100)]
drm/i915: Move non-phys cursors into the GTT
Cursors need to be in the GTT domain when being accessed by the GPU.
Previously this was a fortuitous byproduct of userspace using pwrite()
to upload the image data into the cursor. The redundant clflush was
removed in commit 9b8c4a and so the image was no longer being flushed
out of the caches into main memory. One could also devise a scenario
where the cursor was rendered by the GPU, prior to being attached as the
cursor, resulting in similar corruption due to the missing MI_FLUSH.
Fixes:
Bug 28335 - Cursor corruption caused by commit 9b8c4a0b21
https://bugs.freedesktop.org/show_bug.cgi?id=28335
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com> Tested-by: Linus Torvalds <torvalds@linux-foundation.org> Reported-by: Andy Isaacson <adi@hexapodia.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 5 Jun 2010 14:33:05 +0000 (07:33 -0700)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: improve xfs_isilocked
xfs: skip writeback from reclaim context
xfs: remove done roadmap item from xfs-delayed-logging-design.txt
xfs: fix race in inode cluster freeing failing to stale inodes
xfs: fix access to upper inodes without inode64
xfs: fix might_sleep() warning when initialising per-ag tree
fs/xfs/quota: Add missing mutex_unlock
xfs: remove duplicated #include
xfs: convert more trace events to DEFINE_EVENT
xfs: xfs_trace.c: remove duplicated #include
xfs: Check new inode size is OK before preallocating
xfs: clean up xlog_align
xfs: cleanup log reservation calculactions
xfs: be more explicit if RT mount fails due to config
xfs: replace E2BIG with EFBIG where appropriate
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits)
X25: remove duplicated #include
tcp: use correct net ns in cookie_v4_check()
rps: tcp: fix rps_sock_flow_table table updates
ppp_generic: fix multilink fragment sizes
syncookies: remove Kconfig text line about disabled-by-default
ixgbe: only check pfc bits in hang logic if pfc is enabled
net: check for refcount if pop a stacked dst_entry
ixgbe: return IXGBE_ERR_RAR_INDEX when out of range
act_pedit: access skb->data safely
sfc: Store port number in net_device::dev_id
epic100: Test __BIG_ENDIAN instead of (non-existent) CONFIG_BIG_ENDIAN
tehuti: return -EFAULT on copy_to_user errors
isdn/kcapi: return -EFAULT on copy_from_user errors
e1000e: change logical negate to bitwise
sfc: Get port number from CS_PORT_NUM, not PCI function number
cls_u32: use skb_header_pointer() to dereference data safely
TCP: tcp_hybla: Fix integer overflow in slow start increment
act_nat: fix the wrong checksum when addr isn't in old_addr/mask
net/fec: fix pm to survive to suspend/resume
korina: count RX DMA OVR as rx_fifo_error
...
Linus Torvalds [Sat, 5 Jun 2010 14:31:13 +0000 (07:31 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
nilfs2: remove obsolete declarations of cache constructor and destructor
nilfs2: fix style issue in nilfs_destroy_cachep
Linus Torvalds [Sat, 5 Jun 2010 04:12:39 +0000 (21:12 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
Minix: Clean up left over label
fix truncate inode time modification breakage
fix setattr error handling in sysfs, configfs
fcntl: return -EFAULT if copy_to_user fails
wrong type for 'magic' argument in simple_fill_super()
fix the deadlock in qib_fs
mqueue doesn't need make_bad_inode()
* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus:
module: fix bne2 "gave up waiting for init of module libcrc32c"
module: verify_export_symbols under the lock
module: move find_module check to end
module: make locking more fine-grained.
module: Make module sysfs functions private.
module: move sysfs exposure to end of load_module
module: fix kdb's illicit use of struct module_use.
module: Make the 'usage' lists be two-way
Rusty Russell [Sat, 5 Jun 2010 17:17:37 +0000 (11:17 -0600)]
module: fix bne2 "gave up waiting for init of module libcrc32c"
Problem: it's hard to avoid an init routine stumbling over a
request_module these days. And it's not clear it's always a bad idea:
for example, a module like kvm with dynamic dependencies on kvm-intel
or kvm-amd would be neater if it could simply request_module the right
one.
If another module is waiting inside resolve_symbol() for libcrc32c to
finish initializing (ie. bne2 depends on libcrc32c) then it does so
holding the module lock, and our request_module() can't make progress
until that is released.
Waiting inside resolve_symbol() without the lock isn't all that hard:
we just need to pass the -EBUSY up the call chain so we can sleep
where we don't hold the lock. Error reporting is a bit trickier: we
need to copy the name of the unfinished module before releasing the
lock.
Other notes:
1) This also fixes a theoretical issue where a weak dependency would allow
symbol version mismatches to be ignored.
2) We rename use_module to ref_module to make life easier for the only
external user (the out-of-tree ksplice patches).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Tim Abbot <tabbott@ksplice.com> Tested-by: Brandon Philips <bphilips@suse.de>
Rusty Russell [Sat, 5 Jun 2010 17:17:37 +0000 (11:17 -0600)]
module: verify_export_symbols under the lock
It disabled preempt so it was "safe", but nothing stops another module
slipping in before this module is added to the global list now we don't
hold the lock the whole time.
So we check this just after we check for duplicate modules, and just
before we put the module in the global list.
(find_symbol finds symbols in coming and going modules, too).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Linus Torvalds [Sat, 5 Jun 2010 17:17:36 +0000 (11:17 -0600)]
module: move find_module check to end
I think Rusty may have made the lock a bit _too_ finegrained there, and
didn't add it to some places that needed it. It looks, for example, like
PATCH 1/2 actually drops the lock in places where it's needed
("find_module()" is documented to need it, but now load_module() didn't
hold it at all when it did the find_module()).
Rather than adding a new "module_loading" list, I think we should be able
to just use the existing "modules" list, and just fix up the locking a
bit.
In fact, maybe we could just move the "look up existing module" a bit
later - optimistically assuming that the module doesn't exist, and then
just undoing the work if it turns out that we were wrong, just before
adding ourselves to the list.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Rusty Russell [Sat, 5 Jun 2010 17:17:36 +0000 (11:17 -0600)]
module: move sysfs exposure to end of load_module
This means a little extra work, but is more logical: we don't put
anything in sysfs until we're about to put the module into the
global list an parse its parameters.
This also gives us a logical place to put duplicate module detection
in the next patch.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Rusty Russell [Sat, 5 Jun 2010 17:17:35 +0000 (11:17 -0600)]
module: fix kdb's illicit use of struct module_use.
Linus changed the structure, and luckily this didn't compile any more.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Cc: Jason Wessel <jason.wessel@windriver.com> Cc: Martin Hicks <mort@sgi.com>
Linus Torvalds [Mon, 31 May 2010 19:19:37 +0000 (12:19 -0700)]
module: Make the 'usage' lists be two-way
When adding a module that depends on another one, we used to create a
one-way list of "modules_which_use_me", so that module unloading could
see who needs a module.
It's actually quite simple to make that list go both ways: so that we
not only can see "who uses me", but also see a list of modules that are
"used by me".
In fact, we always wanted that list in "module_unload_free()": when we
unload a module, we want to also release all the other modules that are
used by that module. But because we didn't have that list, we used to
first iterate over all modules, and then iterate over each "used by me"
list of that module.
By making the list two-way, we simplify module_unload_free(), and it
allows for some trivial fixes later too.
Eric Dumazet [Thu, 3 Jun 2010 09:03:58 +0000 (09:03 +0000)]
rps: tcp: fix rps_sock_flow_table table updates
I believe a moderate SYN flood attack can corrupt RFS flow table
(rps_sock_flow_table), making RPS/RFS much less effective.
Even in a normal situation, server handling short lived sessions suffer
from bad steering for the first data packet of a session, if another SYN
packet is received for another session.
We do following action in tcp_v4_rcv() :
sock_rps_save_rxhash(sk, skb->rxhash);
We should _not_ do this if sk is a LISTEN socket, as about each
packet received on a LISTEN socket has a different rxhash than
previous one.
-> RPS_NO_CPU markers are spread all over rps_sock_flow_table.
Also, it makes sense to protect sk->rxhash field changes with socket
lock (We currently can change it even if user thread owns the lock
and might use rxhash)
This patch moves sock_rps_save_rxhash() to a sock locked section,
and only for non LISTEN sockets.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
John Fastabend [Thu, 3 Jun 2010 17:03:45 +0000 (17:03 +0000)]
ixgbe: only check pfc bits in hang logic if pfc is enabled
Only check pfc bits in hang logic if PFC is enabled. Previously,
if DCB was enabled but PFC was disabled the incorrect pause
bits would be checked.
Signed-off-by: John Fastabend <john.r.fastabend@intel.com> Acked-by: Don Skidmore <donald.c.skidmore@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
net: check for refcount if pop a stacked dst_entry
xfrm triggers a warning if dst_pop() drops a refcount
on a noref dst. This patch changes dst_pop() to
skb_dst_pop(). skb_dst_pop() drops the refcnt only
on a refcounted dst. Also we don't clone the child
dst_entry, so it is not refcounted and we can use
skb_dst_set_noref() in xfrm_output_one().
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (23 commits)
sh: Make intc messages consistent via pr_fmt.
sh: make sure static declaration on ms7724se
sh: make sure static declaration on mach-migor
sh: make sure static declaration on mach-ecovec24
sh: make sure static declaration on mach-ap325rxa
clocksource: sh_cmt: compute mult and shift before registration
clocksource: sh_tmu: compute mult and shift before registration
sh: PIO disabling for x3proto and urquell.
sh: mach-sdk7786: conditionally disable PIO support.
sh: support for platforms without PIO.
usb: r8a66597-hcd pio to mmio accessor conversion.
usb: gadget: r8a66597-udc pio to mmio accessor conversion.
usb: gadget: m66592-udc pio to mmio accessor conversion.
sh: add romImage MMCIF boot for sh7724 and Ecovec V2
sh: add boot code to MMCIF driver header
sh: prepare MMCIF driver header file
sh: allow romImage data between head.S and the zero page
sh: Add support MMCIF for ecovec
sh: remove duplicated #include
input: serio: disable i8042 for non-cayman sh platforms.
...
Linus Torvalds [Fri, 4 Jun 2010 22:39:54 +0000 (15:39 -0700)]
Merge branch 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core
* 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core: (83 commits)
i7core_edac: Better describe the supported devices
Add support for Westmere to i7core_edac driver
i7core_edac: don't free on success
i7core_edac: Add support for X5670
Always call i7core_[ur]dimm_check_mc_ecc_err
i7core_edac: fix memory leak of i7core_dev
EDAC: add __init to i7core_xeon_pci_fixup
i7core_edac: Fix wrong device id for channel 1 devices
i7core: add support for Lynnfield alternate address
i7core_edac: Add initial support for Lynnfield
i7core_edac: do not export static functions
edac: fix i7core build
edac: i7core_edac produces undefined behaviour on 32bit
i7core_edac: Use a more generic approach for probing PCI devices
i7core_edac: PCI device is called NONCORE, instead of NOCORE
i7core_edac: Fix ringbuffer maxsize
i7core_edac: First store, then increment
i7core_edac: Better parse "any" addrmask
i7core_edac: Use a lockless ringbuffer
edac: Create an unique instance for each kobj
...
Linus Torvalds [Fri, 4 Jun 2010 22:37:44 +0000 (15:37 -0700)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: (27 commits)
block: make blk_init_free_list and elevator_init idempotent
block: avoid unconditionally freeing previously allocated request_queue
pipe: change /proc/sys/fs/pipe-max-pages to byte sized interface
pipe: change the privilege required for growing a pipe beyond system max
pipe: adjust minimum pipe size to 1 page
block: disable preemption before using sched_clock()
cciss: call BUG() earlier
Preparing 8.3.8rc2
drbd: Reduce verbosity
drbd: use drbd specific ratelimit instead of global printk_ratelimit
drbd: fix hang on local read errors while disconnected
drbd: Removed the now empty w_io_error() function
drbd: removed duplicated #includes
drbd: improve usage of MSG_MORE
drbd: need to set socket bufsize early to take effect
drbd: improve network latency, TCP_QUICKACK
drbd: Revert "drbd: Create new current UUID as late as possible"
brd: support discard
Revert "writeback: fix WB_SYNC_NONE writeback from umount"
Revert "writeback: ensure that WB_SYNC_NONE writeback with sb pinned is sync"
...
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
serial: add support for various Titan PCI cards
vt_ioctl: return -EFAULT on copy_from_user errors
serial: altera_uart: Proper section for altera_uart_remove
tty: fix a little bug in scrup, vt.c
altera_uart: Simplify altera_uart_console_putc
altera_uart: Don't take spinlock in already protected functions
TTY/n_gsm: potential double lock
serial: bfin_5xx: fix typo in IER check
serial: bfin_5xx: IRDA is not affected by anomaly 05000230
serial_cs: add and sort IDs for serial and modem cards
msm_serial: fix serial on trout
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: unbind all interfaces before rebinding them
USB: serial: digi_acceleport: Eliminate a NULL pointer dereference
usb: fix ehci_hcd build failure when both generic-OF and xilinx is selected
USB: cdc-acm: fix resource reclaim in error path of acm_probe
USB: ftdi_sio: fix DTR/RTS line modes
USB: s3c-hsotg: Ensure FIFOs are fully flushed after layout
USB: s3c-hsotg: SoftDisconnect minimum 3ms
USB: s3c-hsotg: Ensure TX FIFO addresses setup when initialising FIFOs
USB: s3c_hsotg: define USB_GADGET_DUALSPEED in Kconfig
USB: s3c: Enable soft disconnect during initialization
USB: xhci: Print NEC firmware version.
USB: xhci: Wait for host to start running.
USB: xhci: Wait for controller to be ready after reset.
USB: isp1362: fix inw warning on Blackfin systems
USB: mos7840: fix null-pointer dereference
Cory Maccarrone [Fri, 4 Jun 2010 21:15:07 +0000 (14:15 -0700)]
omap: remove BUG_ON for disabled interrupts
Remove a BUG_ON for when interrupts are disabled during an MMC request.
During boot, interrupts can be disabled when a request is made, causing
this bug to be triggered. In reality, there's no reason this should halt
the kernel, as the driver has proved reliable in spite of disabled
interrupts, and additionally, there's nothing in this code that would
require interrupts to be enabled.
The only setup I've managed to make it trigger on is on the HTC Herald
during bootup when the driver is built into the kernel (mostly because
that's all I have). I believe it's related to the fact that on bootup I
get many timeout errors on "CMD5" while initializing the card. Each CMD5
timeout triggers that bug (I changed it to a WARN_ON to get it to boot in)
due to the fact that part of the timeout code involves sending the request
again. With interrupts turned off, that BUG would be triggered.
Signed-off-by: Cory Maccarrone <darkstar6262@gmail.com> Acked-by: Tony Lindgren <tony@atomide.com> Cc: <linux-mmc@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
page allocator: smarter retry of costly-order allocations
Original intention was "return success if the system have shrinkable zones
though priority==0 reclaim was failure". But the above patch changed to
"return nr_reclaimed if .....". Oh, That forgot nr_reclaimed may be 0 if
priority==0 reclaim failure.
And Johannes's patch 0aeb2339e54e ("vmscan: remove all_unreclaimable scan
control") made it more corrupt. Originally, priority==0 reclaim failure
on memcg return 0, but this patch changed to return 1. It totally
confused memcg.
Akinobu Mita [Fri, 4 Jun 2010 21:15:04 +0000 (14:15 -0700)]
kernel/: fix BUG_ON checks for cpu notifier callbacks direct call
The commit 80b5184cc537718122e036afe7e62d202b70d077 ("kernel/: convert cpu
notifier to return encapsulate errno value") changed the return value of
cpu notifier callbacks.
Those callbacks don't return NOTIFY_BAD on failures anymore. But there
are a few callbacks which are called directly at init time and checking
the return value.
I forgot to change BUG_ON checking by the direct callers in the commit.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Child groups should have a greater depth than their parents. Prior to
this change, the parent would incorrectly report zero memory usage for
child cgroups when use_hierarchy is enabled.
test script:
mount -t cgroup none /cgroups -o memory
cd /cgroups
mkdir cg1
Using fae9c79, a recent patch that changed alloc_css_id() depth computation,
the parent incorrectly reports zero usage:
root@ubuntu:~# ./test
1+0 records in
1+0 records out 1048576 bytes (1.0 MB) copied, 0.0151844 s, 69.1 MB/s
With this patch, the parent correctly includes child usage:
root@ubuntu:~# ./test
1+0 records in
1+0 records out 1048576 bytes (1.0 MB) copied, 0.0136827 s, 76.6 MB/s
Commit f601441916d1e19291d0b4f044b4a7551e2924d0 ("imxfb: add support for
i.MX25:) has inserted the symbol HAVE_FB_IMX, which does not depend on FB
after the menuconfig FB. This breaks the menu, presenting most of the
drivers outside of it, when using menuconfig.
Moving the symbol to the start of the file, just like HAVE_FB_ATMEL, fixes
the problem without breaking it for iMX25 configurations (tested with
ARCH=arm, no build).
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com> Cc: Sascha Hauer <s.hauer@pengutronix.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Baruch Siach <baruch@tkos.co.il> Cc: "David S. Miller" <davem@davemloft.net> Cc: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
arch/um: fix kunmap_atomic() call in skas/uaccess.c
kunmap_atomic() takes a pointer to within the page, not the struct page.
Signed-off-by: Cesar Eduardo Barros <cesarb@cesarb.net> Cc: Jeff Dike <jdike@addtoit.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Oleg Nesterov [Fri, 4 Jun 2010 21:14:58 +0000 (14:14 -0700)]
sys_personality: change sys_personality() to accept "unsigned int" instead of u_long
task_struct->pesonality is "unsigned int", but sys_personality() paths use
"unsigned long pesonality". This means that every assignment or
comparison is not right. In particular, if this argument does not fit
into "unsigned int" __set_personality() changes the caller's personality
and then sys_personality() returns -EINVAL.
Turn this argument into "unsigned int" and avoid overflows. Obviously,
this is the user-visible change, we just ignore the upper bits. But this
can't break the sane application.
There is another thing which can confuse the poorly written applications.
User-space thinks that this syscall returns int, not long. This means
that the returned value can be negative and look like the error code. But
note that libc won't be confused and thus errno won't be set, and with
this patch the user-space can never get -1 unless sys_personality() really
fails. And, most importantly, the negative RET != -1 is only possible if
that app previously called personality(RET).
Although the fix provided is correct, it's been suggested to avoid the
underlying race in the same way as it is currently done in filesystems
like NFS, for maintainability.
A following patch "fb_defio: redo fix for non-dirty ptes" will provide
such an alternate fix.
Signed-off-by: Albert Herranz <albert_herranz@yahoo.es> Cc: Jaya Kumar <jayakumar.lkml@gmail.com> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mike Frysinger [Fri, 4 Jun 2010 21:14:55 +0000 (14:14 -0700)]
flat: fix unmap len in load error path
The data chunk is mmaped with 'len' which remains unchanged, so use that
when unmapping in the error path rather than trying to recalculate (and
incorrectly so) the value used originally.
Signed-off-by: Mike Frysinger <vapier@gentoo.org> Acked-by: David McCullough <davidm@snapgear.com> Acked-by: Greg Ungerer <gerg@uclinux.org> Cc: Paul Mundt <lethal@linux-sh.org> Cc: Michal Simek <monstr@monstr.eu> Cc: Hirokazu Takata <takata@linux-m32r.org> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mike Frysinger [Fri, 4 Jun 2010 21:14:53 +0000 (14:14 -0700)]
fs/binfmt_flat.c: split the stack & data alignments
The stack and data have different alignment requirements, so don't force
them to wear the same shoe. Increase the data alignment to match that
which the elf2flt linker script has always been using: 0x20 bytes. Not
only does this bring the kernel loader in line with the toolchain, but it
also fixes a swath of gcc tests which try to force larger alignment values
but randomly fail when the FLAT loader fails to deliver.
Signed-off-by: Mike Frysinger <vapier@gentoo.org> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: David Woodhouse <David.Woodhouse@intel.com> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Acked-by: David McCullough <davidm@snapgear.com> Acked-by: Greg Ungerer <gerg@uclinux.org> Cc: Paul Mundt <lethal@linux-sh.org> Tested-by: Michal Simek <monstr@monstr.eu> Cc: Hirokazu Takata <takata@linux-m32r.org> Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Jie Zhang <jie@codesourcery.com> Cc: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dmitry Torokhov [Fri, 4 Jun 2010 21:14:52 +0000 (14:14 -0700)]
vmware balloon: clamp number of collected non-balloonable pages
Limit number of accumulated non-balloonable pages during inflation cycle,
otherwise there is a chance we will be spinning and growing the list
forever. This happens during torture tests when balloon target changes
while we are in the middle of inflation cycle and monitor starts refusing
to lock pages (since they are not needed anymore).
Nick Piggin [Fri, 4 Jun 2010 21:14:51 +0000 (14:14 -0700)]
xtensa: invoke oom-killer from page fault
As explained in commit 1c0fe6e3bd ("mm: invoke oom-killer from page
fault") , we want to call the architecture independent oom killer when
getting an unexplained OOM from handle_mm_fault, rather than simply
killing current.
Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: David Rientjes <rientjes@google.com> Cc: Chris Zankel <chris@zankel.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Fri, 4 Jun 2010 21:14:51 +0000 (14:14 -0700)]
mn10300: invoke oom-killer from page fault
As explained in commit 1c0fe6e3bd ("mm: invoke oom-killer from page
fault") , we want to call the architecture independent oom killer when
getting an unexplained OOM from handle_mm_fault, rather than simply
killing current.
Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: David Rientjes <rientjes@google.com> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Fri, 4 Jun 2010 21:14:49 +0000 (14:14 -0700)]
m32r: invoke oom-killer from page fault
As explained in commit 1c0fe6e3bd ("mm: invoke oom-killer from page
fault") , we want to call the architecture independent oom killer when
getting an unexplained OOM from handle_mm_fault, rather than simply
killing current.
Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: David Rientjes <rientjes@google.com> Cc: Hirokazu Takata <takata@linux-m32r.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Fri, 4 Jun 2010 21:14:49 +0000 (14:14 -0700)]
frv: invoke oom-killer from page fault
As explained in commit 1c0fe6e3bd ("mm: invoke oom-killer from page
fault") , we want to call the architecture independent oom killer when
getting an unexplained OOM from handle_mm_fault, rather than simply
killing current.
Signed-off-by: Nick Piggin <npiggin@suse.de> Acked-by: David Howells <dhowells@redhat.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
A call to access_ok is missing a compat_ptr conversion. Introduced with b83733639a494d5f42fa00a2506563fbd2d3015d "compat: factor out
compat_rw_copy_check_uvector from compat_do_readv_writev"
fs/compat.c: In function 'compat_rw_copy_check_uvector':
fs/compat.c:629: warning: passing argument 1 of '__access_ok' makes pointer from integer without a cast
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Thu, 3 Jun 2010 12:01:46 +0000 (22:01 +1000)]
fix truncate inode time modification breakage
mtime and ctime should be changed only if the file size has actually
changed. Patches changing ext2 and tmpfs from vmtruncate to new truncate
sequence has caused regressions where they always update timestamps.
There is some strange cases in POSIX where truncate(2) must not update
times unless the size has acutally changed, see 6e656be89.
This area is all still rather buggy in different ways in a lot of
filesystems and needs a cleanup and audit (ideally the vfs will provide
a simple attribute or call to direct all filesystems exactly which
attributes to change). But coming up with the best solution will take a
while and is not appropriate for rc anyway.
So fix recent regression for now.
Signed-off-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Nick Piggin [Mon, 31 May 2010 07:58:02 +0000 (17:58 +1000)]
fix setattr error handling in sysfs, configfs
sysfs and configfs setattr functions have error cases after the generic inode's
attributes have been changed. Fix consistency by changing the generic inode
attributes only when it is guaranteed to succeed.
Signed-off-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Dan Carpenter [Thu, 3 Jun 2010 10:35:42 +0000 (12:35 +0200)]
fcntl: return -EFAULT if copy_to_user fails
copy_to_user() returns the number of bytes remaining, but we want to
return -EFAULT.
ret = fcntl(fd, F_SETOWN_EX, NULL);
With the original code ret would be 8 here.
V2: Takuya Yoshikawa pointed out a similar issue in f_getown_ex()
Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 29 May 2010 01:32:44 +0000 (21:32 -0400)]
fix the deadlock in qib_fs
get_sb_single() calls fill_super with superblock locked; calling
deactivate_super() will deadlock immedately. Moreover, if fill_super
callback returns an error, get_sb_single() will release the reference
to superblock itself just fine.
Dan Carpenter [Fri, 4 Jun 2010 10:38:40 +0000 (12:38 +0200)]
Staging: sep: return -EFAULT on copy_to_user errors
copy_to_user() returns the number of bytes remaining but we want to
return a negative error code here. These functions are used in the
ioctl handler and the error code gets returned to userspace.
Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Dan Carpenter [Fri, 4 Jun 2010 10:39:51 +0000 (12:39 +0200)]
Staging: rc2860: return -EFAULT on copy_to_user errors
copy_to_user() returns the number of bytes remaining but we want to
return a negative error code. This is in the ioctl handler and the
error code gets passed to userspace.
Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c
Correct at least one of the incorrect specs for a national instrument
data acquisition card DAQCard-6024E. This card has only four different
gain settings (+-10V, +-5V, +-0.5V, +-0.05V).
Alexander Kurz [Thu, 3 Jun 2010 11:50:24 +0000 (15:50 +0400)]
Staging: comedi: fixing ni_labpc to mite dependancy
the dependancy of ni_labpc on mite was missing,
Signed-off-by: Alexander Kurz <linux@kbdbabel.org> Acked-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
index 0aa2b0d..79f5f2e 100644
Fixes Kconfig so the wlags49_h2 and wlags49_h25 drivers can be
selected from menuconfig without having to select another WLAN
driver first. Before it could only be selected when another driver
already selected WIRELESS_EXT. Also adds WEXT_PRIV on which
the driver also depends.
Align help text in Kconfig.
Signed-off-by: Henk de Groot <pe1dnn@amsat.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Randy Dunlap [Wed, 26 May 2010 17:30:02 +0000 (10:30 -0700)]
Staging: phison: depends on ATA_BMDMA
phison uses interfaces and data that are built only when
ATA_BMDMA is enabled, so it should depend on that symbol.
drivers/staging/phison/phison.c:43: error: implicit declaration of function 'ATA_BMDMA_SHT'
drivers/staging/phison/phison.c:43: error: initializer element is not constant
drivers/staging/phison/phison.c:43: error: (near initialization for 'phison_sht.module')
drivers/staging/phison/phison.c:47: error: 'ata_bmdma_port_ops' undeclared here (not in a function)
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: evan_ko@phison.com Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sven Eckelmann [Sat, 22 May 2010 15:48:47 +0000 (17:48 +0200)]
Staging: batman-adv: Don't allocate icmp packet with GFP_KERNEL
A new buffer for a packet is created when a icmp packet is received.
This happens in a context with disabled irq. Thus we are not allowed to
sleep or call function which might sleep. kmalloc must be called with
GFP_ATOMIC instead of GFP_KERNEL to ensure that it does not sleep.
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sven Eckelmann [Sat, 22 May 2010 15:48:46 +0000 (17:48 +0200)]
Staging: batman-adv: Don't call free_netdev twice
Free_netdev is registered as destructor in interface_setup for every
soft_device. This destructor is automatically called from
unregister_netdev and we must not call it again for the freed
net_device.
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sven Eckelmann [Sat, 22 May 2010 15:48:45 +0000 (17:48 +0200)]
Staging: batman-adv: Call unregister_netdev on failures to get rtnl lock
We must call unregister_netdev when we couldn't initialise the
batman-adv module and the soft_device was registered. There are two
version of the function which we can use:
* unregister_netdevice - removes device
* unregister_netdev - takes rtnl semaphore and remove device
We don't hold the semaphore in an error situation. So we must use
unregister_netdev.
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Marek Lindner [Sat, 22 May 2010 15:48:44 +0000 (17:48 +0200)]
Staging: batman-adv: fix rogue packets on shutdown
On module shutdown batman-adv would purge the internal packet
queue by sending all remaining packets which could confuse
other nodes. Now, the packets are silently discarded.
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Qualcomm development of the MSM SOC framebuffer driver has
diverged significantly from the driver used by Android. This
is a snapshot of our current driver, in all it's agony. We are
putting this in staging to help with the process of converging
the two drivers.
At this point, the driver has been tested only in dumb
framebuffer mode.
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org> Signed-off-by: David Brown <davidb@codeaurora.org> Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
[dwalker@codeaurora.org: added a small compile fix and TODO.] Signed-off-by: Daniel Walker <dwalker@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alexander Kurz [Wed, 19 May 2010 20:32:42 +0000 (00:32 +0400)]
Staging: comedi: fixing ni_tio to mite PCI dependancy
On Wed, 19 May 2010, Randy Dunlap wrote:
> linux-next of 2010-0519:
> when CONFIG_PCI is not enabled:
>
> drivers/staging/comedi/drivers/mite.c: In function 'mite_init':
> drivers/staging/comedi/drivers/mite.c:89: error: implicit declaration of function 'pci_dev_get'
> drivers/staging/comedi/drivers/mite.c:89: warning: assignment makes pointer from integer without a cast
> make[5]: *** [drivers/staging/comedi/drivers/mite.o] Error 1
This patch fixes the problem.
Signed-off-by: Alexander Kurz <linux@kbdbabel.org> Acked-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 17:09:50 +0000 (18:09 +0100)]
Staging: comedi: For COMEDI_BUFINFO, check access to command
Don't allow COMEDI_BUFINFO ioctl if some other file object has locked
the subdevice or has an active command. If there is no active command,
just report back the last buffer position.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 17:09:49 +0000 (18:09 +0100)]
Staging: comedi: COMEDI_BUFINFO with no async - report no bytes read or written
When the COMEDI_BUFINFO ioctl is used on a subdevice without
asynchronous streaming command support, set 'bytes_read = 0' and
'bytes_written = 0' in the buffer info returned back to the user.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 16:22:41 +0000 (17:22 +0100)]
Staging: comedi: don't write to buffer if command finished
For write(), any data copied to the data buffer after the previously
set up streaming acquisition command has finished won't be used, but a
non-empty write() does not currently return 0 (or -EPIPE on error) after
the command has finished until the data buffer has been filled up.
Change this behavior to return 0 (or -EPIPE) any time after the command
has finished, without bothering to fill up the buffer with more useless
data.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 15:59:40 +0000 (16:59 +0100)]
Staging: comedi: amplc_dio200: Protect counter subdevice with spinlock
The internal state of an 82C54 counter timer chip will get messed up if
several threads read, write, configure, or check the status of the chip
simultaneously. Protect the register access sequences with a spin lock.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 14:11:58 +0000 (15:11 +0100)]
Staging: comedi: addi-data: don't overwrite name for request_irq()
The Addi-Data PCI drivers for Comedi use sprintf() in their comedi
"attach" routine to construct a string to pass as the name in the call
to request_irq(). All calls to "attach" routine share the same static
buffer for this name, but the contents will differ on each call
(including the comedi device number and the comedi board name). This
changes the name displayed in /proc/interrupts for previous calls to
request_irq() using the same buffer. Just use the board name instead;
it has slightly less information (no comedi device number) but at least
it doesn't change over the lifetime of the IRQ handler.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ian Abbott [Wed, 19 May 2010 14:11:57 +0000 (15:11 +0100)]
Staging: comedi: Give the addi_apci_* drivers different driver names
It is not currently possible for more than one of the addi_apci_*
drivers to register themselves with comedi at once because they all use
the same comedi driver name "addi_common". Give them different names.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sreedhara DS [Tue, 1 Jun 2010 11:50:06 +0000 (12:50 +0100)]
Staging: mid: Intel MID touch screen driver
Touchscreen driver used by intel mid devices. Some clean up by Alan Cox. This
driver is basically ready for upstreaming properly but is tied wrongly to the
SPI layer and needs firmware/SFI changes to fix that.
Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This driver handles XG20, XG21, XG40, XG42 chipsets from XGI. They're
also known as Z7,Z9,Z11 chipsets. It's based on the SiS fb driver but
has been heavily modified by XGI to support their newer chipsets.
Frank Pan [Wed, 26 May 2010 07:37:43 +0000 (15:37 +0800)]
tty: fix a little bug in scrup, vt.c
The code uses vc->vc_cols instead of vc->vc_size_row by mistake, it
will cause half of the region which is going to clear remain
uncleared.
The issue happens in background consoles, so it's hard to observe.
Frank Pan
Signed-off-by: Frank Pan <frankpzh@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
projects / karo-tx-linux.git / log