* [34-longterm 061/247] klist: Fix object alignment on 64-bit.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 062/247] powerpc: Fix some 6xx/7xxx CPU setup functions Paul Gortmaker
` (185 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, David Miller, Linus Torvalds, Paul Gortmaker
From: David Miller <davem@davemloft.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 795abaf1e4e188c4171e3cd3dbb11a9fcacaf505 upstream.
Commit c0e69a5bbc6f ("klist.c: bit 0 in pointer can't be used as flag")
intended to make sure that all klist objects were at least pointer size
aligned, but used the constant "4" which only works on 32-bit.
Use "sizeof(void *)" which is correct in all cases.
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/klist.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/include/linux/klist.h b/include/linux/klist.h
index e91a4e5..a370ce5 100644
--- a/include/linux/klist.h
+++ b/include/linux/klist.h
@@ -22,7 +22,7 @@ struct klist {
struct list_head k_list;
void (*get)(struct klist_node *);
void (*put)(struct klist_node *);
-} __attribute__ ((aligned (4)));
+} __attribute__ ((aligned (sizeof(void *))));
#define KLIST_INIT(_name, _get, _put) \
{ .k_lock = __SPIN_LOCK_UNLOCKED(_name.k_lock), \
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 062/247] powerpc: Fix some 6xx/7xxx CPU setup functions
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 061/247] klist: Fix object alignment on 64-bit Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 063/247] parisc : Remove broken line wrapping handling pdc_iodc_print() Paul Gortmaker
` (184 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Benjamin Herrenschmidt, Paul Gortmaker
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1f1936ff3febf38d582177ea319eaa278f32c91f upstream.
Some of those functions try to adjust the CPU features, for example
to remove NAP support on some revisions. However, they seem to use
r5 as an index into the CPU table entry, which might have been right
a long time ago but no longer is. r4 is the right register to use.
This probably caused some off behaviours on some PowerMac variants
using 750cx or 7455 processor revisions.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/cpu_setup_6xx.S | 40 +++++++++++++++++-----------------
1 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
index 55cba4a..f8cd9fb 100644
--- a/arch/powerpc/kernel/cpu_setup_6xx.S
+++ b/arch/powerpc/kernel/cpu_setup_6xx.S
@@ -18,7 +18,7 @@
#include <asm/mmu.h>
_GLOBAL(__setup_cpu_603)
- mflr r4
+ mflr r5
BEGIN_MMU_FTR_SECTION
li r10,0
mtspr SPRN_SPRG_603_LRU,r10 /* init SW LRU tracking */
@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION
bl __init_fpu_registers
END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
bl setup_common_caches
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_604)
- mflr r4
+ mflr r5
bl setup_common_caches
bl setup_604_hid0
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_750)
- mflr r4
+ mflr r5
bl __init_fpu_registers
bl setup_common_caches
bl setup_750_7400_hid0
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_750cx)
- mflr r4
+ mflr r5
bl __init_fpu_registers
bl setup_common_caches
bl setup_750_7400_hid0
bl setup_750cx
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_750fx)
- mflr r4
+ mflr r5
bl __init_fpu_registers
bl setup_common_caches
bl setup_750_7400_hid0
bl setup_750fx
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_7400)
- mflr r4
+ mflr r5
bl __init_fpu_registers
bl setup_7400_workarounds
bl setup_common_caches
bl setup_750_7400_hid0
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_7410)
- mflr r4
+ mflr r5
bl __init_fpu_registers
bl setup_7410_workarounds
bl setup_common_caches
bl setup_750_7400_hid0
li r3,0
mtspr SPRN_L2CR2,r3
- mtlr r4
+ mtlr r5
blr
_GLOBAL(__setup_cpu_745x)
- mflr r4
+ mflr r5
bl setup_common_caches
bl setup_745x_specifics
- mtlr r4
+ mtlr r5
blr
/* Enable caches for 603's, 604, 750 & 7400 */
@@ -194,10 +194,10 @@ setup_750cx:
cror 4*cr0+eq,4*cr0+eq,4*cr1+eq
cror 4*cr0+eq,4*cr0+eq,4*cr2+eq
bnelr
- lwz r6,CPU_SPEC_FEATURES(r5)
+ lwz r6,CPU_SPEC_FEATURES(r4)
li r7,CPU_FTR_CAN_NAP
andc r6,r6,r7
- stw r6,CPU_SPEC_FEATURES(r5)
+ stw r6,CPU_SPEC_FEATURES(r4)
blr
/* 750fx specific
@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION
andis. r11,r11,L3CR_L3E@h
beq 1f
END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
- lwz r6,CPU_SPEC_FEATURES(r5)
+ lwz r6,CPU_SPEC_FEATURES(r4)
andi. r0,r6,CPU_FTR_L3_DISABLE_NAP
beq 1f
li r7,CPU_FTR_CAN_NAP
andc r6,r6,r7
- stw r6,CPU_SPEC_FEATURES(r5)
+ stw r6,CPU_SPEC_FEATURES(r4)
1:
mfspr r11,SPRN_HID0
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 063/247] parisc : Remove broken line wrapping handling pdc_iodc_print()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 061/247] klist: Fix object alignment on 64-bit Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 062/247] powerpc: Fix some 6xx/7xxx CPU setup functions Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 064/247] kernel/smp.c: fix smp_call_function_many() SMP race Paul Gortmaker
` (183 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Guy Martin, James Bottomley, Paul Gortmaker
From: Guy Martin <gmsoft@tuxicoman.be>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fbea668498e93bb38ac9226c7af9120a25957375 upstream.
Remove the broken line wrapping handling in pdc_iodc_print().
It is broken in 3 ways :
- It doesn't keep track of the current screen position, it just
assumes that the new buffer will be printed at the begining of the
screen.
- It doesn't take in account that non printable characters won't
increase the current position on the screen.
- And last but not least, it triggers a kernel panic if a backspace
is the first char in the provided buffer :
Backtrace:
[<0000000040128ec4>] pdc_console_write+0x44/0x78
[<0000000040128f18>] pdc_console_tty_write+0x20/0x38
[<000000004032f1ac>] n_tty_write+0x2a4/0x550
[<000000004032b158>] tty_write+0x1e0/0x2d8
[<00000000401bb420>] vfs_write+0xb8/0x188
[<00000000401bb630>] sys_write+0x68/0xb8
[<0000000040104eb8>] syscall_exit+0x0/0x14
Most terminals handle the line wrapping just fine. I've confirmed that
it works correctly on a C8000 with both vga and serial output.
Signed-off-by: Guy Martin <gmsoft@tuxicoman.be>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/parisc/kernel/firmware.c | 13 +------------
1 files changed, 1 insertions(+), 12 deletions(-)
diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
index df971fa..4896ed0 100644
--- a/arch/parisc/kernel/firmware.c
+++ b/arch/parisc/kernel/firmware.c
@@ -1126,15 +1126,13 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
unsigned int i;
unsigned long flags;
- for (i = 0; i < count && i < 79;) {
+ for (i = 0; i < count;) {
switch(str[i]) {
case '\n':
iodc_dbuf[i+0] = '\r';
iodc_dbuf[i+1] = '\n';
i += 2;
goto print;
- case '\b': /* BS */
- i--; /* overwrite last */
default:
iodc_dbuf[i] = str[i];
i++;
@@ -1142,15 +1140,6 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
}
}
- /* if we're at the end of line, and not already inserting a newline,
- * insert one anyway. iodc console doesn't claim to support >79 char
- * lines. don't account for this in the return value.
- */
- if (i == 79 && iodc_dbuf[i-1] != '\n') {
- iodc_dbuf[i+0] = '\r';
- iodc_dbuf[i+1] = '\n';
- }
-
print:
spin_lock_irqsave(&pdc_lock, flags);
real32_call(PAGE0->mem_cons.iodc_io,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 064/247] kernel/smp.c: fix smp_call_function_many() SMP race
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (2 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 063/247] parisc : Remove broken line wrapping handling pdc_iodc_print() Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 065/247] hostap_cs: fix sleeping function called from invalid context Paul Gortmaker
` (182 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Milton Miller, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6dc19899958e420a931274b94019e267e2396d3e upstream.
I noticed a failure where we hit the following WARN_ON in
generic_smp_call_function_interrupt:
if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
continue;
data->csd.func(data->csd.info);
refs = atomic_dec_return(&data->refs);
WARN_ON(refs < 0); <-------------------------
We atomically tested and cleared our bit in the cpumask, and yet the
number of cpus left (ie refs) was 0. How can this be?
It turns out commit 54fdade1c3332391948ec43530c02c4794a38172
("generic-ipi: make struct call_function_data lockless") is at fault. It
removes locking from smp_call_function_many and in doing so creates a
rather complicated race.
The problem comes about because:
- The smp_call_function_many interrupt handler walks call_function.queue
without any locking.
- We reuse a percpu data structure in smp_call_function_many.
- We do not wait for any RCU grace period before starting the next
smp_call_function_many.
Imagine a scenario where CPU A does two smp_call_functions back to back,
and CPU B does an smp_call_function in between. We concentrate on how CPU
C handles the calls:
CPU A CPU B CPU C CPU D
smp_call_function
smp_call_function_interrupt
walks
call_function.queue sees
data from CPU A on list
smp_call_function
smp_call_function_interrupt
walks
call_function.queue sees
(stale) CPU A on list
smp_call_function int
clears last ref on A
list_del_rcu, unlock
smp_call_function reuses
percpu *data A
data->cpumask sees and
clears bit in cpumask
might be using old or new fn!
decrements refs below 0
set data->refs (too late!)
The important thing to note is since the interrupt handler walks a
potentially stale call_function.queue without any locking, then another
cpu can view the percpu *data structure at any time, even when the owner
is in the process of initialising it.
The following test case hits the WARN_ON 100% of the time on my PowerPC
box (having 128 threads does help :)
#include <linux/module.h>
#include <linux/init.h>
#define ITERATIONS 100
static void do_nothing_ipi(void *dummy)
{
}
static void do_ipis(struct work_struct *dummy)
{
int i;
for (i = 0; i < ITERATIONS; i++)
smp_call_function(do_nothing_ipi, NULL, 1);
printk(KERN_DEBUG "cpu %d finished\n", smp_processor_id());
}
static struct work_struct work[NR_CPUS];
static int __init testcase_init(void)
{
int cpu;
for_each_online_cpu(cpu) {
INIT_WORK(&work[cpu], do_ipis);
schedule_work_on(cpu, &work[cpu]);
}
return 0;
}
static void __exit testcase_exit(void)
{
}
module_init(testcase_init)
module_exit(testcase_exit)
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Anton Blanchard");
I tried to fix it by ordering the read and the write of ->cpumask and
->refs. In doing so I missed a critical case but Paul McKenney was able
to spot my bug thankfully :) To ensure we arent viewing previous
iterations the interrupt handler needs to read ->refs then ->cpumask then
->refs _again_.
Thanks to Milton Miller and Paul McKenney for helping to debug this issue.
[miltonm@bga.com: add WARN_ON and BUG_ON, remove extra read of refs before initial read of mask that doesn't help (also noted by Peter Zijlstra), adjust comments, hopefully clarify scenario ]
[miltonm@bga.com: remove excess tests]
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Milton Miller <miltonm@bga.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/smp.c | 30 ++++++++++++++++++++++++++++++
1 files changed, 30 insertions(+), 0 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index 3fc6973..0a9e6bd 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -194,6 +194,24 @@ void generic_smp_call_function_interrupt(void)
list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
int refs;
+ /*
+ * Since we walk the list without any locks, we might
+ * see an entry that was completed, removed from the
+ * list and is in the process of being reused.
+ *
+ * We must check that the cpu is in the cpumask before
+ * checking the refs, and both must be set before
+ * executing the callback on this cpu.
+ */
+
+ if (!cpumask_test_cpu(cpu, data->cpumask))
+ continue;
+
+ smp_rmb();
+
+ if (atomic_read(&data->refs) == 0)
+ continue;
+
if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
continue;
@@ -202,6 +220,8 @@ void generic_smp_call_function_interrupt(void)
refs = atomic_dec_return(&data->refs);
WARN_ON(refs < 0);
if (!refs) {
+ WARN_ON(!cpumask_empty(data->cpumask));
+
raw_spin_lock(&call_function.lock);
list_del_rcu(&data->csd.list);
raw_spin_unlock(&call_function.lock);
@@ -442,11 +462,21 @@ void smp_call_function_many(const struct cpumask *mask,
data = &__get_cpu_var(cfd_data);
csd_lock(&data->csd);
+ BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
data->csd.func = func;
data->csd.info = info;
cpumask_and(data->cpumask, mask, cpu_online_mask);
cpumask_clear_cpu(this_cpu, data->cpumask);
+
+ /*
+ * To ensure the interrupt handler gets an complete view
+ * we order the cpumask and refs writes and order the read
+ * of them in the interrupt handler. In addition we may
+ * only clear our own cpu bit from the mask.
+ */
+ smp_wmb();
+
atomic_set(&data->refs, cpumask_weight(data->cpumask));
raw_spin_lock_irqsave(&call_function.lock, flags);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 065/247] hostap_cs: fix sleeping function called from invalid context
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (3 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 064/247] kernel/smp.c: fix smp_call_function_many() SMP race Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 066/247] pata_mpc52xx: inherit from ata_bmdma_port_ops Paul Gortmaker
` (181 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stanislaw Gruszka, John W. Linville,
Paul Gortmaker
From: Stanislaw Gruszka <sgruszka@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4e5518ca53be29c1ec3c00089c97bef36bfed515 upstream.
pcmcia_request_irq() and pcmcia_enable_device() are intended
to be called from process context (first function allocate memory
with GFP_KERNEL, second take a mutex). We can not take spin lock
and call them.
It's safe to move spin lock after pcmcia_enable_device() as we
still hold off IRQ until dev->base_addr is 0 and driver will
not proceed with interrupts when is not ready.
Patch resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=643758
Reported-and-tested-by: rbugz@biobind.com
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/hostap/hostap_cs.c | 15 ++++++---------
1 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index f33e18e..e436aca 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -638,11 +638,10 @@ static int prism2_config(struct pcmcia_device *link)
link->dev_node = &hw_priv->node;
/*
- * Make sure the IRQ handler cannot proceed until at least
- * dev->base_addr is initialized.
+ * We enable IRQ here, but IRQ handler will not proceed
+ * until dev->base_addr is set below. This protect us from
+ * receive interrupts when driver is not initialized.
*/
- spin_lock_irqsave(&local->irq_init_lock, flags);
-
/*
* Allocate an interrupt line. Note that this does not assign a
* handler to the interrupt, unless the 'Handler' member of the
@@ -653,7 +652,7 @@ static int prism2_config(struct pcmcia_device *link)
link->irq.Handler = prism2_interrupt;
ret = pcmcia_request_irq(link, &link->irq);
if (ret)
- goto failed_unlock;
+ goto failed;
}
/*
@@ -663,11 +662,11 @@ static int prism2_config(struct pcmcia_device *link)
*/
ret = pcmcia_request_configuration(link, &link->conf);
if (ret)
- goto failed_unlock;
+ goto failed;
+ spin_lock_irqsave(&local->irq_init_lock, flags);
dev->irq = link->irq.AssignedIRQ;
dev->base_addr = link->io.BasePort1;
-
spin_unlock_irqrestore(&local->irq_init_lock, flags);
/* Finally, report what we've done */
@@ -698,8 +697,6 @@ static int prism2_config(struct pcmcia_device *link)
}
return ret;
- failed_unlock:
- spin_unlock_irqrestore(&local->irq_init_lock, flags);
failed:
kfree(hw_priv);
prism2_release((u_long)link);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 066/247] pata_mpc52xx: inherit from ata_bmdma_port_ops
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (4 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 065/247] hostap_cs: fix sleeping function called from invalid context Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 067/247] TPM: Long default timeout fix Paul Gortmaker
` (180 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tejun Heo, Jeff Garzik, Paul Gortmaker
From: Tejun Heo <tj@kernel.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 77c5fd19075d299fe820bb59bb21b0b113676e20 upstream.
pata_mpc52xx supports BMDMA but inherits ata_sff_port_ops which
triggers BUG_ON() when a DMA command is issued. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Roman Fietze <roman.fietze@telemotive.de>
Cc: Sergei Shtylyov <sshtylyov@mvista.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/pata_mpc52xx.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 9f5b053..e80ebcb 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
};
static struct ata_port_operations mpc52xx_ata_port_ops = {
- .inherits = &ata_sff_port_ops,
+ .inherits = &ata_bmdma_port_ops,
.sff_dev_select = mpc52xx_ata_dev_select,
.set_piomode = mpc52xx_ata_set_piomode,
.set_dmamode = mpc52xx_ata_set_dmamode,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 067/247] TPM: Long default timeout fix
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (5 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 066/247] pata_mpc52xx: inherit from ata_bmdma_port_ops Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 068/247] SELinux: define permissions for DCB netlink messages Paul Gortmaker
` (179 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Rajiv Andrade, James Morris, Paul Gortmaker
From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c4ff4b829ef9e6353c0b133b7adb564a68054979 upstream.
If duration variable value is 0 at this point, it's because
chip->vendor.duration wasn't filled by tpm_get_timeouts() yet.
This patch sets then the lowest timeout just to give enough
time for tpm_get_timeouts() to further succeed.
This fix avoids long boot times in case another entity attempts
to send commands to the TPM when the TPM isn't accessible.
Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/tpm/tpm.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 068c816..6ab5381 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -354,12 +354,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
tpm_protected_ordinal_duration[ordinal &
TPM_PROTECTED_ORDINAL_MASK];
- if (duration_idx != TPM_UNDEFINED)
+ if (duration_idx != TPM_UNDEFINED) {
duration = chip->vendor.duration[duration_idx];
- if (duration <= 0)
+ /* if duration is 0, it's because chip->vendor.duration wasn't */
+ /* filled yet, so we set the lowest timeout just to give enough */
+ /* time for tpm_get_timeouts() to succeed */
+ return (duration <= 0 ? HZ : duration);
+ } else
return 2 * 60 * HZ;
- else
- return duration;
}
EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 068/247] SELinux: define permissions for DCB netlink messages
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (6 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 067/247] TPM: Long default timeout fix Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 069/247] SELinux: do not compute transition labels on mountpoint labeled filesystems Paul Gortmaker
` (178 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Eric Paris, Paul Gortmaker
From: Eric Paris <eparis@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 350e4f31e0eaf56dfc3b328d24a11bdf42a41fb8 upstream.
Commit 2f90b865 added two new netlink message types to the netlink route
socket. SELinux has hooks to define if netlink messages are allowed to
be sent or received, but it did not know about these two new message
types. By default we allow such actions so noone likely noticed. This
patch adds the proper definitions and thus proper permissions
enforcement.
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
security/selinux/nlmsgtab.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index dd7cc6d..24b958c 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -66,6 +66,8 @@ static struct nlmsg_perm nlmsg_route_perms[] =
{ RTM_NEWADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
{ RTM_DELADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
{ RTM_GETADDRLABEL, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_GETDCB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_SETDCB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
};
static struct nlmsg_perm nlmsg_firewall_perms[] =
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 069/247] SELinux: do not compute transition labels on mountpoint labeled filesystems
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (7 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 068/247] SELinux: define permissions for DCB netlink messages Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 070/247] ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro Paul Gortmaker
` (177 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Eric Paris, Paul Gortmaker
From: Eric Paris <eparis@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 415103f9932d45f7927f4b17e3a9a13834cdb9a1 upstream.
selinux_inode_init_security computes transitions sids even for filesystems
that use mount point labeling. It shouldn't do that. It should just use
the mount point label always and no matter what.
This causes 2 problems. 1) it makes file creation slower than it needs to be
since we calculate the transition sid and 2) it allows files to be created
with a different label than the mount point!
# id -Z
staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
# sesearch --type --class file --source sysadm_t --target tmp_t
Found 1 semantic te rules:
type_transition sysadm_t tmp_t : file user_tmp_t;
# mount -o loop,context="system_u:object_r:tmp_t:s0" /tmp/fs /mnt/tmp
# ls -lZ /mnt/tmp
drwx------. root root system_u:object_r:tmp_t:s0 lost+found
# touch /mnt/tmp/file1
# ls -lZ /mnt/tmp
-rw-r--r--. root root staff_u:object_r:user_tmp_t:s0 file1
drwx------. root root system_u:object_r:tmp_t:s0 lost+found
Whoops, we have a mount point labeled filesystem tmp_t with a user_tmp_t
labeled file!
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
security/selinux/hooks.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5feecb4..0b459c8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2595,7 +2595,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
sid = tsec->sid;
newsid = tsec->create_sid;
- if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+ if ((sbsec->flags & SE_SBINITIALIZED) &&
+ (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
+ newsid = sbsec->mntpoint_sid;
+ else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
rc = security_transition_sid(sid, dsec->sid,
inode_mode_to_security_class(inode->i_mode),
&newsid);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 070/247] ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (8 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 069/247] SELinux: do not compute transition labels on mountpoint labeled filesystems Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 071/247] dm: dont take i_mutex to change device size Paul Gortmaker
` (176 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Amitkumar Karwar, Bing Zhao, John W. Linville,
Paul Gortmaker
From: Amitkumar Karwar <akarwar@marvell.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8d661f1e462d50bd83de87ee628aaf820ce3c66c upstream.
It is defined in include/linux/ieee80211.h. As per IEEE spec.
bit6 to bit15 in block ack parameter represents buffer size.
So the bitmask should be 0xFFC0.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/ieee80211.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 1998495..fd80eec 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -958,7 +958,7 @@ struct ieee80211_ht_info {
/* block-ack parameters */
#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 071/247] dm: dont take i_mutex to change device size
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (9 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 070/247] ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 072/247] dm mpath: disable blk_abort_queue Paul Gortmaker
` (175 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Mike Snitzer, Mikulas Patocka, Alasdair G Kergon,
Paul Gortmaker
From: Mike Snitzer <snitzer@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c217649bf2d60ac119afd71d938278cffd55962b upstream.
No longer needlessly hold md->bdev->bd_inode->i_mutex when changing the
size of a DM device. This additional locking is unnecessary because
i_size_write() is already protected by the existing critical section in
dm_swap_table(). DM already has a reference on md->bdev so the
associated bd_inode may be changed without lifetime concerns.
A negative side-effect of having held md->bdev->bd_inode->i_mutex was
that a concurrent DM device resize and flush (via fsync) would deadlock.
Dropping md->bdev->bd_inode->i_mutex eliminates this potential for
deadlock. The following reproducer no longer deadlocks:
https://www.redhat.com/archives/dm-devel/2009-July/msg00284.html
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/dm.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 56d192d..c955f7f 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2039,13 +2039,14 @@ static void event_callback(void *context)
wake_up(&md->eventq);
}
+/*
+ * Protected by md->suspend_lock obtained by dm_swap_table().
+ */
static void __set_size(struct mapped_device *md, sector_t size)
{
set_capacity(md->disk, size);
- mutex_lock(&md->bdev->bd_inode->i_mutex);
i_size_write(md->bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
- mutex_unlock(&md->bdev->bd_inode->i_mutex);
}
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 072/247] dm mpath: disable blk_abort_queue
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (10 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 071/247] dm: dont take i_mutex to change device size Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 073/247] drm/radeon/kms: add quirk for Mac Radeon HD 2600 card Paul Gortmaker
` (174 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Mike Snitzer, Alasdair G Kergon, Paul Gortmaker
From: Mike Snitzer <snitzer@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 09c9d4c9b6a2b5909ae3c6265e4cd3820b636863 upstream.
Revert commit 224cb3e981f1b2f9f93dbd49eaef505d17d894c2
dm: Call blk_abort_queue on failed paths
Multipath began to use blk_abort_queue() to allow for
lower latency path deactivation. This was found to
cause list corruption:
the cmd gets blk_abort_queued/timedout run on it and the scsi eh
somehow is able to complete and run scsi_queue_insert while
scsi_request_fn is still trying to process the request.
https://www.redhat.com/archives/dm-devel/2010-November/msg00085.html
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Cc: Mike Anderson <andmike@linux.vnet.ibm.com>
Cc: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/dm-mpath.c | 12 ------------
1 files changed, 0 insertions(+), 12 deletions(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index da2223a..ed1d0c2 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -33,7 +33,6 @@ struct pgpath {
unsigned fail_count; /* Cumulative failure count */
struct dm_path path;
- struct work_struct deactivate_path;
struct work_struct activate_path;
};
@@ -116,7 +115,6 @@ static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
static void process_queued_ios(struct work_struct *work);
static void trigger_event(struct work_struct *work);
static void activate_path(struct work_struct *work);
-static void deactivate_path(struct work_struct *work);
/*-----------------------------------------------
@@ -129,7 +127,6 @@ static struct pgpath *alloc_pgpath(void)
if (pgpath) {
pgpath->is_active = 1;
- INIT_WORK(&pgpath->deactivate_path, deactivate_path);
INIT_WORK(&pgpath->activate_path, activate_path);
}
@@ -141,14 +138,6 @@ static void free_pgpath(struct pgpath *pgpath)
kfree(pgpath);
}
-static void deactivate_path(struct work_struct *work)
-{
- struct pgpath *pgpath =
- container_of(work, struct pgpath, deactivate_path);
-
- blk_abort_queue(pgpath->path.dev->bdev->bd_disk->queue);
-}
-
static struct priority_group *alloc_priority_group(void)
{
struct priority_group *pg;
@@ -994,7 +983,6 @@ static int fail_path(struct pgpath *pgpath)
pgpath->path.dev->name, m->nr_valid_paths);
schedule_work(&m->trigger_event);
- queue_work(kmultipathd, &pgpath->deactivate_path);
out:
spin_unlock_irqrestore(&m->lock, flags);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 073/247] drm/radeon/kms: add quirk for Mac Radeon HD 2600 card
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (11 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 072/247] dm mpath: disable blk_abort_queue Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 074/247] drm/radeon/kms: make the mac rv630 quirk generic Paul Gortmaker
` (173 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f598aa7593427ffe3a61e7767c34bd695a5e7ed0 upstream.
Reported-by: 屋国遥 <hyagni@gmail.com>
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 05ef0c4..8e4031f 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -272,6 +272,17 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
*line_mux = 0x90;
}
+ /* mac rv630 */
+ if ((dev->pdev->device == 0x9588) &&
+ (dev->pdev->subsystem_vendor == 0x106b) &&
+ (dev->pdev->subsystem_device == 0x00a6)) {
+ if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
+ (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
+ *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
+ *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
+ }
+ }
+
/* ASUS HD 3600 XT board lists the DVI port as HDMI */
if ((dev->pdev->device == 0x9598) &&
(dev->pdev->subsystem_vendor == 0x1043) &&
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 074/247] drm/radeon/kms: make the mac rv630 quirk generic
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (12 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 073/247] drm/radeon/kms: add quirk for Mac Radeon HD 2600 card Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 075/247] drm/radeon/kms: add pll debugging output Paul Gortmaker
` (172 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit be23da8ad219650517cbbb7acbeaeb235667113a upstream.
Seems some other boards do this as well.
Reported-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 14 +++++---------
1 files changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 8e4031f..139f8ad 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -272,15 +272,11 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
*line_mux = 0x90;
}
- /* mac rv630 */
- if ((dev->pdev->device == 0x9588) &&
- (dev->pdev->subsystem_vendor == 0x106b) &&
- (dev->pdev->subsystem_device == 0x00a6)) {
- if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
- (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
- *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
- *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
- }
+ /* mac rv630, rv730, others */
+ if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
+ (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
+ *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
+ *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
}
/* ASUS HD 3600 XT board lists the DVI port as HDMI */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 075/247] drm/radeon/kms: add pll debugging output
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (13 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 074/247] drm/radeon/kms: make the mac rv630 quirk generic Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 076/247] drm/radeon: remove 0x4243 pci id Paul Gortmaker
` (171 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 51d4bf840a27fe02c883ddc6d9708af056773769 upstream.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/radeon_display.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index c2848e0..40e11e4 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -618,6 +618,10 @@ static void radeon_compute_pll_legacy(struct radeon_pll *pll,
*frac_fb_div_p = best_frac_feedback_div;
*ref_div_p = best_ref_div;
*post_div_p = best_post_div;
+ DRM_DEBUG_KMS("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+ freq, best_freq / 1000, best_feedback_div, best_frac_feedback_div,
+ best_ref_div, best_post_div);
+
}
static bool
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 076/247] drm/radeon: remove 0x4243 pci id
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (14 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 075/247] drm/radeon/kms: add pll debugging output Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 077/247] drm/radeon/kms: fix s/r issues with bios scratch regs Paul Gortmaker
` (170 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 63a507800c8aca5a1891d598ae13f829346e8e39 upstream.
0x4243 is a PCI bridge, not a GPU.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=33815
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/drm/drm_pciids.h | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 883c1d4..40b1f0e 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -28,7 +28,6 @@
{0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
{0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \
{0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
- {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
{0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
{0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
{0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 077/247] drm/radeon/kms: fix s/r issues with bios scratch regs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (15 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 076/247] drm/radeon: remove 0x4243 pci id Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 078/247] drm/i915/lvds: Add AOpen i915GMm-HFS to the list of false-positive LVDS Paul Gortmaker
` (169 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 87364760de5d631390c478fcbac8db1b926e0adf upstream.
The accelerate mode bit gets checked by certain atom
command tables to set up some register state. It needs
to be clear when setting modes and set when not.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=26942
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 139f8ad..052e933 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1953,7 +1953,7 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE;
/* tell the bios not to handle mode switching */
- bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH | ATOM_S6_ACC_MODE);
+ bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
if (rdev->family >= CHIP_R600) {
WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
@@ -2004,10 +2004,13 @@ void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock)
else
bios_6_scratch = RREG32(RADEON_BIOS_6_SCRATCH);
- if (lock)
+ if (lock) {
bios_6_scratch |= ATOM_S6_CRITICAL_STATE;
- else
+ bios_6_scratch &= ~ATOM_S6_ACC_MODE;
+ } else {
bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE;
+ bios_6_scratch |= ATOM_S6_ACC_MODE;
+ }
if (rdev->family >= CHIP_R600)
WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 078/247] drm/i915/lvds: Add AOpen i915GMm-HFS to the list of false-positive LVDS
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (16 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 077/247] drm/radeon/kms: fix s/r issues with bios scratch regs Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 079/247] drm/i915: Add dependency on CONFIG_TMPFS Paul Gortmaker
` (168 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Knut Petersen, Chris Wilson, Paul Gortmaker
From: Knut Petersen <knut_petersen@t-online.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 22ab70d3262ddb6e69b3c246a34e2967ba5eb1e8 upstream.
Signed-off-by: Knut Petersen <knut_petersen@t-online.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b66806a..4072b0d 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -855,6 +855,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
},
{
.callback = intel_no_lvds_dmi_callback,
+ .ident = "AOpen i915GMm-HFS",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+ DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
+ },
+ },
+ {
+ .callback = intel_no_lvds_dmi_callback,
.ident = "Aopen i945GTt-VFA",
.matches = {
DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 079/247] drm/i915: Add dependency on CONFIG_TMPFS
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (17 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 078/247] drm/i915/lvds: Add AOpen i915GMm-HFS to the list of false-positive LVDS Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 080/247] x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm Paul Gortmaker
` (167 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Chris Wilson, Paul Gortmaker
From: Chris Wilson <chris@chris-wilson.co.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f7ab9b407b3bc83161c2aa74c992ba4782e87c9c upstream.
Without tmpfs, shmem_readpage() is not compiled in causing an OOPS as
soon as we try to allocate some swappable pages for GEM.
Jan 19 22:52:26 harlie kernel: Modules linked in: i915(+) drm_kms_helper cfbcopyarea video backlight cfbimgblt cfbfillrect
Jan 19 22:52:26 harlie kernel:
Jan 19 22:52:26 harlie kernel: Pid: 1125, comm: modprobe Not tainted 2.6.37Harlie #10 To be filled by O.E.M./To be filled by O.E.M.
Jan 19 22:52:26 harlie kernel: EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 3
Jan 19 22:52:26 harlie kernel: EIP is at 0x0
Jan 19 22:52:26 harlie kernel: EAX: 00000000 EBX: f7b7d000 ECX: f3383100 EDX: f7b7d000
Jan 19 22:52:26 harlie kernel: ESI: f1456118 EDI: 00000000 EBP: f2303c98 ESP: f2303c7c
Jan 19 22:52:26 harlie kernel: DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Jan 19 22:52:26 harlie kernel: Process modprobe (pid: 1125, ti=f2302000 task=f259cd80 task.ti=f2302000)
Jan 19 22:52:26 harlie kernel: Stack:
Jan 19 22:52:26 harlie udevd-work[1072]: '/sbin/modprobe -b pci:v00008086d00000046sv00000000sd00000000bc03sc00i00' unexpected exit with status 0x0009
Jan 19 22:52:26 harlie kernel: c1074061 000000d0 f2f42b80 00000000 000a13d2 f2d5dcc0 00000001 f2303cac
Jan 19 22:52:26 harlie kernel: c107416f 00000000 000a13d2 00000000 f2303cd4 f8d620ed f2cee620 00001000
Jan 19 22:52:26 harlie kernel: 00000000 000a13d2 f1456118 f2d5dcc0 f1a40000 00001000 f2303d04 f8d637ab
Jan 19 22:52:26 harlie kernel: Call Trace:
Jan 19 22:52:26 harlie kernel: [<c1074061>] ? do_read_cache_page+0x71/0x160
Jan 19 22:52:26 harlie kernel: [<c107416f>] ? read_cache_page_gfp+0x1f/0x30
Jan 19 22:52:26 harlie kernel: [<f8d620ed>] ? i915_gem_object_get_pages+0xad/0x1d0 [i915]
Jan 19 22:52:26 harlie kernel: [<f8d637ab>] ? i915_gem_object_bind_to_gtt+0xeb/0x2d0 [i915]
Jan 19 22:52:26 harlie kernel: [<f8d65961>] ? i915_gem_object_pin+0x151/0x190 [i915]
Jan 19 22:52:26 harlie kernel: [<c11e16ed>] ? drm_gem_object_init+0x3d/0x60
Jan 19 22:52:26 harlie kernel: [<f8d65aa5>] ? i915_gem_init_ringbuffer+0x105/0x1e0 [i915]
Jan 19 22:52:26 harlie kernel: [<f8d571b7>] ? i915_driver_load+0x667/0x1160 [i915]
Reported-by: John J. Stimson-III <john@idsfa.net>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/Kconfig | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 305c590..7bb111b 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -94,7 +94,10 @@ config DRM_I830
config DRM_I915
tristate "i915 driver"
depends on AGP_INTEL
+ # we need shmfs for the swappable backing store, and in particular
+ # the shmem_readpage() which depends upon tmpfs
select SHMEM
+ select TMPFS
select DRM_KMS_HELPER
select FB_CFB_FILLRECT
select FB_CFB_COPYAREA
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 080/247] x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (18 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 079/247] drm/i915: Add dependency on CONFIG_TMPFS Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 081/247] usb: Realloc xHCI structures after a hub is verified Paul Gortmaker
` (166 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Suresh Siddha, Linus Torvalds, Paul Gortmaker
From: Suresh Siddha <suresh.b.siddha@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 831d52bc153971b70e64eccfbed2b232394f22f8 upstream.
Clearing the cpu in prev's mm_cpumask early will avoid the flush tlb
IPI's while the cr3 is still pointing to the prev mm. And this window
can lead to the possibility of bogus TLB fills resulting in strange
failures. One such problematic scenario is mentioned below.
T1. CPU-1 is context switching from mm1 to mm2 context and got a NMI
etc between the point of clearing the cpu from the mm_cpumask(mm1)
and before reloading the cr3 with the new mm2.
T2. CPU-2 is tearing down a specific vma for mm1 and will proceed with
flushing the TLB for mm1. It doesn't send the flush TLB to CPU-1
as it doesn't see that cpu listed in the mm_cpumask(mm1).
T3. After the TLB flush is complete, CPU-2 goes ahead and frees the
page-table pages associated with the removed vma mapping.
T4. CPU-2 now allocates those freed page-table pages for something
else.
T5. As the CR3 and TLB caches for mm1 is still active on CPU-1, CPU-1
can potentially speculate and walk through the page-table caches
and can insert new TLB entries. As the page-table pages are
already freed and being used on CPU-2, this page walk can
potentially insert a bogus global TLB entry depending on the
(random) contents of the page that is being used on CPU-2.
T6. This bogus TLB entry being global will be active across future CR3
changes and can result in weird memory corruption etc.
To avoid this issue, for the prev mm that is handing over the cpu to
another mm, clear the cpu from the mm_cpumask(prev) after the cr3 is
changed.
Marking it for -stable, though we haven't seen any reported failure that
can be attributed to this.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/mmu_context.h | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 4a2d4e0..8b5393e 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
unsigned cpu = smp_processor_id();
if (likely(prev != next)) {
- /* stop flush ipis for the previous mm */
- cpumask_clear_cpu(cpu, mm_cpumask(prev));
#ifdef CONFIG_SMP
percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
percpu_write(cpu_tlbstate.active_mm, next);
@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
/* Re-load page tables */
load_cr3(next->pgd);
+ /* stop flush ipis for the previous mm */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
/*
* load the LDT, if the LDT is different:
*/
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 081/247] usb: Realloc xHCI structures after a hub is verified.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (19 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 080/247] x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 082/247] sched: Remove some dead code Paul Gortmaker
` (165 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Sarah Sharp, Paul Gortmaker
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 653a39d1f61bdc9f277766736d21d2e9be0391cb upstream.
When there's an xHCI host power loss after a suspend from memory, the USB
core attempts to reset and verify the USB devices that are attached to the
system. The xHCI driver has to reallocate those devices, since the
hardware lost all knowledge of them during the power loss.
When a hub is plugged in, and the host loses power, the xHCI hardware
structures are not updated to say the device is a hub. This is usually
done in hub_configure() when the USB hub is detected. That function is
skipped during a reset and verify by the USB core, since the core restores
the old configuration and alternate settings, and the hub driver has no
idea this happened. This bug makes the xHCI host controller reject the
enumeration of low speed devices under the resumed hub.
Therefore, make the USB core re-setup the internal xHCI hub device
information by calling update_hub_device() when hub_activate() is called
for a hub reset resume. After a host power loss, all devices under the
roothub get a reset-resume or a disconnect.
This patch should be queued for the 2.6.37 stable tree.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/hub.c | 21 +++++++++++++++++++++
1 files changed, 21 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f4e54ba..e5363de 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -677,6 +677,8 @@ static void hub_init_func3(struct work_struct *ws);
static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
{
struct usb_device *hdev = hub->hdev;
+ struct usb_hcd *hcd;
+ int ret;
int port1;
int status;
bool need_debounce_delay = false;
@@ -715,6 +717,25 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
usb_autopm_get_interface_no_resume(
to_usb_interface(hub->intfdev));
return; /* Continues at init2: below */
+ } else if (type == HUB_RESET_RESUME) {
+ /* The internal host controller state for the hub device
+ * may be gone after a host power loss on system resume.
+ * Update the device's info so the HW knows it's a hub.
+ */
+ hcd = bus_to_hcd(hdev->bus);
+ if (hcd->driver->update_hub_device) {
+ ret = hcd->driver->update_hub_device(hcd, hdev,
+ &hub->tt, GFP_NOIO);
+ if (ret < 0) {
+ dev_err(hub->intfdev, "Host not "
+ "accepting hub info "
+ "update.\n");
+ dev_err(hub->intfdev, "LS/FS devices "
+ "and hubs may not work "
+ "under this hub\n.");
+ }
+ }
+ hub_power_on(hub, true);
} else {
hub_power_on(hub, true);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 082/247] sched: Remove some dead code
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (20 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 081/247] usb: Realloc xHCI structures after a hub is verified Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 083/247] sched: Remove remaining USER_SCHED code Paul Gortmaker
` (164 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Carpenter, Ingo Molnar, Paul Gortmaker
From: Dan Carpenter <error27@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6427462bfa50f50dc6c088c07037264fcc73eca1 upstream.
This was left over from "7c9414385e sched: Remove USER_SCHED"
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Dhaval Giani <dhaval.giani@gmail.com>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
LKML-Reference: <20100315082148.GD18181@bicker>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/user.c | 2 --
1 files changed, 0 insertions(+), 2 deletions(-)
diff --git a/kernel/user.c b/kernel/user.c
index 766467b..ec3b222 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -178,8 +178,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
return up;
- put_user_ns(new->user_ns);
- kmem_cache_free(uid_cachep, new);
out_unlock:
return NULL;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 083/247] sched: Remove remaining USER_SCHED code
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (21 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 082/247] sched: Remove some dead code Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 084/247] sched: Move sched_avg_update() to update_cpu_load() Paul Gortmaker
` (163 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Li Zefan, Peter Zijlstra, Ingo Molnar,
Paul Gortmaker
From: Li Zefan <lizf@cn.fujitsu.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 32bd7eb5a7f4596c8440dd9440322fe9e686634d upstream.
This is left over from commit 7c9414385e ("sched: Remove USER_SCHED"")
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Dhaval Giani <dhaval.giani@gmail.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: David Howells <dhowells@redhat.com>
LKML-Reference: <4BA9A05F.7010407@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
init/Kconfig | 3 +--
kernel/capability.c | 1 -
kernel/cred-internals.h | 21 ---------------------
kernel/cred.c | 3 ---
kernel/exit.c | 1 -
kernel/sched_debug.c | 5 -----
kernel/user.c | 10 +---------
7 files changed, 2 insertions(+), 42 deletions(-)
delete mode 100644 kernel/cred-internals.h
diff --git a/init/Kconfig b/init/Kconfig
index eb77e8c..5fe94b8 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -604,8 +604,7 @@ config RT_GROUP_SCHED
default n
help
This feature lets you explicitly allocate real CPU bandwidth
- to users or control groups (depending on the "Basis for grouping tasks"
- setting below. If enabled, it will also make it impossible to
+ to task groups. If enabled, it will also make it impossible to
schedule realtime tasks for non-root users until you allocate
realtime bandwidth for them.
See Documentation/scheduler/sched-rt-group.txt for more information.
diff --git a/kernel/capability.c b/kernel/capability.c
index 9e4697e..2f05303 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -15,7 +15,6 @@
#include <linux/syscalls.h>
#include <linux/pid_namespace.h>
#include <asm/uaccess.h>
-#include "cred-internals.h"
/*
* Leveraged for setting/resetting capabilities
diff --git a/kernel/cred-internals.h b/kernel/cred-internals.h
deleted file mode 100644
index 2dc4fc2..0000000
--- a/kernel/cred-internals.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* Internal credentials stuff
- *
- * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-
-/*
- * user.c
- */
-static inline void sched_switch_user(struct task_struct *p)
-{
-#ifdef CONFIG_USER_SCHED
- sched_move_task(p);
-#endif /* CONFIG_USER_SCHED */
-}
-
diff --git a/kernel/cred.c b/kernel/cred.c
index 62af181..8f3672a 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -17,7 +17,6 @@
#include <linux/init_task.h>
#include <linux/security.h>
#include <linux/cn_proc.h>
-#include "cred-internals.h"
#if 0
#define kdebug(FMT, ...) \
@@ -560,8 +559,6 @@ int commit_creds(struct cred *new)
atomic_dec(&old->user->processes);
alter_cred_subscribers(old, -2);
- sched_switch_user(task);
-
/* send notifications */
if (new->uid != old->uid ||
new->euid != old->euid ||
diff --git a/kernel/exit.c b/kernel/exit.c
index a652c26..0dd27ca 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -55,7 +55,6 @@
#include <asm/unistd.h>
#include <asm/pgtable.h>
#include <asm/mmu_context.h>
-#include "cred-internals.h"
static void exit_mm(struct task_struct * tsk);
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 19be00b..db0f456 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -175,11 +175,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
task_group_path(tg, path, sizeof(path));
SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, path);
-#elif defined(CONFIG_USER_SCHED) && defined(CONFIG_FAIR_GROUP_SCHED)
- {
- uid_t uid = cfs_rq->tg->uid;
- SEQ_printf(m, "\ncfs_rq[%d] for UID: %u\n", cpu, uid);
- }
#else
SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
#endif
diff --git a/kernel/user.c b/kernel/user.c
index ec3b222..8e1c8c0 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -16,7 +16,6 @@
#include <linux/interrupt.h>
#include <linux/module.h>
#include <linux/user_namespace.h>
-#include "cred-internals.h"
struct user_namespace init_user_ns = {
.kref = {
@@ -137,9 +136,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
struct hlist_head *hashent = uidhashentry(ns, uid);
struct user_struct *up, *new;
- /* Make uid_hash_find() + uids_user_create() + uid_hash_insert()
- * atomic.
- */
+ /* Make uid_hash_find() + uid_hash_insert() atomic. */
spin_lock_irq(&uidhash_lock);
up = uid_hash_find(uid, hashent);
spin_unlock_irq(&uidhash_lock);
@@ -161,11 +158,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
spin_lock_irq(&uidhash_lock);
up = uid_hash_find(uid, hashent);
if (up) {
- /* This case is not possible when CONFIG_USER_SCHED
- * is defined, since we serialize alloc_uid() using
- * uids_mutex. Hence no need to call
- * sched_destroy_user() or remove_user_sysfs_dir().
- */
key_put(new->uid_keyring);
key_put(new->session_keyring);
kmem_cache_free(uid_cachep, new);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 084/247] sched: Move sched_avg_update() to update_cpu_load()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (22 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 083/247] sched: Remove remaining USER_SCHED code Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 085/247] sched: suppress RCU lockdep splat in task_fork_fair Paul Gortmaker
` (162 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Suresh Siddha, Peter Zijlstra, Ingo Molnar,
Paul Gortmaker
From: Suresh Siddha <suresh.b.siddha@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit da2b71edd8a7db44fe1746261410a981f3e03632 upstream.
Currently sched_avg_update() (which updates rt_avg stats in the rq)
is getting called from scale_rt_power() (in the load balance context)
which doesn't take rq->lock.
Fix it by moving the sched_avg_update() to more appropriate
update_cpu_load() where the CFS load gets updated as well.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <1282596171.2694.3.camel@sbsiddha-MOBL3>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/sched.c | 6 ++++++
kernel/sched_fair.c | 2 --
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/kernel/sched.c b/kernel/sched.c
index 12ee156..c3e891f 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1269,6 +1269,10 @@ static void resched_task(struct task_struct *p)
static void sched_rt_avg_update(struct rq *rq, u64 rt_delta)
{
}
+
+static void sched_avg_update(struct rq *rq)
+{
+}
#endif /* CONFIG_SMP */
#if BITS_PER_LONG == 32
@@ -3102,6 +3106,8 @@ static void update_cpu_load(struct rq *this_rq)
this_rq->calc_load_update += LOAD_FREQ;
calc_load_account_active(this_rq);
}
+
+ sched_avg_update(this_rq);
}
#ifdef CONFIG_SMP
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 72eb9a6..3a0f7ba 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2337,8 +2337,6 @@ unsigned long scale_rt_power(int cpu)
struct rq *rq = cpu_rq(cpu);
u64 total, available;
- sched_avg_update(rq);
-
total = sched_avg_period() + (rq->clock - rq->age_stamp);
available = total - rq->rt_avg;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 085/247] sched: suppress RCU lockdep splat in task_fork_fair
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (23 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 084/247] sched: Move sched_avg_update() to update_cpu_load() Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 086/247] sched: fix RCU lockdep splat from task_group() Paul Gortmaker
` (161 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Paul E. McKenney, Paul Gortmaker
From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b0a0f667a349247bd7f05f806b662a25653822bc upstream.
> ===================================================
> [ INFO: suspicious rcu_dereference_check() usage. ]
> ---------------------------------------------------
> /home/greearb/git/linux.wireless-testing/kernel/sched.c:618 invoked rcu_dereference_check() without protection!
>
> other info that might help us debug this:
>
> rcu_scheduler_active = 1, debug_locks = 1
> 1 lock held by ifup/23517:
> #0: (&rq->lock){-.-.-.}, at: [<c042f782>] task_fork_fair+0x3b/0x108
>
> stack backtrace:
> Pid: 23517, comm: ifup Not tainted 2.6.36-rc6-wl+ #5
> Call Trace:
> [<c075e219>] ? printk+0xf/0x16
> [<c0455842>] lockdep_rcu_dereference+0x74/0x7d
> [<c0426854>] task_group+0x6d/0x79
> [<c042686e>] set_task_rq+0xe/0x57
> [<c042f79e>] task_fork_fair+0x57/0x108
> [<c042e965>] sched_fork+0x82/0xf9
> [<c04334b3>] copy_process+0x569/0xe8e
> [<c0433ef0>] do_fork+0x118/0x262
> [<c076302f>] ? do_page_fault+0x16a/0x2cf
> [<c044b80c>] ? up_read+0x16/0x2a
> [<c04085ae>] sys_clone+0x1b/0x20
> [<c04030a5>] ptregs_clone+0x15/0x30
> [<c0402f1c>] ? sysenter_do_call+0x12/0x38
Here a newly created task is having its runqueue assigned. The new task
is not yet on the tasklist, so cannot go away. This is therefore a false
positive, suppress with an RCU read-side critical section.
Reported-by: Ben Greear <greearb@candelatech.com
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Ben Greear <greearb@candelatech.com
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/sched_fair.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 3a0f7ba..b0f68035 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -3592,8 +3592,11 @@ static void task_fork_fair(struct task_struct *p)
update_rq_clock(rq);
- if (unlikely(task_cpu(p) != this_cpu))
+ if (unlikely(task_cpu(p) != this_cpu)) {
+ rcu_read_lock();
__set_task_cpu(p, this_cpu);
+ rcu_read_unlock();
+ }
update_curr(cfs_rq);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 086/247] sched: fix RCU lockdep splat from task_group()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (24 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 085/247] sched: suppress RCU lockdep splat in task_fork_fair Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 087/247] sched, cgroup: Fixup broken cgroup movement Paul Gortmaker
` (160 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Peter Zijlstra, Peter Zijlstra, Paul E. McKenney,
Paul Gortmaker
From: Peter Zijlstra <peterz@infradead.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6506cf6ce68d78a5470a8360c965dafe8e4b78e3 upstream.
This addresses the following RCU lockdep splat:
[0.051203] CPU0: AMD QEMU Virtual CPU version 0.12.4 stepping 03
[0.052999] lockdep: fixing up alternatives.
[0.054105]
[0.054106] ===================================================
[0.054999] [ INFO: suspicious rcu_dereference_check() usage. ]
[0.054999] ---------------------------------------------------
[0.054999] kernel/sched.c:616 invoked rcu_dereference_check() without protection!
[0.054999]
[0.054999] other info that might help us debug this:
[0.054999]
[0.054999]
[0.054999] rcu_scheduler_active = 1, debug_locks = 1
[0.054999] 3 locks held by swapper/1:
[0.054999] #0: (cpu_add_remove_lock){+.+.+.}, at: [<ffffffff814be933>] cpu_up+0x42/0x6a
[0.054999] #1: (cpu_hotplug.lock){+.+.+.}, at: [<ffffffff810400d8>] cpu_hotplug_begin+0x2a/0x51
[0.054999] #2: (&rq->lock){-.-...}, at: [<ffffffff814be2f7>] init_idle+0x2f/0x113
[0.054999]
[0.054999] stack backtrace:
[0.054999] Pid: 1, comm: swapper Not tainted 2.6.35 #1
[0.054999] Call Trace:
[0.054999] [<ffffffff81068054>] lockdep_rcu_dereference+0x9b/0xa3
[0.054999] [<ffffffff810325c3>] task_group+0x7b/0x8a
[0.054999] [<ffffffff810325e5>] set_task_rq+0x13/0x40
[0.054999] [<ffffffff814be39a>] init_idle+0xd2/0x113
[0.054999] [<ffffffff814be78a>] fork_idle+0xb8/0xc7
[0.054999] [<ffffffff81068717>] ? mark_held_locks+0x4d/0x6b
[0.054999] [<ffffffff814bcebd>] do_fork_idle+0x17/0x2b
[0.054999] [<ffffffff814bc89b>] native_cpu_up+0x1c1/0x724
[0.054999] [<ffffffff814bcea6>] ? do_fork_idle+0x0/0x2b
[0.054999] [<ffffffff814be876>] _cpu_up+0xac/0x127
[0.054999] [<ffffffff814be946>] cpu_up+0x55/0x6a
[0.054999] [<ffffffff81ab562a>] kernel_init+0xe1/0x1ff
[0.054999] [<ffffffff81003854>] kernel_thread_helper+0x4/0x10
[0.054999] [<ffffffff814c353c>] ? restore_args+0x0/0x30
[0.054999] [<ffffffff81ab5549>] ? kernel_init+0x0/0x1ff
[0.054999] [<ffffffff81003850>] ? kernel_thread_helper+0x0/0x10
[0.056074] Booting Node 0, Processors #1lockdep: fixing up alternatives.
[0.130045] #2lockdep: fixing up alternatives.
[0.203089] #3 Ok.
[0.275286] Brought up 4 CPUs
[0.276005] Total of 4 processors activated (16017.17 BogoMIPS).
The cgroup_subsys_state structures referenced by idle tasks are never
freed, because the idle tasks should be part of the root cgroup,
which is not removable.
The problem is that while we do in-fact hold rq->lock, the newly spawned
idle thread's cpu is not yet set to the correct cpu so the lockdep check
in task_group():
lockdep_is_held(&task_rq(p)->lock)
will fail.
But this is a chicken and egg problem. Setting the CPU's runqueue requires
that the CPU's runqueue already be set. ;-)
So insert an RCU read-side critical section to avoid the complaint.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/sched.c | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/kernel/sched.c b/kernel/sched.c
index c3e891f..f7bc764 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5235,7 +5235,19 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
idle->se.exec_start = sched_clock();
cpumask_copy(&idle->cpus_allowed, cpumask_of(cpu));
+ /*
+ * We're having a chicken and egg problem, even though we are
+ * holding rq->lock, the cpu isn't yet set to this cpu so the
+ * lockdep check in task_group() will fail.
+ *
+ * Similar case to sched_fork(). / Alternatively we could
+ * use task_rq_lock() here and obtain the other rq->lock.
+ *
+ * Silence PROVE_RCU
+ */
+ rcu_read_lock();
__set_task_cpu(idle, cpu);
+ rcu_read_unlock();
rq->curr = rq->idle = idle;
#if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 087/247] sched, cgroup: Fixup broken cgroup movement
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (25 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 086/247] sched: fix RCU lockdep splat from task_group() Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 088/247] sched: Fix wake_affine() vs RT tasks Paul Gortmaker
` (159 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Peter Zijlstra, Ingo Molnar, Paul Gortmaker
From: Peter Zijlstra <a.p.zijlstra@chello.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b2b5ce022acf5e9f52f7b78c5579994fdde191d4 upstream.
Dima noticed that we fail to correct the ->vruntime of sleeping tasks
when we move them between cgroups.
Reported-by: Dima Zavin <dima@android.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Tested-by: Mike Galbraith <efault@gmx.de>
LKML-Reference: <1287150604.29097.1513.camel@twins>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/sched.h | 2 +-
kernel/sched.c | 8 ++++----
kernel/sched_fair.c | 25 +++++++++++++++++++------
3 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 89e0fee..03e34c5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1071,7 +1071,7 @@ struct sched_class {
struct task_struct *task);
#ifdef CONFIG_FAIR_GROUP_SCHED
- void (*moved_group) (struct task_struct *p, int on_rq);
+ void (*task_move_group) (struct task_struct *p, int on_rq);
#endif
};
diff --git a/kernel/sched.c b/kernel/sched.c
index f7bc764..39456fc 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -8275,12 +8275,12 @@ void sched_move_task(struct task_struct *tsk)
if (unlikely(running))
tsk->sched_class->put_prev_task(rq, tsk);
- set_task_rq(tsk, task_cpu(tsk));
-
#ifdef CONFIG_FAIR_GROUP_SCHED
- if (tsk->sched_class->moved_group)
- tsk->sched_class->moved_group(tsk, on_rq);
+ if (tsk->sched_class->task_move_group)
+ tsk->sched_class->task_move_group(tsk, on_rq);
+ else
#endif
+ set_task_rq(tsk, task_cpu(tsk));
if (unlikely(running))
tsk->sched_class->set_curr_task(rq);
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index b0f68035..f060583 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -3668,13 +3668,26 @@ static void set_curr_task_fair(struct rq *rq)
}
#ifdef CONFIG_FAIR_GROUP_SCHED
-static void moved_group_fair(struct task_struct *p, int on_rq)
+static void task_move_group_fair(struct task_struct *p, int on_rq)
{
- struct cfs_rq *cfs_rq = task_cfs_rq(p);
-
- update_curr(cfs_rq);
+ /*
+ * If the task was not on the rq at the time of this cgroup movement
+ * it must have been asleep, sleeping tasks keep their ->vruntime
+ * absolute on their old rq until wakeup (needed for the fair sleeper
+ * bonus in place_entity()).
+ *
+ * If it was on the rq, we've just 'preempted' it, which does convert
+ * ->vruntime to a relative base.
+ *
+ * Make sure both cases convert their relative position when migrating
+ * to another cgroup's rq. This does somewhat interfere with the
+ * fair sleeper stuff for the first placement, but who cares.
+ */
+ if (!on_rq)
+ p->se.vruntime -= cfs_rq_of(&p->se)->min_vruntime;
+ set_task_rq(p, task_cpu(p));
if (!on_rq)
- place_entity(cfs_rq, &p->se, 1);
+ p->se.vruntime += cfs_rq_of(&p->se)->min_vruntime;
}
#endif
@@ -3726,7 +3739,7 @@ static const struct sched_class fair_sched_class = {
.get_rr_interval = get_rr_interval_fair,
#ifdef CONFIG_FAIR_GROUP_SCHED
- .moved_group = moved_group_fair,
+ .task_move_group = task_move_group_fair,
#endif
};
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 088/247] sched: Fix wake_affine() vs RT tasks
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (26 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 087/247] sched, cgroup: Fixup broken cgroup movement Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 089/247] bonding/vlan: Avoid mangled NAs on slaves without VLAN tag insertion Paul Gortmaker
` (158 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Peter Zijlstra, Ingo Molnar, Paul Gortmaker
From: Peter Zijlstra <a.p.zijlstra@chello.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e51fd5e22e12b39f49b1bb60b37b300b17378a43 upstream.
Mike reports that since e9e9250b (sched: Scale down cpu_power due to RT
tasks), wake_affine() goes funny on RT tasks due to them still having a
!0 weight and wake_affine() still subtracts that from the rq weight.
Since nobody should be using se->weight for RT tasks, set the value to
zero. Also, since we now use ->cpu_power to normalize rq weights to
account for RT cpu usage, add that factor into the imbalance computation.
Reported-by: Mike Galbraith <efault@gmx.de>
Tested-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <1275316109.27810.22969.camel@twins>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/sched.c | 24 ++++++------------------
kernel/sched_fair.c | 23 +++++++++++++++++------
2 files changed, 23 insertions(+), 24 deletions(-)
diff --git a/kernel/sched.c b/kernel/sched.c
index 39456fc..7e728cf 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -541,6 +541,8 @@ struct rq {
struct root_domain *rd;
struct sched_domain *sd;
+ unsigned long cpu_power;
+
unsigned char idle_at_tick;
/* For active balancing */
int post_schedule;
@@ -1496,24 +1498,9 @@ static unsigned long target_load(int cpu, int type)
return max(rq->cpu_load[type-1], total);
}
-static struct sched_group *group_of(int cpu)
-{
- struct sched_domain *sd = rcu_dereference_sched(cpu_rq(cpu)->sd);
-
- if (!sd)
- return NULL;
-
- return sd->groups;
-}
-
static unsigned long power_of(int cpu)
{
- struct sched_group *group = group_of(cpu);
-
- if (!group)
- return SCHED_LOAD_SCALE;
-
- return group->cpu_power;
+ return cpu_rq(cpu)->cpu_power;
}
static int task_hot(struct task_struct *p, u64 now, struct sched_domain *sd);
@@ -1850,8 +1837,8 @@ static void dec_nr_running(struct rq *rq)
static void set_load_weight(struct task_struct *p)
{
if (task_has_rt_policy(p)) {
- p->se.load.weight = prio_to_weight[0] * 2;
- p->se.load.inv_weight = prio_to_wmult[0] >> 1;
+ p->se.load.weight = 0;
+ p->se.load.inv_weight = WMULT_CONST;
return;
}
@@ -7793,6 +7780,7 @@ void __init sched_init(void)
#ifdef CONFIG_SMP
rq->sd = NULL;
rq->rd = NULL;
+ rq->cpu_power = SCHED_LOAD_SCALE;
rq->post_schedule = 0;
rq->active_balance = 0;
rq->next_balance = jiffies;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index f060583..85d9dd0 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1244,7 +1244,6 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
unsigned long this_load, load;
int idx, this_cpu, prev_cpu;
unsigned long tl_per_task;
- unsigned int imbalance;
struct task_group *tg;
unsigned long weight;
int balanced;
@@ -1284,8 +1283,6 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
tg = task_group(p);
weight = p->se.load.weight;
- imbalance = 100 + (sd->imbalance_pct - 100) / 2;
-
/*
* In low-load situations, where prev_cpu is idle and this_cpu is idle
* due to the sync cause above having dropped this_load to 0, we'll
@@ -1295,9 +1292,22 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
* Otherwise check if either cpus are near enough in load to allow this
* task to be woken on this_cpu.
*/
- balanced = !this_load ||
- 100*(this_load + effective_load(tg, this_cpu, weight, weight)) <=
- imbalance*(load + effective_load(tg, prev_cpu, 0, weight));
+ if (this_load) {
+ unsigned long this_eff_load, prev_eff_load;
+
+ this_eff_load = 100;
+ this_eff_load *= power_of(prev_cpu);
+ this_eff_load *= this_load +
+ effective_load(tg, this_cpu, weight, weight);
+
+ prev_eff_load = 100 + (sd->imbalance_pct - 100) / 2;
+ prev_eff_load *= power_of(this_cpu);
+ prev_eff_load *= load + effective_load(tg, prev_cpu, 0, weight);
+
+ balanced = this_eff_load <= prev_eff_load;
+ } else
+ balanced = true;
+
rcu_read_unlock();
/*
@@ -2376,6 +2386,7 @@ static void update_cpu_power(struct sched_domain *sd, int cpu)
if (!power)
power = 1;
+ cpu_rq(cpu)->cpu_power = power;
sdg->cpu_power = power;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 089/247] bonding/vlan: Avoid mangled NAs on slaves without VLAN tag insertion
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (27 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 088/247] sched: Fix wake_affine() vs RT tasks Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 090/247] NFSD: memory corruption due to writing beyond the stat array Paul Gortmaker
` (157 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Greg Kroah-Hartman, Paul Gortmaker
From: Ben Hutchings <bhutchings@solarflare.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
This is related to commit f88a4a9b65a6f3422b81be995535d0e69df11bb8
upstream, but the bug cannot be properly fixed without the other
changes to VLAN tagging in 2.6.37.
bond_na_send() attempts to insert a VLAN tag in between building and
sending packets of the respective formats. If the slave does not
implement hardware VLAN tag insertion then vlan_put_tag() will mangle
the network-layer header because the Ethernet header is not present at
this point (unlike in bond_arp_send()).
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/bonding/bond_ipv6.c | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/drivers/net/bonding/bond_ipv6.c b/drivers/net/bonding/bond_ipv6.c
index 6dd64cf..a131d6f 100644
--- a/drivers/net/bonding/bond_ipv6.c
+++ b/drivers/net/bonding/bond_ipv6.c
@@ -69,6 +69,13 @@ static void bond_na_send(struct net_device *slave_dev,
};
struct sk_buff *skb;
+ /* The Ethernet header is built in ndisc_send_skb(), not
+ * ndisc_build_skb(), so we cannot insert a VLAN tag. Only an
+ * out-of-line tag inserted by the hardware will work.
+ */
+ if (vlan_id && !(slave_dev->features & NETIF_F_HW_VLAN_TX))
+ return;
+
icmp6h.icmp6_router = router;
icmp6h.icmp6_solicited = 0;
icmp6h.icmp6_override = 1;
@@ -87,7 +94,7 @@ static void bond_na_send(struct net_device *slave_dev,
}
if (vlan_id) {
- skb = vlan_put_tag(skb, vlan_id);
+ skb = __vlan_hwaccel_put_tag(skb, vlan_id);
if (!skb) {
pr_err("failed to insert VLAN tag\n");
return;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 090/247] NFSD: memory corruption due to writing beyond the stat array
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (28 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 089/247] bonding/vlan: Avoid mangled NAs on slaves without VLAN tag insertion Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 091/247] mptfusion: mptctl_release is required in mptctl.c Paul Gortmaker
` (156 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Konstantin Khorenko, Konstantin Khorenko,
J. Bruce Fields, Paul Gortmaker
From: Konstantin Khorenko <khorenko@parallels.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3aa6e0aa8ab3e64bbfba092c64d42fd1d006b124 upstream.
If nfsd fails to find an exported via NFS file in the readahead cache, it
should increment corresponding nfsdstats counter (ra_depth[10]), but due to a
bug it may instead write to ra_depth[11], corrupting the following field.
In a kernel with NFSDv4 compiled in the corruption takes the form of an
increment of a counter of the number of NFSv4 operation 0's received; since
there is no operation 0, this is harmless.
In a kernel with NFSDv4 disabled it corrupts whatever happens to be in the
memory beyond nfsdstats.
Signed-off-by: Konstantin Khorenko <khorenko@openvz.org>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/vfs.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 4eb9baa..054b50b 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -819,7 +819,7 @@ nfsd_get_raparms(dev_t dev, ino_t ino)
if (ra->p_count == 0)
frap = rap;
}
- depth = nfsdstats.ra_size*11/10;
+ depth = nfsdstats.ra_size;
if (!frap) {
spin_unlock(&rab->pb_lock);
return NULL;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 091/247] mptfusion: mptctl_release is required in mptctl.c
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (29 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 090/247] NFSD: memory corruption due to writing beyond the stat array Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 092/247] mptfusion: Fix Incorrect return value in mptscsih_dev_reset Paul Gortmaker
` (155 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kashyap, Desai, James Bottomley, Paul Gortmaker
From: Kashyap, Desai <kashyap.desai@lsi.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 84857c8bf83e8aa87afc57d2956ba01f11d82386 upstream.
Added missing release callback for file_operations mptctl_fops.
Without release callback there will be never freed. It remains on
mptctl's eent list even after the file is closed and released.
Relavent RHEL bugzilla is 660871
Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/message/fusion/mptctl.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index caa8f56..4e12556 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -577,6 +577,13 @@ mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
}
static int
+mptctl_release(struct inode *inode, struct file *filep)
+{
+ fasync_helper(-1, filep, 0, &async_queue);
+ return 0;
+}
+
+static int
mptctl_fasync(int fd, struct file *filep, int mode)
{
MPT_ADAPTER *ioc;
@@ -2778,6 +2785,7 @@ static const struct file_operations mptctl_fops = {
.llseek = no_llseek,
.fasync = mptctl_fasync,
.unlocked_ioctl = mptctl_ioctl,
+ .release = mptctl_release,
#ifdef CONFIG_COMPAT
.compat_ioctl = compat_mpctl_ioctl,
#endif
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 092/247] mptfusion: Fix Incorrect return value in mptscsih_dev_reset
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (30 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 091/247] mptfusion: mptctl_release is required in mptctl.c Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 093/247] ocfs2_connection_find() returns pointer to bad structure Paul Gortmaker
` (154 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kashyap, Desai, James Bottomley, Paul Gortmaker
From: Kashyap, Desai <kashyap.desai@lsi.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bcfe42e98047f1935c5571c8ea77beb2d43ec19d upstream.
There's a branch at the end of this function that
is supposed to normalize the return value with what
the mid-layer expects. In this one case, we get it wrong.
Also increase the verbosity of the INFO level printk
at the end of mptscsih_abort to include the actual return value
and the scmd->serial_number. The reason being success
or failure is actually determined by the state of
the internal tag list when a TMF is issued, and not the
return value of the TMF cmd. The serial_number is also
used in this decision, thus it's useful to know for debugging
purposes.
Reported-by: Peter M. Petrakis <peter.petrakis@canonical.com>
Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/message/fusion/mptscsih.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index c13726a..d2b0b11 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1841,8 +1841,9 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
}
out:
- printk(MYIOC_s_INFO_FMT "task abort: %s (sc=%p)\n",
- ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), SCpnt);
+ printk(MYIOC_s_INFO_FMT "task abort: %s (rv=%04x) (sc=%p) (sn=%ld)\n",
+ ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), retval,
+ SCpnt, SCpnt->serial_number);
return retval;
}
@@ -1879,7 +1880,7 @@ mptscsih_dev_reset(struct scsi_cmnd * SCpnt)
vdevice = SCpnt->device->hostdata;
if (!vdevice || !vdevice->vtarget) {
- retval = SUCCESS;
+ retval = 0;
goto out;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 093/247] ocfs2_connection_find() returns pointer to bad structure
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (31 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 092/247] mptfusion: Fix Incorrect return value in mptscsih_dev_reset Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 094/247] OHCI: work around for nVidia shutdown problem Paul Gortmaker
` (153 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, dann frazier, Joel Becker, Paul Gortmaker
From: dann frazier <dann.frazier@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 226291aa4641fa13cb5dec3bcb3379faa83009e2 upstream.
If ocfs2_live_connection_list is empty, ocfs2_connection_find() will return
a pointer to the LIST_HEAD, cast as a ocfs2_live_connection. This can cause
an oops when ocfs2_control_send_down() dereferences c->oc_conn:
Call Trace:
[<ffffffffa00c2a3c>] ocfs2_control_message+0x28c/0x2b0 [ocfs2_stack_user]
[<ffffffffa00c2a95>] ocfs2_control_write+0x35/0xb0 [ocfs2_stack_user]
[<ffffffff81143a88>] vfs_write+0xb8/0x1a0
[<ffffffff8155cc13>] ? do_page_fault+0x153/0x3b0
[<ffffffff811442f1>] sys_write+0x51/0x80
[<ffffffff810121b2>] system_call_fastpath+0x16/0x1b
Fix by explicitly returning NULL if no match is found.
Signed-off-by: dann frazier <dann.frazier@canonical.com>
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ocfs2/stack_user.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 2dc57bc..22db114 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -191,7 +191,7 @@ static struct ocfs2_live_connection *ocfs2_connection_find(const char *name)
return c;
}
- return c;
+ return NULL;
}
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 094/247] OHCI: work around for nVidia shutdown problem
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (32 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 093/247] ocfs2_connection_find() returns pointer to bad structure Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 18:49 ` Alan Stern
2011-06-23 17:32 ` [34-longterm 095/247] x86/pvclock: Zero last_value on resume Paul Gortmaker
` (152 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alan Stern, Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3df7169e73fc1d71a39cffeacc969f6840cdf52b upstream.
This patch (as1417) fixes a problem affecting some (or all) nVidia
chipsets. When the computer is shut down, the OHCI controllers
continue to power the USB buses and evidently they drive a Reset
signal out all their ports. This prevents attached devices from going
to low power. Mouse LEDs stay on, for example, which is disconcerting
for users and a drain on laptop batteries.
The fix involves leaving each OHCI controller in the OPERATIONAL state
during system shutdown rather than putting it in the RESET state.
Although this nominally means the controller is running, in fact it's
not doing very much since all the schedules are all disabled. However
there is ongoing DMA to the Host Controller Communications Area, so
the patch also disables the bus-master capability of all PCI USB
controllers after the shutdown routine runs.
The fix is applied only to nVidia-based PCI OHCI controllers, so it
shouldn't cause problems on systems using other hardware. As an added
safety measure, in case the kernel encounters one of these running
controllers during boot, the patch changes quirk_usb_handoff_ohci()
(which runs early on during PCI discovery) to reset the controller
before anything bad can happen.
Reported-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: David Brownell <david-b@pacbell.net>
Tested-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/hcd-pci.c | 4 +++-
drivers/usb/host/ohci-hcd.c | 9 ++++++++-
drivers/usb/host/ohci-pci.c | 18 ++++++++++++++++++
drivers/usb/host/ohci.h | 1 +
drivers/usb/host/pci-quirks.c | 18 +++++++++++-------
5 files changed, 41 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 1528653..93e1ce9 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -317,8 +317,10 @@ void usb_hcd_pci_shutdown(struct pci_dev *dev)
if (!hcd)
return;
- if (hcd->driver->shutdown)
+ if (hcd->driver->shutdown) {
hcd->driver->shutdown(hcd);
+ pci_disable_device(dev);
+ }
}
EXPORT_SYMBOL_GPL(usb_hcd_pci_shutdown);
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index afe59be..d6b6a1f 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -398,7 +398,14 @@ ohci_shutdown (struct usb_hcd *hcd)
ohci = hcd_to_ohci (hcd);
ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
- ohci_usb_reset (ohci);
+ ohci->hc_control = ohci_readl(ohci, &ohci->regs->control);
+
+ /* If the SHUTDOWN quirk is set, don't put the controller in RESET */
+ ohci->hc_control &= (ohci->flags & OHCI_QUIRK_SHUTDOWN ?
+ OHCI_CTRL_RWC | OHCI_CTRL_HCFS :
+ OHCI_CTRL_RWC);
+ ohci_writel(ohci, ohci->hc_control, &ohci->regs->control);
+
/* flush the writes */
(void) ohci_readl (ohci, &ohci->regs->control);
}
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index b8a1148..948a353 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -201,6 +201,20 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
return 0;
}
+/* nVidia controllers continue to drive Reset signalling on the bus
+ * even after system shutdown, wasting power. This flag tells the
+ * shutdown routine to leave the controller OPERATIONAL instead of RESET.
+ */
+static int ohci_quirk_nvidia_shutdown(struct usb_hcd *hcd)
+{
+ struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+
+ ohci->flags |= OHCI_QUIRK_SHUTDOWN;
+ ohci_dbg(ohci, "enabled nVidia shutdown quirk\n");
+
+ return 0;
+}
+
/*
* The hardware normally enables the A-link power management feature, which
* lets the system lower the power consumption in idle states.
@@ -332,6 +346,10 @@ static const struct pci_device_id ohci_pci_quirks[] = {
PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399),
.driver_data = (unsigned long)ohci_quirk_amd700,
},
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID),
+ .driver_data = (unsigned long) ohci_quirk_nvidia_shutdown,
+ },
/* FIXME for some of the early AMD 760 southbridges, OHCI
* won't work at all. blacklist them.
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 5bf15fe..51facb9 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -403,6 +403,7 @@ struct ohci_hcd {
#define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */
#define OHCI_QUIRK_AMD_ISO 0x200 /* ISO transfers*/
#define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */
+#define OHCI_QUIRK_SHUTDOWN 0x800 /* nVidia power bug */
// there are also chip quirks/bugs in init logic
struct work_struct nec_work; /* Worker for NEC quirk */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 83b5f9c..464ed97 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -169,6 +169,7 @@ static int __devinit mmio_resource_enabled(struct pci_dev *pdev, int idx)
static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
{
void __iomem *base;
+ u32 control;
if (!mmio_resource_enabled(pdev, 0))
return;
@@ -177,10 +178,14 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
if (base == NULL)
return;
+ control = readl(base + OHCI_CONTROL);
+
/* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
-#ifndef __hppa__
-{
- u32 control = readl(base + OHCI_CONTROL);
+#ifdef __hppa__
+#define OHCI_CTRL_MASK (OHCI_CTRL_RWC | OHCI_CTRL_IR)
+#else
+#define OHCI_CTRL_MASK OHCI_CTRL_RWC
+
if (control & OHCI_CTRL_IR) {
int wait_time = 500; /* arbitrary; 5 seconds */
writel(OHCI_INTR_OC, base + OHCI_INTRENABLE);
@@ -194,13 +199,12 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
dev_warn(&pdev->dev, "OHCI: BIOS handoff failed"
" (BIOS bug?) %08x\n",
readl(base + OHCI_CONTROL));
-
- /* reset controller, preserving RWC */
- writel(control & OHCI_CTRL_RWC, base + OHCI_CONTROL);
}
-}
#endif
+ /* reset controller, preserving RWC (and possibly IR) */
+ writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
+
/*
* disable interrupts
*/
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [34-longterm 094/247] OHCI: work around for nVidia shutdown problem
2011-06-23 17:32 ` [34-longterm 094/247] OHCI: work around for nVidia shutdown problem Paul Gortmaker
@ 2011-06-23 18:49 ` Alan Stern
0 siblings, 0 replies; 269+ messages in thread
From: Alan Stern @ 2011-06-23 18:49 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel, stable-review, Greg Kroah-Hartman
On Thu, 23 Jun 2011, Paul Gortmaker wrote:
> From: Alan Stern <stern@rowland.harvard.edu>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 3df7169e73fc1d71a39cffeacc969f6840cdf52b upstream.
>
> This patch (as1417) fixes a problem affecting some (or all) nVidia
> chipsets. When the computer is shut down, the OHCI controllers
> continue to power the USB buses and evidently they drive a Reset
> signal out all their ports. This prevents attached devices from going
> to low power. Mouse LEDs stay on, for example, which is disconcerting
> for users and a drain on laptop batteries.
>
> The fix involves leaving each OHCI controller in the OPERATIONAL state
> during system shutdown rather than putting it in the RESET state.
> Although this nominally means the controller is running, in fact it's
> not doing very much since all the schedules are all disabled. However
> there is ongoing DMA to the Host Controller Communications Area, so
> the patch also disables the bus-master capability of all PCI USB
> controllers after the shutdown routine runs.
>
> The fix is applied only to nVidia-based PCI OHCI controllers, so it
> shouldn't cause problems on systems using other hardware. As an added
> safety measure, in case the kernel encounters one of these running
> controllers during boot, the patch changes quirk_usb_handoff_ohci()
> (which runs early on during PCI discovery) to reset the controller
> before anything bad can happen.
This commit caused problems on systems using later NVIDIA hardware. It
shouldn't be merged unless the upstream commit
2b7aaf503d56216b847c8265421d2a7d9b42df3e
is merged also.
Alan Stern
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 095/247] x86/pvclock: Zero last_value on resume
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (33 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 094/247] OHCI: work around for nVidia shutdown problem Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 096/247] CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials Paul Gortmaker
` (151 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeremy Fitzhardinge, Ingo Molnar, Paul Gortmaker
From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e7a3481c0246c8e45e79c629efd63b168e91fcda upstream.
If the guest domain has been suspend/resumed or migrated, then the
system clock backing the pvclock clocksource may revert to a smaller
value (ie, can be non-monotonic across the migration/save-restore).
Make sure we zero last_value in that case so that the domain
continues to see clock updates.
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/pvclock.h | 1 +
arch/x86/kernel/pvclock.c | 5 +++++
arch/x86/xen/time.c | 2 ++
3 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index 53235fd..daaacab 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -10,5 +10,6 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src);
void pvclock_read_wallclock(struct pvclock_wall_clock *wall,
struct pvclock_vcpu_time_info *vcpu,
struct timespec *ts);
+void pvclock_resume(void);
#endif /* _ASM_X86_PVCLOCK_H */
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index dfdfe46..b12fe8d 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -111,6 +111,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
static atomic64_t last_value = ATOMIC64_INIT(0);
+void pvclock_resume(void)
+{
+ atomic64_set(&last_value, 0);
+}
+
cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
{
struct pvclock_shadow_time shadow;
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index e90360f..a05bda6 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -425,6 +425,8 @@ void xen_timer_resume(void)
{
int cpu;
+ pvclock_resume();
+
if (xen_clockevent != &xen_vcpuop_clockevent)
return;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 096/247] CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (34 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 095/247] x86/pvclock: Zero last_value on resume Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 097/247] CRED: Fix kernel panic upon security_file_alloc() failure Paul Gortmaker
` (150 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, David Howells, Linus Torvalds, Paul Gortmaker
From: David Howells <dhowells@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit de09a9771a5346029f4d11e4ac886be7f9bfdd75 upstream.
It's possible for get_task_cred() as it currently stands to 'corrupt' a set of
credentials by incrementing their usage count after their replacement by the
task being accessed.
What happens is that get_task_cred() can race with commit_creds():
TASK_1 TASK_2 RCU_CLEANER
-->get_task_cred(TASK_2)
rcu_read_lock()
__cred = __task_cred(TASK_2)
-->commit_creds()
old_cred = TASK_2->real_cred
TASK_2->real_cred = ...
put_cred(old_cred)
call_rcu(old_cred)
[__cred->usage == 0]
get_cred(__cred)
[__cred->usage == 1]
rcu_read_unlock()
-->put_cred_rcu()
[__cred->usage == 1]
panic()
However, since a tasks credentials are generally not changed very often, we can
reasonably make use of a loop involving reading the creds pointer and using
atomic_inc_not_zero() to attempt to increment it if it hasn't already hit zero.
If successful, we can safely return the credentials in the knowledge that, even
if the task we're accessing has released them, they haven't gone to the RCU
cleanup code.
We then change task_state() in procfs to use get_task_cred() rather than
calling get_cred() on the result of __task_cred(), as that suffers from the
same problem.
Without this change, a BUG_ON in __put_cred() or in put_cred_rcu() can be
tripped when it is noticed that the usage count is not zero as it ought to be,
for example:
kernel BUG at kernel/cred.c:168!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/kernel/mm/ksm/run
CPU 0
Pid: 2436, comm: master Not tainted 2.6.33.3-85.fc13.x86_64 #1 0HR330/OptiPlex
745
RIP: 0010:[<ffffffff81069881>] [<ffffffff81069881>] __put_cred+0xc/0x45
RSP: 0018:ffff88019e7e9eb8 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff880161514480 RCX: 00000000ffffffff
RDX: 00000000ffffffff RSI: ffff880140c690c0 RDI: ffff880140c690c0
RBP: ffff88019e7e9eb8 R08: 00000000000000d0 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000040 R12: ffff880140c690c0
R13: ffff88019e77aea0 R14: 00007fff336b0a5c R15: 0000000000000001
FS: 00007f12f50d97c0(0000) GS:ffff880007400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f461bc000 CR3: 00000001b26ce000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process master (pid: 2436, threadinfo ffff88019e7e8000, task ffff88019e77aea0)
Stack:
ffff88019e7e9ec8 ffffffff810698cd ffff88019e7e9ef8 ffffffff81069b45
<0> ffff880161514180 ffff880161514480 ffff880161514180 0000000000000000
<0> ffff88019e7e9f28 ffffffff8106aace 0000000000000001 0000000000000246
Call Trace:
[<ffffffff810698cd>] put_cred+0x13/0x15
[<ffffffff81069b45>] commit_creds+0x16b/0x175
[<ffffffff8106aace>] set_current_groups+0x47/0x4e
[<ffffffff8106ac89>] sys_setgroups+0xf6/0x105
[<ffffffff81009b02>] system_call_fastpath+0x16/0x1b
Code: 48 8d 71 ff e8 7e 4e 15 00 85 c0 78 0b 8b 75 ec 48 89 df e8 ef 4a 15 00
48 83 c4 18 5b c9 c3 55 8b 07 8b 07 48 89 e5 85 c0 74 04 <0f> 0b eb fe 65 48 8b
04 25 00 cc 00 00 48 3b b8 58 04 00 00 75
RIP [<ffffffff81069881>] __put_cred+0xc/0x45
RSP <ffff88019e7e9eb8>
---[ end trace df391256a100ebdd ]---
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/proc/array.c | 2 +-
include/linux/cred.h | 21 +--------------------
kernel/cred.c | 25 +++++++++++++++++++++++++
3 files changed, 27 insertions(+), 21 deletions(-)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 885ab55..e9f7d54 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -176,7 +176,7 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
if (tracer)
tpid = task_pid_nr_ns(tracer, ns);
}
- cred = get_cred((struct cred *) __task_cred(p));
+ cred = get_task_cred(p);
seq_printf(m,
"State:\t%s\n"
"Tgid:\t%d\n"
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 52507c3..7e3c45a 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -153,6 +153,7 @@ struct cred {
extern void __put_cred(struct cred *);
extern void exit_creds(struct task_struct *);
extern int copy_creds(struct task_struct *, unsigned long);
+extern const struct cred *get_task_cred(struct task_struct *);
extern struct cred *cred_alloc_blank(void);
extern struct cred *prepare_creds(void);
extern struct cred *prepare_exec_creds(void);
@@ -283,26 +284,6 @@ static inline void put_cred(const struct cred *_cred)
((const struct cred *)(rcu_dereference_check((task)->real_cred, rcu_read_lock_held() || lockdep_tasklist_lock_is_held())))
/**
- * get_task_cred - Get another task's objective credentials
- * @task: The task to query
- *
- * Get the objective credentials of a task, pinning them so that they can't go
- * away. Accessing a task's credentials directly is not permitted.
- *
- * The caller must make sure task doesn't go away, either by holding a ref on
- * task or by holding tasklist_lock to prevent it from being unlinked.
- */
-#define get_task_cred(task) \
-({ \
- struct cred *__cred; \
- rcu_read_lock(); \
- __cred = (struct cred *) __task_cred((task)); \
- get_cred(__cred); \
- rcu_read_unlock(); \
- __cred; \
-})
-
-/**
* get_current_cred - Get the current task's subjective credentials
*
* Get the subjective credentials of the current task, pinning them so that
diff --git a/kernel/cred.c b/kernel/cred.c
index 8f3672a..791c431 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -209,6 +209,31 @@ void exit_creds(struct task_struct *tsk)
}
}
+/**
+ * get_task_cred - Get another task's objective credentials
+ * @task: The task to query
+ *
+ * Get the objective credentials of a task, pinning them so that they can't go
+ * away. Accessing a task's credentials directly is not permitted.
+ *
+ * The caller must also make sure task doesn't get deleted, either by holding a
+ * ref on task or by holding tasklist_lock to prevent it from being unlinked.
+ */
+const struct cred *get_task_cred(struct task_struct *task)
+{
+ const struct cred *cred;
+
+ rcu_read_lock();
+
+ do {
+ cred = __task_cred((task));
+ BUG_ON(!cred);
+ } while (!atomic_inc_not_zero(&((struct cred *)cred)->usage));
+
+ rcu_read_unlock();
+ return cred;
+}
+
/*
* Allocate blank credentials, such that the credentials can be filled in at a
* later date without risk of ENOMEM.
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 097/247] CRED: Fix kernel panic upon security_file_alloc() failure.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (35 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 096/247] CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 098/247] CRED: Fix BUG() upon security_cred_alloc_blank() failure Paul Gortmaker
` (149 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tetsuo Handa, Tetsuo Handa, David Howells,
Linus Torvalds, Paul Gortmaker
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 78d2978874e4e10e97dfd4fd79db45bdc0748550 upstream.
In get_empty_filp() since 2.6.29, file_free(f) is called with f->f_cred == NULL
when security_file_alloc() returned an error. As a result, kernel will panic()
due to put_cred(NULL) call within RCU callback.
Fix this bug by assigning f->f_cred before calling security_file_alloc().
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/file_table.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/file_table.c b/fs/file_table.c
index 32d12b7..d4be17f 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -123,13 +123,13 @@ struct file *get_empty_filp(void)
goto fail;
percpu_counter_inc(&nr_files);
+ f->f_cred = get_cred(cred);
if (security_file_alloc(f))
goto fail_sec;
INIT_LIST_HEAD(&f->f_u.fu_list);
atomic_long_set(&f->f_count, 1);
rwlock_init(&f->f_owner.lock);
- f->f_cred = get_cred(cred);
spin_lock_init(&f->f_lock);
eventpoll_init_file(f);
/* f->f_version: 0 */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 098/247] CRED: Fix BUG() upon security_cred_alloc_blank() failure
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (36 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 097/247] CRED: Fix kernel panic upon security_file_alloc() failure Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 099/247] CRED: Fix memory and refcount leaks upon security_prepare_creds() failure Paul Gortmaker
` (148 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tetsuo Handa, David Howells, Linus Torvalds,
Paul Gortmaker
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2edeaa34a6e3f2c43b667f6c4f7b27944b811695 upstream.
In cred_alloc_blank() since 2.6.32, abort_creds(new) is called with
new->security == NULL and new->magic == 0 when security_cred_alloc_blank()
returns an error. As a result, BUG() will be triggered if SELinux is enabled
or CONFIG_DEBUG_CREDENTIALS=y.
If CONFIG_DEBUG_CREDENTIALS=y, BUG() is called from __invalid_creds() because
cred->magic == 0. Failing that, BUG() is called from selinux_cred_free()
because selinux_cred_free() is not expecting cred->security == NULL. This does
not affect smack_cred_free(), tomoyo_cred_free() or apparmor_cred_free().
Fix these bugs by
(1) Set new->magic before calling security_cred_alloc_blank().
(2) Handle null cred->security in creds_are_invalid() and selinux_cred_free().
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/cred.c | 12 ++++++++----
security/selinux/hooks.c | 6 +++++-
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/kernel/cred.c b/kernel/cred.c
index 791c431..9a85aee 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -256,13 +256,13 @@ struct cred *cred_alloc_blank(void)
#endif
atomic_set(&new->usage, 1);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+ new->magic = CRED_MAGIC;
+#endif
if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
goto error;
-#ifdef CONFIG_DEBUG_CREDENTIALS
- new->magic = CRED_MAGIC;
-#endif
return new;
error:
@@ -816,7 +816,11 @@ bool creds_are_invalid(const struct cred *cred)
if (cred->magic != CRED_MAGIC)
return true;
#ifdef CONFIG_SECURITY_SELINUX
- if (selinux_is_enabled()) {
+ /*
+ * cred->security == NULL if security_cred_alloc_blank() or
+ * security_prepare_creds() returned an error.
+ */
+ if (selinux_is_enabled() && cred->security) {
if ((unsigned long) cred->security < PAGE_SIZE)
return true;
if ((*(u32 *)cred->security & 0xffffff00) ==
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 0b459c8..c59c83f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3256,7 +3256,11 @@ static void selinux_cred_free(struct cred *cred)
{
struct task_security_struct *tsec = cred->security;
- BUG_ON((unsigned long) cred->security < PAGE_SIZE);
+ /*
+ * cred->security == NULL if security_cred_alloc_blank() or
+ * security_prepare_creds() returned an error.
+ */
+ BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
cred->security = (void *) 0x7UL;
kfree(tsec);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 099/247] CRED: Fix memory and refcount leaks upon security_prepare_creds() failure
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (37 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 098/247] CRED: Fix BUG() upon security_cred_alloc_blank() failure Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync() Paul Gortmaker
` (147 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tetsuo Handa, David Howells, Linus Torvalds,
Paul Gortmaker
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fb2b2a1d37f80cc818fd4487b510f4e11816e5e1 upstream.
In prepare_kernel_cred() since 2.6.29, put_cred(new) is called without
assigning new->usage when security_prepare_creds() returned an error. As a
result, memory for new and refcount for new->{user,group_info,tgcred} are
leaked because put_cred(new) won't call __put_cred() unless old->usage == 1.
Fix these leaks by assigning new->usage (and new->subscribers which was added
in 2.6.32) before calling security_prepare_creds().
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/cred.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/cred.c b/kernel/cred.c
index 9a85aee..aa66d6f 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -725,6 +725,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
validate_creds(old);
*new = *old;
+ atomic_set(&new->usage, 1);
+ set_cred_subscribers(new, 0);
get_uid(new->user);
get_group_info(new->group_info);
@@ -742,8 +744,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
goto error;
- atomic_set(&new->usage, 1);
- set_cred_subscribers(new, 0);
put_cred(old);
validate_creds(new);
return new;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (38 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 099/247] CRED: Fix memory and refcount leaks upon security_prepare_creds() failure Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-24 2:03 ` J. R. Okajima
2011-06-23 17:32 ` [34-longterm 101/247] isdn: hisax: Replace the bogus access to irq stats Paul Gortmaker
` (146 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, J. R. Okajima, Trond Myklebust, Paul Gortmaker
From: J. R. Okajima <hooanon05@yahoo.co.jp>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0702099bd86c33c2dcdbd3963433a61f3f503901 upstream.
By the commit af7fa16 2010-08-03 NFS: Fix up the fsync code
close(2) became returning the non-zero value even if it went well.
nfs_file_fsync() should return 0 when "status" is positive.
[PG: in 34, nfs_file_fsync is just a wrapper around nfs_do_fsync,
so the related code and actual change lands in nfs_do_fsync here.]
Signed-off-by: J. R. Okajima <hooanon05@yahoo.co.jp>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/file.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 7f7df1d..1c91289 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -219,7 +219,7 @@ static int nfs_do_fsync(struct nfs_open_context *ctx, struct inode *inode)
have_error |= test_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
if (have_error)
ret = xchg(&ctx->error, 0);
- if (!ret)
+ if (!ret && status < 0)
ret = status;
return ret;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync()
2011-06-23 17:32 ` [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync() Paul Gortmaker
@ 2011-06-24 2:03 ` J. R. Okajima
2011-06-24 2:05 ` Trond Myklebust
0 siblings, 1 reply; 269+ messages in thread
From: J. R. Okajima @ 2011-06-24 2:03 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel, stable-review, Trond Myklebust
Paul Gortmaker:
> By the commit af7fa16 2010-08-03 NFS: Fix up the fsync code
> close(2) became returning the non-zero value even if it went well.
> nfs_file_fsync() should return 0 when "status" is positive.
>
> [PG: in 34, nfs_file_fsync is just a wrapper around nfs_do_fsync,
> so the related code and actual change lands in nfs_do_fsync here.]
In these 247 patches, I could not find the backport of
af7fa16 2010-08-03 NFS: Fix up the fsync code
If you bring the commit af7fa16 into 2.6.34.10, then you will need this
one (0702099bd in upstream) too. Otherwise I am afraid it is
unnecessary.
But I'd ask a reply from Trond Myklebust.
J. R. Okajima
^ permalink raw reply [flat|nested] 269+ messages in thread
* Re: [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync()
2011-06-24 2:03 ` J. R. Okajima
@ 2011-06-24 2:05 ` Trond Myklebust
2011-06-24 12:11 ` Paul Gortmaker
0 siblings, 1 reply; 269+ messages in thread
From: Trond Myklebust @ 2011-06-24 2:05 UTC (permalink / raw)
To: J. R. Okajima; +Cc: Paul Gortmaker, stable, linux-kernel, stable-review
On Fri, 2011-06-24 at 11:03 +0900, J. R. Okajima wrote:
> Paul Gortmaker:
> > By the commit af7fa16 2010-08-03 NFS: Fix up the fsync code
> > close(2) became returning the non-zero value even if it went well.
> > nfs_file_fsync() should return 0 when "status" is positive.
> >
> > [PG: in 34, nfs_file_fsync is just a wrapper around nfs_do_fsync,
> > so the related code and actual change lands in nfs_do_fsync here.]
>
> In these 247 patches, I could not find the backport of
> af7fa16 2010-08-03 NFS: Fix up the fsync code
> If you bring the commit af7fa16 into 2.6.34.10, then you will need this
> one (0702099bd in upstream) too. Otherwise I am afraid it is
> unnecessary.
> But I'd ask a reply from Trond Myklebust.
I agree.
Cheers
Trond
--
Trond Myklebust
Linux NFS client maintainer
NetApp
Trond.Myklebust@netapp.com
www.netapp.com
^ permalink raw reply [flat|nested] 269+ messages in thread
* Re: [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync()
2011-06-24 2:05 ` Trond Myklebust
@ 2011-06-24 12:11 ` Paul Gortmaker
0 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-24 12:11 UTC (permalink / raw)
To: Trond Myklebust; +Cc: J. R. Okajima, stable, linux-kernel, stable-review
On 11-06-23 10:05 PM, Trond Myklebust wrote:
> On Fri, 2011-06-24 at 11:03 +0900, J. R. Okajima wrote:
>> Paul Gortmaker:
>>> By the commit af7fa16 2010-08-03 NFS: Fix up the fsync code
>>> close(2) became returning the non-zero value even if it went well.
>>> nfs_file_fsync() should return 0 when "status" is positive.
>>>
>>> [PG: in 34, nfs_file_fsync is just a wrapper around nfs_do_fsync,
>>> so the related code and actual change lands in nfs_do_fsync here.]
>>
>> In these 247 patches, I could not find the backport of
>> af7fa16 2010-08-03 NFS: Fix up the fsync code
>> If you bring the commit af7fa16 into 2.6.34.10, then you will need this
>> one (0702099bd in upstream) too. Otherwise I am afraid it is
>> unnecessary.
>> But I'd ask a reply from Trond Myklebust.
>
> I agree.
Thanks guys! I'll queue 0702099bd86c33c2dcdbd3963433a61f3f503901
for 34.10
Paul.
>
> Cheers
> Trond
>
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 101/247] isdn: hisax: Replace the bogus access to irq stats
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (39 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 100/247] NFS: fix the return value of nfs_file_fsync() Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 102/247] nfsd: correctly handle return value from nfsd_map_name_to_* Paul Gortmaker
` (145 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Thomas Gleixner, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 40f08a724fcc21285cf3a75aec957aef908605c6 upstream.
Abusing irq stats in a driver for counting interrupts is a horrible
idea and not safe with shared interrupts. Replace it by a local
interrupt counter.
Noticed by the attempt to remove the irq stats export.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/isdn/hisax/config.c | 18 ++++++++++++++----
drivers/isdn/hisax/hisax.h | 1 +
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index 544cf4b..0a347a8 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -801,6 +801,16 @@ static void closecard(int cardnr)
ll_unload(csta);
}
+static irqreturn_t card_irq(int intno, void *dev_id)
+{
+ struct IsdnCardState *cs = dev_id;
+ irqreturn_t ret = cs->irq_func(intno, cs);
+
+ if (ret == IRQ_HANDLED)
+ cs->irq_cnt++;
+ return ret;
+}
+
static int init_card(struct IsdnCardState *cs)
{
int irq_cnt, cnt = 3, ret;
@@ -809,10 +819,10 @@ static int init_card(struct IsdnCardState *cs)
ret = cs->cardmsg(cs, CARD_INIT, NULL);
return(ret);
}
- irq_cnt = kstat_irqs(cs->irq);
+ irq_cnt = cs->irq_cnt = 0;
printk(KERN_INFO "%s: IRQ %d count %d\n", CardType[cs->typ],
cs->irq, irq_cnt);
- if (request_irq(cs->irq, cs->irq_func, cs->irq_flags, "HiSax", cs)) {
+ if (request_irq(cs->irq, card_irq, cs->irq_flags, "HiSax", cs)) {
printk(KERN_WARNING "HiSax: couldn't get interrupt %d\n",
cs->irq);
return 1;
@@ -822,8 +832,8 @@ static int init_card(struct IsdnCardState *cs)
/* Timeout 10ms */
msleep(10);
printk(KERN_INFO "%s: IRQ %d count %d\n",
- CardType[cs->typ], cs->irq, kstat_irqs(cs->irq));
- if (kstat_irqs(cs->irq) == irq_cnt) {
+ CardType[cs->typ], cs->irq, cs->irq_cnt);
+ if (cs->irq_cnt == irq_cnt) {
printk(KERN_WARNING
"%s: IRQ(%d) getting no interrupts during init %d\n",
CardType[cs->typ], cs->irq, 4 - cnt);
diff --git a/drivers/isdn/hisax/hisax.h b/drivers/isdn/hisax/hisax.h
index 832a878..32ab392 100644
--- a/drivers/isdn/hisax/hisax.h
+++ b/drivers/isdn/hisax/hisax.h
@@ -959,6 +959,7 @@ struct IsdnCardState {
u_long event;
struct work_struct tqueue;
struct timer_list dbusytimer;
+ unsigned int irq_cnt;
#ifdef ERROR_STATISTIC
int err_crc;
int err_tx;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 102/247] nfsd: correctly handle return value from nfsd_map_name_to_*
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (40 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 101/247] isdn: hisax: Replace the bogus access to irq stats Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 103/247] xfs: always use iget in bulkstat Paul Gortmaker
` (144 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, NeilBrown, J. Bruce Fields, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 47c85291d3dd1a51501555000b90f8e281a0458e upstream.
These functions return an nfs status, not a host_err. So don't
try to convert before returning.
This is a regression introduced by
3c726023402a2f3b28f49b9d90ebf9e71151157d; I fixed up two of the callers,
but missed these two.
Reported-by: Herbert Poetzl <herbert@13thfloor.at>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4xdr.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 34ccf81..cb0a5fe 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -316,8 +316,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
READ_BUF(dummy32);
len += (XDR_QUADLEN(dummy32) << 2);
READMEM(buf, dummy32);
- if ((host_err = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
- goto out_nfserr;
+ if ((status = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
+ return status;
iattr->ia_valid |= ATTR_UID;
}
if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
@@ -327,8 +327,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
READ_BUF(dummy32);
len += (XDR_QUADLEN(dummy32) << 2);
READMEM(buf, dummy32);
- if ((host_err = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
- goto out_nfserr;
+ if ((status = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
+ return status;
iattr->ia_valid |= ATTR_GID;
}
if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 103/247] xfs: always use iget in bulkstat
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (41 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 102/247] nfsd: correctly handle return value from nfsd_map_name_to_* Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 104/247] xfs: validate untrusted inode numbers during lookup Paul Gortmaker
` (143 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Christoph Hellwig, Paul Gortmaker
From: Christoph Hellwig <hch@lst.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7dce11dbac54fce777eea0f5fb25b2694ccd7900 upstream.
The non-coherent bulkstat versionsthat look directly at the inode
buffers causes various problems with performance optimizations that
make increased use of just logging inodes. This patch makes bulkstat
always use iget, which should be fast enough for normal use with the
radix-tree based inode cache introduced a while ago.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/linux-2.6/xfs_ioctl.c | 7 +-
fs/xfs/linux-2.6/xfs_ioctl32.c | 12 +-
fs/xfs/quota/xfs_qm.c | 11 +-
fs/xfs/quota/xfs_qm_syscalls.c | 16 +--
fs/xfs/xfs_itable.c | 281 ++++++----------------------------------
fs/xfs/xfs_itable.h | 14 --
6 files changed, 59 insertions(+), 282 deletions(-)
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index 3da1da7..c6df36f 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -675,10 +675,9 @@ xfs_ioc_bulkstat(
error = xfs_bulkstat_single(mp, &inlast,
bulkreq.ubuffer, &done);
else /* XFS_IOC_FSBULKSTAT */
- error = xfs_bulkstat(mp, &inlast, &count,
- (bulkstat_one_pf)xfs_bulkstat_one, NULL,
- sizeof(xfs_bstat_t), bulkreq.ubuffer,
- BULKSTAT_FG_QUICK, &done);
+ error = xfs_bulkstat(mp, &inlast, &count, xfs_bulkstat_one,
+ sizeof(xfs_bstat_t), bulkreq.ubuffer,
+ &done);
if (error)
return -error;
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index 593c05b..bf89be9 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -237,15 +237,13 @@ xfs_bulkstat_one_compat(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* buffer to place output in */
int ubsize, /* size of buffer */
- void *private_data, /* my private data */
xfs_daddr_t bno, /* starting bno of inode cluster */
int *ubused, /* bytes used by me */
- void *dibuff, /* on-disk inode buffer */
int *stat) /* BULKSTAT_RV_... */
{
return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
xfs_bulkstat_one_fmt_compat, bno,
- ubused, dibuff, stat);
+ ubused, stat);
}
/* copied from xfs_ioctl.c */
@@ -298,13 +296,11 @@ xfs_compat_ioc_bulkstat(
int res;
error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
- sizeof(compat_xfs_bstat_t),
- NULL, 0, NULL, NULL, &res);
+ sizeof(compat_xfs_bstat_t), 0, NULL, &res);
} else if (cmd == XFS_IOC_FSBULKSTAT_32) {
error = xfs_bulkstat(mp, &inlast, &count,
- xfs_bulkstat_one_compat, NULL,
- sizeof(compat_xfs_bstat_t), bulkreq.ubuffer,
- BULKSTAT_FG_QUICK, &done);
+ xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
+ bulkreq.ubuffer, &done);
} else
error = XFS_ERROR(EINVAL);
if (error)
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 417e61e..8c01fb6 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1621,10 +1621,8 @@ xfs_qm_dqusage_adjust(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* not used */
int ubsize, /* not used */
- void *private_data, /* not used */
xfs_daddr_t bno, /* starting block of inode cluster */
int *ubused, /* not used */
- void *dip, /* on-disk inode pointer (not used) */
int *res) /* result code value */
{
xfs_inode_t *ip;
@@ -1781,12 +1779,13 @@ xfs_qm_quotacheck(
* Iterate thru all the inodes in the file system,
* adjusting the corresponding dquot counters in core.
*/
- if ((error = xfs_bulkstat(mp, &lastino, &count,
- xfs_qm_dqusage_adjust, NULL,
- structsz, NULL, BULKSTAT_FG_IGET, &done)))
+ error = xfs_bulkstat(mp, &lastino, &count,
+ xfs_qm_dqusage_adjust,
+ structsz, NULL, &done);
+ if (error)
break;
- } while (! done);
+ } while (!done);
/*
* We've made all the changes that we need to make incore.
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 50bee07..7d2edee 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -1112,10 +1112,8 @@ xfs_qm_internalqcheck_adjust(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* not used */
int ubsize, /* not used */
- void *private_data, /* not used */
xfs_daddr_t bno, /* starting block of inode cluster */
int *ubused, /* not used */
- void *dip, /* not used */
int *res) /* bulkstat result code */
{
xfs_inode_t *ip;
@@ -1210,15 +1208,15 @@ xfs_qm_internalqcheck(
* Iterate thru all the inodes in the file system,
* adjusting the corresponding dquot counters
*/
- if ((error = xfs_bulkstat(mp, &lastino, &count,
- xfs_qm_internalqcheck_adjust, NULL,
- 0, NULL, BULKSTAT_FG_IGET, &done))) {
+ error = xfs_bulkstat(mp, &lastino, &count,
+ xfs_qm_internalqcheck_adjust,
+ 0, NULL, &done);
+ if (error) {
+ cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
break;
}
- } while (! done);
- if (error) {
- cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
- }
+ } while (!done);
+
cmn_err(CE_DEBUG, "Checking results against system dquots");
for (i = 0; i < qmtest_hashmask; i++) {
h1 = &qmtest_udqtab[i];
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index b1b801e..83d7827 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -49,24 +49,41 @@ xfs_internal_inum(
(ino == mp->m_sb.sb_uquotino || ino == mp->m_sb.sb_gquotino)));
}
-STATIC int
-xfs_bulkstat_one_iget(
- xfs_mount_t *mp, /* mount point for filesystem */
- xfs_ino_t ino, /* inode number to get data for */
- xfs_daddr_t bno, /* starting bno of inode cluster */
- xfs_bstat_t *buf, /* return buffer */
- int *stat) /* BULKSTAT_RV_... */
+/*
+ * Return stat information for one inode.
+ * Return 0 if ok, else errno.
+ */
+int
+xfs_bulkstat_one_int(
+ struct xfs_mount *mp, /* mount point for filesystem */
+ xfs_ino_t ino, /* inode to get data for */
+ void __user *buffer, /* buffer to place output in */
+ int ubsize, /* size of buffer */
+ bulkstat_one_fmt_pf formatter, /* formatter, copy to user */
+ xfs_daddr_t bno, /* starting bno of cluster */
+ int *ubused, /* bytes used by me */
+ int *stat) /* BULKSTAT_RV_... */
{
- xfs_icdinode_t *dic; /* dinode core info pointer */
- xfs_inode_t *ip; /* incore inode pointer */
- struct inode *inode;
- int error;
+ struct xfs_icdinode *dic; /* dinode core info pointer */
+ struct xfs_inode *ip; /* incore inode pointer */
+ struct inode *inode;
+ struct xfs_bstat *buf; /* return buffer */
+ int error = 0; /* error value */
+
+ *stat = BULKSTAT_RV_NOTHING;
+
+ if (!buffer || xfs_internal_inum(mp, ino))
+ return XFS_ERROR(EINVAL);
+
+ buf = kmem_alloc(sizeof(*buf), KM_SLEEP | KM_MAYFAIL);
+ if (!buf)
+ return XFS_ERROR(ENOMEM);
error = xfs_iget(mp, NULL, ino,
XFS_IGET_BULKSTAT, XFS_ILOCK_SHARED, &ip, bno);
if (error) {
*stat = BULKSTAT_RV_NOTHING;
- return error;
+ goto out_free;
}
ASSERT(ip != NULL);
@@ -127,77 +144,16 @@ xfs_bulkstat_one_iget(
buf->bs_blocks = dic->di_nblocks + ip->i_delayed_blks;
break;
}
-
xfs_iput(ip, XFS_ILOCK_SHARED);
- return error;
-}
-STATIC void
-xfs_bulkstat_one_dinode(
- xfs_mount_t *mp, /* mount point for filesystem */
- xfs_ino_t ino, /* inode number to get data for */
- xfs_dinode_t *dic, /* dinode inode pointer */
- xfs_bstat_t *buf) /* return buffer */
-{
- /*
- * The inode format changed when we moved the link count and
- * made it 32 bits long. If this is an old format inode,
- * convert it in memory to look like a new one. If it gets
- * flushed to disk we will convert back before flushing or
- * logging it. We zero out the new projid field and the old link
- * count field. We'll handle clearing the pad field (the remains
- * of the old uuid field) when we actually convert the inode to
- * the new format. We don't change the version number so that we
- * can distinguish this from a real new format inode.
- */
- if (dic->di_version == 1) {
- buf->bs_nlink = be16_to_cpu(dic->di_onlink);
- buf->bs_projid = 0;
- } else {
- buf->bs_nlink = be32_to_cpu(dic->di_nlink);
- buf->bs_projid = be16_to_cpu(dic->di_projid);
- }
+ error = formatter(buffer, ubsize, ubused, buf);
- buf->bs_ino = ino;
- buf->bs_mode = be16_to_cpu(dic->di_mode);
- buf->bs_uid = be32_to_cpu(dic->di_uid);
- buf->bs_gid = be32_to_cpu(dic->di_gid);
- buf->bs_size = be64_to_cpu(dic->di_size);
- buf->bs_atime.tv_sec = be32_to_cpu(dic->di_atime.t_sec);
- buf->bs_atime.tv_nsec = be32_to_cpu(dic->di_atime.t_nsec);
- buf->bs_mtime.tv_sec = be32_to_cpu(dic->di_mtime.t_sec);
- buf->bs_mtime.tv_nsec = be32_to_cpu(dic->di_mtime.t_nsec);
- buf->bs_ctime.tv_sec = be32_to_cpu(dic->di_ctime.t_sec);
- buf->bs_ctime.tv_nsec = be32_to_cpu(dic->di_ctime.t_nsec);
- buf->bs_xflags = xfs_dic2xflags(dic);
- buf->bs_extsize = be32_to_cpu(dic->di_extsize) << mp->m_sb.sb_blocklog;
- buf->bs_extents = be32_to_cpu(dic->di_nextents);
- buf->bs_gen = be32_to_cpu(dic->di_gen);
- memset(buf->bs_pad, 0, sizeof(buf->bs_pad));
- buf->bs_dmevmask = be32_to_cpu(dic->di_dmevmask);
- buf->bs_dmstate = be16_to_cpu(dic->di_dmstate);
- buf->bs_aextents = be16_to_cpu(dic->di_anextents);
- buf->bs_forkoff = XFS_DFORK_BOFF(dic);
+ if (!error)
+ *stat = BULKSTAT_RV_DIDONE;
- switch (dic->di_format) {
- case XFS_DINODE_FMT_DEV:
- buf->bs_rdev = xfs_dinode_get_rdev(dic);
- buf->bs_blksize = BLKDEV_IOSIZE;
- buf->bs_blocks = 0;
- break;
- case XFS_DINODE_FMT_LOCAL:
- case XFS_DINODE_FMT_UUID:
- buf->bs_rdev = 0;
- buf->bs_blksize = mp->m_sb.sb_blocksize;
- buf->bs_blocks = 0;
- break;
- case XFS_DINODE_FMT_EXTENTS:
- case XFS_DINODE_FMT_BTREE:
- buf->bs_rdev = 0;
- buf->bs_blksize = mp->m_sb.sb_blocksize;
- buf->bs_blocks = be64_to_cpu(dic->di_nblocks);
- break;
- }
+ out_free:
+ kmem_free(buf);
+ return error;
}
/* Return 0 on success or positive error */
@@ -217,118 +173,19 @@ xfs_bulkstat_one_fmt(
return 0;
}
-/*
- * Return stat information for one inode.
- * Return 0 if ok, else errno.
- */
-int /* error status */
-xfs_bulkstat_one_int(
- xfs_mount_t *mp, /* mount point for filesystem */
- xfs_ino_t ino, /* inode number to get data for */
- void __user *buffer, /* buffer to place output in */
- int ubsize, /* size of buffer */
- bulkstat_one_fmt_pf formatter, /* formatter, copy to user */
- xfs_daddr_t bno, /* starting bno of inode cluster */
- int *ubused, /* bytes used by me */
- void *dibuff, /* on-disk inode buffer */
- int *stat) /* BULKSTAT_RV_... */
-{
- xfs_bstat_t *buf; /* return buffer */
- int error = 0; /* error value */
- xfs_dinode_t *dip; /* dinode inode pointer */
-
- dip = (xfs_dinode_t *)dibuff;
- *stat = BULKSTAT_RV_NOTHING;
-
- if (!buffer || xfs_internal_inum(mp, ino))
- return XFS_ERROR(EINVAL);
-
- buf = kmem_alloc(sizeof(*buf), KM_SLEEP);
-
- if (dip == NULL) {
- /* We're not being passed a pointer to a dinode. This happens
- * if BULKSTAT_FG_IGET is selected. Do the iget.
- */
- error = xfs_bulkstat_one_iget(mp, ino, bno, buf, stat);
- if (error)
- goto out_free;
- } else {
- xfs_bulkstat_one_dinode(mp, ino, dip, buf);
- }
-
- error = formatter(buffer, ubsize, ubused, buf);
- if (error)
- goto out_free;
-
- *stat = BULKSTAT_RV_DIDONE;
-
- out_free:
- kmem_free(buf);
- return error;
-}
-
int
xfs_bulkstat_one(
xfs_mount_t *mp, /* mount point for filesystem */
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* buffer to place output in */
int ubsize, /* size of buffer */
- void *private_data, /* my private data */
xfs_daddr_t bno, /* starting bno of inode cluster */
int *ubused, /* bytes used by me */
- void *dibuff, /* on-disk inode buffer */
int *stat) /* BULKSTAT_RV_... */
{
return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
xfs_bulkstat_one_fmt, bno,
- ubused, dibuff, stat);
-}
-
-/*
- * Test to see whether we can use the ondisk inode directly, based
- * on the given bulkstat flags, filling in dipp accordingly.
- * Returns zero if the inode is dodgey.
- */
-STATIC int
-xfs_bulkstat_use_dinode(
- xfs_mount_t *mp,
- int flags,
- xfs_buf_t *bp,
- int clustidx,
- xfs_dinode_t **dipp)
-{
- xfs_dinode_t *dip;
- unsigned int aformat;
-
- *dipp = NULL;
- if (!bp || (flags & BULKSTAT_FG_IGET))
- return 1;
- dip = (xfs_dinode_t *)
- xfs_buf_offset(bp, clustidx << mp->m_sb.sb_inodelog);
- /*
- * Check the buffer containing the on-disk inode for di_mode == 0.
- * This is to prevent xfs_bulkstat from picking up just reclaimed
- * inodes that have their in-core state initialized but not flushed
- * to disk yet. This is a temporary hack that would require a proper
- * fix in the future.
- */
- if (be16_to_cpu(dip->di_magic) != XFS_DINODE_MAGIC ||
- !XFS_DINODE_GOOD_VERSION(dip->di_version) ||
- !dip->di_mode)
- return 0;
- if (flags & BULKSTAT_FG_QUICK) {
- *dipp = dip;
- return 1;
- }
- /* BULKSTAT_FG_INLINE: if attr fork is local, or not there, use it */
- aformat = dip->di_aformat;
- if ((XFS_DFORK_Q(dip) == 0) ||
- (aformat == XFS_DINODE_FMT_LOCAL) ||
- (aformat == XFS_DINODE_FMT_EXTENTS && !dip->di_anextents)) {
- *dipp = dip;
- return 1;
- }
- return 1;
+ ubused, stat);
}
#define XFS_BULKSTAT_UBLEFT(ubleft) ((ubleft) >= statstruct_size)
@@ -342,10 +199,8 @@ xfs_bulkstat(
xfs_ino_t *lastinop, /* last inode returned */
int *ubcountp, /* size of buffer/count returned */
bulkstat_one_pf formatter, /* func that'd fill a single buf */
- void *private_data,/* private data for formatter */
size_t statstruct_size, /* sizeof struct filling */
char __user *ubuffer, /* buffer with inode stats */
- int flags, /* defined in xfs_itable.h */
int *done) /* 1 if there are more stats to get */
{
xfs_agblock_t agbno=0;/* allocation group block number */
@@ -380,14 +235,12 @@ xfs_bulkstat(
int ubelem; /* spaces used in user's buffer */
int ubused; /* bytes used by formatter */
xfs_buf_t *bp; /* ptr to on-disk inode cluster buf */
- xfs_dinode_t *dip; /* ptr into bp for specific inode */
/*
* Get the last inode value, see if there's nothing to do.
*/
ino = (xfs_ino_t)*lastinop;
lastino = ino;
- dip = NULL;
agno = XFS_INO_TO_AGNO(mp, ino);
agino = XFS_INO_TO_AGINO(mp, ino);
if (agno >= mp->m_sb.sb_agcount ||
@@ -612,37 +465,6 @@ xfs_bulkstat(
irbp->ir_startino) +
((chunkidx & nimask) >>
mp->m_sb.sb_inopblog);
-
- if (flags & (BULKSTAT_FG_QUICK |
- BULKSTAT_FG_INLINE)) {
- int offset;
-
- ino = XFS_AGINO_TO_INO(mp, agno,
- agino);
- bno = XFS_AGB_TO_DADDR(mp, agno,
- agbno);
-
- /*
- * Get the inode cluster buffer
- */
- if (bp)
- xfs_buf_relse(bp);
-
- error = xfs_inotobp(mp, NULL, ino, &dip,
- &bp, &offset,
- XFS_IGET_BULKSTAT);
-
- if (!error)
- clustidx = offset / mp->m_sb.sb_inodesize;
- if (XFS_TEST_ERROR(error != 0,
- mp, XFS_ERRTAG_BULKSTAT_READ_CHUNK,
- XFS_RANDOM_BULKSTAT_READ_CHUNK)) {
- bp = NULL;
- ubleft = 0;
- rval = error;
- break;
- }
- }
}
ino = XFS_AGINO_TO_INO(mp, agno, agino);
bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
@@ -658,35 +480,13 @@ xfs_bulkstat(
* when the chunk is used up.
*/
irbp->ir_freecount++;
- if (!xfs_bulkstat_use_dinode(mp, flags, bp,
- clustidx, &dip)) {
- lastino = ino;
- continue;
- }
- /*
- * If we need to do an iget, cannot hold bp.
- * Drop it, until starting the next cluster.
- */
- if ((flags & BULKSTAT_FG_INLINE) && !dip) {
- if (bp)
- xfs_buf_relse(bp);
- bp = NULL;
- }
/*
* Get the inode and fill in a single buffer.
- * BULKSTAT_FG_QUICK uses dip to fill it in.
- * BULKSTAT_FG_IGET uses igets.
- * BULKSTAT_FG_INLINE uses dip if we have an
- * inline attr fork, else igets.
- * See: xfs_bulkstat_one & xfs_dm_bulkstat_one.
- * This is also used to count inodes/blks, etc
- * in xfs_qm_quotacheck.
*/
ubused = statstruct_size;
- error = formatter(mp, ino, ubufp,
- ubleft, private_data,
- bno, &ubused, dip, &fmterror);
+ error = formatter(mp, ino, ubufp, ubleft, bno,
+ &ubused, &fmterror);
if (fmterror == BULKSTAT_RV_NOTHING) {
if (error && error != ENOENT &&
error != EINVAL) {
@@ -779,7 +579,7 @@ xfs_bulkstat_single(
ino = (xfs_ino_t)*lastinop;
error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t),
- NULL, 0, NULL, NULL, &res);
+ 0, NULL, &res);
if (error) {
/*
* Special case way failed, do it the "long" way
@@ -788,8 +588,7 @@ xfs_bulkstat_single(
(*lastinop)--;
count = 1;
if (xfs_bulkstat(mp, lastinop, &count, xfs_bulkstat_one,
- NULL, sizeof(xfs_bstat_t), buffer,
- BULKSTAT_FG_IGET, done))
+ sizeof(xfs_bstat_t), buffer, done))
return error;
if (count == 0 || (xfs_ino_t)*lastinop != ino)
return error == EFSCORRUPTED ?
diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
index 20792bf..fea0339 100644
--- a/fs/xfs/xfs_itable.h
+++ b/fs/xfs/xfs_itable.h
@@ -27,10 +27,8 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount *mp,
xfs_ino_t ino,
void __user *buffer,
int ubsize,
- void *private_data,
xfs_daddr_t bno,
int *ubused,
- void *dip,
int *stat);
/*
@@ -41,13 +39,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount *mp,
#define BULKSTAT_RV_GIVEUP 2
/*
- * Values for bulkstat flag argument.
- */
-#define BULKSTAT_FG_IGET 0x1 /* Go through the buffer cache */
-#define BULKSTAT_FG_QUICK 0x2 /* No iget, walk the dinode cluster */
-#define BULKSTAT_FG_INLINE 0x4 /* No iget if inline attrs */
-
-/*
* Return stat information in bulk (by-inode) for the filesystem.
*/
int /* error status */
@@ -56,10 +47,8 @@ xfs_bulkstat(
xfs_ino_t *lastino, /* last inode returned */
int *count, /* size of buffer/count returned */
bulkstat_one_pf formatter, /* func that'd fill a single buf */
- void *private_data, /* private data for formatter */
size_t statstruct_size,/* sizeof struct that we're filling */
char __user *ubuffer,/* buffer with inode stats */
- int flags, /* flag to control access method */
int *done); /* 1 if there are more stats to get */
int
@@ -84,7 +73,6 @@ xfs_bulkstat_one_int(
bulkstat_one_fmt_pf formatter,
xfs_daddr_t bno,
int *ubused,
- void *dibuff,
int *stat);
int
@@ -93,10 +81,8 @@ xfs_bulkstat_one(
xfs_ino_t ino,
void __user *buffer,
int ubsize,
- void *private_data,
xfs_daddr_t bno,
int *ubused,
- void *dibuff,
int *stat);
typedef int (*inumbers_fmt_pf)(
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 104/247] xfs: validate untrusted inode numbers during lookup
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (42 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 103/247] xfs: always use iget in bulkstat Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 105/247] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED Paul Gortmaker
` (142 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Dave Chinner, Paul Gortmaker
From: Dave Chinner <dchinner@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7124fe0a5b619d65b739477b3b55a20bf805b06d upstream.
When we decode a handle or do a bulkstat lookup, we are using an
inode number we cannot trust to be valid. If we are deleting inode
chunks from disk (default noikeep mode), then we cannot trust the on
disk inode buffer for any given inode number to correctly reflect
whether the inode has been unlinked as the di_mode nor the
generation number may have been updated on disk.
This is due to the fact that when we delete an inode chunk, we do
not write the clusters back to disk when they are removed - instead
we mark them stale to avoid them being written back potentially over
the top of something that has been subsequently allocated at that
location. The result is that we can have locations of disk that look
like they contain valid inodes but in reality do not. Hence we
cannot simply convert the inode number to a block number and read
the location from disk to determine if the inode is valid or not.
As a result, and XFS_IGET_BULKSTAT lookup needs to actually look the
inode up in the inode allocation btree to determine if the inode
number is valid or not.
It should be noted even on ikeep filesystems, there is the
possibility that blocks on disk may look like valid inode clusters.
e.g. if there are filesystem images hosted on the filesystem. Hence
even for ikeep filesystems we really need to validate that the inode
number is valid before issuing the inode buffer read.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/xfs_ialloc.c | 121 +++++++++++++++++++++++++++++++++------------------
1 files changed, 78 insertions(+), 43 deletions(-)
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 9d884c1..0c946c8 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1203,6 +1203,63 @@ error0:
return error;
}
+STATIC int
+xfs_imap_lookup(
+ struct xfs_mount *mp,
+ struct xfs_trans *tp,
+ xfs_agnumber_t agno,
+ xfs_agino_t agino,
+ xfs_agblock_t agbno,
+ xfs_agblock_t *chunk_agbno,
+ xfs_agblock_t *offset_agbno,
+ int flags)
+{
+ struct xfs_inobt_rec_incore rec;
+ struct xfs_btree_cur *cur;
+ struct xfs_buf *agbp;
+ xfs_agino_t startino;
+ int error;
+ int i;
+
+ error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
+ if (error) {
+ xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
+ "xfs_ialloc_read_agi() returned "
+ "error %d, agno %d",
+ error, agno);
+ return error;
+ }
+
+ /*
+ * derive and lookup the exact inode record for the given agino. If the
+ * record cannot be found, then it's an invalid inode number and we
+ * should abort.
+ */
+ cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
+ startino = agino & ~(XFS_IALLOC_INODES(mp) - 1);
+ error = xfs_inobt_lookup(cur, startino, XFS_LOOKUP_EQ, &i);
+ if (!error) {
+ if (i)
+ error = xfs_inobt_get_rec(cur, &rec, &i);
+ if (!error && i == 0)
+ error = EINVAL;
+ }
+
+ xfs_trans_brelse(tp, agbp);
+ xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+ if (error)
+ return error;
+
+ /* for untrusted inodes check it is allocated first */
+ if ((flags & XFS_IGET_BULKSTAT) &&
+ (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))
+ return EINVAL;
+
+ *chunk_agbno = XFS_AGINO_TO_AGBNO(mp, rec.ir_startino);
+ *offset_agbno = agbno - *chunk_agbno;
+ return 0;
+}
+
/*
* Return the location of the inode in imap, for mapping it into a buffer.
*/
@@ -1263,6 +1320,23 @@ xfs_imap(
return XFS_ERROR(EINVAL);
}
+ blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
+
+ /*
+ * For bulkstat and handle lookups, we have an untrusted inode number
+ * that we have to verify is valid. We cannot do this just by reading
+ * the inode buffer as it may have been unlinked and removed leaving
+ * inodes in stale state on disk. Hence we have to do a btree lookup
+ * in all cases where an untrusted inode number is passed.
+ */
+ if (flags & XFS_IGET_BULKSTAT) {
+ error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+ &chunk_agbno, &offset_agbno, flags);
+ if (error)
+ return error;
+ goto out_map;
+ }
+
/*
* If the inode cluster size is the same as the blocksize or
* smaller we get to the buffer by simple arithmetics.
@@ -1277,10 +1351,8 @@ xfs_imap(
return 0;
}
- blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
-
/*
- * If we get a block number passed from bulkstat we can use it to
+ * If we get a block number passed we can use it to
* find the buffer easily.
*/
if (imap->im_blkno) {
@@ -1304,50 +1376,13 @@ xfs_imap(
offset_agbno = agbno & mp->m_inoalign_mask;
chunk_agbno = agbno - offset_agbno;
} else {
- xfs_btree_cur_t *cur; /* inode btree cursor */
- xfs_inobt_rec_incore_t chunk_rec;
- xfs_buf_t *agbp; /* agi buffer */
- int i; /* temp state */
-
- error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
- if (error) {
- xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
- "xfs_ialloc_read_agi() returned "
- "error %d, agno %d",
- error, agno);
- return error;
- }
-
- cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
- error = xfs_inobt_lookup(cur, agino, XFS_LOOKUP_LE, &i);
- if (error) {
- xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
- "xfs_inobt_lookup() failed");
- goto error0;
- }
-
- error = xfs_inobt_get_rec(cur, &chunk_rec, &i);
- if (error) {
- xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
- "xfs_inobt_get_rec() failed");
- goto error0;
- }
- if (i == 0) {
-#ifdef DEBUG
- xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
- "xfs_inobt_get_rec() failed");
-#endif /* DEBUG */
- error = XFS_ERROR(EINVAL);
- }
- error0:
- xfs_trans_brelse(tp, agbp);
- xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+ error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+ &chunk_agbno, &offset_agbno, flags);
if (error)
return error;
- chunk_agbno = XFS_AGINO_TO_AGBNO(mp, chunk_rec.ir_startino);
- offset_agbno = agbno - chunk_agbno;
}
+out_map:
ASSERT(agbno >= chunk_agbno);
cluster_agbno = chunk_agbno +
((offset_agbno / blks_per_cluster) * blks_per_cluster);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 105/247] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (43 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 104/247] xfs: validate untrusted inode numbers during lookup Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 106/247] xfs: remove block number from inode lookup code Paul Gortmaker
` (141 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Dave Chinner, Paul Gortmaker
From: Dave Chinner <dchinner@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1920779e67cbf5ea8afef317777c5bf2b8096188 upstream.
Inode numbers may come from somewhere external to the filesystem
(e.g. file handles, bulkstat information) and so are inherently
untrusted. Rename the flag we use for these lookups to make it
obvious we are doing a lookup of an untrusted inode number and need
to verify it completely before trying to read it from disk.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/linux-2.6/xfs_export.c | 9 ++++-----
fs/xfs/xfs_ialloc.c | 11 +++++++----
fs/xfs/xfs_inode.c | 2 +-
fs/xfs/xfs_inode.h | 2 +-
fs/xfs/xfs_itable.c | 2 +-
5 files changed, 14 insertions(+), 12 deletions(-)
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 846b75a..92c84a1 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -128,12 +128,11 @@ xfs_nfs_get_inode(
return ERR_PTR(-ESTALE);
/*
- * The XFS_IGET_BULKSTAT means that an invalid inode number is just
- * fine and not an indication of a corrupted filesystem. Because
- * clients can send any kind of invalid file handle, e.g. after
- * a restore on the server we have to deal with this case gracefully.
+ * The XFS_IGET_UNTRUSTED means that an invalid inode number is just
+ * fine and not an indication of a corrupted filesystem as clients can
+ * send invalid file handles and we have to handle it gracefully..
*/
- error = xfs_iget(mp, NULL, ino, XFS_IGET_BULKSTAT,
+ error = xfs_iget(mp, NULL, ino, XFS_IGET_UNTRUSTED,
XFS_ILOCK_SHARED, &ip, 0);
if (error) {
/*
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 0c946c8..d8fd366 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1251,7 +1251,7 @@ xfs_imap_lookup(
return error;
/* for untrusted inodes check it is allocated first */
- if ((flags & XFS_IGET_BULKSTAT) &&
+ if ((flags & XFS_IGET_UNTRUSTED) &&
(rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))
return EINVAL;
@@ -1292,8 +1292,11 @@ xfs_imap(
if (agno >= mp->m_sb.sb_agcount || agbno >= mp->m_sb.sb_agblocks ||
ino != XFS_AGINO_TO_INO(mp, agno, agino)) {
#ifdef DEBUG
- /* no diagnostics for bulkstat, ino comes from userspace */
- if (flags & XFS_IGET_BULKSTAT)
+ /*
+ * Don't output diagnostic information for untrusted inodes
+ * as they can be invalid without implying corruption.
+ */
+ if (flags & XFS_IGET_UNTRUSTED)
return XFS_ERROR(EINVAL);
if (agno >= mp->m_sb.sb_agcount) {
xfs_fs_cmn_err(CE_ALERT, mp,
@@ -1329,7 +1332,7 @@ xfs_imap(
* inodes in stale state on disk. Hence we have to do a btree lookup
* in all cases where an untrusted inode number is passed.
*/
- if (flags & XFS_IGET_BULKSTAT) {
+ if (flags & XFS_IGET_UNTRUSTED) {
error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
&chunk_agbno, &offset_agbno, flags);
if (error)
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 0ffd564..078811f 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -177,7 +177,7 @@ xfs_imap_to_bp(
if (unlikely(XFS_TEST_ERROR(!di_ok, mp,
XFS_ERRTAG_ITOBP_INOTOBP,
XFS_RANDOM_ITOBP_INOTOBP))) {
- if (iget_flags & XFS_IGET_BULKSTAT) {
+ if (iget_flags & XFS_IGET_UNTRUSTED) {
xfs_trans_brelse(tp, bp);
return XFS_ERROR(EINVAL);
}
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 9965e40..6b31b38 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -500,7 +500,7 @@ do { \
* Flags for xfs_iget()
*/
#define XFS_IGET_CREATE 0x1
-#define XFS_IGET_BULKSTAT 0x2
+#define XFS_IGET_UNTRUSTED 0x2
int xfs_inotobp(struct xfs_mount *, struct xfs_trans *,
xfs_ino_t, struct xfs_dinode **,
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 83d7827..2acd12f 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -80,7 +80,7 @@ xfs_bulkstat_one_int(
return XFS_ERROR(ENOMEM);
error = xfs_iget(mp, NULL, ino,
- XFS_IGET_BULKSTAT, XFS_ILOCK_SHARED, &ip, bno);
+ XFS_IGET_UNTRUSTED, XFS_ILOCK_SHARED, &ip, bno);
if (error) {
*stat = BULKSTAT_RV_NOTHING;
goto out_free;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 106/247] xfs: remove block number from inode lookup code
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (44 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 105/247] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 107/247] xfs: fix untrusted inode number lookup Paul Gortmaker
` (140 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Dave Chinner, Paul Gortmaker
From: Dave Chinner <dchinner@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7b6259e7a83647948fa33a736cc832310c8d85aa upstream.
The block number comes from bulkstat based inode lookups to shortcut
the mapping calculations. We ar enot able to trust anything from
bulkstat, so drop the block number as well so that the correct
lookups and mappings are always done.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/linux-2.6/xfs_export.c | 2 +-
fs/xfs/linux-2.6/xfs_ioctl32.c | 5 ++---
fs/xfs/quota/xfs_qm.c | 7 +++----
fs/xfs/quota/xfs_qm_syscalls.c | 11 +++++------
fs/xfs/xfs_ialloc.c | 16 ----------------
fs/xfs/xfs_iget.c | 10 +++-------
fs/xfs/xfs_inode.c | 3 ---
fs/xfs/xfs_inode.h | 4 ++--
fs/xfs/xfs_itable.c | 12 ++++--------
fs/xfs/xfs_itable.h | 3 ---
fs/xfs/xfs_log_recover.c | 2 +-
fs/xfs/xfs_mount.c | 2 +-
fs/xfs/xfs_rtalloc.c | 4 ++--
fs/xfs/xfs_trans_inode.c | 2 +-
fs/xfs/xfs_vnodeops.c | 2 +-
15 files changed, 26 insertions(+), 59 deletions(-)
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 92c84a1..e7839ee 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -133,7 +133,7 @@ xfs_nfs_get_inode(
* send invalid file handles and we have to handle it gracefully..
*/
error = xfs_iget(mp, NULL, ino, XFS_IGET_UNTRUSTED,
- XFS_ILOCK_SHARED, &ip, 0);
+ XFS_ILOCK_SHARED, &ip);
if (error) {
/*
* EINVAL means the inode cluster doesn't exist anymore.
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index bf89be9..4dfcefe 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -237,12 +237,11 @@ xfs_bulkstat_one_compat(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* buffer to place output in */
int ubsize, /* size of buffer */
- xfs_daddr_t bno, /* starting bno of inode cluster */
int *ubused, /* bytes used by me */
int *stat) /* BULKSTAT_RV_... */
{
return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
- xfs_bulkstat_one_fmt_compat, bno,
+ xfs_bulkstat_one_fmt_compat,
ubused, stat);
}
@@ -296,7 +295,7 @@ xfs_compat_ioc_bulkstat(
int res;
error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
- sizeof(compat_xfs_bstat_t), 0, NULL, &res);
+ sizeof(compat_xfs_bstat_t), 0, &res);
} else if (cmd == XFS_IOC_FSBULKSTAT_32) {
error = xfs_bulkstat(mp, &inlast, &count,
xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 8c01fb6..2dfa5bd 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1621,7 +1621,6 @@ xfs_qm_dqusage_adjust(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* not used */
int ubsize, /* not used */
- xfs_daddr_t bno, /* starting block of inode cluster */
int *ubused, /* not used */
int *res) /* result code value */
{
@@ -1647,7 +1646,7 @@ xfs_qm_dqusage_adjust(
* the case in all other instances. It's OK that we do this because
* quotacheck is done only at mount time.
*/
- if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip, bno))) {
+ if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip))) {
*res = BULKSTAT_RV_NOTHING;
return error;
}
@@ -1873,14 +1872,14 @@ xfs_qm_init_quotainos(
mp->m_sb.sb_uquotino != NULLFSINO) {
ASSERT(mp->m_sb.sb_uquotino > 0);
if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
- 0, 0, &uip, 0)))
+ 0, 0, &uip)))
return XFS_ERROR(error);
}
if (XFS_IS_OQUOTA_ON(mp) &&
mp->m_sb.sb_gquotino != NULLFSINO) {
ASSERT(mp->m_sb.sb_gquotino > 0);
if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
- 0, 0, &gip, 0))) {
+ 0, 0, &gip))) {
if (uip)
IRELE(uip);
return XFS_ERROR(error);
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 7d2edee..f8e52bf 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -267,7 +267,7 @@ xfs_qm_scall_trunc_qfiles(
}
if ((flags & XFS_DQ_USER) && mp->m_sb.sb_uquotino != NULLFSINO) {
- error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip, 0);
+ error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip);
if (!error) {
error = xfs_truncate_file(mp, qip);
IRELE(qip);
@@ -276,7 +276,7 @@ xfs_qm_scall_trunc_qfiles(
if ((flags & (XFS_DQ_GROUP|XFS_DQ_PROJ)) &&
mp->m_sb.sb_gquotino != NULLFSINO) {
- error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip, 0);
+ error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip);
if (!error2) {
error2 = xfs_truncate_file(mp, qip);
IRELE(qip);
@@ -421,12 +421,12 @@ xfs_qm_scall_getqstat(
}
if (!uip && mp->m_sb.sb_uquotino != NULLFSINO) {
if (xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
- 0, 0, &uip, 0) == 0)
+ 0, 0, &uip) == 0)
tempuqip = B_TRUE;
}
if (!gip && mp->m_sb.sb_gquotino != NULLFSINO) {
if (xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
- 0, 0, &gip, 0) == 0)
+ 0, 0, &gip) == 0)
tempgqip = B_TRUE;
}
if (uip) {
@@ -1112,7 +1112,6 @@ xfs_qm_internalqcheck_adjust(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* not used */
int ubsize, /* not used */
- xfs_daddr_t bno, /* starting block of inode cluster */
int *ubused, /* not used */
int *res) /* bulkstat result code */
{
@@ -1135,7 +1134,7 @@ xfs_qm_internalqcheck_adjust(
ipreleased = B_FALSE;
again:
lock_flags = XFS_ILOCK_SHARED;
- if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip, bno))) {
+ if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip))) {
*res = BULKSTAT_RV_NOTHING;
return (error);
}
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index d8fd366..c7142a0 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1355,22 +1355,6 @@ xfs_imap(
}
/*
- * If we get a block number passed we can use it to
- * find the buffer easily.
- */
- if (imap->im_blkno) {
- offset = XFS_INO_TO_OFFSET(mp, ino);
- ASSERT(offset < mp->m_sb.sb_inopblock);
-
- cluster_agbno = xfs_daddr_to_agbno(mp, imap->im_blkno);
- offset += (agbno - cluster_agbno) * mp->m_sb.sb_inopblock;
-
- imap->im_len = XFS_FSB_TO_BB(mp, blks_per_cluster);
- imap->im_boffset = (ushort)(offset << mp->m_sb.sb_inodelog);
- return 0;
- }
-
- /*
* If the inode chunks are aligned then use simple maths to
* find the location. Otherwise we have to do a btree
* lookup to find the location.
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 6845db9..5ac3be0 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -259,7 +259,6 @@ xfs_iget_cache_miss(
xfs_trans_t *tp,
xfs_ino_t ino,
struct xfs_inode **ipp,
- xfs_daddr_t bno,
int flags,
int lock_flags)
{
@@ -272,7 +271,7 @@ xfs_iget_cache_miss(
if (!ip)
return ENOMEM;
- error = xfs_iread(mp, tp, ip, bno, flags);
+ error = xfs_iread(mp, tp, ip, flags);
if (error)
goto out_destroy;
@@ -358,8 +357,6 @@ out_destroy:
* within the file system for the inode being requested.
* lock_flags -- flags indicating how to lock the inode. See the comment
* for xfs_ilock() for a list of valid values.
- * bno -- the block number starting the buffer containing the inode,
- * if known (as by bulkstat), else 0.
*/
int
xfs_iget(
@@ -368,8 +365,7 @@ xfs_iget(
xfs_ino_t ino,
uint flags,
uint lock_flags,
- xfs_inode_t **ipp,
- xfs_daddr_t bno)
+ xfs_inode_t **ipp)
{
xfs_inode_t *ip;
int error;
@@ -400,7 +396,7 @@ again:
read_unlock(&pag->pag_ici_lock);
XFS_STATS_INC(xs_ig_missed);
- error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip, bno,
+ error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip,
flags, lock_flags);
if (error)
goto out_error_or_again;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 078811f..7aaaf52 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -787,7 +787,6 @@ xfs_iread(
xfs_mount_t *mp,
xfs_trans_t *tp,
xfs_inode_t *ip,
- xfs_daddr_t bno,
uint iget_flags)
{
xfs_buf_t *bp;
@@ -797,11 +796,9 @@ xfs_iread(
/*
* Fill in the location information in the in-core inode.
*/
- ip->i_imap.im_blkno = bno;
error = xfs_imap(mp, tp, ip->i_ino, &ip->i_imap, iget_flags);
if (error)
return error;
- ASSERT(bno == 0 || bno == ip->i_imap.im_blkno);
/*
* Get pointers to the on-disk inode and the buffer containing it.
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 6b31b38..78550df 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -442,7 +442,7 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
* xfs_iget.c prototypes.
*/
int xfs_iget(struct xfs_mount *, struct xfs_trans *, xfs_ino_t,
- uint, uint, xfs_inode_t **, xfs_daddr_t);
+ uint, uint, xfs_inode_t **);
void xfs_iput(xfs_inode_t *, uint);
void xfs_iput_new(xfs_inode_t *, uint);
void xfs_ilock(xfs_inode_t *, uint);
@@ -509,7 +509,7 @@ int xfs_itobp(struct xfs_mount *, struct xfs_trans *,
struct xfs_inode *, struct xfs_dinode **,
struct xfs_buf **, uint);
int xfs_iread(struct xfs_mount *, struct xfs_trans *,
- struct xfs_inode *, xfs_daddr_t, uint);
+ struct xfs_inode *, uint);
void xfs_dinode_to_disk(struct xfs_dinode *,
struct xfs_icdinode *);
void xfs_idestroy_fork(struct xfs_inode *, int);
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 2acd12f..2b86f86 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -60,7 +60,6 @@ xfs_bulkstat_one_int(
void __user *buffer, /* buffer to place output in */
int ubsize, /* size of buffer */
bulkstat_one_fmt_pf formatter, /* formatter, copy to user */
- xfs_daddr_t bno, /* starting bno of cluster */
int *ubused, /* bytes used by me */
int *stat) /* BULKSTAT_RV_... */
{
@@ -80,7 +79,7 @@ xfs_bulkstat_one_int(
return XFS_ERROR(ENOMEM);
error = xfs_iget(mp, NULL, ino,
- XFS_IGET_UNTRUSTED, XFS_ILOCK_SHARED, &ip, bno);
+ XFS_IGET_UNTRUSTED, XFS_ILOCK_SHARED, &ip);
if (error) {
*stat = BULKSTAT_RV_NOTHING;
goto out_free;
@@ -179,13 +178,11 @@ xfs_bulkstat_one(
xfs_ino_t ino, /* inode number to get data for */
void __user *buffer, /* buffer to place output in */
int ubsize, /* size of buffer */
- xfs_daddr_t bno, /* starting bno of inode cluster */
int *ubused, /* bytes used by me */
int *stat) /* BULKSTAT_RV_... */
{
return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
- xfs_bulkstat_one_fmt, bno,
- ubused, stat);
+ xfs_bulkstat_one_fmt, ubused, stat);
}
#define XFS_BULKSTAT_UBLEFT(ubleft) ((ubleft) >= statstruct_size)
@@ -485,7 +482,7 @@ xfs_bulkstat(
* Get the inode and fill in a single buffer.
*/
ubused = statstruct_size;
- error = formatter(mp, ino, ubufp, ubleft, bno,
+ error = formatter(mp, ino, ubufp, ubleft,
&ubused, &fmterror);
if (fmterror == BULKSTAT_RV_NOTHING) {
if (error && error != ENOENT &&
@@ -578,8 +575,7 @@ xfs_bulkstat_single(
*/
ino = (xfs_ino_t)*lastinop;
- error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t),
- 0, NULL, &res);
+ error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t), 0, &res);
if (error) {
/*
* Special case way failed, do it the "long" way
diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
index fea0339..97295d9 100644
--- a/fs/xfs/xfs_itable.h
+++ b/fs/xfs/xfs_itable.h
@@ -27,7 +27,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount *mp,
xfs_ino_t ino,
void __user *buffer,
int ubsize,
- xfs_daddr_t bno,
int *ubused,
int *stat);
@@ -71,7 +70,6 @@ xfs_bulkstat_one_int(
void __user *buffer,
int ubsize,
bulkstat_one_fmt_pf formatter,
- xfs_daddr_t bno,
int *ubused,
int *stat);
@@ -81,7 +79,6 @@ xfs_bulkstat_one(
xfs_ino_t ino,
void __user *buffer,
int ubsize,
- xfs_daddr_t bno,
int *ubused,
int *stat);
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 22e6efd..4b2e742 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3139,7 +3139,7 @@ xlog_recover_process_one_iunlink(
int error;
ino = XFS_AGINO_TO_INO(mp, agno, agino);
- error = xfs_iget(mp, NULL, ino, 0, 0, &ip, 0);
+ error = xfs_iget(mp, NULL, ino, 0, 0, &ip);
if (error)
goto fail;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index e79b56b..2815141 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1310,7 +1310,7 @@ xfs_mountfs(
* Get and sanity-check the root inode.
* Save the pointer to it in the mount structure.
*/
- error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip, 0);
+ error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip);
if (error) {
cmn_err(CE_WARN, "XFS: failed to read root inode");
goto out_log_dealloc;
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 6be05f7..17bd576 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -2277,12 +2277,12 @@ xfs_rtmount_inodes(
sbp = &mp->m_sb;
if (sbp->sb_rbmino == NULLFSINO)
return 0;
- error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip, 0);
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
if (error)
return error;
ASSERT(mp->m_rbmip != NULL);
ASSERT(sbp->sb_rsumino != NULLFSINO);
- error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip, 0);
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
if (error) {
IRELE(mp->m_rbmip);
return error;
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index 785ff10..2559dfe 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -62,7 +62,7 @@ xfs_trans_iget(
{
int error;
- error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp, 0);
+ error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp);
if (!error && tp)
xfs_trans_ijoin(tp, *ipp, lock_flags);
return error;
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 9d376be..4498f07 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1269,7 +1269,7 @@ xfs_lookup(
if (error)
goto out;
- error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp, 0);
+ error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp);
if (error)
goto out_free_name;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 107/247] xfs: fix untrusted inode number lookup
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (45 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 106/247] xfs: remove block number from inode lookup code Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 108/247] s390: remove task_show_regs Paul Gortmaker
` (139 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Dave Chinner, Paul Gortmaker
From: Dave Chinner <dchinner@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4536f2ad8b330453d7ebec0746c4374eadd649b1 upstream.
Commit 7124fe0a5b619d65b739477b3b55a20bf805b06d ("xfs: validate untrusted inode
numbers during lookup") changes the inode lookup code to do btree lookups for
untrusted inode numbers. This change made an invalid assumption about the
alignment of inodes and hence incorrectly calculated the first inode in the
cluster. As a result, some inode numbers were being incorrectly considered
invalid when they were actually valid.
The issue was not picked up by the xfstests suite because it always runs fsr
and dump (the two utilities that utilise the bulkstat interface) on cache hot
inodes and hence the lookup code in the cold cache path was not sufficiently
exercised to uncover this intermittent problem.
Fix the issue by relaxing the btree lookup criteria and then checking if the
record returned contains the inode number we are lookup for. If it we get an
incorrect record, then the inode number is invalid.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/xfs_ialloc.c | 16 ++++++++++------
1 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index c7142a0..eb779af 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1217,7 +1217,6 @@ xfs_imap_lookup(
struct xfs_inobt_rec_incore rec;
struct xfs_btree_cur *cur;
struct xfs_buf *agbp;
- xfs_agino_t startino;
int error;
int i;
@@ -1231,13 +1230,13 @@ xfs_imap_lookup(
}
/*
- * derive and lookup the exact inode record for the given agino. If the
- * record cannot be found, then it's an invalid inode number and we
- * should abort.
+ * Lookup the inode record for the given agino. If the record cannot be
+ * found, then it's an invalid inode number and we should abort. Once
+ * we have a record, we need to ensure it contains the inode number
+ * we are looking up.
*/
cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
- startino = agino & ~(XFS_IALLOC_INODES(mp) - 1);
- error = xfs_inobt_lookup(cur, startino, XFS_LOOKUP_EQ, &i);
+ error = xfs_inobt_lookup(cur, agino, XFS_LOOKUP_LE, &i);
if (!error) {
if (i)
error = xfs_inobt_get_rec(cur, &rec, &i);
@@ -1250,6 +1249,11 @@ xfs_imap_lookup(
if (error)
return error;
+ /* check that the returned record contains the required inode */
+ if (rec.ir_startino > agino ||
+ rec.ir_startino + XFS_IALLOC_INODES(mp) <= agino)
+ return EINVAL;
+
/* for untrusted inodes check it is allocated first */
if ((flags & XFS_IGET_UNTRUSTED) &&
(rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 108/247] s390: remove task_show_regs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (46 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 107/247] xfs: fix untrusted inode number lookup Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 109/247] PM / Hibernate: Return error code when alloc_image_page() fails Paul Gortmaker
` (138 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Martin Schwidefsky, Linus Torvalds, Paul Gortmaker
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 261cd298a8c363d7985e3482946edb4bfedacf98 upstream.
task_show_regs used to be a debugging aid in the early bringup days
of Linux on s390. /proc/<pid>/status is a world readable file, it
is not a good idea to show the registers of a process. The only
correct fix is to remove task_show_regs.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/s390/include/asm/processor.h | 5 -----
arch/s390/kernel/traps.c | 37 -------------------------------------
fs/proc/array.c | 3 ---
3 files changed, 0 insertions(+), 45 deletions(-)
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 73e2598..f73b50a 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -150,11 +150,6 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
*/
extern unsigned long thread_saved_pc(struct task_struct *t);
-/*
- * Print register of task into buffer. Used in fs/proc/array.c.
- */
-extern void task_show_regs(struct seq_file *m, struct task_struct *task);
-
extern void show_code(struct pt_regs *regs);
unsigned long get_wchan(struct task_struct *p);
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 6e7ad63..7dd1ca6 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -243,43 +243,6 @@ void show_regs(struct pt_regs *regs)
show_last_breaking_event(regs);
}
-/* This is called from fs/proc/array.c */
-void task_show_regs(struct seq_file *m, struct task_struct *task)
-{
- struct pt_regs *regs;
-
- regs = task_pt_regs(task);
- seq_printf(m, "task: %p, ksp: %p\n",
- task, (void *)task->thread.ksp);
- seq_printf(m, "User PSW : %p %p\n",
- (void *) regs->psw.mask, (void *)regs->psw.addr);
-
- seq_printf(m, "User GPRS: " FOURLONG,
- regs->gprs[0], regs->gprs[1],
- regs->gprs[2], regs->gprs[3]);
- seq_printf(m, " " FOURLONG,
- regs->gprs[4], regs->gprs[5],
- regs->gprs[6], regs->gprs[7]);
- seq_printf(m, " " FOURLONG,
- regs->gprs[8], regs->gprs[9],
- regs->gprs[10], regs->gprs[11]);
- seq_printf(m, " " FOURLONG,
- regs->gprs[12], regs->gprs[13],
- regs->gprs[14], regs->gprs[15]);
- seq_printf(m, "User ACRS: %08x %08x %08x %08x\n",
- task->thread.acrs[0], task->thread.acrs[1],
- task->thread.acrs[2], task->thread.acrs[3]);
- seq_printf(m, " %08x %08x %08x %08x\n",
- task->thread.acrs[4], task->thread.acrs[5],
- task->thread.acrs[6], task->thread.acrs[7]);
- seq_printf(m, " %08x %08x %08x %08x\n",
- task->thread.acrs[8], task->thread.acrs[9],
- task->thread.acrs[10], task->thread.acrs[11]);
- seq_printf(m, " %08x %08x %08x %08x\n",
- task->thread.acrs[12], task->thread.acrs[13],
- task->thread.acrs[14], task->thread.acrs[15]);
-}
-
static DEFINE_SPINLOCK(die_lock);
void die(const char * str, struct pt_regs * regs, long err)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index e9f7d54..ed2afa6 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -353,9 +353,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
task_cap(m, task);
task_cpus_allowed(m, task);
cpuset_task_status_allowed(m, task);
-#if defined(CONFIG_S390)
- task_show_regs(m, task);
-#endif
task_context_switch_counts(m, task);
return 0;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 109/247] PM / Hibernate: Return error code when alloc_image_page() fails
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (47 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 108/247] s390: remove task_show_regs Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 110/247] fs/partitions: Validate map_count in Mac partition tables Paul Gortmaker
` (137 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stanislaw Gruszka, Stanislaw Gruszka,
Rafael J. Wysocki, Paul Gortmaker
From: Stanislaw Gruszka <stf_xl@pop3.wp.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2e725a065b0153f0c449318da1923a120477633d upstream.
Currently we return 0 in swsusp_alloc() when alloc_image_page() fails.
Fix that. Also remove unneeded "error" variable since the only
useful value of error is -ENOMEM.
[rjw: Fixed up the changelog and changed subject.]
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/power/snapshot.c | 7 ++-----
1 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index be861c2..0652dcc 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1467,11 +1467,8 @@ static int
swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
unsigned int nr_pages, unsigned int nr_highmem)
{
- int error = 0;
-
if (nr_highmem > 0) {
- error = get_highmem_buffer(PG_ANY);
- if (error)
+ if (get_highmem_buffer(PG_ANY))
goto err_out;
if (nr_highmem > alloc_highmem) {
nr_highmem -= alloc_highmem;
@@ -1494,7 +1491,7 @@ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
err_out:
swsusp_free();
- return error;
+ return -ENOMEM;
}
asmlinkage int swsusp_save(void)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 110/247] fs/partitions: Validate map_count in Mac partition tables
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (48 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 109/247] PM / Hibernate: Return error code when alloc_image_page() fails Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:32 ` [34-longterm 111/247] ALSA: HDA: Add position_fix quirk for an Asus device Paul Gortmaker
` (136 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Linus Torvalds, Paul Gortmaker
From: Timo Warns <warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fa7ea87a057958a8b7926c1a60a3ca6d696328ed upstream.
Validate number of blocks in map and remove redundant variable.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/mac.c | 17 +++++++++--------
1 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
index d4a0fad..5765198 100644
--- a/fs/partitions/mac.c
+++ b/fs/partitions/mac.c
@@ -29,10 +29,9 @@ static inline void mac_fix_string(char *stg, int len)
int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
{
- int slot = 1;
Sector sect;
unsigned char *data;
- int blk, blocks_in_map;
+ int slot, blocks_in_map;
unsigned secsize;
#ifdef CONFIG_PPC_PMAC
int found_root = 0;
@@ -59,10 +58,14 @@ int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
put_dev_sector(sect);
return 0; /* not a MacOS disk */
}
- printk(" [mac]");
blocks_in_map = be32_to_cpu(part->map_count);
- for (blk = 1; blk <= blocks_in_map; ++blk) {
- int pos = blk * secsize;
+ if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
+ put_dev_sector(sect);
+ return 0;
+ }
+ printk(" [mac]");
+ for (slot = 1; slot <= blocks_in_map; ++slot) {
+ int pos = slot * secsize;
put_dev_sector(sect);
data = read_dev_sector(bdev, pos/512, §);
if (!data)
@@ -113,13 +116,11 @@ int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
}
if (goodness > found_root_goodness) {
- found_root = blk;
+ found_root = slot;
found_root_goodness = goodness;
}
}
#endif /* CONFIG_PPC_PMAC */
-
- ++slot;
}
#ifdef CONFIG_PPC_PMAC
if (found_root_goodness)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 111/247] ALSA: HDA: Add position_fix quirk for an Asus device
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (49 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 110/247] fs/partitions: Validate map_count in Mac partition tables Paul Gortmaker
@ 2011-06-23 17:32 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 112/247] ARM: Ensure predictable endian state on signal handler entry Paul Gortmaker
` (135 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:32 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, David Henningsson, Takashi Iwai, Paul Gortmaker
From: David Henningsson <david.henningsson@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b540afc2b3d6e4cd1d1f137ef6d9e9c78d67fecd upstream.
The bug reporter claims that position_fix=1 is needed for his
microphone to work. The controller PCI vendor-id is [1002:4383] (rev 40).
Reported-by: Kjell L.
BugLink: http://bugs.launchpad.net/bugs/718402
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/hda_intel.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 57adfa8..3cf21ff 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2272,6 +2272,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1043, 0x8410, "ASUS", POS_FIX_LPIB),
SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB),
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 112/247] ARM: Ensure predictable endian state on signal handler entry
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (50 preceding siblings ...)
2011-06-23 17:32 ` [34-longterm 111/247] ALSA: HDA: Add position_fix quirk for an Asus device Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 113/247] acer-wmi: Fix capitalisation of GUID Paul Gortmaker
` (134 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Russell King, Paul Gortmaker
From: Russell King <rmk+kernel@arm.linux.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 53399053eb505cf541b2405bd9d9bca5ecfb96fb upstream.
Ensure a predictable endian state when entering signal handlers. This
avoids programs which use SETEND to momentarily switch their endian
state from having their signal handlers entered with an unpredictable
endian state.
Acked-by: Dave Martin <dave.martin@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/arm/kernel/signal.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 907d5a6..abaf844 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -474,7 +474,9 @@ setup_return(struct pt_regs *regs, struct k_sigaction *ka,
unsigned long handler = (unsigned long)ka->sa.sa_handler;
unsigned long retcode;
int thumb = 0;
- unsigned long cpsr = regs->ARM_cpsr & ~PSR_f;
+ unsigned long cpsr = regs->ARM_cpsr & ~(PSR_f | PSR_E_BIT);
+
+ cpsr |= PSR_ENDSTATE;
/*
* Maybe we need to deliver a 32-bit signal to a 26-bit task.
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 113/247] acer-wmi: Fix capitalisation of GUID
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (51 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 112/247] ARM: Ensure predictable endian state on signal handler entry Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 114/247] eCryptfs: Copy up lower inode attrs in getattr Paul Gortmaker
` (133 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Matthew Garrett, Paul Gortmaker
From: Matthew Garrett <mjg@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bbb706079abe955a9e3f208f541de97d99449236 upstream.
6AF4F258-B401-42fd-BE91-3D4AC2D7C0D3 needs to be
6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3 to match the hardware alias.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/acer-wmi.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 1ea6c43..9fa2643 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -91,7 +91,7 @@ struct acer_quirks {
*/
#define AMW0_GUID1 "67C3371D-95A3-4C37-BB61-DD47B491DAAB"
#define AMW0_GUID2 "431F16ED-0C2B-444C-B267-27DEB140CF9C"
-#define WMID_GUID1 "6AF4F258-B401-42fd-BE91-3D4AC2D7C0D3"
+#define WMID_GUID1 "6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3"
#define WMID_GUID2 "95764E09-FB56-4e83-B31A-37761F60994A"
MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 114/247] eCryptfs: Copy up lower inode attrs in getattr
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (52 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 113/247] acer-wmi: Fix capitalisation of GUID Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 115/247] platform: x86: acer-wmi: world-writable sysfs threeg file Paul Gortmaker
` (132 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Tyler Hicks, Paul Gortmaker
From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 55f9cf6bbaa682958a7dd2755f883b768270c3ce upstream.
The lower filesystem may do some type of inode revalidation during a
getattr call. eCryptfs should take advantage of that by copying the
lower inode attributes to the eCryptfs inode after a call to
vfs_getattr() on the lower inode.
I originally wrote this fix while working on eCryptfs on nfsv3 support,
but discovered it also fixed an eCryptfs on ext4 nanosecond timestamp
bug that was reported.
https://bugs.launchpad.net/bugs/613873
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ecryptfs/inode.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 31c8b2f..b39e46f 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -1034,6 +1034,8 @@ int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
ecryptfs_dentry_to_lower(dentry), &lower_stat);
if (!rc) {
+ fsstack_copy_attr_all(dentry->d_inode,
+ ecryptfs_inode_to_lower(dentry->d_inode));
generic_fillattr(dentry->d_inode, stat);
stat->blocks = lower_stat.blocks;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 115/247] platform: x86: acer-wmi: world-writable sysfs threeg file
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (53 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 114/247] eCryptfs: Copy up lower inode attrs in getattr Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 116/247] platform: x86: asus_acpi: world-writable procfs files Paul Gortmaker
` (131 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Matthew Garrett, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b80b168f918bba4b847e884492415546b340e19d upstream.
Don't allow everybody to write to hardware registers.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/acer-wmi.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 9fa2643..7b32e9c 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1066,7 +1066,7 @@ static ssize_t set_bool_threeg(struct device *dev,
return -EINVAL;
return count;
}
-static DEVICE_ATTR(threeg, S_IWUGO | S_IRUGO | S_IWUSR, show_bool_threeg,
+static DEVICE_ATTR(threeg, S_IRUGO | S_IWUSR, show_bool_threeg,
set_bool_threeg);
static ssize_t show_interface(struct device *dev, struct device_attribute *attr,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 116/247] platform: x86: asus_acpi: world-writable procfs files
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (54 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 115/247] platform: x86: acer-wmi: world-writable sysfs threeg file Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 117/247] platform: x86: tc1100-wmi: world-writable sysfs wireless and jogdial files Paul Gortmaker
` (130 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Matthew Garrett, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8040835760adf0ef66876c063d47f79f015fb55d upstream.
Don't allow everybody to change ACPI settings. The comment says that it
is done deliberatelly, however, the comment before disp_proc_write()
says that at least one of these setting is experimental.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/asus_acpi.c | 8 +-------
1 files changed, 1 insertions(+), 7 deletions(-)
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index 92fd30c..9727b8e 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -1079,14 +1079,8 @@ static int asus_hotk_add_fs(struct acpi_device *device)
struct proc_dir_entry *proc;
mode_t mode;
- /*
- * If parameter uid or gid is not changed, keep the default setting for
- * our proc entries (-rw-rw-rw-) else, it means we care about security,
- * and then set to -rw-rw----
- */
-
if ((asus_uid == 0) && (asus_gid == 0)) {
- mode = S_IFREG | S_IRUGO | S_IWUGO;
+ mode = S_IFREG | S_IRUGO | S_IWUSR | S_IWGRP;
} else {
mode = S_IFREG | S_IRUSR | S_IRGRP | S_IWUSR | S_IWGRP;
printk(KERN_WARNING " asus_uid and asus_gid parameters are "
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 117/247] platform: x86: tc1100-wmi: world-writable sysfs wireless and jogdial files
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (55 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 116/247] platform: x86: asus_acpi: world-writable procfs files Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 118/247] genirq: Disable the SHIRQ_DEBUG call in request_threaded_irq for now Paul Gortmaker
` (129 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Matthew Garrett, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8a6a142c1286797978e4db266d22875a5f424897 upstream.
Don't allow everybody to change WMI settings.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/tc1100-wmi.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c
index 1fe0f1f..865ef78 100644
--- a/drivers/platform/x86/tc1100-wmi.c
+++ b/drivers/platform/x86/tc1100-wmi.c
@@ -162,7 +162,7 @@ set_bool_##value(struct device *dev, struct device_attribute *attr, \
return -EINVAL; \
return count; \
} \
-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO | S_IWUSR, \
+static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, \
show_bool_##value, set_bool_##value);
show_set_bool(wireless, TC1100_INSTANCE_WIRELESS);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 118/247] genirq: Disable the SHIRQ_DEBUG call in request_threaded_irq for now
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (56 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 117/247] platform: x86: tc1100-wmi: world-writable sysfs wireless and jogdial files Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 119/247] usb: musb: omap2430: fix kernel panic on reboot Paul Gortmaker
` (128 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Thomas Gleixner, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6d83f94db95cfe65d2a6359cccdf61cf087c2598 upstream.
With CONFIG_SHIRQ_DEBUG=y we call a newly installed interrupt handler
in request_threaded_irq().
The original implementation (commit a304e1b8) called the handler
_BEFORE_ it was installed, but that caused problems with handlers
calling disable_irq_nosync(). See commit 377bf1e4.
It's braindead in the first place to call disable_irq_nosync in shared
handlers, but ....
Moving this call after we installed the handler looks innocent, but it
is very subtle broken on SMP.
Interrupt handlers rely on the fact, that the irq core prevents
reentrancy.
Now this debug call violates that promise because we run the handler
w/o the IRQ_INPROGRESS protection - which we cannot apply here because
that would result in a possibly forever masked interrupt line.
A concurrent real hardware interrupt on a different CPU results in
handler reentrancy and can lead to complete wreckage, which was
unfortunately observed in reality and took a fricking long time to
debug.
Leave the code here for now. We want this debug feature, but that's
not easy to fix. We really should get rid of those
disable_irq_nosync() abusers and remove that function completely.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Anton Vorontsov <avorontsov@ru.mvista.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Arjan van de Ven <arjan@infradead.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/irq/manage.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 26b1b7b..8305828 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1101,7 +1101,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
if (retval)
kfree(action);
-#ifdef CONFIG_DEBUG_SHIRQ
+#ifdef CONFIG_DEBUG_SHIRQ_FIXME
if (!retval && (irqflags & IRQF_SHARED)) {
/*
* It's a shared IRQ -- the driver ought to be prepared for it
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 119/247] usb: musb: omap2430: fix kernel panic on reboot
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (57 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 118/247] genirq: Disable the SHIRQ_DEBUG call in request_threaded_irq for now Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 120/247] USB: add quirks entry for Keytouch QWERTY Panel Paul Gortmaker
` (127 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Johan Hovold, Felipe Balbi, Paul Gortmaker
From: Johan Hovold <jhovold@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b193b412e62b134adf69af286c7e7f8e99259350 upstream.
Cancel idle timer in musb_platform_exit.
The idle timer could trigger after clock had been disabled leading to
kernel panic when MUSB_DEVCTL is accessed in musb_do_idle on 2.6.37.
The fault below is no longer triggered on 2.6.38-rc4 (clock is disabled
later, and only if compiled as a module, and the offending memory access
has moved) but the timer should be cancelled nonetheless.
Rebooting... musb_hdrc musb_hdrc: remove, state 4
usb usb1: USB disconnect, address 1
musb_hdrc musb_hdrc: USB bus 1 deregistered
Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa0ab060
Internal error: : 1028 [#1] PREEMPT
last sysfs file: /sys/kernel/uevent_seqnum
Modules linked in:
CPU: 0 Not tainted (2.6.37+ #6)
PC is at musb_do_idle+0x24/0x138
LR is at musb_do_idle+0x18/0x138
pc : [<c02377d8>] lr : [<c02377cc>] psr: 80000193
sp : cf2bdd80 ip : cf2bdd80 fp : c048a20c
r10: c048a60c r9 : c048a40c r8 : cf85e110
r7 : cf2bc000 r6 : 40000113 r5 : c0489800 r4 : cf85e110
r3 : 00000004 r2 : 00000006 r1 : fa0ab000 r0 : cf8a7000
Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c5387d Table: 8faac019 DAC: 00000015
Process reboot (pid: 769, stack limit = 0xcf2bc2f0)
Stack: (0xcf2bdd80 to 0xcf2be000)
dd80: 00000103 c0489800 c02377b4 c005fa34 00000555 c0071a8c c04a3858 cf2bdda8
dda0: 00000555 c048a00c cf2bdda8 cf2bdda8 1838beb0 00000103 00000004 cf2bc000
ddc0: 00000001 00000001 c04896c8 0000000a 00000000 c005ac14 00000001 c003f32c
dde0: 00000000 00000025 00000000 cf2bc000 00000002 00000001 cf2bc000 00000000
de00: 00000001 c005ad08 cf2bc000 c002e07c c03ec039 ffffffff fa200000 c0033608
de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8
de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8
de60: 60000013 ffffffff c0033c04 00000000 01234567 fee1dead 00000000 c006627c
de80: 00000001 c00662c8 28121969 c00663ec cfa38c40 cf9f6a00 cf2bded0 cf9f6a0c
dea0: 00000000 cf92f000 00008914 c02cd284 c04a55c8 c028b398 c00715c0 becf24a8
dec0: 30687465 00000000 00000000 00000000 00000002 1301a8c0 00000000 00000000
dee0: 00000002 1301a8c0 00000000 00000000 c0450494 cf527920 00011f10 cf2bdf08
df00: 00011f10 cf2bdf10 00011f10 cf2bdf18 c00f0b44 c004f7e8 cf2bdf18 cf2bdf18
df20: 00011f10 cf2bdf30 00011f10 cf2bdf38 cf401300 cf486100 00000008 c00d2b28
df40: 00011f10 cf401300 00200200 c00d3388 00011f10 cfb63a88 cfb63a80 c00c2f08
df60: 00000000 00000000 cfb63a80 00000000 cf0a3480 00000006 c0033c04 cfb63a80
df80: 00000000 c00c0104 00000003 cf0a3480 cfb63a80 00000000 00000001 00000004
dfa0: 00000058 c0033a80 00000000 00000001 fee1dead 28121969 01234567 00000000
dfc0: 00000000 00000001 00000004 00000058 00000001 00000001 00000000 00000001
dfe0: 4024d200 becf2cb0 00009210 4024d218 60000010 fee1dead 00000000 00000000
[<c02377d8>] (musb_do_idle+0x24/0x138) from [<c005fa34>] (run_timer_softirq+0x1a8/0x26)
[<c005fa34>] (run_timer_softirq+0x1a8/0x26c) from [<c005ac14>] (__do_softirq+0x88/0x13)
[<c005ac14>] (__do_softirq+0x88/0x138) from [<c005ad08>] (irq_exit+0x44/0x98)
[<c005ad08>] (irq_exit+0x44/0x98) from [<c002e07c>] (asm_do_IRQ+0x7c/0xa0)
[<c002e07c>] (asm_do_IRQ+0x7c/0xa0) from [<c0033608>] (__irq_svc+0x48/0xa8)
Exception stack(0xcf2bde20 to 0xcf2bde68)
de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8
de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8
de60: 60000013 ffffffff
[<c0033608>] (__irq_svc+0x48/0xa8) from [<c004f7d8>] (sub_preempt_count+0x0/0xb8)
Code: ebf86030 e5940098 e594108c e5902010 (e5d13060)
---[ end trace 3689c0d808f9bf7c ]---
Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/musb/omap2430.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 8259263..f77a21a 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -326,6 +326,7 @@ static int musb_platform_resume(struct musb *musb)
int musb_platform_exit(struct musb *musb)
{
+ del_timer_sync(&musb_idle_timer);
omap_vbus_power(musb, 0 /*off*/, 1);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 120/247] USB: add quirks entry for Keytouch QWERTY Panel
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (58 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 119/247] usb: musb: omap2430: fix kernel panic on reboot Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 121/247] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver Paul Gortmaker
` (126 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alan Stern, Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3c18e30f87ac5466bddbb05cf955605efd7db025 upstream.
This patch (as1448) adds a quirks entry for the Keytouch QWERTY Panel
firmware, used in the IEC 60945 keyboard. This device crashes during
enumeration when the computer asks for its configuration string
descriptor.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: kholis <nur.kholis.majid@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/quirks.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index df5dda7..0ac3810 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -65,6 +65,10 @@ static const struct usb_device_id usb_quirk_list[] = {
/* M-Systems Flash Disk Pioneers */
{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Keytouch QWERTY Panel keyboard */
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 121/247] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (59 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 120/247] USB: add quirks entry for Keytouch QWERTY Panel Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 122/247] USB: Add quirk for Samsung Android phone modem Paul Gortmaker
` (125 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Maciej Szmigiero, Greg Kroah-Hartman,
Paul Gortmaker
From: Maciej Szmigiero <mhej@o2.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit acb52cb1613e1d3c8a8c650717cc51965c60d7d4 upstream.
[USB]Add Samsung SGH-I500/Android modem ID switch to visor driver
Samsung decided to reuse USB ID of its old CDMA phone SGH-I500 for the
modem part of some of their Android phones. At least Galaxy Spica
is affected.
This modem needs ACM driver and does not work with visor driver which
binds the conflicting ID for SGH-I500.
Because SGH-I500 is pretty an old hardware its best to add switch to
visor
driver in cause somebody still wants to use that phone with Linux.
Note that this is needed only when using the Android phone as modem,
not in USB storage or ADB mode.
Signed-off-by: Maciej Szmigiero <mhej@o2.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/visor.c | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index fb7fc40..81fa4f9 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -27,6 +27,7 @@
#include <linux/uaccess.h>
#include <linux/usb.h>
#include <linux/usb/serial.h>
+#include <linux/usb/cdc.h>
#include "visor.h"
/*
@@ -754,6 +755,17 @@ static int visor_probe(struct usb_serial *serial,
dbg("%s", __func__);
+ /*
+ * some Samsung Android phones in modem mode have the same ID
+ * as SPH-I500, but they are ACM devices, so dont bind to them
+ */
+ if (id->idVendor == SAMSUNG_VENDOR_ID &&
+ id->idProduct == SAMSUNG_SPH_I500_ID &&
+ serial->dev->descriptor.bDeviceClass == USB_CLASS_COMM &&
+ serial->dev->descriptor.bDeviceSubClass ==
+ USB_CDC_SUBCLASS_ACM)
+ return -ENODEV;
+
if (serial->dev->actconfig->desc.bConfigurationValue != 1) {
dev_err(&serial->dev->dev, "active config #%d != 1 ??\n",
serial->dev->actconfig->desc.bConfigurationValue);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 122/247] USB: Add quirk for Samsung Android phone modem
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (60 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 121/247] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 123/247] p54pci: update receive dma buffers before and after processing Paul Gortmaker
` (124 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Maciej Szmigiero, Greg Kroah-Hartman,
Paul Gortmaker
From: Maciej Szmigiero <mhej@o2.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 72a012ce0a02c6c616676a24b40ff81d1aaeafda upstream.
My Galaxy Spica needs this quirk when in modem mode, otherwise
it causes endless USB bus resets and is unusable in this mode.
Unfortunately Samsung decided to reuse ID of its old CDMA phone SGH-I500
for the modem part.
That's why in addition to this patch the visor driver must be prevented
from binding to SPH-I500 ID, so ACM driver can do that.
Signed-off-by: Maciej Szmigiero <mhej@o2.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/quirks.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0ac3810..99f2d61 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -45,6 +45,10 @@ static const struct usb_device_id usb_quirk_list[] = {
{ USB_DEVICE(0x04b4, 0x0526), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
+ /* Samsung Android phone modem - ID conflict with SPH-I500 */
+ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
/* Roland SC-8820 */
{ USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 123/247] p54pci: update receive dma buffers before and after processing
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (61 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 122/247] USB: Add quirk for Samsung Android phone modem Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 124/247] sierra: add new ID for Airprime/Sierra USB IP modem Paul Gortmaker
` (123 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Christian Lamparter, John W. Linville,
Paul Gortmaker
From: Christian Lamparter <chunkeey@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0bf719dfdecc5552155cbec78e49fa06e531e35c upstream.
Documentation/DMA-API-HOWTO.txt states:
"DMA transfers need to be synced properly in order for
the cpu and device to see the most uptodate and correct
copy of the DMA buffer."
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/p54/p54pci.c | 14 +++++++++-----
1 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index e1e3972..5735b6b 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -199,6 +199,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
while (i != idx) {
u16 len;
struct sk_buff *skb;
+ dma_addr_t dma_addr;
desc = &ring[i];
len = le16_to_cpu(desc->len);
skb = rx_buf[i];
@@ -216,17 +217,20 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
len = priv->common.rx_mtu;
}
+ dma_addr = le32_to_cpu(desc->host_addr);
+ pci_dma_sync_single_for_cpu(priv->pdev, dma_addr,
+ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
skb_put(skb, len);
if (p54_rx(dev, skb)) {
- pci_unmap_single(priv->pdev,
- le32_to_cpu(desc->host_addr),
- priv->common.rx_mtu + 32,
- PCI_DMA_FROMDEVICE);
+ pci_unmap_single(priv->pdev, dma_addr,
+ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
rx_buf[i] = NULL;
- desc->host_addr = 0;
+ desc->host_addr = cpu_to_le32(0);
} else {
skb_trim(skb, 0);
+ pci_dma_sync_single_for_device(priv->pdev, dma_addr,
+ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 124/247] sierra: add new ID for Airprime/Sierra USB IP modem
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (62 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 123/247] p54pci: update receive dma buffers before and after processing Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 125/247] staging: usbip: vhci: update reference count for usb_device Paul Gortmaker
` (122 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jon Thomas, Greg Kroah-Hartman, Paul Gortmaker
From: Jon Thomas <jthomas@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e1dc5157c574e7249dc1cd072fde2e48b3011533 upstream.
I picked up a new Sierra usb 308 (At&t Shockwave) on 2/2011 and the vendor code
is 0x0f3d
Looking up vendor and product id's I see:
0f3d Airprime, Incorporated
0112 CDMA 1xEVDO PC Card, PC 5220
Sierra and Airprime are somehow related and I'm guessing the At&t usb 308 might
be have some common hardware with the AirPrime SL809x.
Signed-off-by: Jon Thomas <jthomas@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/sierra.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index d47b56e..e3f32a4 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -301,6 +301,9 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
.driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
},
+ { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
{ USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
{ }
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 125/247] staging: usbip: vhci: update reference count for usb_device
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (63 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 124/247] sierra: add new ID for Airprime/Sierra USB IP modem Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 126/247] staging: usbip: vhci: give back URBs from in-flight unlink requests Paul Gortmaker
` (121 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Max Vozeler, Greg Kroah-Hartman, Paul Gortmaker
From: Max Vozeler <max@vozeler.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7606ee8aa33287dd3e6eb44c78541b87a413a325 upstream.
This fixes an oops observed when reading status during
removal of a device:
[ 1706.648285] general protection fault: 0000 [#1] SMP
[ 1706.648294] last sysfs file: /sys/devices/platform/vhci_hcd/status
[ 1706.648297] CPU 1
[ 1706.648300] Modules linked in: binfmt_misc microcode fuse loop vhci_hcd(N) usbip(N) usbcore usbip_common_mod(N) rtc_core rtc_lib joydev dm_mirror dm_region_hash dm_log linear dm_snapshot xennet dm_mod ext3 mbcache jbd processor thermal_sys hwmon xenblk cdrom
[ 1706.648324] Supported: Yes
[ 1706.648327] Pid: 10422, comm: usbip Tainted: G N 2.6.32.12-0.7-xen #1
[ 1706.648330] RIP: e030:[<ffffffff801b10d5>] [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648340] RSP: e02b:ffff8800a994dd30 EFLAGS: 00010286
[ 1706.648343] RAX: ffffffff80481ec1 RBX: 0000000000000000 RCX: 0000000000000002
[ 1706.648347] RDX: 00200d1d4f1c001c RSI: ffffffffffffffff RDI: 00200d1d4f1c001c
[ 1706.648350] RBP: ffff880129a1c0aa R08: ffffffffa01901c4 R09: 0000000000000006
[ 1706.648353] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800a9a1c0ab
[ 1706.648357] R13: 00200d1d4f1c001c R14: 00000000ffffffff R15: ffff880129a1c0aa
[ 1706.648363] FS: 00007f2f2e9ca700(0000) GS:ffff880001018000(0000) knlGS:0000000000000000
[ 1706.648367] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1706.648370] CR2: 000000000071b048 CR3: 00000000b4b68000 CR4: 0000000000002660
[ 1706.648374] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1706.648378] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1706.648381] Process usbip (pid: 10422, threadinfo ffff8800a994c000, task ffff88007b170200)
[ 1706.648385] Stack:
[ 1706.648387] ffffffff801b28c9 0000000000000002 ffffffffa01901c4 ffff8800a9a1c0ab
[ 1706.648391] <0> ffffffffa01901c6 ffff8800a994de08 ffffffff801b339b 0000000000000004
[ 1706.648397] <0> 0000000affffffff ffffffffffffffff 00000000000067c0 0000000000000000
[ 1706.648404] Call Trace:
[ 1706.648413] [<ffffffff801b28c9>] string+0x39/0xe0
[ 1706.648419] [<ffffffff801b339b>] vsnprintf+0x1eb/0x620
[ 1706.648423] [<ffffffff801b3813>] sprintf+0x43/0x50
[ 1706.648429] [<ffffffffa018d719>] show_status+0x1b9/0x220 [vhci_hcd]
[ 1706.648438] [<ffffffff8024a2b7>] dev_attr_show+0x27/0x60
[ 1706.648445] [<ffffffff80144821>] sysfs_read_file+0x101/0x1d0
[ 1706.648451] [<ffffffff800da4a7>] vfs_read+0xc7/0x130
[ 1706.648457] [<ffffffff800da613>] sys_read+0x53/0xa0
[ 1706.648462] [<ffffffff80007458>] system_call_fastpath+0x16/0x1b
[ 1706.648468] [<00007f2f2de40f30>] 0x7f2f2de40f30
[ 1706.648470] Code: 66 0f 1f 44 00 00 48 83 c2 01 80 3a 00 75 f7 48 89 d0 48 29 f8 f3 c3 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 85 f6 74 29 <80> 3f 00 74 24 48 8d 56 ff 48 89 f8 eb 0e 0f 1f 44 00 00 48 83
[ 1706.648507] RIP [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648511] RSP <ffff8800a994dd30>
[ 1706.649575] ---[ end trace b4eb72bf2e149593 ]---
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/usbip/vhci_hcd.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 31317ff..b007205 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -607,7 +607,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
dev_info(dev, "SetAddress Request (%d) to port %d\n",
ctrlreq->wValue, vdev->rhport);
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
spin_lock(&vdev->ud.lock);
vdev->ud.status = VDEV_ST_USED;
@@ -627,8 +629,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
"Get_Descriptor to device 0 "
"(get max pipe size)\n");
- /* FIXME: reference count? (usb_get_dev()) */
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
goto out;
default:
@@ -887,6 +890,10 @@ static void vhci_device_reset(struct usbip_device *ud)
vdev->speed = 0;
vdev->devid = 0;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = NULL;
+
ud->tcp_socket = NULL;
ud->status = VDEV_ST_NULL;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 126/247] staging: usbip: vhci: give back URBs from in-flight unlink requests
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (64 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 125/247] staging: usbip: vhci: update reference count for usb_device Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 127/247] staging: usbip: vhci: refuse to enqueue for dead connections Paul Gortmaker
` (120 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Max Vozeler, Greg Kroah-Hartman, Paul Gortmaker
From: Max Vozeler <max@vozeler.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b92a5e23737172c52656a090977408a80d7f06d1 upstream.
If we never received a RET_UNLINK because the TCP
connection broke the pending URBs still need to be
unlinked and given back.
Previously processes would be stuck trying to kill
the URB even after the device was detached.
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/usbip/vhci.h | 3 +++
drivers/staging/usbip/vhci_hcd.c | 24 +++++++++++++++++++++++-
drivers/staging/usbip/vhci_rx.c | 15 +++++++++------
3 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
index 5e37517..ad3a19d 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/staging/usbip/vhci.h
@@ -119,6 +119,9 @@ void rh_port_disconnect(int rhport);
void vhci_rx_loop(struct usbip_task *ut);
void vhci_tx_loop(struct usbip_task *ut);
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+ __u32 seqnum);
+
#define hardware (&the_controller->pdev.dev)
static inline struct vhci_device *port_to_vdev(__u32 port)
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index b007205..9878e5d 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -808,7 +808,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
return 0;
}
-
static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
{
struct vhci_unlink *unlink, *tmp;
@@ -816,11 +815,34 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
spin_lock(&vdev->priv_lock);
list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
+ usbip_uinfo("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
list_del(&unlink->list);
kfree(unlink);
}
list_for_each_entry_safe(unlink, tmp, &vdev->unlink_rx, list) {
+ struct urb *urb;
+
+ /* give back URB of unanswered unlink request */
+ usbip_uinfo("unlink cleanup rx %lu\n", unlink->unlink_seqnum);
+
+ urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+ if (!urb) {
+ usbip_uinfo("the urb (seqnum %lu) was already given back\n",
+ unlink->unlink_seqnum);
+ list_del(&unlink->list);
+ kfree(unlink);
+ continue;
+ }
+
+ urb->status = -ENODEV;
+
+ spin_lock(&the_controller->lock);
+ usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+ spin_unlock(&the_controller->lock);
+
+ usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
+
list_del(&unlink->list);
kfree(unlink);
}
diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
index 8147d72..bdbedd2 100644
--- a/drivers/staging/usbip/vhci_rx.c
+++ b/drivers/staging/usbip/vhci_rx.c
@@ -23,16 +23,14 @@
#include "vhci.h"
-/* get URB from transmitted urb queue */
-static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+/* get URB from transmitted urb queue. caller must hold vdev->priv_lock */
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
__u32 seqnum)
{
struct vhci_priv *priv, *tmp;
struct urb *urb = NULL;
int status;
- spin_lock(&vdev->priv_lock);
-
list_for_each_entry_safe(priv, tmp, &vdev->priv_rx, list) {
if (priv->seqnum == seqnum) {
urb = priv->urb;
@@ -63,8 +61,6 @@ static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
}
}
- spin_unlock(&vdev->priv_lock);
-
return urb;
}
@@ -74,9 +70,11 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
struct usbip_device *ud = &vdev->ud;
struct urb *urb;
+ spin_lock(&vdev->priv_lock);
urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
+ spin_unlock(&vdev->priv_lock);
if (!urb) {
usbip_uerr("cannot find a urb of seqnum %u\n",
@@ -161,7 +159,12 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
return;
}
+ spin_lock(&vdev->priv_lock);
+
urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+
+ spin_unlock(&vdev->priv_lock);
+
if (!urb) {
/*
* I get the result of a unlink request. But, it seems that I
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 127/247] staging: usbip: vhci: refuse to enqueue for dead connections
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (65 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 126/247] staging: usbip: vhci: give back URBs from in-flight unlink requests Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 128/247] staging: usbip: vhci: use urb->dev->portnum to find port Paul Gortmaker
` (119 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Max Vozeler, Greg Kroah-Hartman, Paul Gortmaker
From: Max Vozeler <max@vozeler.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6d212153a838354078cc7d96f9bb23b7d1fd3d1b upstream.
There can be requests to enqueue URBs while we are shutting
down a connection.
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/usbip/vhci_hcd.c | 15 +++++++++++++--
1 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 9878e5d..006d5f7 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -559,6 +559,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
struct device *dev = &urb->dev->dev;
int ret = 0;
unsigned long flags;
+ struct vhci_device *vdev;
usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
hcd, urb, mem_flags);
@@ -574,6 +575,18 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
return urb->status;
}
+ vdev = port_to_vdev(the_controller->pending_port);
+
+ /* refuse enqueue for dead connection */
+ spin_lock(&vdev->ud.lock);
+ if (vdev->ud.status == VDEV_ST_NULL || vdev->ud.status == VDEV_ST_ERROR) {
+ usbip_uerr("enqueue for inactive port %d\n", vdev->rhport);
+ spin_unlock(&vdev->ud.lock);
+ spin_unlock_irqrestore(&the_controller->lock, flags);
+ return -ENODEV;
+ }
+ spin_unlock(&vdev->ud.lock);
+
ret = usb_hcd_link_urb_to_ep(hcd, urb);
if (ret)
goto no_need_unlink;
@@ -592,8 +605,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
__u8 type = usb_pipetype(urb->pipe);
struct usb_ctrlrequest *ctrlreq =
(struct usb_ctrlrequest *) urb->setup_packet;
- struct vhci_device *vdev =
- port_to_vdev(the_controller->pending_port);
if (type != PIPE_CONTROL || !ctrlreq) {
dev_err(dev, "invalid request to devnum 0\n");
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 128/247] staging: usbip: vhci: use urb->dev->portnum to find port
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (66 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 127/247] staging: usbip: vhci: refuse to enqueue for dead connections Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 129/247] epoll: prevent creating circular epoll structures Paul Gortmaker
` (118 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Max Vozeler, Greg Kroah-Hartman, Paul Gortmaker
From: Max Vozeler <max@vozeler.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 01446ef5af4e8802369bf4d257806e24345a9371 upstream.
The access to pending_port was racy when two devices
were being attached at the same time.
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/usbip/vhci.h | 3 ---
drivers/staging/usbip/vhci_hcd.c | 4 +---
2 files changed, 1 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
index ad3a19d..57f7946 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/staging/usbip/vhci.h
@@ -100,9 +100,6 @@ struct vhci_hcd {
* But, the index of this array begins from 0.
*/
struct vhci_device vdev[VHCI_NPORTS];
-
- /* vhci_device which has not been assiged its address yet */
- int pending_port;
};
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 006d5f7..fd4cc48 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -138,8 +138,6 @@ void rh_port_connect(int rhport, enum usb_device_speed speed)
* the_controller->vdev[rhport].ud.status = VDEV_CONNECT;
* spin_unlock(&the_controller->vdev[rhport].ud.lock); */
- the_controller->pending_port = rhport;
-
spin_unlock_irqrestore(&the_controller->lock, flags);
usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
@@ -575,7 +573,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
return urb->status;
}
- vdev = port_to_vdev(the_controller->pending_port);
+ vdev = port_to_vdev(urb->dev->portnum-1);
/* refuse enqueue for dead connection */
spin_lock(&vdev->ud.lock);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 129/247] epoll: prevent creating circular epoll structures
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (67 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 128/247] staging: usbip: vhci: use urb->dev->portnum to find port Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 130/247] ldm: corrupted partition table can cause kernel oops Paul Gortmaker
` (117 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Davide Libenzi, Nelson Elhage, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Davide Libenzi <davidel@xmailserver.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e upstream.
In several places, an epoll fd can call another file's ->f_op->poll()
method with ep->mtx held. This is in general unsafe, because that other
file could itself be an epoll fd that contains the original epoll fd.
The code defends against this possibility in its own ->poll() method using
ep_call_nested, but there are several other unsafe calls to ->poll
elsewhere that can be made to deadlock. For example, the following simple
program causes the call in ep_insert recursively call the original fd's
->poll, leading to deadlock:
#include <unistd.h>
#include <sys/epoll.h>
int main(void) {
int e1, e2, p[2];
struct epoll_event evt = {
.events = EPOLLIN
};
e1 = epoll_create(1);
e2 = epoll_create(2);
pipe(p);
epoll_ctl(e2, EPOLL_CTL_ADD, e1, &evt);
epoll_ctl(e1, EPOLL_CTL_ADD, p[0], &evt);
write(p[1], p, sizeof p);
epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);
return 0;
}
On insertion, check whether the inserted file is itself a struct epoll,
and if so, do a recursive walk to detect whether inserting this file would
create a loop of epoll structures, which could lead to deadlock.
[nelhage@ksplice.com: Use epmutex to serialize concurrent inserts]
Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Reported-by: Nelson Elhage <nelhage@ksplice.com>
Tested-by: Nelson Elhage <nelhage@ksplice.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/eventpoll.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 95 insertions(+), 0 deletions(-)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index bd056a5..a8dfe21 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -63,6 +63,13 @@
* cleanup path and it is also acquired by eventpoll_release_file()
* if a file has been pushed inside an epoll set and it is then
* close()d without a previous call toepoll_ctl(EPOLL_CTL_DEL).
+ * It is also acquired when inserting an epoll fd onto another epoll
+ * fd. We do this so that we walk the epoll tree and ensure that this
+ * insertion does not create a cycle of epoll file descriptors, which
+ * could lead to deadlock. We need a global mutex to prevent two
+ * simultaneous inserts (A into B and B into A) from racing and
+ * constructing a cycle without either insert observing that it is
+ * going to.
* It is possible to drop the "ep->mtx" and to use the global
* mutex "epmutex" (together with "ep->lock") to have it working,
* but having "ep->mtx" will make the interface more scalable.
@@ -227,6 +234,9 @@ static int max_user_watches __read_mostly;
*/
static DEFINE_MUTEX(epmutex);
+/* Used to check for epoll file descriptor inclusion loops */
+static struct nested_calls poll_loop_ncalls;
+
/* Used for safe wake up implementation */
static struct nested_calls poll_safewake_ncalls;
@@ -1182,6 +1192,62 @@ retry:
return res;
}
+/**
+ * ep_loop_check_proc - Callback function to be passed to the @ep_call_nested()
+ * API, to verify that adding an epoll file inside another
+ * epoll structure, does not violate the constraints, in
+ * terms of closed loops, or too deep chains (which can
+ * result in excessive stack usage).
+ *
+ * @priv: Pointer to the epoll file to be currently checked.
+ * @cookie: Original cookie for this call. This is the top-of-the-chain epoll
+ * data structure pointer.
+ * @call_nests: Current dept of the @ep_call_nested() call stack.
+ *
+ * Returns: Returns zero if adding the epoll @file inside current epoll
+ * structure @ep does not violate the constraints, or -1 otherwise.
+ */
+static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+{
+ int error = 0;
+ struct file *file = priv;
+ struct eventpoll *ep = file->private_data;
+ struct rb_node *rbp;
+ struct epitem *epi;
+
+ mutex_lock(&ep->mtx);
+ for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ epi = rb_entry(rbp, struct epitem, rbn);
+ if (unlikely(is_file_epoll(epi->ffd.file))) {
+ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ ep_loop_check_proc, epi->ffd.file,
+ epi->ffd.file->private_data, current);
+ if (error != 0)
+ break;
+ }
+ }
+ mutex_unlock(&ep->mtx);
+
+ return error;
+}
+
+/**
+ * ep_loop_check - Performs a check to verify that adding an epoll file (@file)
+ * another epoll file (represented by @ep) does not create
+ * closed loops or too deep chains.
+ *
+ * @ep: Pointer to the epoll private data structure.
+ * @file: Pointer to the epoll file to be checked.
+ *
+ * Returns: Returns zero if adding the epoll @file inside current epoll
+ * structure @ep does not violate the constraints, or -1 otherwise.
+ */
+static int ep_loop_check(struct eventpoll *ep, struct file *file)
+{
+ return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ ep_loop_check_proc, file, ep, current);
+}
+
/*
* Open an eventpoll file descriptor.
*/
@@ -1230,6 +1296,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
struct epoll_event __user *, event)
{
int error;
+ int did_lock_epmutex = 0;
struct file *file, *tfile;
struct eventpoll *ep;
struct epitem *epi;
@@ -1271,6 +1338,25 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
*/
ep = file->private_data;
+ /*
+ * When we insert an epoll file descriptor, inside another epoll file
+ * descriptor, there is the change of creating closed loops, which are
+ * better be handled here, than in more critical paths.
+ *
+ * We hold epmutex across the loop check and the insert in this case, in
+ * order to prevent two separate inserts from racing and each doing the
+ * insert "at the same time" such that ep_loop_check passes on both
+ * before either one does the insert, thereby creating a cycle.
+ */
+ if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
+ mutex_lock(&epmutex);
+ did_lock_epmutex = 1;
+ error = -ELOOP;
+ if (ep_loop_check(ep, tfile) != 0)
+ goto error_tgt_fput;
+ }
+
+
mutex_lock(&ep->mtx);
/*
@@ -1306,6 +1392,9 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
mutex_unlock(&ep->mtx);
error_tgt_fput:
+ if (unlikely(did_lock_epmutex))
+ mutex_unlock(&epmutex);
+
fput(tfile);
error_fput:
fput(file);
@@ -1424,6 +1513,12 @@ static int __init eventpoll_init(void)
max_user_watches = (((si.totalram - si.totalhigh) / 25) << PAGE_SHIFT) /
EP_ITEM_COST;
+ /*
+ * Initialize the structure used to perform epoll file descriptor
+ * inclusion loops checks.
+ */
+ ep_nested_calls_init(&poll_loop_ncalls);
+
/* Initialize the structure used to perform safe poll wait head wake ups */
ep_nested_calls_init(&poll_safewake_ncalls);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 130/247] ldm: corrupted partition table can cause kernel oops
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (68 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 129/247] epoll: prevent creating circular epoll structures Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 131/247] md: correctly handle probe of an 'mdp' device Paul Gortmaker
` (116 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 294f6cf48666825d23c9372ef37631232746e40d upstream.
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
a bug that causes a kernel oops on certain corrupted LDM partitions. A
kernel subsystem seems to crash, because, after the oops, the kernel no
longer recognizes newly connected storage devices.
The patch changes ldm_parse_vmdb() to Validate the value of vblk_size.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: Eugene Teo <eugeneteo@kernel.sg>
Acked-by: Richard Russon <ldm@flatcap.org>
Cc: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/ldm.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index 8652fb9..2cd9e43 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -251,6 +251,11 @@ static bool ldm_parse_vmdb (const u8 *data, struct vmdb *vm)
}
vm->vblk_size = get_unaligned_be32(data + 0x08);
+ if (vm->vblk_size == 0) {
+ ldm_error ("Illegal VBLK size");
+ return false;
+ }
+
vm->vblk_offset = get_unaligned_be32(data + 0x0C);
vm->last_vblk_seq = get_unaligned_be32(data + 0x04);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 131/247] md: correctly handle probe of an 'mdp' device.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (69 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 130/247] ldm: corrupted partition table can cause kernel oops Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 132/247] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems Paul Gortmaker
` (115 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, NeilBrown, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8f5f02c460b7ca74ce55ce126ce0c1e58a3f923d upstream.
'mdp' devices are md devices with preallocated device numbers
for partitions. As such it is possible to mknod and open a partition
before opening the whole device.
this causes md_probe() to be called with a device number of a
partition, which in-turn calls mddev_find with such a number.
However mddev_find expects the number of a 'whole device' and
does the wrong thing with partition numbers.
So add code to mddev_find to remove the 'partition' part of
a device number and just work with the 'whole device'.
This patch addresses https://bugzilla.kernel.org/show_bug.cgi?id=28652
Reported-by: hkmaly@bigfoot.com
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/md.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7db9ceb..f468ec6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -410,6 +410,9 @@ static mddev_t * mddev_find(dev_t unit)
{
mddev_t *mddev, *new = NULL;
+ if (unit && MAJOR(unit) != MD_MAJOR)
+ unit &= ~((1<<MdpMinorShift)-1);
+
retry:
spin_lock(&all_mddevs_lock);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 132/247] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (70 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 131/247] md: correctly handle probe of an 'mdp' device Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 133/247] xhci: Avoid BUG() in interrupt context Paul Gortmaker
` (114 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Andreas Herrmann, Ingo Molnar, Paul Gortmaker
From: Andreas Herrmann <andreas.herrmann3@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7f74f8f28a2bd9db9404f7d364e2097a0c42cc12 upstream.
On some SB800 systems polarity for IOAPIC pin2 is wrongly
specified as low active by BIOS. This caused system hangs after
resume from S3 when HPET was used in one-shot mode on such
systems because a timer interrupt was missed (HPET signal is
high active).
For more details see:
http://marc.info/?l=linux-kernel&m=129623757413868
Tested-by: Manoj Iyer <manoj.iyer@canonical.com>
Tested-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Cc: Borislav Petkov <borislav.petkov@amd.com>
LKML-Reference: <20110224145346.GD3658@alberich.amd.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/acpi.h | 1 +
arch/x86/kernel/acpi/boot.c | 14 ++++++++++----
arch/x86/kernel/early-quirks.c | 16 +++++++---------
3 files changed, 18 insertions(+), 13 deletions(-)
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 56f462c..60a8959 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -89,6 +89,7 @@ extern int acpi_ht;
extern int acpi_pci_disabled;
extern int acpi_skip_timer_override;
extern int acpi_use_timer_override;
+extern int acpi_fix_pin2_polarity;
extern u8 acpi_sci_flags;
extern int acpi_sci_override_gsi;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index cd40aba..37311ba 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -73,6 +73,7 @@ u8 acpi_sci_flags __initdata;
int acpi_sci_override_gsi __initdata;
int acpi_skip_timer_override __initdata;
int acpi_use_timer_override __initdata;
+int acpi_fix_pin2_polarity __initdata;
#ifdef CONFIG_X86_LOCAL_APIC
static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
@@ -363,10 +364,15 @@ acpi_parse_int_src_ovr(struct acpi_subtable_header * header,
return 0;
}
- if (acpi_skip_timer_override &&
- intsrc->source_irq == 0 && intsrc->global_irq == 2) {
- printk(PREFIX "BIOS IRQ0 pin2 override ignored.\n");
- return 0;
+ if (intsrc->source_irq == 0 && intsrc->global_irq == 2) {
+ if (acpi_skip_timer_override) {
+ printk(PREFIX "BIOS IRQ0 pin2 override ignored.\n");
+ return 0;
+ }
+ if (acpi_fix_pin2_polarity && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
+ intsrc->inti_flags &= ~ACPI_MADT_POLARITY_MASK;
+ printk(PREFIX "BIOS IRQ0 pin2 override: forcing polarity to high active.\n");
+ }
}
mp_override_legacy_irq(intsrc->source_irq,
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index ebdb85c..ef01d3d 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -145,15 +145,10 @@ static void __init ati_bugs(int num, int slot, int func)
static u32 __init ati_sbx00_rev(int num, int slot, int func)
{
- u32 old, d;
+ u32 d;
- d = read_pci_config(num, slot, func, 0x70);
- old = d;
- d &= ~(1<<8);
- write_pci_config(num, slot, func, 0x70, d);
d = read_pci_config(num, slot, func, 0x8);
d &= 0xff;
- write_pci_config(num, slot, func, 0x70, old);
return d;
}
@@ -162,13 +157,16 @@ static void __init ati_bugs_contd(int num, int slot, int func)
{
u32 d, rev;
- if (acpi_use_timer_override)
- return;
-
rev = ati_sbx00_rev(num, slot, func);
+ if (rev >= 0x40)
+ acpi_fix_pin2_polarity = 1;
+
if (rev > 0x13)
return;
+ if (acpi_use_timer_override)
+ return;
+
/* check for IRQ0 interrupt swap */
d = read_pci_config(num, slot, func, 0x64);
if (!(d & (1<<14)))
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 133/247] xhci: Avoid BUG() in interrupt context
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (71 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 132/247] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 134/247] xhci: Clarify some expressions in the TRB math Paul Gortmaker
` (113 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Zimmerman, Paul Zimmerman, Sarah Sharp,
Paul Gortmaker
From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 68e41c5d032668e2905404afbef75bc58be179d6 upstream.
Change the BUGs in xhci_find_new_dequeue_state() to WARN_ONs, to avoid
bringing down the box if one of them is hit
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-ring.c | 13 +++++++++----
1 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 632a7b6..6ead609 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -392,8 +392,11 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
state->new_deq_seg = find_trb_seg(cur_td->start_seg,
dev->eps[ep_index].stopped_trb,
&state->new_cycle_state);
- if (!state->new_deq_seg)
- BUG();
+ if (!state->new_deq_seg) {
+ WARN_ON(1);
+ return;
+ }
+
/* Dig out the cycle state saved by the xHC during the stop ep cmd */
xhci_dbg(xhci, "Finding endpoint context\n");
ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
@@ -404,8 +407,10 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
state->new_deq_seg = find_trb_seg(state->new_deq_seg,
state->new_deq_ptr,
&state->new_cycle_state);
- if (!state->new_deq_seg)
- BUG();
+ if (!state->new_deq_seg) {
+ WARN_ON(1);
+ return;
+ }
trb = &state->new_deq_ptr->generic;
if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) &&
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 134/247] xhci: Clarify some expressions in the TRB math
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (72 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 133/247] xhci: Avoid BUG() in interrupt context Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 135/247] xhci: Fix errors in the running total calculations " Paul Gortmaker
` (112 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Zimmerman, Paul Zimmerman, Sarah Sharp,
Paul Gortmaker
From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a2490187011cc2263117626615a581927d19f1d3 upstream.
This makes it easier to spot some problems, which will be fixed by the
next patch in the series. Also change dev_dbg to dev_err in
check_trb_math(), so any math errors will be visible even when running
with debug disabled.
Note: This patch changes the expressions containing
"((1 << TRB_MAX_BUFF_SHIFT) - 1)" to use the equivalent
"(TRB_MAX_BUFF_SIZE - 1)". No change in behavior is intended for
those expressions.
This patch should be queued for stable kernels back to 2.6.31.
[PG: 34 doesn't have count_isoc_trbs_needed() hence this has
one less instance to change vs. the originating release]
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-ring.c | 19 +++++++++----------
1 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6ead609..8bf5563 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1710,7 +1710,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
/* Scatter gather list entries may cross 64KB boundaries */
running_total = TRB_MAX_BUFF_SIZE -
- (sg_dma_address(sg) & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+ (sg_dma_address(sg) & (TRB_MAX_BUFF_SIZE - 1));
if (running_total != 0)
num_trbs++;
@@ -1740,11 +1740,11 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
static void check_trb_math(struct urb *urb, int num_trbs, int running_total)
{
if (num_trbs != 0)
- dev_dbg(&urb->dev->dev, "%s - ep %#x - Miscalculated number of "
+ dev_err(&urb->dev->dev, "%s - ep %#x - Miscalculated number of "
"TRBs, %d left\n", __func__,
urb->ep->desc.bEndpointAddress, num_trbs);
if (running_total != urb->transfer_buffer_length)
- dev_dbg(&urb->dev->dev, "%s - ep %#x - Miscalculated tx length, "
+ dev_err(&urb->dev->dev, "%s - ep %#x - Miscalculated tx length, "
"queued %#x (%d), asked for %#x (%d)\n",
__func__,
urb->ep->desc.bEndpointAddress,
@@ -1866,8 +1866,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
sg = urb->sg->sg;
addr = (u64) sg_dma_address(sg);
this_sg_len = sg_dma_len(sg);
- trb_buff_len = TRB_MAX_BUFF_SIZE -
- (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+ trb_buff_len = TRB_MAX_BUFF_SIZE - (addr & (TRB_MAX_BUFF_SIZE - 1));
trb_buff_len = min_t(int, trb_buff_len, this_sg_len);
if (trb_buff_len > urb->transfer_buffer_length)
trb_buff_len = urb->transfer_buffer_length;
@@ -1903,7 +1902,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
(unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
(unsigned int) addr + trb_buff_len);
if (TRB_MAX_BUFF_SIZE -
- (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1)) < trb_buff_len) {
+ (addr & (TRB_MAX_BUFF_SIZE - 1)) < trb_buff_len) {
xhci_warn(xhci, "WARN: sg dma xfer crosses 64KB boundaries!\n");
xhci_dbg(xhci, "Next boundary at %#x, end dma = %#x\n",
(unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
@@ -1943,7 +1942,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
}
trb_buff_len = TRB_MAX_BUFF_SIZE -
- (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+ (addr & (TRB_MAX_BUFF_SIZE - 1));
trb_buff_len = min_t(int, trb_buff_len, this_sg_len);
if (running_total + trb_buff_len > urb->transfer_buffer_length)
trb_buff_len =
@@ -1978,7 +1977,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
num_trbs = 0;
/* How much data is (potentially) left before the 64KB boundary? */
running_total = TRB_MAX_BUFF_SIZE -
- (urb->transfer_dma & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+ (urb->transfer_dma & (TRB_MAX_BUFF_SIZE - 1));
/* If there's some data on this 64KB chunk, or we have to send a
* zero-length transfer, we need at least one TRB
@@ -2017,8 +2016,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
/* How much data is in the first TRB? */
addr = (u64) urb->transfer_dma;
trb_buff_len = TRB_MAX_BUFF_SIZE -
- (urb->transfer_dma & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
- if (urb->transfer_buffer_length < trb_buff_len)
+ (urb->transfer_dma & (TRB_MAX_BUFF_SIZE - 1));
+ if (trb_buff_len > urb->transfer_buffer_length)
trb_buff_len = urb->transfer_buffer_length;
first_trb = true;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 135/247] xhci: Fix errors in the running total calculations in the TRB math
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (73 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 134/247] xhci: Clarify some expressions in the TRB math Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 136/247] xhci: Fix an error in count_sg_trbs_needed() Paul Gortmaker
` (111 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Zimmerman, Paul Zimmerman, Sarah Sharp,
Paul Gortmaker
From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5807795bd4dececdf553719cc02869e633395787 upstream.
Calculations like
running_total = TRB_MAX_BUFF_SIZE -
(sg_dma_address(sg) & (TRB_MAX_BUFF_SIZE - 1));
if (running_total != 0)
num_trbs++;
are incorrect, because running_total can never be zero, so the if()
expression will never be true. I think the intention was that
running_total be in the range of 0 to TRB_MAX_BUFF_SIZE-1, not 1
to TRB_MAX_BUFF_SIZE. So adding a
running_total &= TRB_MAX_BUFF_SIZE - 1;
fixes the problem.
This patch should be queued for stable kernels back to 2.6.31.
[PG: 34 doesn't have count_isoc_trbs_needed() hence this has
only two of the three upstream running_total changes.]
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-ring.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 8bf5563..e4afa99 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1711,6 +1711,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
/* Scatter gather list entries may cross 64KB boundaries */
running_total = TRB_MAX_BUFF_SIZE -
(sg_dma_address(sg) & (TRB_MAX_BUFF_SIZE - 1));
+ running_total &= TRB_MAX_BUFF_SIZE - 1;
if (running_total != 0)
num_trbs++;
@@ -1978,6 +1979,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
/* How much data is (potentially) left before the 64KB boundary? */
running_total = TRB_MAX_BUFF_SIZE -
(urb->transfer_dma & (TRB_MAX_BUFF_SIZE - 1));
+ running_total &= TRB_MAX_BUFF_SIZE - 1;
/* If there's some data on this 64KB chunk, or we have to send a
* zero-length transfer, we need at least one TRB
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 136/247] xhci: Fix an error in count_sg_trbs_needed()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (74 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 135/247] xhci: Fix errors in the running total calculations " Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 137/247] Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number Paul Gortmaker
` (110 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Zimmerman, Paul Zimmerman, Sarah Sharp,
Paul Gortmaker
From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bcd2fde05341cef0052e49566ec88b406a521cf3 upstream.
The expression
while (running_total < sg_dma_len(sg))
does not take into account that the remaining data length can be less
than sg_dma_len(sg). In that case, running_total can end up being
greater than the total data length, so an extra TRB is counted.
Changing the expression to
while (running_total < sg_dma_len(sg) && running_total < temp)
fixes that.
This patch should be queued for stable kernels back to 2.6.31.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-ring.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index e4afa99..34ce5d4 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1716,7 +1716,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
num_trbs++;
/* How many more 64KB chunks to transfer, how many more TRBs? */
- while (running_total < sg_dma_len(sg)) {
+ while (running_total < sg_dma_len(sg) && running_total < temp) {
num_trbs++;
running_total += TRB_MAX_BUFF_SIZE;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 137/247] Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (75 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 136/247] xhci: Fix an error in count_sg_trbs_needed() Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 138/247] mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo Paul Gortmaker
` (109 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tristan Ye, Joel Becker, Paul Gortmaker
From: Tristan Ye <tristan.ye@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit acf3bb007e5636ef4c17505affb0974175108553 upstream.
Current refcounttree codes actually didn't writeback the new pages out in
write-back mode, due to a bug of always passing a ZERO number of clusters
to 'ocfs2_cow_sync_writeback', the patch tries to pass a proper one in.
Signed-off-by: Tristan Ye <tristan.ye@oracle.com>
Signed-off-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ocfs2/refcounttree.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 9e6dc1d..fe8d576 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3223,7 +3223,7 @@ static int ocfs2_make_clusters_writable(struct super_block *sb,
u32 num_clusters, unsigned int e_flags)
{
int ret, delete, index, credits = 0;
- u32 new_bit, new_len;
+ u32 new_bit, new_len, orig_num_clusters;
unsigned int set_len;
struct ocfs2_super *osb = OCFS2_SB(sb);
handle_t *handle;
@@ -3256,6 +3256,8 @@ static int ocfs2_make_clusters_writable(struct super_block *sb,
goto out;
}
+ orig_num_clusters = num_clusters;
+
while (num_clusters) {
ret = ocfs2_get_refcount_rec(ref_ci, context->ref_root_bh,
p_cluster, num_clusters,
@@ -3343,7 +3345,8 @@ static int ocfs2_make_clusters_writable(struct super_block *sb,
* in write-back mode.
*/
if (context->get_clusters == ocfs2_di_get_clusters) {
- ret = ocfs2_cow_sync_writeback(sb, context, cpos, num_clusters);
+ ret = ocfs2_cow_sync_writeback(sb, context, cpos,
+ orig_num_clusters);
if (ret)
mlog_errno(ret);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 138/247] mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (76 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 137/247] Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 139/247] x86: Use u32 instead of long to set reset vector back to 0 Paul Gortmaker
` (108 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jochen Friedrich, Samuel Ortiz, Paul Gortmaker
From: Jochen Friedrich <jochen@scram.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9063f1f15eec35e5fd608879cef8be5728f2d12a upstream.
Call input_set_abs_params instead of manually setting absbit only.
This fixes this oops:
Unable to handle kernel NULL pointer dereference at virtual address 00000024
Internal error: Oops: 41b67017 [#1]
CPU: 0 Not tainted (2.6.37 #4)
pc : [<c016d1fc>] lr : [<00000000>] psr: 20000093
sp : c19e5f30 ip : c19e5e6c fp : c19e5f58
r10: 00000000 r9 : c19e4000 r8 : 00000003
r7 : 000001e4 r6 : 00000001 r5 : c1854400 r4 : 00000003
r3 : 00000018 r2 : 00000018 r1 : 00000018 r0 : c185447c
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: c1b6717f Table: c1b6717f DAC: 00000017
Stack: (0xc19e5f30 to 0xc19e6000)
5f20: 00000003 00000003 c1854400 00000013
5f40: 00000001 000001e4 000001c5 c19e5f80 c19e5f5c c016d5e8 c016cf5c 000001e4
5f60: c1854400 c18b5860 00000000 00000171 000001e4 c19e5fc4 c19e5f84 c01559a4
5f80: c016d584 c18b5868 00000000 c1bb5c40 c0035afc c18b5868 c18b5868 c1a55d54
5fa0: c18b5860 c0155750 00000013 00000000 00000000 00000000 c19e5ff4 c19e5fc8
5fc0: c0050174 c015575c 00000000 c18b5860 00000000 c19e5fd4 c19e5fd4 c1a55d54
5fe0: c00500f0 c003b464 00000000 c19e5ff8 c003b464 c00500fc 04000400 04000400
Backtrace:
Function entered at [<c016cf50>] from [<c016d5e8>]
Function entered at [<c016d578>] from [<c01559a4>]
r8:000001e4 r7:00000171 r6:00000000 r5:c18b5860 r4:c1854400
Function entered at [<c0155750>] from [<c0050174>]
Function entered at [<c00500f0>] from [<c003b464>]
r6:c003b464 r5:c00500f0 r4:c1a55d54
Code: e59520fc e1a03286 e0433186 e0822003 (e592000c)
>>PC; c016d1fc <input_handle_event+2ac/5a0> <=====
Trace; c016cf50 <input_handle_event+0/5a0>
Trace; c016d5e8 <input_event+70/88>
Trace; c016d578 <input_event+0/88>
Trace; c01559a4 <ucb1x00_thread+254/2dc>
Trace; c0155750 <ucb1x00_thread+0/2dc>
Trace; c0050174 <kthread+84/8c>
Trace; c00500f0 <kthread+0/8c>
Trace; c003b464 <do_exit+0/624>
Signed-off-by: Jochen Friedrich <jochen@scram.de>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mfd/ucb1x00-ts.c | 12 +++++++++---
1 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/mfd/ucb1x00-ts.c b/drivers/mfd/ucb1x00-ts.c
index 000cb41..92b85e2 100644
--- a/drivers/mfd/ucb1x00-ts.c
+++ b/drivers/mfd/ucb1x00-ts.c
@@ -385,12 +385,18 @@ static int ucb1x00_ts_add(struct ucb1x00_dev *dev)
idev->close = ucb1x00_ts_close;
__set_bit(EV_ABS, idev->evbit);
- __set_bit(ABS_X, idev->absbit);
- __set_bit(ABS_Y, idev->absbit);
- __set_bit(ABS_PRESSURE, idev->absbit);
input_set_drvdata(idev, ts);
+ ucb1x00_adc_enable(ts->ucb);
+ ts->x_res = ucb1x00_ts_read_xres(ts);
+ ts->y_res = ucb1x00_ts_read_yres(ts);
+ ucb1x00_adc_disable(ts->ucb);
+
+ input_set_abs_params(idev, ABS_X, 0, ts->x_res, 0, 0);
+ input_set_abs_params(idev, ABS_Y, 0, ts->y_res, 0, 0);
+ input_set_abs_params(idev, ABS_PRESSURE, 0, 0, 0, 0);
+
err = input_register_device(idev);
if (err)
goto fail;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 139/247] x86: Use u32 instead of long to set reset vector back to 0
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (77 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 138/247] mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 140/247] fuse: fix hang of single threaded fuseblk filesystem Paul Gortmaker
` (107 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Don Zickus, Ingo Molnar, Paul Gortmaker
From: Don Zickus <dzickus@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 299c56966a72b9109d47c71a6db52097098703dd upstream.
A customer of ours, complained that when setting the reset
vector back to 0, it trashed other data and hung their box.
They noticed when only 4 bytes were set to 0 instead of 8,
everything worked correctly.
Mathew pointed out:
|
| We're supposed to be resetting trampoline_phys_low and
| trampoline_phys_high here, which are two 16-bit values.
| Writing 64 bits is definitely going to overwrite space
| that we're not supposed to be touching.
|
So limit the area modified to u32.
Signed-off-by: Don Zickus <dzickus@redhat.com>
Acked-by: Matthew Garrett <mjg@redhat.com>
LKML-Reference: <1297139100-424-1-git-send-email-dzickus@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/smpboot_hooks.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/x86/include/asm/smpboot_hooks.h b/arch/x86/include/asm/smpboot_hooks.h
index 1def601..cfdc6c8 100644
--- a/arch/x86/include/asm/smpboot_hooks.h
+++ b/arch/x86/include/asm/smpboot_hooks.h
@@ -34,7 +34,7 @@ static inline void smpboot_restore_warm_reset_vector(void)
*/
CMOS_WRITE(0, 0xf);
- *((volatile long *)phys_to_virt(apic->trampoline_phys_low)) = 0;
+ *((volatile u32 *)phys_to_virt(apic->trampoline_phys_low)) = 0;
}
static inline void __init smpboot_setup_io_apic(void)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 140/247] fuse: fix hang of single threaded fuseblk filesystem
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (78 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 139/247] x86: Use u32 instead of long to set reset vector back to 0 Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 141/247] clockevents: Prevent oneshot mode when broadcast device is periodic Paul Gortmaker
` (106 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Miklos Szeredi, Paul Gortmaker
From: Miklos Szeredi <mszeredi@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5a18ec176c934ca1bc9dc61580a5e0e90a9b5733 upstream.
Single threaded NTFS-3G could get stuck if a delayed RELEASE reply
triggered a DESTROY request via path_put().
Fix this by
a) making RELEASE requests synchronous, whenever possible, on fuseblk
filesystems
b) if not possible (triggered by an asynchronous read/write) then do
the path_put() in a separate thread with schedule_work().
Reported-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/fuse/file.c | 52 +++++++++++++++++++++++++++++++++++++++++++++-------
fs/fuse/fuse_i.h | 6 +++++-
2 files changed, 50 insertions(+), 8 deletions(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index edfce0b..f6104a95 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -86,18 +86,52 @@ struct fuse_file *fuse_file_get(struct fuse_file *ff)
return ff;
}
+static void fuse_release_async(struct work_struct *work)
+{
+ struct fuse_req *req;
+ struct fuse_conn *fc;
+ struct path path;
+
+ req = container_of(work, struct fuse_req, misc.release.work);
+ path = req->misc.release.path;
+ fc = get_fuse_conn(path.dentry->d_inode);
+
+ fuse_put_request(fc, req);
+ path_put(&path);
+}
+
static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
{
- path_put(&req->misc.release.path);
+ if (fc->destroy_req) {
+ /*
+ * If this is a fuseblk mount, then it's possible that
+ * releasing the path will result in releasing the
+ * super block and sending the DESTROY request. If
+ * the server is single threaded, this would hang.
+ * For this reason do the path_put() in a separate
+ * thread.
+ */
+ atomic_inc(&req->count);
+ INIT_WORK(&req->misc.release.work, fuse_release_async);
+ schedule_work(&req->misc.release.work);
+ } else {
+ path_put(&req->misc.release.path);
+ }
}
-static void fuse_file_put(struct fuse_file *ff)
+static void fuse_file_put(struct fuse_file *ff, bool sync)
{
if (atomic_dec_and_test(&ff->count)) {
struct fuse_req *req = ff->reserved_req;
- req->end = fuse_release_end;
- fuse_request_send_background(ff->fc, req);
+ if (sync) {
+ fuse_request_send(ff->fc, req);
+ path_put(&req->misc.release.path);
+ fuse_put_request(ff->fc, req);
+ } else {
+ req->end = fuse_release_end;
+ fuse_request_send_background(ff->fc, req);
+ }
kfree(ff);
}
}
@@ -219,8 +253,12 @@ void fuse_release_common(struct file *file, int opcode)
* Normally this will send the RELEASE request, however if
* some asynchronous READ or WRITE requests are outstanding,
* the sending will be delayed.
+ *
+ * Make the release synchronous if this is a fuseblk mount,
+ * synchronous RELEASE is allowed (and desirable) in this case
+ * because the server can be trusted not to screw up.
*/
- fuse_file_put(ff);
+ fuse_file_put(ff, ff->fc->destroy_req != NULL);
}
static int fuse_open(struct inode *inode, struct file *file)
@@ -549,7 +587,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
unlock_page(page);
}
if (req->ff)
- fuse_file_put(req->ff);
+ fuse_file_put(req->ff, false);
}
static void fuse_send_readpages(struct fuse_req *req, struct file *file)
@@ -1129,7 +1167,7 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
{
__free_page(req->pages[0]);
- fuse_file_put(req->ff);
+ fuse_file_put(req->ff, false);
}
static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 01cc462..e6d614d 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -21,6 +21,7 @@
#include <linux/rwsem.h>
#include <linux/rbtree.h>
#include <linux/poll.h>
+#include <linux/workqueue.h>
/** Max number of pages that can be used in a single read request */
#define FUSE_MAX_PAGES_PER_REQ 32
@@ -254,7 +255,10 @@ struct fuse_req {
union {
struct fuse_forget_in forget_in;
struct {
- struct fuse_release_in in;
+ union {
+ struct fuse_release_in in;
+ struct work_struct work;
+ };
struct path path;
} release;
struct fuse_init_in init_in;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 141/247] clockevents: Prevent oneshot mode when broadcast device is periodic
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (79 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 140/247] fuse: fix hang of single threaded fuseblk filesystem Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 142/247] ext2: Fix link count corruption under heavy link+rename load Paul Gortmaker
` (105 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Thomas Gleixner, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3a142a0672b48a853f00af61f184c7341ac9c99d upstream.
When the per cpu timer is marked CLOCK_EVT_FEAT_C3STOP, then we only
can switch into oneshot mode, when the backup broadcast device
supports oneshot mode as well. Otherwise we would try to switch the
broadcast device into an unsupported mode unconditionally. This went
unnoticed so far as the current available broadcast devices support
oneshot mode. Seth unearthed this problem while debugging and working
around an hpet related BIOS wreckage.
Add the necessary check to tick_is_oneshot_available().
Reported-and-tested-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
LKML-Reference: <alpine.LFD.2.00.1102252231200.2701@localhost6.localdomain6>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/tick-broadcast.c | 10 ++++++++++
kernel/time/tick-common.c | 6 +++++-
kernel/time/tick-internal.h | 3 +++
3 files changed, 18 insertions(+), 1 deletions(-)
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index b3bafd5..2030f62 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -600,4 +600,14 @@ int tick_broadcast_oneshot_active(void)
return tick_broadcast_device.mode == TICKDEV_MODE_ONESHOT;
}
+/*
+ * Check whether the broadcast device supports oneshot.
+ */
+bool tick_broadcast_oneshot_available(void)
+{
+ struct clock_event_device *bc = tick_broadcast_device.evtdev;
+
+ return bc ? bc->features & CLOCK_EVT_FEAT_ONESHOT : false;
+}
+
#endif
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index b6b898d..61e296b 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -51,7 +51,11 @@ int tick_is_oneshot_available(void)
{
struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
- return dev && (dev->features & CLOCK_EVT_FEAT_ONESHOT);
+ if (!dev || !(dev->features & CLOCK_EVT_FEAT_ONESHOT))
+ return 0;
+ if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
+ return 1;
+ return tick_broadcast_oneshot_available();
}
/*
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 290eefb..f65d3a7 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -36,6 +36,7 @@ extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
extern int tick_broadcast_oneshot_active(void);
extern void tick_check_oneshot_broadcast(int cpu);
+bool tick_broadcast_oneshot_available(void);
# else /* BROADCAST */
static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
{
@@ -46,6 +47,7 @@ static inline void tick_broadcast_switch_to_oneshot(void) { }
static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
static inline int tick_broadcast_oneshot_active(void) { return 0; }
static inline void tick_check_oneshot_broadcast(int cpu) { }
+static inline bool tick_broadcast_oneshot_available(void) { return true; }
# endif /* !BROADCAST */
#else /* !ONESHOT */
@@ -76,6 +78,7 @@ static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
return 0;
}
static inline int tick_broadcast_oneshot_active(void) { return 0; }
+static inline bool tick_broadcast_oneshot_available(void) { return false; }
#endif /* !TICK_ONESHOT */
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 142/247] ext2: Fix link count corruption under heavy link+rename load
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (80 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 141/247] clockevents: Prevent oneshot mode when broadcast device is periodic Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 143/247] p54usb: add Senao NUB-350 usbid Paul Gortmaker
` (104 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Josh Hunt, Jan Kara, Paul Gortmaker
From: Josh Hunt <johunt@akamai.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e8a80c6f769dd4622d8b211b398452158ee60c0b upstream.
vfs_rename_other() does not lock renamed inode with i_mutex. Thus changing
i_nlink in a non-atomic manner (which happens in ext2_rename()) can corrupt
it as reported and analyzed by Josh.
In fact, there is no good reason to mess with i_nlink of the moved file.
We did it presumably to simulate linking into the new directory and unlinking
from an old one. But the practical effect of this is disputable because fsck
can possibly treat file as being properly linked into both directories without
writing any error which is confusing. So we just stop increment-decrement
games with i_nlink which also fixes the corruption.
CC: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext2/namei.c | 9 ++-------
1 files changed, 2 insertions(+), 7 deletions(-)
diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index 71efb0e..b5d9028 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -344,7 +344,6 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
new_de = ext2_find_entry (new_dir, &new_dentry->d_name, &new_page);
if (!new_de)
goto out_dir;
- inode_inc_link_count(old_inode);
ext2_set_link(new_dir, new_de, new_page, old_inode, 1);
new_inode->i_ctime = CURRENT_TIME_SEC;
if (dir_de)
@@ -356,12 +355,9 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
if (new_dir->i_nlink >= EXT2_LINK_MAX)
goto out_dir;
}
- inode_inc_link_count(old_inode);
err = ext2_add_link(new_dentry, old_inode);
- if (err) {
- inode_dec_link_count(old_inode);
+ if (err)
goto out_dir;
- }
if (dir_de)
inode_inc_link_count(new_dir);
}
@@ -369,12 +365,11 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
/*
* Like most other Unix systems, set the ctime for inodes on a
* rename.
- * inode_dec_link_count() will mark the inode dirty.
*/
old_inode->i_ctime = CURRENT_TIME_SEC;
+ mark_inode_dirty(old_inode);
ext2_delete_entry (old_de, old_page);
- inode_dec_link_count(old_inode);
if (dir_de) {
if (old_dir != new_dir)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 143/247] p54usb: add Senao NUB-350 usbid
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (81 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 142/247] ext2: Fix link count corruption under heavy link+rename load Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 144/247] dccp: fix oops on Reset after close Paul Gortmaker
` (103 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Christian Lamparter, John W. Linville,
Paul Gortmaker
From: Christian Lamparter <chunkeey@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2b799a6b25bb9f9fbc478782cd9503e8066ab618 upstream.
Reported-by: Mark Davis
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 906fd6c..9a57d14 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -97,6 +97,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
{USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */
{USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
{USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
+ {USB_DEVICE(0x1740, 0x1000)}, /* Senao NUB-350 */
{USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
{USB_DEVICE(0x2001, 0x3705)}, /* D-Link DWL-G120 rev C1 */
{USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 144/247] dccp: fix oops on Reset after close
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (82 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 143/247] p54usb: add Senao NUB-350 usbid Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 145/247] e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead Paul Gortmaker
` (102 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Gerrit Renker, David S. Miller, Paul Gortmaker
From: Gerrit Renker <gerrit@erg.abdn.ac.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 720dc34bbbe9493c7bd48b2243058b4e447a929d upstream.
This fixes a bug in the order of dccp_rcv_state_process() that still permitted
reception even after closing the socket. A Reset after close thus causes a NULL
pointer dereference by not preventing operations on an already torn-down socket.
dccp_v4_do_rcv()
|
| state other than OPEN
v
dccp_rcv_state_process()
|
| DCCP_PKT_RESET
v
dccp_rcv_reset()
|
v
dccp_time_wait()
WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()
Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah
[<c0038850>] (unwind_backtrace+0x0/0xec) from [<c0055364>] (warn_slowpath_common)
[<c0055364>] (warn_slowpath_common+0x4c/0x64) from [<c0055398>] (warn_slowpath_n)
[<c0055398>] (warn_slowpath_null+0x1c/0x24) from [<c02b72d0>] (__inet_twsk_hashd)
[<c02b72d0>] (__inet_twsk_hashdance+0x48/0x128) from [<c031caa0>] (dccp_time_wai)
[<c031caa0>] (dccp_time_wait+0x40/0xc8) from [<c031c15c>] (dccp_rcv_state_proces)
[<c031c15c>] (dccp_rcv_state_process+0x120/0x538) from [<c032609c>] (dccp_v4_do_)
[<c032609c>] (dccp_v4_do_rcv+0x11c/0x14c) from [<c0286594>] (release_sock+0xac/0)
[<c0286594>] (release_sock+0xac/0x110) from [<c031fd34>] (dccp_close+0x28c/0x380)
[<c031fd34>] (dccp_close+0x28c/0x380) from [<c02d9a78>] (inet_release+0x64/0x70)
The fix is by testing the socket state first. Receiving a packet in Closed state
now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.
Reported-and-tested-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/dccp/input.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/dccp/input.c b/net/dccp/input.c
index def29ca..3caceee 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -617,6 +617,9 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
/* Caller (dccp_v4_do_rcv) will send Reset */
dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
return 1;
+ } else if (sk->sk_state == DCCP_CLOSED) {
+ dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
+ return 1;
}
if (sk->sk_state != DCCP_REQUESTING && sk->sk_state != DCCP_RESPOND) {
@@ -679,10 +682,6 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
}
switch (sk->sk_state) {
- case DCCP_CLOSED:
- dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
- return 1;
-
case DCCP_REQUESTING:
queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
if (queued >= 0)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 145/247] e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (83 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 144/247] dccp: fix oops on Reset after close Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 146/247] r8169: disable ASPM Paul Gortmaker
` (101 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bruce Allan, Jeff Kirsher, Paul Gortmaker
From: Bruce Allan <bruce.w.allan@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4def99bbfd46e05c5e03b5b282cb4ee30e27ff19 upstream.
When support for 82577/82578 was added[1] in 2.6.31, PHY wakeup was in-
advertently enabled (even though it does not function properly) on ICH10
LOMs. This patch makes it so that the ICH10 LOMs use MAC wakeup instead
as was done with the initial support for those devices (i.e. 82567LM-3,
82567LF-3 and 82567V-4).
[1] commit a4f58f5455ba0efda36fb33c37074922d1527a10
Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/e1000e/netdev.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 56c9e69..d82c361 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -5185,7 +5185,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
/* APME bit in EEPROM is mapped to WUC.APME */
eeprom_data = er32(WUC);
eeprom_apme_mask = E1000_WUC_APME;
- if (eeprom_data & E1000_WUC_PHY_WAKE)
+ if ((hw->mac.type > e1000_ich10lan) &&
+ (eeprom_data & E1000_WUC_PHY_WAKE))
adapter->flags2 |= FLAG2_HAS_PHY_WAKEUP;
} else if (adapter->flags & FLAG_APME_IN_CTRL3) {
if (adapter->flags & FLAG_APME_CHECK_PORT_B &&
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 146/247] r8169: disable ASPM
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (84 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 145/247] e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 147/247] usb: iowarrior: don't trust report_size for buffer size Paul Gortmaker
` (100 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stanislaw Gruszka, David S. Miller, Paul Gortmaker
From: Stanislaw Gruszka <sgruszka@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ba04c7c93bbcb48ce880cf75b6e9dffcd79d4c7b upstream.
For some time is known that ASPM is causing troubles on r8169, i.e. make
device randomly stop working without any errors in dmesg.
Currently Tomi Leppikangas reports that system with r8169 device hangs
with MCE errors when ASPM is enabled:
https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4
Lets disable ASPM for r8169 devices at all, to avoid problems with
r8169 PCIe devices at least for some users.
Reported-by: Tomi Leppikangas <tomi.leppikangas@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/r8169.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0fa0598..812d102 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -23,6 +23,7 @@
#include <linux/tcp.h>
#include <linux/init.h>
#include <linux/dma-mapping.h>
+#include <linux/pci-aspm.h>
#include <asm/system.h>
#include <asm/io.h>
@@ -3024,6 +3025,11 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
mii->reg_num_mask = 0x1f;
mii->supports_gmii = !!(cfg->features & RTL_FEATURE_GMII);
+ /* disable ASPM completely as that cause random device stop working
+ * problems as well as full system hangs for some PCIe devices users */
+ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+ PCIE_LINK_STATE_CLKPM);
+
/* enable device (incl. PCI PM wakeup and hotplug setup) */
rc = pci_enable_device(pdev);
if (rc < 0) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 147/247] usb: iowarrior: don't trust report_size for buffer size
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (85 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 146/247] r8169: disable ASPM Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 148/247] arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS Paul Gortmaker
` (99 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kees Cook, Greg Kroah-Hartman, Paul Gortmaker
From: Kees Cook <kees.cook@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3ed780117dbe5acb64280d218f0347f238dafed0 upstream.
If the iowarrior devices in this case statement support more than 8 bytes
per report, it is possible to write past the end of a kernel heap allocation.
This will probably never be possible, but change the allocation to be more
defensive anyway.
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/misc/iowarrior.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 7c84321..f2a4ad5 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -373,7 +373,7 @@ static ssize_t iowarrior_write(struct file *file,
case USB_DEVICE_ID_CODEMERCS_IOWPV2:
case USB_DEVICE_ID_CODEMERCS_IOW40:
/* IOW24 and IOW40 use a synchronous call */
- buf = kmalloc(8, GFP_KERNEL); /* 8 bytes are enough for both products */
+ buf = kmalloc(count, GFP_KERNEL);
if (!buf) {
retval = -ENOMEM;
goto exit;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 148/247] arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (86 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 147/247] usb: iowarrior: don't trust report_size for buffer size Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 149/247] CIFS: Fix oplock break handling (try #2) Paul Gortmaker
` (98 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ian Campbell, Ian Campbell, David S. Miller,
Paul Gortmaker
From: Ian Campbell <Ian.Campbell@citrix.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d11327ad6695db8117c78d70611e71102ceec2ac upstream.
NETDEV_NOTIFY_PEER is an explicit request by the driver to send a link
notification while NETDEV_UP/NETDEV_CHANGEADDR generate link
notifications as a sort of side effect.
In the later cases the sysctl option is present because link
notification events can have undesired effects e.g. if the link is
flapping. I don't think this applies in the case of an explicit
request from a driver.
This patch makes NETDEV_NOTIFY_PEER unconditional, if preferred we
could add a new sysctl for this case which defaults to on.
This change causes Xen post-migration ARP notifications (which cause
switches to relearn their MAC tables etc) to be sent by default.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/devinet.c | 30 ++++++++++++++++++++----------
1 files changed, 20 insertions(+), 10 deletions(-)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index c12777f..e85d771 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1029,6 +1029,21 @@ static inline bool inetdev_valid_mtu(unsigned mtu)
return mtu >= 68;
}
+static void inetdev_send_gratuitous_arp(struct net_device *dev,
+ struct in_device *in_dev)
+
+{
+ struct in_ifaddr *ifa = in_dev->ifa_list;
+
+ if (!ifa)
+ return;
+
+ arp_send(ARPOP_REQUEST, ETH_P_ARP,
+ ifa->ifa_address, dev,
+ ifa->ifa_address, NULL,
+ dev->dev_addr, NULL);
+}
+
/* Called only under RTNL semaphore */
static int inetdev_event(struct notifier_block *this, unsigned long event,
@@ -1081,18 +1096,13 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
}
ip_mc_up(in_dev);
/* fall through */
- case NETDEV_NOTIFY_PEERS:
case NETDEV_CHANGEADDR:
+ if (!IN_DEV_ARP_NOTIFY(in_dev))
+ break;
+ /* fall through */
+ case NETDEV_NOTIFY_PEERS:
/* Send gratuitous ARP to notify of link change */
- if (IN_DEV_ARP_NOTIFY(in_dev)) {
- struct in_ifaddr *ifa = in_dev->ifa_list;
-
- if (ifa)
- arp_send(ARPOP_REQUEST, ETH_P_ARP,
- ifa->ifa_address, dev,
- ifa->ifa_address, NULL,
- dev->dev_addr, NULL);
- }
+ inetdev_send_gratuitous_arp(dev, in_dev);
break;
case NETDEV_DOWN:
ip_mc_down(in_dev);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 149/247] CIFS: Fix oplock break handling (try #2)
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (87 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 148/247] arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 150/247] cpuset: add a missing unlock in cpuset_write_resmask() Paul Gortmaker
` (97 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Pavel Shilovsky, Steve French, Paul Gortmaker
From: Pavel Shilovsky <piastryyy@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 12fed00de963433128b5366a21a55808fab2f756 upstream.
When we get oplock break notification we should set the appropriate
value of OplockLevel field in oplock break acknowledge according to
the oplock level held by the client in this time. As we only can have
level II oplock or no oplock in the case of oplock break, we should be
aware only about clientCanCacheRead field in cifsInodeInfo structure.
Also fix bug connected with wrong interpretation of OplockLevel field
during oplock break notification processing.
[PG: above OplockLevel bug only exists via. e66673e39a which didn't
appear until v2.6.37-rc2, so cifs/misc.c hunk dropped.]
Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/cifsproto.h | 2 +-
fs/cifs/cifssmb.c | 4 +++-
fs/cifs/file.c | 21 +++++++++++----------
3 files changed, 15 insertions(+), 12 deletions(-)
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index a6db615..ef0db18 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -329,7 +329,7 @@ extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
const __u16 netfid, const __u64 len,
const __u64 offset, const __u32 numUnlock,
const __u32 numLock, const __u8 lockType,
- const bool waitFlag);
+ const bool waitFlag, const __u8 oplock_level);
extern int CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
const __u16 smb_file_id, const int get_flag,
const __u64 len, struct file_lock *,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5d3f29f..62e49ab 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1642,7 +1642,8 @@ int
CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
const __u16 smb_file_id, const __u64 len,
const __u64 offset, const __u32 numUnlock,
- const __u32 numLock, const __u8 lockType, const bool waitFlag)
+ const __u32 numLock, const __u8 lockType,
+ const bool waitFlag, const __u8 oplock_level)
{
int rc = 0;
LOCK_REQ *pSMB = NULL;
@@ -1670,6 +1671,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
pSMB->NumberOfLocks = cpu_to_le16(numLock);
pSMB->NumberOfUnlocks = cpu_to_le16(numUnlock);
pSMB->LockType = lockType;
+ pSMB->OplockLevel = oplock_level;
pSMB->AndXCommand = 0xFF; /* none */
pSMB->Fid = smb_file_id; /* netfid stays le */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 4cbdb20..1ab7670 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -828,12 +828,12 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
/* BB we could chain these into one lock request BB */
rc = CIFSSMBLock(xid, tcon, netfid, length, pfLock->fl_start,
- 0, 1, lockType, 0 /* wait flag */ );
+ 0, 1, lockType, 0 /* wait flag */, 0);
if (rc == 0) {
rc = CIFSSMBLock(xid, tcon, netfid, length,
pfLock->fl_start, 1 /* numUnlock */ ,
0 /* numLock */ , lockType,
- 0 /* wait flag */ );
+ 0 /* wait flag */, 0);
pfLock->fl_type = F_UNLCK;
if (rc != 0)
cERROR(1, ("Error unlocking previously locked "
@@ -850,13 +850,13 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
rc = CIFSSMBLock(xid, tcon, netfid, length,
pfLock->fl_start, 0, 1,
lockType | LOCKING_ANDX_SHARED_LOCK,
- 0 /* wait flag */);
+ 0 /* wait flag */, 0);
if (rc == 0) {
rc = CIFSSMBLock(xid, tcon, netfid,
length, pfLock->fl_start, 1, 0,
lockType |
LOCKING_ANDX_SHARED_LOCK,
- 0 /* wait flag */);
+ 0 /* wait flag */, 0);
pfLock->fl_type = F_RDLCK;
if (rc != 0)
cERROR(1, ("Error unlocking "
@@ -900,8 +900,8 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
if (numLock) {
rc = CIFSSMBLock(xid, tcon, netfid, length,
- pfLock->fl_start,
- 0, numLock, lockType, wait_flag);
+ pfLock->fl_start, 0, numLock, lockType,
+ wait_flag, 0);
if (rc == 0) {
/* For Windows locks we must store them. */
@@ -921,9 +921,9 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
(pfLock->fl_start + length) >=
(li->offset + li->length)) {
stored_rc = CIFSSMBLock(xid, tcon,
- netfid,
- li->length, li->offset,
- 1, 0, li->type, false);
+ netfid, li->length,
+ li->offset, 1, 0,
+ li->type, false, 0);
if (stored_rc)
rc = stored_rc;
@@ -2340,7 +2340,8 @@ cifs_oplock_break(struct slow_work *work)
*/
if (!cfile->closePend && !cfile->oplock_break_cancelled) {
rc = CIFSSMBLock(0, cifs_sb->tcon, cfile->netfid, 0, 0, 0, 0,
- LOCKING_ANDX_OPLOCK_RELEASE, false);
+ LOCKING_ANDX_OPLOCK_RELEASE, false,
+ cinode->clientCanCacheRead ? 1 : 0);
cFYI(1, ("Oplock release rc = %d", rc));
}
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 150/247] cpuset: add a missing unlock in cpuset_write_resmask()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (88 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 149/247] CIFS: Fix oplock break handling (try #2) Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 151/247] keyboard: integer underflow bug Paul Gortmaker
` (96 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Li Zefan, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Li Zefan <lizf@cn.fujitsu.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b75f38d659e6fc747eda64cb72f3920e29dd44a4 upstream.
Don't forget to release cgroup_mutex if alloc_trial_cpuset() fails.
[akpm@linux-foundation.org: avoid multiple return points]
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Cc: Paul Menage <menage@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/cpuset.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 9a50c5f..8f024fa 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1534,8 +1534,10 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
return -ENODEV;
trialcs = alloc_trial_cpuset(cs);
- if (!trialcs)
- return -ENOMEM;
+ if (!trialcs) {
+ retval = -ENOMEM;
+ goto out;
+ }
switch (cft->private) {
case FILE_CPULIST:
@@ -1550,6 +1552,7 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
}
free_trial_cpuset(trialcs);
+out:
cgroup_unlock();
return retval;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 151/247] keyboard: integer underflow bug
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (89 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 150/247] cpuset: add a missing unlock in cpuset_write_resmask() Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 152/247] RxRPC: Fix v1 keys Paul Gortmaker
` (95 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Carpenter, Martin Schwidefsky, Paul Gortmaker
From: Dan Carpenter <error27@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b652277b09d3d030cb074cc6a98ba80b34244c03 upstream.
The "ct" variable should be an unsigned int. Both struct kbdiacrs
->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.
Making it signed causes a problem in KBDIACRUC because the user could
set the signed bit and cause a buffer overflow.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/s390/char/keyboard.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index cb6bffe..84d08f9 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -463,7 +463,8 @@ kbd_ioctl(struct kbd_data *kbd, struct file *file,
unsigned int cmd, unsigned long arg)
{
void __user *argp;
- int ct, perm;
+ unsigned int ct;
+ int perm;
argp = (void __user *)arg;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 152/247] RxRPC: Fix v1 keys
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (90 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 151/247] keyboard: integer underflow bug Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 153/247] ixgbe: fix for 82599 erratum on Header Splitting Paul Gortmaker
` (94 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Anton Blanchard, David Howells,
David S. Miller, Paul Gortmaker
From: Anton Blanchard <anton@au1.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f009918a1c1bbf8607b8aab3959876913a30193a upstream.
commit 339412841d7 (RxRPC: Allow key payloads to be passed in XDR form)
broke klog for me. I notice the v1 key struct had a kif_version field
added:
-struct rxkad_key {
- u16 security_index; /* RxRPC header security index */
- u16 ticket_len; /* length of ticket[] */
- u32 expiry; /* time at which expires */
- u32 kvno; /* key version number */
- u8 session_key[8]; /* DES session key */
- u8 ticket[0]; /* the encrypted ticket */
-};
+struct rxrpc_key_data_v1 {
+ u32 kif_version; /* 1 */
+ u16 security_index;
+ u16 ticket_length;
+ u32 expiry; /* time_t */
+ u32 kvno;
+ u8 session_key[8];
+ u8 ticket[0];
+};
However the code in rxrpc_instantiate strips it away:
data += sizeof(kver);
datalen -= sizeof(kver);
Removing kif_version fixes my problem.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/keys/rxrpc-type.h | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/include/keys/rxrpc-type.h b/include/keys/rxrpc-type.h
index 5cb86c3..fc48754 100644
--- a/include/keys/rxrpc-type.h
+++ b/include/keys/rxrpc-type.h
@@ -99,7 +99,6 @@ struct rxrpc_key_token {
* structure of raw payloads passed to add_key() or instantiate key
*/
struct rxrpc_key_data_v1 {
- u32 kif_version; /* 1 */
u16 security_index;
u16 ticket_length;
u32 expiry; /* time_t */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 153/247] ixgbe: fix for 82599 erratum on Header Splitting
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (91 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 152/247] RxRPC: Fix v1 keys Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 154/247] mm: fix possible cause of a page_mapped BUG Paul Gortmaker
` (93 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Don Skidmore, Jeff Kirsher, Paul Gortmaker
From: Don Skidmore <donald.c.skidmore@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a124339ad28389093ed15eca990d39c51c5736cc upstream.
We have found a hardware erratum on 82599 hardware that can lead to
unpredictable behavior when Header Splitting mode is enabled. So
we are no longer enabling this feature on affected hardware.
Please see the 82599 Specification Update for more information.
Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Tested-by: Stephen Ko <stephen.s.ko@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/ixgbe/ixgbe_main.c | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 156dfcb..f76f4f5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2250,9 +2250,16 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
int rx_buf_len;
/* Decide whether to use packet split mode or not */
+ /* On by default */
+ adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+
/* Do not use packet split if we're in SR-IOV Mode */
- if (!adapter->num_vfs)
- adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+ if (adapter->num_vfs)
+ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+ /* Disable packet split due to 82599 erratum #45 */
+ if (hw->mac.type == ixgbe_mac_82599EB)
+ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
/* Set the RX buffer length according to the mode */
if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 154/247] mm: fix possible cause of a page_mapped BUG
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (92 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 153/247] ixgbe: fix for 82599 erratum on Header Splitting Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 155/247] powerpc/kdump: CPUs assume the context of the oopsing CPU Paul Gortmaker
` (92 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Hugh Dickins, Linus Torvalds, Paul Gortmaker
From: Hugh Dickins <hughd@google.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a3e8cc643d22d2c8ed36b9be7d9c9ca21efcf7f7 upstream.
Robert Swiecki reported a BUG_ON(page_mapped) from a fuzzer, punching
a hole with madvise(,, MADV_REMOVE). That path is under mutex, and
cannot be explained by lack of serialization in unmap_mapping_range().
Reviewing the code, I found one place where vm_truncate_count handling
should have been updated, when I switched at the last minute from one
way of managing the restart_addr to another: mremap move changes the
virtual addresses, so it ought to adjust the restart_addr.
But rather than exporting the notion of restart_addr from memory.c, or
converting to restart_pgoff throughout, simply reset vm_truncate_count
to 0 to force a rescan if mremap move races with preempted truncation.
We have no confirmation that this fixes Robert's BUG,
but it is a fix that's worth making anyway.
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
mm/mremap.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)
diff --git a/mm/mremap.c b/mm/mremap.c
index cde56ee..10d5f62 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -91,9 +91,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
*/
mapping = vma->vm_file->f_mapping;
spin_lock(&mapping->i_mmap_lock);
- if (new_vma->vm_truncate_count &&
- new_vma->vm_truncate_count != vma->vm_truncate_count)
- new_vma->vm_truncate_count = 0;
+ new_vma->vm_truncate_count = 0;
}
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 155/247] powerpc/kdump: CPUs assume the context of the oopsing CPU
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (93 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 154/247] mm: fix possible cause of a page_mapped BUG Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 156/247] powerpc/kdump: Use chip->shutdown to disable IRQs Paul Gortmaker
` (91 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Benjamin Herrenschmidt,
Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0644079410065567e3bb31fcb8e6441f2b7685a9 upstream.
We wrap the crash_shutdown_handles[] calls with longjmp/setjmp, so if any
of them fault we can recover. The problem is we add a hook to the debugger
fault handler hook which calls longjmp unconditionally.
This first part of kdump is run before we marshall the other CPUs, so there
is a very good chance some CPU on the box is going to page fault. And when
it does it hits the longjmp code and assumes the context of the oopsing CPU.
The machine gets very confused when it has 10 CPUs all with the same stack,
all thinking they have the same CPU id. I get even more confused trying
to debug it.
The patch below adds crash_shutdown_cpu and uses it to specify which cpu is
in the protected region. Since it can only be -1 or the oopsing CPU, we don't
need to use memory barriers since it is only valid on the local CPU - no other
CPU will ever see a value that matches it's local CPU id.
Eventually we should switch the order and marshall all CPUs before doing the
crash_shutdown_handles[] calls, but that is a bigger fix.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/crash.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 6f4613d..fbe3c1c 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -347,10 +347,12 @@ int crash_shutdown_unregister(crash_shutdown_t handler)
EXPORT_SYMBOL(crash_shutdown_unregister);
static unsigned long crash_shutdown_buf[JMP_BUF_LEN];
+static int crash_shutdown_cpu = -1;
static int handle_fault(struct pt_regs *regs)
{
- longjmp(crash_shutdown_buf, 1);
+ if (crash_shutdown_cpu == smp_processor_id())
+ longjmp(crash_shutdown_buf, 1);
return 0;
}
@@ -388,6 +390,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
*/
old_handler = __debugger_fault_handler;
__debugger_fault_handler = handle_fault;
+ crash_shutdown_cpu = smp_processor_id();
for (i = 0; crash_shutdown_handles[i]; i++) {
if (setjmp(crash_shutdown_buf) == 0) {
/*
@@ -401,6 +404,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
asm volatile("sync; isync");
}
}
+ crash_shutdown_cpu = -1;
__debugger_fault_handler = old_handler;
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 156/247] powerpc/kdump: Use chip->shutdown to disable IRQs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (94 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 155/247] powerpc/kdump: CPUs assume the context of the oopsing CPU Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 157/247] powerpc: Use more accurate limit for first segment memory allocations Paul Gortmaker
` (90 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Benjamin Herrenschmidt,
Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5d7a87217de48b234b3c8ff8a73059947d822e07 upstream.
I saw this in a kdump kernel:
IOMMU table initialized, virtual merging enabled
Interrupt 155954 (real) is invalid, disabling it.
Interrupt 155953 (real) is invalid, disabling it.
ie we took some spurious interrupts. default_machine_crash_shutdown tries
to disable all interrupt sources but uses chip->disable which maps to
the default action of:
static void default_disable(unsigned int irq)
{
}
If we use chip->shutdown, then we actually mask the IRQ:
static void default_shutdown(unsigned int irq)
{
struct irq_desc *desc = irq_to_desc(irq);
desc->chip->mask(irq);
desc->status |= IRQ_MASKED;
}
Not sure why we don't implement a ->disable action for xics.c, or why
default_disable doesn't mask the interrupt.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/crash.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index fbe3c1c..0384376 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -381,7 +381,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
desc->chip->eoi(i);
if (!(desc->status & IRQ_DISABLED))
- desc->chip->disable(i);
+ desc->chip->shutdown(i);
}
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 157/247] powerpc: Use more accurate limit for first segment memory allocations
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (95 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 156/247] powerpc/kdump: Use chip->shutdown to disable IRQs Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 158/247] powerpc/pseries: Add hcall to read 4 ptes at a time in real mode Paul Gortmaker
` (89 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Milton Miller,
Benjamin Herrenschmidt, Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 095c7965f4dc870ed2b65143b1e2610de653416c upstream.
Author: Milton Miller <miltonm@bga.com>
On large machines we are running out of room below 256MB. In some cases we
only need to ensure the allocation is in the first segment, which may be
256MB or 1TB.
Add slb0_limit and use it to specify the upper limit for the irqstack and
emergency stacks.
On a large ppc64 box, this fixes a panic at boot when the crashkernel=
option is specified (previously we would run out of memory below 256MB).
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/setup_64.c | 17 +++++++++++++----
1 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 9143891..d44e38b 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -424,9 +424,18 @@ void __init setup_system(void)
DBG(" <- setup_system()\n");
}
+static u64 slb0_limit(void)
+{
+ if (cpu_has_feature(CPU_FTR_1T_SEGMENT)) {
+ return 1UL << SID_SHIFT_1T;
+ }
+ return 1UL << SID_SHIFT;
+}
+
#ifdef CONFIG_IRQSTACKS
static void __init irqstack_early_init(void)
{
+ u64 limit = slb0_limit();
unsigned int i;
/*
@@ -436,10 +445,10 @@ static void __init irqstack_early_init(void)
for_each_possible_cpu(i) {
softirq_ctx[i] = (struct thread_info *)
__va(lmb_alloc_base(THREAD_SIZE,
- THREAD_SIZE, 0x10000000));
+ THREAD_SIZE, limit));
hardirq_ctx[i] = (struct thread_info *)
__va(lmb_alloc_base(THREAD_SIZE,
- THREAD_SIZE, 0x10000000));
+ THREAD_SIZE, limit));
}
}
#else
@@ -470,7 +479,7 @@ static void __init exc_lvl_early_init(void)
*/
static void __init emergency_stack_init(void)
{
- unsigned long limit;
+ u64 limit;
unsigned int i;
/*
@@ -482,7 +491,7 @@ static void __init emergency_stack_init(void)
* bringup, we need to get at them in real mode. This means they
* must also be within the RMO region.
*/
- limit = min(0x10000000ULL, lmb.rmo_size);
+ limit = min(slb0_limit(), lmb.rmo_size);
for_each_possible_cpu(i) {
unsigned long sp;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 158/247] powerpc/pseries: Add hcall to read 4 ptes at a time in real mode
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (96 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 157/247] powerpc: Use more accurate limit for first segment memory allocations Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 159/247] powerpc/kexec: Speedup kexec hash PTE tear down Paul Gortmaker
` (88 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michael Neuling, Benjamin Herrenschmidt,
Paul Gortmaker
From: Michael Neuling <mikey@neuling.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f90ece28c1f5b3ec13fe481406857fe92f4bc7d1 upstream.
This adds plpar_pte_read_4_raw() which can be used read 4 PTEs from
PHYP at a time, while in real mode.
It also creates a new hcall9 which can be used in real mode. It's the
same as plpar_hcall9 but minus the tracing hcall statistics which may
require variables outside the RMO.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/include/asm/hvcall.h | 1 +
arch/powerpc/platforms/pseries/hvCall.S | 38 +++++++++++++++++++++++
arch/powerpc/platforms/pseries/plpar_wrappers.h | 18 +++++++++++
3 files changed, 57 insertions(+), 0 deletions(-)
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index f027581..f0d067c 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -281,6 +281,7 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...);
*/
#define PLPAR_HCALL9_BUFSIZE 9
long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...);
+long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...);
/* For hcall instrumentation. One structure per-hcall, per-CPU */
struct hcall_stats {
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index 383a5d0..48d2057 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -228,3 +228,41 @@ _GLOBAL(plpar_hcall9)
mtcrf 0xff,r0
blr /* return r3 = status */
+
+/* See plpar_hcall_raw to see why this is needed */
+_GLOBAL(plpar_hcall9_raw)
+ HMT_MEDIUM
+
+ mfcr r0
+ stw r0,8(r1)
+
+ std r4,STK_PARM(r4)(r1) /* Save ret buffer */
+
+ mr r4,r5
+ mr r5,r6
+ mr r6,r7
+ mr r7,r8
+ mr r8,r9
+ mr r9,r10
+ ld r10,STK_PARM(r11)(r1) /* put arg7 in R10 */
+ ld r11,STK_PARM(r12)(r1) /* put arg8 in R11 */
+ ld r12,STK_PARM(r13)(r1) /* put arg9 in R12 */
+
+ HVSC /* invoke the hypervisor */
+
+ mr r0,r12
+ ld r12,STK_PARM(r4)(r1)
+ std r4, 0(r12)
+ std r5, 8(r12)
+ std r6, 16(r12)
+ std r7, 24(r12)
+ std r8, 32(r12)
+ std r9, 40(r12)
+ std r10,48(r12)
+ std r11,56(r12)
+ std r0, 64(r12)
+
+ lwz r0,8(r1)
+ mtcrf 0xff,r0
+
+ blr /* return r3 = status */
diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/platforms/pseries/plpar_wrappers.h
index 6c4fd2c..d980111 100644
--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
+++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h
@@ -191,6 +191,24 @@ static inline long plpar_pte_read_raw(unsigned long flags, unsigned long ptex,
return rc;
}
+/*
+ * plpar_pte_read_4_raw can be called in real mode.
+ * ptes must be 8*sizeof(unsigned long)
+ */
+static inline long plpar_pte_read_4_raw(unsigned long flags, unsigned long ptex,
+ unsigned long *ptes)
+
+{
+ long rc;
+ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+
+ rc = plpar_hcall9_raw(H_READ, retbuf, flags | H_READ_4, ptex);
+
+ memcpy(ptes, retbuf, 8*sizeof(unsigned long));
+
+ return rc;
+}
+
static inline long plpar_pte_protect(unsigned long flags, unsigned long ptex,
unsigned long avpn)
{
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 159/247] powerpc/kexec: Speedup kexec hash PTE tear down
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (97 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 158/247] powerpc/pseries: Add hcall to read 4 ptes at a time in real mode Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 160/247] powerpc/crashdump: Do not fail on NULL pointer dereferencing Paul Gortmaker
` (87 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michael Neuling, Benjamin Herrenschmidt,
Paul Gortmaker
From: Michael Neuling <mikey@neuling.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d504bed676caad29a3dba3d3727298c560628f5c upstream.
Currently for kexec the PTE tear down on 1TB segment systems normally
requires 3 hcalls for each PTE removal. On a machine with 32GB of
memory it can take around a minute to remove all the PTEs.
This optimises the path so that we only remove PTEs that are valid.
It also uses the read 4 PTEs at once HCALL. For the common case where
a PTEs is invalid in a 1TB segment, this turns the 3 HCALLs per PTE
down to 1 HCALL per 4 PTEs.
This gives an > 10x speedup in kexec times on PHYP, taking a 32GB
machine from around 1 minute down to a few seconds.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/platforms/pseries/lpar.c | 35 +++++++++++++++++++-------------
1 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 0707653..cf79b46 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -367,21 +367,28 @@ static void pSeries_lpar_hptab_clear(void)
{
unsigned long size_bytes = 1UL << ppc64_pft_size;
unsigned long hpte_count = size_bytes >> 4;
- unsigned long dummy1, dummy2, dword0;
+ struct {
+ unsigned long pteh;
+ unsigned long ptel;
+ } ptes[4];
long lpar_rc;
- int i;
+ int i, j;
- /* TODO: Use bulk call */
- for (i = 0; i < hpte_count; i++) {
- /* dont remove HPTEs with VRMA mappings */
- lpar_rc = plpar_pte_remove_raw(H_ANDCOND, i, HPTE_V_1TB_SEG,
- &dummy1, &dummy2);
- if (lpar_rc == H_NOT_FOUND) {
- lpar_rc = plpar_pte_read_raw(0, i, &dword0, &dummy1);
- if (!lpar_rc && ((dword0 & HPTE_V_VRMA_MASK)
- != HPTE_V_VRMA_MASK))
- /* Can be hpte for 1TB Seg. So remove it */
- plpar_pte_remove_raw(0, i, 0, &dummy1, &dummy2);
+ /* Read in batches of 4,
+ * invalidate only valid entries not in the VRMA
+ * hpte_count will be a multiple of 4
+ */
+ for (i = 0; i < hpte_count; i += 4) {
+ lpar_rc = plpar_pte_read_4_raw(0, i, (void *)ptes);
+ if (lpar_rc != H_SUCCESS)
+ continue;
+ for (j = 0; j < 4; j++){
+ if ((ptes[j].pteh & HPTE_V_VRMA_MASK) ==
+ HPTE_V_VRMA_MASK)
+ continue;
+ if (ptes[j].pteh & HPTE_V_VALID)
+ plpar_pte_remove_raw(0, i + j, 0,
+ &(ptes[j].pteh), &(ptes[j].ptel));
}
}
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 160/247] powerpc/crashdump: Do not fail on NULL pointer dereferencing
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (98 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 159/247] powerpc/kexec: Speedup kexec hash PTE tear down Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 161/247] powerpc/kexec: Fix orphaned offline CPUs across kexec Paul Gortmaker
` (86 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Maxim Uvarov, Benjamin Herrenschmidt,
Paul Gortmaker
From: Maxim Uvarov <muvarov@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 426b6cb478e60352a463a0d1ec75c1c9fab30b13 upstream.
Signed-off-by: Maxim Uvarov <muvarov@gmail.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/crash.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 0384376..cca7c8f 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -377,6 +377,9 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
for_each_irq(i) {
struct irq_desc *desc = irq_to_desc(i);
+ if (!desc || !desc->chip || !desc->chip->eoi)
+ continue;
+
if (desc->status & IRQ_INPROGRESS)
desc->chip->eoi(i);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 161/247] powerpc/kexec: Fix orphaned offline CPUs across kexec
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (99 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 160/247] powerpc/crashdump: Do not fail on NULL pointer dereferencing Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 162/247] netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values Paul Gortmaker
` (85 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Matt Evans, Benjamin Herrenschmidt, Paul Gortmaker
From: Matt Evans <matt@ozlabs.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e8e5c2155b0035b6e04f29be67f6444bc914005b upstream.
When CPU hotplug is used, some CPUs may be offline at the time a kexec is
performed. The subsequent kernel may expect these CPUs to be already running,
and will declare them stuck. On pseries, there's also a soft-offline (cede)
state that CPUs may be in; this can also cause problems as the kexeced kernel
may ask RTAS if they're online -- and RTAS would say they are. The CPU will
either appear stuck, or will cause a crash as we replace its cede loop beneath
it.
This patch kicks each present offline CPU awake before the kexec, so that
none are forever lost to these assumptions in the subsequent kernel.
Now, the behaviour is that all available CPUs that were offlined are now
online & usable after the kexec. This mimics the behaviour of a full reboot
(on which all CPUs will be restarted).
Signed-off-by: Matt Evans <matt@ozlabs.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/machine_kexec_64.c | 25 +++++++++++++++++++++++++
1 files changed, 25 insertions(+), 0 deletions(-)
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 040bd1d..f61943d 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -15,6 +15,7 @@
#include <linux/thread_info.h>
#include <linux/init_task.h>
#include <linux/errno.h>
+#include <linux/cpu.h>
#include <asm/page.h>
#include <asm/current.h>
@@ -169,10 +170,34 @@ static void kexec_smp_down(void *arg)
/* NOTREACHED */
}
+/*
+ * We need to make sure each present CPU is online. The next kernel will scan
+ * the device tree and assume primary threads are online and query secondary
+ * threads via RTAS to online them if required. If we don't online primary
+ * threads, they will be stuck. However, we also online secondary threads as we
+ * may be using 'cede offline'. In this case RTAS doesn't see the secondary
+ * threads as offline -- and again, these CPUs will be stuck.
+ *
+ * So, we online all CPUs that should be running, including secondary threads.
+ */
+static void wake_offline_cpus(void)
+{
+ int cpu = 0;
+
+ for_each_present_cpu(cpu) {
+ if (!cpu_online(cpu)) {
+ printk(KERN_INFO "kexec: Waking offline cpu %d.\n",
+ cpu);
+ cpu_up(cpu);
+ }
+ }
+}
+
static void kexec_prepare_cpus(void)
{
int my_cpu, i, notified=-1;
+ wake_offline_cpus();
smp_call_function(kexec_smp_down, NULL, /* wait */0);
my_cpu = get_cpu();
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 162/247] netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (100 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 161/247] powerpc/kexec: Fix orphaned offline CPUs across kexec Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 163/247] nfsd: wrong index used in inner loop Paul Gortmaker
` (84 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jan Engelhardt, Patrick McHardy, Paul Gortmaker
From: Jan Engelhardt <jengelh@medozas.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9ef0298a8e5730d9a46d640014c727f3b4152870 upstream.
Like many other places, we have to check that the array index is
within allowed limits, or otherwise, a kernel oops and other nastiness
can ensue when we access memory beyond the end of the array.
[ 5954.115381] BUG: unable to handle kernel paging request at 0000004000000000
[ 5954.120014] IP: __find_logger+0x6f/0xa0
[ 5954.123979] nf_log_bind_pf+0x2b/0x70
[ 5954.123979] nfulnl_recv_config+0xc0/0x4a0 [nfnetlink_log]
[ 5954.123979] nfnetlink_rcv_msg+0x12c/0x1b0 [nfnetlink]
...
The problem goes back to v2.6.30-rc1~1372~1342~31 where nf_log_bind
was decoupled from nf_log_register.
Reported-by: Miguel Di Ciurcio Filho <miguel.filho@gmail.com>,
via irc.freenode.net/#netfilter
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/netfilter/nf_log.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 015725a..eda826b 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -83,6 +83,8 @@ EXPORT_SYMBOL(nf_log_unregister);
int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
{
+ if (pf >= ARRAY_SIZE(nf_loggers))
+ return -EINVAL;
mutex_lock(&nf_log_mutex);
if (__find_logger(pf, logger->name) == NULL) {
mutex_unlock(&nf_log_mutex);
@@ -96,6 +98,8 @@ EXPORT_SYMBOL(nf_log_bind_pf);
void nf_log_unbind_pf(u_int8_t pf)
{
+ if (pf >= ARRAY_SIZE(nf_loggers))
+ return;
mutex_lock(&nf_log_mutex);
rcu_assign_pointer(nf_loggers[pf], NULL);
mutex_unlock(&nf_log_mutex);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 163/247] nfsd: wrong index used in inner loop
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (101 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 162/247] netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 164/247] " Paul Gortmaker
` (83 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, roel, J. Bruce Fields, Paul Gortmaker
From: roel <roel.kluin@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3ec07aa9522e3d5e9d5ede7bef946756e623a0a0 upstream.
Index i was already used in the outer loop
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4xdr.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index cb0a5fe..d2b44c8 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1107,7 +1107,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
u32 dummy;
char *machine_name;
- int i;
+ int i, j;
int nr_secflavs;
READ_BUF(16);
@@ -1180,7 +1180,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
READ_BUF(4);
READ32(dummy);
READ_BUF(dummy * 4);
- for (i = 0; i < dummy; ++i)
+ for (j = 0; j < dummy; ++j)
READ32(dummy);
break;
case RPC_AUTH_GSS:
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 164/247] nfsd: wrong index used in inner loop
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (102 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 163/247] nfsd: wrong index used in inner loop Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 165/247] r8169: use RxFIFO overflow workaround for 8168c chipset Paul Gortmaker
` (82 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Mi Jinlong, J. Bruce Fields, Paul Gortmaker
From: Mi Jinlong <mijinlong@cn.fujitsu.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5a02ab7c3c4580f94d13c683721039855b67cda6 upstream.
We must not use dummy for index.
After the first index, READ32(dummy) will change dummy!!!!
Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
[bfields@redhat.com: Trond points out READ_BUF alone is sufficient.]
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4xdr.c | 5 +----
1 files changed, 1 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index d2b44c8..28d586a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1107,7 +1107,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
u32 dummy;
char *machine_name;
- int i, j;
+ int i;
int nr_secflavs;
READ_BUF(16);
@@ -1180,8 +1180,6 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
READ_BUF(4);
READ32(dummy);
READ_BUF(dummy * 4);
- for (j = 0; j < dummy; ++j)
- READ32(dummy);
break;
case RPC_AUTH_GSS:
dprintk("RPC_AUTH_GSS callback secflavor "
@@ -1197,7 +1195,6 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
READ_BUF(4);
READ32(dummy);
READ_BUF(dummy);
- p += XDR_QUADLEN(dummy);
break;
default:
dprintk("Illegal callback secflavor\n");
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 165/247] r8169: use RxFIFO overflow workaround for 8168c chipset.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (103 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 164/247] " Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 166/247] hwmon/f71882fg: Set platform drvdata to NULL later Paul Gortmaker
` (81 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Ivan Vecera, Paul Gortmaker
From: Ivan Vecera <ivecera@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b5ba6d12bdac21bc0620a5089e0f24e362645efd upstream.
I found that one of the 8168c chipsets (concretely XID 1c4000c0) starts
generating RxFIFO overflow errors. The result is an infinite loop in
interrupt handler as the RxFIFOOver is handled only for ...MAC_VER_11.
With the workaround everything goes fine.
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Cc: Hayes <hayeswang@realtek.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/r8169.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 812d102..81cd399 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3712,7 +3712,8 @@ static void rtl_hw_start_8168(struct net_device *dev)
RTL_W16(IntrMitigate, 0x5151);
/* Work around for RxFIFO overflow. */
- if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
+ if (tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+ tp->mac_version == RTL_GIGA_MAC_VER_22) {
tp->intr_event |= RxFIFOOver | PCSTimeout;
tp->intr_event &= ~RxOverflow;
}
@@ -4602,7 +4603,8 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
/* Work around for rx fifo overflow */
if (unlikely(status & RxFIFOOver) &&
- (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+ (tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+ tp->mac_version == RTL_GIGA_MAC_VER_22)) {
netif_stop_queue(dev);
rtl8169_tx_timeout(dev);
break;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 166/247] hwmon/f71882fg: Set platform drvdata to NULL later
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (104 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 165/247] r8169: use RxFIFO overflow workaround for 8168c chipset Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 167/247] mtd: add "platform:" prefix for platform modalias Paul Gortmaker
` (80 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Hans de Goede, Guenter Roeck, Paul Gortmaker
From: Hans de Goede <hdegoede@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d9ebaa45472c92704f4814682eec21455edcfa1f upstream.
This avoids a possible race leading to trying to dereference NULL.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/f71882fg.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index a95fa42..03f08b2 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -2031,7 +2031,6 @@ static int f71882fg_remove(struct platform_device *pdev)
int nr_fans = (data->type == f71882fg) ? 4 : 3;
u8 start_reg = f71882fg_read8(data, F71882FG_REG_START);
- platform_set_drvdata(pdev, NULL);
if (data->hwmon_dev)
hwmon_device_unregister(data->hwmon_dev);
@@ -2098,6 +2097,7 @@ static int f71882fg_remove(struct platform_device *pdev)
}
}
+ platform_set_drvdata(pdev, NULL);
kfree(data);
return 0;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 167/247] mtd: add "platform:" prefix for platform modalias
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (105 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 166/247] hwmon/f71882fg: Set platform drvdata to NULL later Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 168/247] libata: no special completion processing for EH commands Paul Gortmaker
` (79 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Axel Lin, Artem Bityutskiy, David Woodhouse,
Paul Gortmaker
From: Axel Lin <axel.lin@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c804c733846572ca85c2bba60c7fe6fa024dff18 upstream.
Since 43cc71eed1250755986da4c0f9898f9a635cb3bf (platform: prefix MODALIAS
with "platform:"), the platform modalias is prefixed with "platform:".
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mtd/nand/omap2.c | 2 +-
drivers/mtd/onenand/generic.c | 2 +-
drivers/mtd/onenand/omap2.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 7545568..ff4d802 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1073,6 +1073,6 @@ static void __exit omap_nand_exit(void)
module_init(omap_nand_init);
module_exit(omap_nand_exit);
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Glue layer for NAND flash on TI OMAP boards");
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index e789149..ac08750 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -131,7 +131,7 @@ static struct platform_driver generic_onenand_driver = {
.remove = __devexit_p(generic_onenand_remove),
};
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
static int __init generic_onenand_init(void)
{
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index fd40634..5a9c4f6 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -815,7 +815,7 @@ static void __exit omap2_onenand_exit(void)
module_init(omap2_onenand_init);
module_exit(omap2_onenand_exit);
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jarkko Lavinen <jarkko.lavinen@nokia.com>");
MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3");
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 168/247] libata: no special completion processing for EH commands
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (106 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 167/247] mtd: add "platform:" prefix for platform modalias Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 169/247] MIPS: MTX-1: Make au1000_eth probe all PHY addresses Paul Gortmaker
` (78 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tejun Heo, Jeff Garzik, Paul Gortmaker
From: Tejun Heo <tj@kernel.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f08dc1ac6b15c681f4643d8da1700e06c3855608 upstream.
ata_qc_complete() contains special handling for certain commands. For
example, it schedules EH for device revalidation after certain
configurations are changed. These shouldn't be applied to EH
commands but they were.
In most cases, it doesn't cause an actual problem because EH doesn't
issue any command which would trigger special handling; however, ACPI
can issue such commands via _GTF which can cause weird interactions.
Restructure ata_qc_complete() such that EH commands are always passed
on to __ata_qc_complete().
stable: Please apply to -stable only after 2.6.38 is released.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Kyle McMartin <kyle@mcmartin.ca>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/libata-core.c | 24 +++++++++++++++---------
1 files changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 5405b36..6e4b795 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5038,9 +5038,6 @@ static void ata_verify_xfer(struct ata_queued_cmd *qc)
{
struct ata_device *dev = qc->dev;
- if (ata_tag_internal(qc->tag))
- return;
-
if (ata_is_nodata(qc->tf.protocol))
return;
@@ -5084,14 +5081,23 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
if (unlikely(qc->err_mask))
qc->flags |= ATA_QCFLAG_FAILED;
- if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
- /* always fill result TF for failed qc */
+ /*
+ * Finish internal commands without any further processing
+ * and always with the result TF filled.
+ */
+ if (unlikely(ata_tag_internal(qc->tag))) {
fill_result_tf(qc);
+ __ata_qc_complete(qc);
+ return;
+ }
- if (!ata_tag_internal(qc->tag))
- ata_qc_schedule_eh(qc);
- else
- __ata_qc_complete(qc);
+ /*
+ * Non-internal qc has failed. Fill the result TF and
+ * summon EH.
+ */
+ if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
+ fill_result_tf(qc);
+ ata_qc_schedule_eh(qc);
return;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 169/247] MIPS: MTX-1: Make au1000_eth probe all PHY addresses
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (107 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 168/247] libata: no special completion processing for EH commands Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 170/247] x86/mm: Handle mm_fault_error() in kernel space Paul Gortmaker
` (77 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Florian Fainelli, Ralf Baechle, Paul Gortmaker
From: Florian Fainelli <florian@openwrt.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bf3a1eb85967dcbaae42f4fcb53c2392cec32677 upstream.
When au1000_eth probes the MII bus for PHY address, if we do not set
au1000_eth platform data's phy_search_highest_address, the MII probing
logic will exit early and will assume a valid PHY is found at address 0.
For MTX-1, the PHY is at address 31, and without this patch, the link
detection/speed/duplex would not work correctly.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/2111/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/mips/alchemy/mtx-1/platform.c | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/arch/mips/alchemy/mtx-1/platform.c b/arch/mips/alchemy/mtx-1/platform.c
index e30e42a..956f946 100644
--- a/arch/mips/alchemy/mtx-1/platform.c
+++ b/arch/mips/alchemy/mtx-1/platform.c
@@ -28,6 +28,8 @@
#include <linux/mtd/physmap.h>
#include <mtd/mtd-abi.h>
+#include <asm/mach-au1x00/au1xxx_eth.h>
+
static struct gpio_keys_button mtx1_gpio_button[] = {
{
.gpio = 207,
@@ -140,10 +142,17 @@ static struct __initdata platform_device * mtx1_devs[] = {
&mtx1_mtd,
};
+static struct au1000_eth_platform_data mtx1_au1000_eth0_pdata = {
+ .phy_search_highest_addr = 1,
+ .phy1_search_mac0 = 1,
+};
+
static int __init mtx1_register_devices(void)
{
int rc;
+ au1xxx_override_eth_cfg(0, &mtx1_au1000_eth0_pdata);
+
rc = gpio_request(mtx1_gpio_button[0].gpio,
mtx1_gpio_button[0].desc);
if (rc < 0) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 170/247] x86/mm: Handle mm_fault_error() in kernel space
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (108 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 169/247] MIPS: MTX-1: Make au1000_eth probe all PHY addresses Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:33 ` [34-longterm 171/247] ftrace: Fix memory leak with function graph and cpu hotplug Paul Gortmaker
` (76 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Andrey Vagin, Andrew Morton, Ingo Molnar,
Paul Gortmaker
From: Andrey Vagin <avagin@openvz.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f86268549f424f83b9eb0963989270e14fbfc3de upstream.
mm_fault_error() should not execute oom-killer, if page fault
occurs in kernel space. E.g. in copy_from_user()/copy_to_user().
This would happen if we find ourselves in OOM on a
copy_to_user(), or a copy_from_user() which faults.
Without this patch, the kernels hangs up in copy_from_user(),
because OOM killer sends SIG_KILL to current process, but it
can't handle a signal while in syscall, then the kernel returns
to copy_from_user(), reexcute current command and provokes
page_fault again.
With this patch the kernel return -EFAULT from copy_from_user().
The code, which checks that page fault occurred in kernel space,
has been copied from do_sigbus().
This situation is handled by the same way on powerpc, xtensa,
tile, ...
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
LKML-Reference: <201103092322.p29NMNPH001682@imap1.linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/mm/fault.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 4c4508e..544ed25 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -831,6 +831,13 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
unsigned long address, unsigned int fault)
{
if (fault & VM_FAULT_OOM) {
+ /* Kernel mode? Handle exceptions or die: */
+ if (!(error_code & PF_USER)) {
+ up_read(¤t->mm->mmap_sem);
+ no_context(regs, error_code, address);
+ return;
+ }
+
out_of_memory(regs, error_code, address);
} else {
if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON))
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 171/247] ftrace: Fix memory leak with function graph and cpu hotplug
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (109 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 170/247] x86/mm: Handle mm_fault_error() in kernel space Paul Gortmaker
@ 2011-06-23 17:33 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 172/247] x86: Fix panic when handling "mem={invalid}" param Paul Gortmaker
` (75 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:33 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Steven Rostedt, Steven Rostedt, Paul Gortmaker
From: Steven Rostedt <srostedt@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 868baf07b1a259f5f3803c1dc2777b6c358f83cf upstream.
When the fuction graph tracer starts, it needs to make a special
stack for each task to save the real return values of the tasks.
All running tasks have this stack created, as well as any new
tasks.
On CPU hot plug, the new idle task will allocate a stack as well
when init_idle() is called. The problem is that cpu hotplug does
not create a new idle_task. Instead it uses the idle task that
existed when the cpu went down.
ftrace_graph_init_task() will add a new ret_stack to the task
that is given to it. Because a clone will make the task
have a stack of its parent it does not check if the task's
ret_stack is already NULL or not. When the CPU hotplug code
starts a CPU up again, it will allocate a new stack even
though one already existed for it.
The solution is to treat the idle_task specially. In fact, the
function_graph code already does, just not at init_idle().
Instead of using the ftrace_graph_init_task() for the idle task,
which that function expects the task to be a clone, have a
separate ftrace_graph_init_idle_task(). Also, we will create a
per_cpu ret_stack that is used by the idle task. When we call
ftrace_graph_init_idle_task() it will check if the idle task's
ret_stack is NULL, if it is, then it will assign it the per_cpu
ret_stack.
Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Suggested-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/ftrace.h | 2 +
kernel/sched.c | 2 +-
kernel/trace/ftrace.c | 52 +++++++++++++++++++++++++++++++++++++++++------
3 files changed, 48 insertions(+), 8 deletions(-)
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 01e6ade..95d9122 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -417,6 +417,7 @@ extern void unregister_ftrace_graph(void);
extern void ftrace_graph_init_task(struct task_struct *t);
extern void ftrace_graph_exit_task(struct task_struct *t);
+extern void ftrace_graph_init_idle_task(struct task_struct *t, int cpu);
static inline int task_curr_ret_stack(struct task_struct *t)
{
@@ -440,6 +441,7 @@ static inline void unpause_graph_tracing(void)
static inline void ftrace_graph_init_task(struct task_struct *t) { }
static inline void ftrace_graph_exit_task(struct task_struct *t) { }
+static inline void ftrace_graph_init_idle_task(struct task_struct *t, int cpu) { }
static inline int task_curr_ret_stack(struct task_struct *tsk)
{
diff --git a/kernel/sched.c b/kernel/sched.c
index 7e728cf..245458e 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5252,7 +5252,7 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
* The idle tasks have their own, simple scheduling class:
*/
idle->sched_class = &idle_sched_class;
- ftrace_graph_init_task(idle);
+ ftrace_graph_init_idle_task(idle, cpu);
}
/*
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 73dedb3..e28af02 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3268,7 +3268,7 @@ static int start_graph_tracing(void)
/* The cpu_boot init_task->ret_stack will never be freed */
for_each_online_cpu(cpu) {
if (!idle_task(cpu)->ret_stack)
- ftrace_graph_init_task(idle_task(cpu));
+ ftrace_graph_init_idle_task(idle_task(cpu), cpu);
}
do {
@@ -3358,6 +3358,49 @@ void unregister_ftrace_graph(void)
mutex_unlock(&ftrace_lock);
}
+static DEFINE_PER_CPU(struct ftrace_ret_stack *, idle_ret_stack);
+
+static void
+graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
+{
+ atomic_set(&t->tracing_graph_pause, 0);
+ atomic_set(&t->trace_overrun, 0);
+ t->ftrace_timestamp = 0;
+ /* make curr_ret_stack visable before we add the ret_stack */
+ smp_wmb();
+ t->ret_stack = ret_stack;
+}
+
+/*
+ * Allocate a return stack for the idle task. May be the first
+ * time through, or it may be done by CPU hotplug online.
+ */
+void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
+{
+ t->curr_ret_stack = -1;
+ /*
+ * The idle task has no parent, it either has its own
+ * stack or no stack at all.
+ */
+ if (t->ret_stack)
+ WARN_ON(t->ret_stack != per_cpu(idle_ret_stack, cpu));
+
+ if (ftrace_graph_active) {
+ struct ftrace_ret_stack *ret_stack;
+
+ ret_stack = per_cpu(idle_ret_stack, cpu);
+ if (!ret_stack) {
+ ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH
+ * sizeof(struct ftrace_ret_stack),
+ GFP_KERNEL);
+ if (!ret_stack)
+ return;
+ per_cpu(idle_ret_stack, cpu) = ret_stack;
+ }
+ graph_init_task(t, ret_stack);
+ }
+}
+
/* Allocate a return stack for newly created task */
void ftrace_graph_init_task(struct task_struct *t)
{
@@ -3373,12 +3416,7 @@ void ftrace_graph_init_task(struct task_struct *t)
GFP_KERNEL);
if (!ret_stack)
return;
- atomic_set(&t->tracing_graph_pause, 0);
- atomic_set(&t->trace_overrun, 0);
- t->ftrace_timestamp = 0;
- /* make curr_ret_stack visable before we add the ret_stack */
- smp_wmb();
- t->ret_stack = ret_stack;
+ graph_init_task(t, ret_stack);
}
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 172/247] x86: Fix panic when handling "mem={invalid}" param
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (110 preceding siblings ...)
2011-06-23 17:33 ` [34-longterm 171/247] ftrace: Fix memory leak with function graph and cpu hotplug Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 173/247] x86: Emit "mem=nopentium ignored" warning when not supported Paul Gortmaker
` (74 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kamal Mostafa, Ingo Molnar, Paul Gortmaker
From: Kamal Mostafa <kamal@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 77eed821accf5dd962b1f13bed0680e217e49112 upstream.
Avoid removing all of memory and panicing when "mem={invalid}"
is specified, e.g. mem=blahblah, mem=0, or mem=nopentium (on
platforms other than x86_32).
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
BugLink: http://bugs.launchpad.net/bugs/553464
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Len Brown <len.brown@intel.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
LKML-Reference: <1296783486-23033-1-git-send-email-kamal@canonical.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/e820.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 7bca3c6..4267f42 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -989,6 +989,9 @@ static int __init parse_memopt(char *p)
userdef = 1;
mem_size = memparse(p, &p);
+ /* don't remove all of memory when handling "mem={invalid}" param */
+ if (mem_size == 0)
+ return -EINVAL;
e820_remove_range(mem_size, ULLONG_MAX - mem_size, E820_RAM, 1);
return 0;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 173/247] x86: Emit "mem=nopentium ignored" warning when not supported
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (111 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 172/247] x86: Fix panic when handling "mem={invalid}" param Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 174/247] ahci: AHCI and RAID mode SATA patch for Intel Patsburg DeviceIDs Paul Gortmaker
` (73 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kamal Mostafa, Ingo Molnar, Paul Gortmaker
From: Kamal Mostafa <kamal@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9a6d44b9adb777ca9549e88cd55bd8f2673c52a2 upstream.
Emit warning when "mem=nopentium" is specified on any arch other
than x86_32 (the only that arch supports it).
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
BugLink: http://bugs.launchpad.net/bugs/553464
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Len Brown <len.brown@intel.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
LKML-Reference: <1296783486-23033-2-git-send-email-kamal@canonical.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/e820.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 4267f42..41ac10e 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -980,12 +980,15 @@ static int __init parse_memopt(char *p)
if (!p)
return -EINVAL;
-#ifdef CONFIG_X86_32
if (!strcmp(p, "nopentium")) {
+#ifdef CONFIG_X86_32
setup_clear_cpu_cap(X86_FEATURE_PSE);
return 0;
- }
+#else
+ printk(KERN_WARNING "mem=nopentium ignored! (only supported on x86_32)\n");
+ return -EINVAL;
#endif
+ }
userdef = 1;
mem_size = memparse(p, &p);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 174/247] ahci: AHCI and RAID mode SATA patch for Intel Patsburg DeviceIDs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (112 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 173/247] x86: Emit "mem=nopentium ignored" warning when not supported Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 175/247] ahci: AHCI mode SATA patch for Intel DH89xxCC DeviceIDs Paul Gortmaker
` (72 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Seth Heasley, Jeff Garzik, Paul Gortmaker
From: Seth Heasley <seth.heasley@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 992b3fb9b5391bc4de5b42bb810dc6dd583a6c4a upstream.
This patch adds the Intel Patsburg (PCH) SATA AHCI and RAID Controller
DeviceIDs.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/ahci.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index c12aa05..4cae519 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -596,6 +596,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT RAID */
{ PCI_VDEVICE(INTEL, 0x1c06), board_ahci }, /* CPT RAID */
{ PCI_VDEVICE(INTEL, 0x1c07), board_ahci }, /* CPT RAID */
+ { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
+ { PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
+ { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */
{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 175/247] ahci: AHCI mode SATA patch for Intel DH89xxCC DeviceIDs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (113 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 174/247] ahci: AHCI and RAID mode SATA patch for Intel Patsburg DeviceIDs Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 176/247] ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller Paul Gortmaker
` (71 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Seth Heasley, Jeff Garzik, Paul Gortmaker
From: Seth Heasley <seth.heasley@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a4a461a6df6c0481d5a3d61660ed97f5b539cf16 upstream.
This patch adds the AHCI-mode SATA DeviceID for the Intel DH89xxCC PCH.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/ahci.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 4cae519..a297e43 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -599,6 +599,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
{ PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
{ PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
+ { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */
{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 176/247] ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (114 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 175/247] ahci: AHCI mode SATA patch for Intel DH89xxCC DeviceIDs Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 177/247] RDMA/cma: Fix crash in request handlers Paul Gortmaker
` (70 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Seth Heasley, Jeff Garzik, Paul Gortmaker
From: Seth Heasley <seth.heasley@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 64a3903d0885879ba8706a8bcf71c5e3e7664db2 upstream.
This patch adds an updated SATA RAID DeviceID for the Intel Patsburg PCH.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/ahci.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a297e43..9215998 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -599,6 +599,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
{ PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
{ PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
+ { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */
{ PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 177/247] RDMA/cma: Fix crash in request handlers
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (115 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 176/247] ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 178/247] IB/cm: Bump reference count on cm_id before invoking callback Paul Gortmaker
` (69 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Sean Hefty, Roland Dreier, Paul Gortmaker
From: Sean Hefty <sean.hefty@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 25ae21a10112875763c18b385624df713a288a05 upstream.
Doug Ledford and Red Hat reported a crash when running the rdma_cm on
a real-time OS. The crash has the following call trace:
cm_process_work
cma_req_handler
cma_disable_callback
rdma_create_id
kzalloc
init_completion
cma_get_net_info
cma_save_net_info
cma_any_addr
cma_zero_addr
rdma_translate_ip
rdma_copy_addr
cma_acquire_dev
rdma_addr_get_sgid
ib_find_cached_gid
cma_attach_to_dev
ucma_event_handler
kzalloc
ib_copy_ah_attr_to_user
cma_comp
[ preempted ]
cma_write
copy_from_user
ucma_destroy_id
copy_from_user
_ucma_find_context
ucma_put_ctx
ucma_free_ctx
rdma_destroy_id
cma_exch
cma_cancel_operation
rdma_node_get_transport
rt_mutex_slowunlock
bad_area_nosemaphore
oops_enter
They were able to reproduce the crash multiple times with the
following details:
Crash seems to always happen on the:
mutex_unlock(&conn_id->handler_mutex);
as conn_id looks to have been freed during this code path.
An examination of the code shows that a race exists in the request
handlers. When a new connection request is received, the rdma_cm
allocates a new connection identifier. This identifier has a single
reference count on it. If a user calls rdma_destroy_id() from another
thread after receiving a callback, rdma_destroy_id will proceed to
destroy the id and free the associated memory. However, the request
handlers may still be in the process of running. When control returns
to the request handlers, they can attempt to access the newly created
identifiers.
Fix this by holding a reference on the newly created rdma_cm_id until
the request handler is through accessing it.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/infiniband/core/cma.c | 15 +++++++++++++++
1 files changed, 15 insertions(+), 0 deletions(-)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 6d77706..42f8e8a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1137,6 +1137,11 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
cm_id->context = conn_id;
cm_id->cm_handler = cma_ib_handler;
+ /*
+ * Protect against the user destroying conn_id from another thread
+ * until we're done accessing it.
+ */
+ atomic_inc(&conn_id->refcount);
ret = conn_id->id.event_handler(&conn_id->id, &event);
if (!ret) {
/*
@@ -1149,8 +1154,10 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
ib_send_cm_mra(cm_id, CMA_CM_MRA_SETTING, NULL, 0);
mutex_unlock(&lock);
mutex_unlock(&conn_id->handler_mutex);
+ cma_deref_id(conn_id);
goto out;
}
+ cma_deref_id(conn_id);
/* Destroy the CM ID by returning a non-zero value. */
conn_id->cm_id.ib = NULL;
@@ -1352,17 +1359,25 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id,
event.param.conn.private_data_len = iw_event->private_data_len;
event.param.conn.initiator_depth = attr.max_qp_init_rd_atom;
event.param.conn.responder_resources = attr.max_qp_rd_atom;
+
+ /*
+ * Protect against the user destroying conn_id from another thread
+ * until we're done accessing it.
+ */
+ atomic_inc(&conn_id->refcount);
ret = conn_id->id.event_handler(&conn_id->id, &event);
if (ret) {
/* User wants to destroy the CM ID */
conn_id->cm_id.iw = NULL;
cma_exch(conn_id, CMA_DESTROYING);
mutex_unlock(&conn_id->handler_mutex);
+ cma_deref_id(conn_id);
rdma_destroy_id(&conn_id->id);
goto out;
}
mutex_unlock(&conn_id->handler_mutex);
+ cma_deref_id(conn_id);
out:
if (dev)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 178/247] IB/cm: Bump reference count on cm_id before invoking callback
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (116 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 177/247] RDMA/cma: Fix crash in request handlers Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 179/247] x86, quirk: Fix SB600 revision check Paul Gortmaker
` (68 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Sean Hefty, Roland Dreier, Paul Gortmaker
From: Sean Hefty <sean.hefty@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 29963437a48475036353b95ab142bf199adb909e upstream.
When processing a SIDR REQ, the ib_cm allocates a new cm_id. The
refcount of the cm_id is initialized to 1. However, cm_process_work
will decrement the refcount after invoking all callbacks. The result
is that the cm_id will end up with refcount set to 0 by the end of the
sidr req handler.
If a user tries to destroy the cm_id, the destruction will proceed,
under the incorrect assumption that no other threads are referencing
the cm_id. This can lead to a crash when the cm callback thread tries
to access the cm_id.
This problem was noticed as part of a larger investigation with kernel
crashes in the rdma_cm when running on a real time OS.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/infiniband/core/cm.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index ad63b79..2422945 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -2987,6 +2987,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
goto out; /* No match. */
}
atomic_inc(&cur_cm_id_priv->refcount);
+ atomic_inc(&cm_id_priv->refcount);
spin_unlock_irq(&cm.lock);
cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 179/247] x86, quirk: Fix SB600 revision check
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (117 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 178/247] IB/cm: Bump reference count on cm_id before invoking callback Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 180/247] ath9k_hw: Fix incorrect macversion and macrev checks Paul Gortmaker
` (67 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Andreas Herrmann, Ingo Molnar, Paul Gortmaker
From: Andreas Herrmann <andreas.herrmann3@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1d3e09a304e6c4e004ca06356578b171e8735d3c upstream.
Commit 7f74f8f28a2bd9db9404f7d364e2097a0c42cc12
(x86 quirk: Fix polarity for IRQ0 pin2 override on SB800
systems) introduced a regression. It removed some SB600 specific
code to determine the revision ID without adapting a
corresponding revision ID check for SB600.
See this mail thread:
http://marc.info/?l=linux-kernel&m=129980296006380&w=2
This patch adapts the corresponding check to cover all SB600
revisions.
Tested-by: Wang Lei <f3d27b@gmail.com>
Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <20110315143137.GD29499@alberich.amd.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/early-quirks.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index ef01d3d..f67a33c7 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -161,7 +161,12 @@ static void __init ati_bugs_contd(int num, int slot, int func)
if (rev >= 0x40)
acpi_fix_pin2_polarity = 1;
- if (rev > 0x13)
+ /*
+ * SB600: revisions 0x11, 0x12, 0x13, 0x14, ...
+ * SB700: revisions 0x39, 0x3a, ...
+ * SB800: revisions 0x40, 0x41, ...
+ */
+ if (rev >= 0x39)
return;
if (acpi_use_timer_override)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 180/247] ath9k_hw: Fix incorrect macversion and macrev checks
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (118 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 179/247] x86, quirk: Fix SB600 revision check Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 181/247] USB: serial/kobil_sct, fix potential tty NULL dereference Paul Gortmaker
` (66 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Senthil Balasubramanian, John W. Linville,
Paul Gortmaker
From: Senthil Balasubramanian <senthilkumar@atheros.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ac45c12dfb3f727a5a7a3332ed9c11b4a5ab287e upstream.
There are few places where we are checking for macversion and revsions
before RTC is powered ON. However we are reading the macversion and
revisions only after RTC is powered ON and so both macversion and
revisions are actully zero and this leads to incorrect srev checks
Incorrect srev checks can cause registers to be configured wrongly and can
cause unexpected behavior. Fixing this seems to address the ASPM issue that
we have observed. The laptop becomes very slow and hangs mostly with ASPM L1
enabled without this fix.
fix this by reading the macversion and revisisons even before we start
using them. There is no reason why should we delay reading this info
until RTC is powered on as this is just a register information.
Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/ath/ath9k/hw.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1774a59..28d3d51 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -850,6 +850,8 @@ int ath9k_hw_init(struct ath_hw *ah)
ath9k_hw_init_defaults(ah);
ath9k_hw_init_config(ah);
+ ath9k_hw_read_revisions(ah);
+
if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
ath_print(common, ATH_DBG_FATAL,
"Couldn't reset chip\n");
@@ -1770,8 +1772,6 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
return false;
}
- ath9k_hw_read_revisions(ah);
-
return ath9k_hw_set_reset(ah, ATH9K_RESET_WARM);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 181/247] USB: serial/kobil_sct, fix potential tty NULL dereference
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (119 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 180/247] ath9k_hw: Fix incorrect macversion and macrev checks Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 182/247] USB: serial: ch341: add new id Paul Gortmaker
` (65 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jiri Slaby, Greg Kroah-Hartman, Paul Gortmaker
From: Jiri Slaby <jslaby@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6960f40a954619857e7095a6179eef896f297077 upstream.
Make sure that we check the return value of tty_port_tty_get.
Sometimes it may return NULL and we later dereference that.
The only place here is in kobil_read_int_callback, so fix it.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/kobil_sct.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index bd5bd85..b382d9a 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -372,7 +372,7 @@ static void kobil_read_int_callback(struct urb *urb)
}
tty = tty_port_tty_get(&port->port);
- if (urb->actual_length) {
+ if (tty && urb->actual_length) {
/* BEGIN DEBUG */
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 182/247] USB: serial: ch341: add new id
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (120 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 181/247] USB: serial/kobil_sct, fix potential tty NULL dereference Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 183/247] xhci: Fix cycle bit calculation during stall handling Paul Gortmaker
` (64 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, wangyanqing, Greg Kroah-Hartman, Paul Gortmaker
From: wangyanqing <udknight@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d0781383038e983a63843a9a6a067ed781db89c1 upstream.
I picked up a new DAK-780EX(professional digitl reverb/mix system),
which use CH341T chipset to communication with computer on 3/2011
and the CH341T's vendor code is 1a86
Looking up the CH341T's vendor and product id's I see:
1a86 QinHeng Electronics
5523 CH341 in serial mode, usb to serial port converter
CH341T,CH341 are the products of the same company, maybe
have some common hardware, and I test the ch341.c works
well with CH341T
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ch341.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index c467850..a1c9625 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -75,6 +75,7 @@ static int debug;
static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x4348, 0x5523) },
{ USB_DEVICE(0x1a86, 0x7523) },
+ { USB_DEVICE(0x1a86, 0x5523) },
{ },
};
MODULE_DEVICE_TABLE(usb, id_table);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 183/247] xhci: Fix cycle bit calculation during stall handling.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (121 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 182/247] USB: serial: ch341: add new id Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 184/247] ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs Paul Gortmaker
` (63 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Sarah Sharp, Paul Gortmaker
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 01a1fdb9a7afa5e3c14c9316d6f380732750b4e4 upstream.
When an endpoint stalls, we need to update the xHCI host's internal
dequeue pointer to move it past the stalled transfer. This includes
updating the cycle bit (TRB ownership bit) if we have moved the dequeue
pointer past a link TRB with the toggle cycle bit set.
When we're trying to find the new dequeue segment, find_trb_seg() is
supposed to keep track of whether we've passed any link TRBs with the
toggle cycle bit set. However, this while loop's body
while (cur_seg->trbs > trb ||
&cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) {
Will never get executed if the ring only contains one segment.
find_trb_seg() will return immediately, without updating the new cycle
bit. Since find_trb_seg() has no idea where in the segment the TD that
stalled was, make the caller, xhci_find_new_dequeue_state(), check for
this special case and update the cycle bit accordingly.
This patch should be queued to kernels all the way back to 2.6.31.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-ring.c | 14 ++++++++++++++
1 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 34ce5d4..3aa5c29 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -418,6 +418,20 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
state->new_cycle_state = ~(state->new_cycle_state) & 0x1;
next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+ /*
+ * If there is only one segment in a ring, find_trb_seg()'s while loop
+ * will not run, and it will return before it has a chance to see if it
+ * needs to toggle the cycle bit. It can't tell if the stalled transfer
+ * ended just before the link TRB on a one-segment ring, or if the TD
+ * wrapped around the top of the ring, because it doesn't have the TD in
+ * question. Look for the one-segment case where stalled TRB's address
+ * is greater than the new dequeue pointer address.
+ */
+ if (ep_ring->first_seg == ep_ring->first_seg->next &&
+ state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
+ state->new_cycle_state ^= 0x1;
+ xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state);
+
/* Don't update the ring cycle state for the producer (us). */
xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n",
state->new_deq_seg);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 184/247] ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (122 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 183/247] xhci: Fix cycle bit calculation during stall handling Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 185/247] PCI: remove quirk for pre-production systems Paul Gortmaker
` (62 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vitaliy Kulikov, Takashi Iwai, Paul Gortmaker
From: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 094a42452abd5564429045e210281c6d22e67fca upstream.
When the mux for digital mic is different from the mux for other mics,
the current auto-parser doesn't handle them in a right way but provides
only one mic. This patch fixes the issue.
Signed-off-by: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_sigmatel.c | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6cf2dd4..02b813ef6 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -735,7 +735,7 @@ static int stac92xx_mux_enum_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
struct sigmatel_spec *spec = codec->spec;
unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
const struct hda_input_mux *imux = spec->input_mux;
- unsigned int idx, prev_idx;
+ unsigned int idx, prev_idx, didx;
idx = ucontrol->value.enumerated.item[0];
if (idx >= imux->num_items)
@@ -747,7 +747,8 @@ static int stac92xx_mux_enum_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
snd_hda_codec_write_cache(codec, spec->mux_nids[adc_idx], 0,
AC_VERB_SET_CONNECT_SEL,
imux->items[idx].index);
- if (prev_idx >= spec->num_analog_muxes) {
+ if (prev_idx >= spec->num_analog_muxes &&
+ spec->mux_nids[adc_idx] != spec->dmux_nids[adc_idx]) {
imux = spec->dinput_mux;
/* 0 = analog */
snd_hda_codec_write_cache(codec,
@@ -757,9 +758,13 @@ static int stac92xx_mux_enum_put(struct snd_kcontrol *kcontrol, struct snd_ctl_e
}
} else {
imux = spec->dinput_mux;
+ /* first dimux item is hardcoded to select analog imux,
+ * so lets skip it
+ */
+ didx = idx - spec->num_analog_muxes + 1;
snd_hda_codec_write_cache(codec, spec->dmux_nids[adc_idx], 0,
AC_VERB_SET_CONNECT_SEL,
- imux->items[idx - 1].index);
+ imux->items[didx].index);
}
spec->cur_mux[adc_idx] = idx;
return 1;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 185/247] PCI: remove quirk for pre-production systems
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (123 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 184/247] ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 186/247] PCI: add more checking to ICH region quirks Paul Gortmaker
` (61 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Brandeburg, Jesse, Jesse Barnes, Paul Gortmaker
From: Brandeburg, Jesse <jesse.brandeburg@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b99af4b002e4908d1a5cdaf424529bdf1dc69768 upstream.
Revert commit 7eb93b175d4de9438a4b0af3a94a112cb5266944
Author: Yu Zhao <yu.zhao@intel.com>
Date: Fri Apr 3 15:18:11 2009 +0800
PCI: SR-IOV quirk for Intel 82576 NIC
If BIOS doesn't allocate resources for the SR-IOV BARs, zero the Flash
BAR and program the SR-IOV BARs to use the old Flash Memory Space.
Please refer to Intel 82576 Gigabit Ethernet Controller Datasheet
section 7.9.2.14.2 for details.
http://download.intel.com/design/network/datashts/82576_Datasheet.pdf
Signed-off-by: Yu Zhao <yu.zhao@intel.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
This quirk was added before SR-IOV was in production and now all machines that
originally had this issue alreayd have bios updates to correct the issue. The
quirk itself is no longer needed and in fact causes bugs if run. Remove it.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
CC: Yu Zhao <yu.zhao@intel.com>
CC: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/quirks.c | 52 --------------------------------------------------
1 files changed, 0 insertions(+), 52 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ccc2683..c5f5f44 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2529,58 +2529,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4375,
#endif /* CONFIG_PCI_MSI */
-#ifdef CONFIG_PCI_IOV
-
-/*
- * For Intel 82576 SR-IOV NIC, if BIOS doesn't allocate resources for the
- * SR-IOV BARs, zero the Flash BAR and program the SR-IOV BARs to use the
- * old Flash Memory Space.
- */
-static void __devinit quirk_i82576_sriov(struct pci_dev *dev)
-{
- int pos, flags;
- u32 bar, start, size;
-
- if (PAGE_SIZE > 0x10000)
- return;
-
- flags = pci_resource_flags(dev, 0);
- if ((flags & PCI_BASE_ADDRESS_SPACE) !=
- PCI_BASE_ADDRESS_SPACE_MEMORY ||
- (flags & PCI_BASE_ADDRESS_MEM_TYPE_MASK) !=
- PCI_BASE_ADDRESS_MEM_TYPE_32)
- return;
-
- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV);
- if (!pos)
- return;
-
- pci_read_config_dword(dev, pos + PCI_SRIOV_BAR, &bar);
- if (bar & PCI_BASE_ADDRESS_MEM_MASK)
- return;
-
- start = pci_resource_start(dev, 1);
- size = pci_resource_len(dev, 1);
- if (!start || size != 0x400000 || start & (size - 1))
- return;
-
- pci_resource_flags(dev, 1) = 0;
- pci_write_config_dword(dev, PCI_BASE_ADDRESS_1, 0);
- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR, start);
- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR + 12, start + size / 2);
-
- dev_info(&dev->dev, "use Flash Memory Space for SR-IOV BARs\n");
-}
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10c9, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e6, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov);
-
-#endif /* CONFIG_PCI_IOV */
-
/*
* This is a quirk for the Ricoh MMC controller found as a part of
* some mulifunction chips.
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 186/247] PCI: add more checking to ICH region quirks
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (124 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 185/247] PCI: remove quirk for pre-production systems Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 187/247] PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH Paul Gortmaker
` (60 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jiri Slaby, Jesse Barnes, Paul Gortmaker
From: Jiri Slaby <jslaby@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit cdb9755849fbaf2bb9c0a009ba5baa817a0f152d upstream.
Per ICH4 and ICH6 specs, ACPI and GPIO regions are valid iff ACPI_EN
and GPIO_EN bits are set to 1. Add checks for these bits into the
quirks prior to the region creation.
While at it, name the constants by macros.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Renninger <trenn@suse.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/quirks.c | 45 +++++++++++++++++++++++++++++++++++++--------
1 files changed, 37 insertions(+), 8 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c5f5f44..48b13bb 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -519,6 +519,17 @@ static void __devinit quirk_piix4_acpi(struct pci_dev *dev)
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3, quirk_piix4_acpi);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443MX_3, quirk_piix4_acpi);
+#define ICH_PMBASE 0x40
+#define ICH_ACPI_CNTL 0x44
+#define ICH4_ACPI_EN 0x10
+#define ICH6_ACPI_EN 0x80
+#define ICH4_GPIOBASE 0x58
+#define ICH4_GPIO_CNTL 0x5c
+#define ICH4_GPIO_EN 0x10
+#define ICH6_GPIOBASE 0x48
+#define ICH6_GPIO_CNTL 0x4c
+#define ICH6_GPIO_EN 0x10
+
/*
* ICH4, ICH4-M, ICH5, ICH5-M ACPI: Three IO regions pointed to by longwords at
* 0x40 (128 bytes of ACPI, GPIO & TCO registers)
@@ -527,12 +538,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443MX_3, qui
static void __devinit quirk_ich4_lpc_acpi(struct pci_dev *dev)
{
u32 region;
+ u8 enable;
- pci_read_config_dword(dev, 0x40, ®ion);
- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH4 ACPI/GPIO/TCO");
+ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
+ if (enable & ICH4_ACPI_EN) {
+ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
+ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+ "ICH4 ACPI/GPIO/TCO");
+ }
- pci_read_config_dword(dev, 0x58, ®ion);
- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH4 GPIO");
+ pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable);
+ if (enable & ICH4_GPIO_EN) {
+ pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion);
+ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
+ "ICH4 GPIO");
+ }
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_0, quirk_ich4_lpc_acpi);
@@ -548,12 +568,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_1, qui
static void __devinit ich6_lpc_acpi_gpio(struct pci_dev *dev)
{
u32 region;
+ u8 enable;
- pci_read_config_dword(dev, 0x40, ®ion);
- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH6 ACPI/GPIO/TCO");
+ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
+ if (enable & ICH6_ACPI_EN) {
+ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
+ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+ "ICH6 ACPI/GPIO/TCO");
+ }
- pci_read_config_dword(dev, 0x48, ®ion);
- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO");
+ pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable);
+ if (enable & ICH4_GPIO_EN) {
+ pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion);
+ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
+ "ICH6 GPIO");
+ }
}
static void __devinit ich6_lpc_generic_decode(struct pci_dev *dev, unsigned reg, const char *name, int dynsize)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 187/247] PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (125 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 186/247] PCI: add more checking to ICH region quirks Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 188/247] PCI: sysfs: Fix failure path for addition of "vpd" attribute Paul Gortmaker
` (59 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jiri Slaby, Jesse Barnes, Paul Gortmaker
From: Jiri Slaby <jslaby@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 87e3dc3855430bd254370afc79f2ed92250f5b7c upstream.
Some broken BIOSes on ICH4 chipset report an ACPI region which is in
conflict with legacy IDE ports when ACPI is disabled. Even though the
regions overlap, IDE ports are working correctly (we cannot find out
the decoding rules on chipsets).
So the only problem is the reported region itself, if we don't reserve
the region in the quirk everything works as expected.
This patch avoids reserving any quirk regions below PCIBIOS_MIN_IO
which is 0x1000. Some regions might be (and are by a fast google
query) below this border, but the only difference is that they won't
be reserved anymore. They should still work though the same as before.
The conflicts look like (1f.0 is bridge, 1f.1 is IDE ctrl):
pci 0000:00:1f.1: address space collision: [io 0x0170-0x0177] conflicts with 0000:00:1f.0 [io 0x0100-0x017f]
At 0x0100 a 128 bytes long ACPI region is reported in the quirk for
ICH4. ata_piix then fails to find disks because the IDE legacy ports
are zeroed:
ata_piix 0000:00:1f.1: device not available (can't reserve [io 0x0000-0x0007])
References: https://bugzilla.novell.com/show_bug.cgi?id=558740
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Renninger <trenn@suse.de>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/quirks.c | 32 ++++++++++++++++++++++++--------
1 files changed, 24 insertions(+), 8 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 48b13bb..46aca60 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -540,18 +540,30 @@ static void __devinit quirk_ich4_lpc_acpi(struct pci_dev *dev)
u32 region;
u8 enable;
+ /*
+ * The check for PCIBIOS_MIN_IO is to ensure we won't create a conflict
+ * with low legacy (and fixed) ports. We don't know the decoding
+ * priority and can't tell whether the legacy device or the one created
+ * here is really at that address. This happens on boards with broken
+ * BIOSes.
+ */
+
pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
if (enable & ICH4_ACPI_EN) {
pci_read_config_dword(dev, ICH_PMBASE, ®ion);
- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
- "ICH4 ACPI/GPIO/TCO");
+ region &= PCI_BASE_ADDRESS_IO_MASK;
+ if (region >= PCIBIOS_MIN_IO)
+ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+ "ICH4 ACPI/GPIO/TCO");
}
pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable);
if (enable & ICH4_GPIO_EN) {
pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion);
- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
- "ICH4 GPIO");
+ region &= PCI_BASE_ADDRESS_IO_MASK;
+ if (region >= PCIBIOS_MIN_IO)
+ quirk_io_region(dev, region, 64,
+ PCI_BRIDGE_RESOURCES + 1, "ICH4 GPIO");
}
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi);
@@ -573,15 +585,19 @@ static void __devinit ich6_lpc_acpi_gpio(struct pci_dev *dev)
pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
if (enable & ICH6_ACPI_EN) {
pci_read_config_dword(dev, ICH_PMBASE, ®ion);
- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
- "ICH6 ACPI/GPIO/TCO");
+ region &= PCI_BASE_ADDRESS_IO_MASK;
+ if (region >= PCIBIOS_MIN_IO)
+ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+ "ICH6 ACPI/GPIO/TCO");
}
pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable);
if (enable & ICH4_GPIO_EN) {
pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion);
- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
- "ICH6 GPIO");
+ region &= PCI_BASE_ADDRESS_IO_MASK;
+ if (region >= PCIBIOS_MIN_IO)
+ quirk_io_region(dev, region, 64,
+ PCI_BRIDGE_RESOURCES + 1, "ICH6 GPIO");
}
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 188/247] PCI: sysfs: Fix failure path for addition of "vpd" attribute
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (126 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 187/247] PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 189/247] ALSA: ctxfi - Fix incorrect SPDIF status bit mask Paul Gortmaker
` (58 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Jesse Barnes, Paul Gortmaker
From: Ben Hutchings <bhutchings@solarflare.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0f12a4e29368a9476076515881d9ef4e5876c6e2 upstream.
Commit 280c73d ("PCI: centralize the capabilities code in
pci-sysfs.c") changed the initialisation of the "rom" and "vpd"
attributes, and made the failure path for the "vpd" attribute
incorrect. We must free the new attribute structure (attr), but
instead we currently free dev->vpd->attr. That will normally be NULL,
resulting in a memory leak, but it might be a stale pointer, resulting
in a double-free.
Found by inspection; compile-tested only.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/pci-sysfs.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index f5cd68c..e1783bb 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -995,7 +995,7 @@ static int pci_create_capabilities_sysfs(struct pci_dev *dev)
attr->write = write_vpd_attr;
retval = sysfs_create_bin_file(&dev->dev.kobj, attr);
if (retval) {
- kfree(dev->vpd->attr);
+ kfree(attr);
return retval;
}
dev->vpd->attr = attr;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 189/247] ALSA: ctxfi - Fix incorrect SPDIF status bit mask
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (127 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 188/247] PCI: sysfs: Fix failure path for addition of "vpd" attribute Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 190/247] ALSA: ctxfi - Fix SPDIF status retrieval Paul Gortmaker
` (57 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Przemyslaw Bruski, Takashi Iwai, Paul Gortmaker
From: Przemyslaw Bruski <pbruskispam@op.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4c1847e884efddcc3ede371f7839e5e65b25c34d upstream.
SPDIF status mask creation was incorrect.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/ctxfi/ctatc.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
index 1bff80c..b932154 100644
--- a/sound/pci/ctxfi/ctatc.c
+++ b/sound/pci/ctxfi/ctatc.c
@@ -869,7 +869,7 @@ spdif_passthru_playback_setup(struct ct_atc *atc, struct ct_atc_pcm *apcm)
mutex_lock(&atc->atc_mutex);
dao->ops->get_spos(dao, &status);
if (((status >> 24) & IEC958_AES3_CON_FS) != iec958_con_fs) {
- status &= ((~IEC958_AES3_CON_FS) << 24);
+ status &= ~(IEC958_AES3_CON_FS << 24);
status |= (iec958_con_fs << 24);
dao->ops->set_spos(dao, status);
dao->ops->commit_write(dao);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 190/247] ALSA: ctxfi - Fix SPDIF status retrieval
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (128 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 189/247] ALSA: ctxfi - Fix incorrect SPDIF status bit mask Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 191/247] ALSA: ctxfi - Clear input settings before initialization Paul Gortmaker
` (56 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Przemyslaw Bruski, Takashi Iwai, Paul Gortmaker
From: Przemyslaw Bruski <pbruskispam@op.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f164753a263bfd2daaf3e0273b179de7e099c57d upstream.
SDPIF status retrieval always returned the default settings instead of
the actual ones.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/ctxfi/ctmixer.c | 19 +++++--------------
1 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/sound/pci/ctxfi/ctmixer.c b/sound/pci/ctxfi/ctmixer.c
index 15c1e72..c3519ff 100644
--- a/sound/pci/ctxfi/ctmixer.c
+++ b/sound/pci/ctxfi/ctmixer.c
@@ -566,19 +566,6 @@ static int ct_spdif_get_mask(struct snd_kcontrol *kcontrol,
return 0;
}
-static int ct_spdif_default_get(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
-{
- unsigned int status = SNDRV_PCM_DEFAULT_CON_SPDIF;
-
- ucontrol->value.iec958.status[0] = (status >> 0) & 0xff;
- ucontrol->value.iec958.status[1] = (status >> 8) & 0xff;
- ucontrol->value.iec958.status[2] = (status >> 16) & 0xff;
- ucontrol->value.iec958.status[3] = (status >> 24) & 0xff;
-
- return 0;
-}
-
static int ct_spdif_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol)
{
@@ -586,6 +573,10 @@ static int ct_spdif_get(struct snd_kcontrol *kcontrol,
unsigned int status;
atc->spdif_out_get_status(atc, &status);
+
+ if (status == 0)
+ status = SNDRV_PCM_DEFAULT_CON_SPDIF;
+
ucontrol->value.iec958.status[0] = (status >> 0) & 0xff;
ucontrol->value.iec958.status[1] = (status >> 8) & 0xff;
ucontrol->value.iec958.status[2] = (status >> 16) & 0xff;
@@ -629,7 +620,7 @@ static struct snd_kcontrol_new iec958_default_ctl = {
.name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
.count = 1,
.info = ct_spdif_info,
- .get = ct_spdif_default_get,
+ .get = ct_spdif_get,
.put = ct_spdif_put,
.private_value = MIXER_IEC958_DEFAULT
};
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 191/247] ALSA: ctxfi - Clear input settings before initialization
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (129 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 190/247] ALSA: ctxfi - Fix SPDIF status retrieval Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 192/247] SUNRPC: Ensure we always run the tk_callback before tk_action Paul Gortmaker
` (55 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Przemyslaw Bruski, Takashi Iwai, Paul Gortmaker
From: Przemyslaw Bruski <pbruskispam@op.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit efed5f26664f93991c929d5bb343e65f900d72bc upstream.
Clear input settings before initialization.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/ctxfi/ctdaio.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
index af56eb9..47d9ea9 100644
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -176,6 +176,7 @@ static int dao_set_left_input(struct dao *dao, struct rsc *input)
if (!entry)
return -ENOMEM;
+ dao->ops->clear_left_input(dao);
/* Program master and conjugate resources */
input->ops->master(input);
daio->rscl.ops->master(&daio->rscl);
@@ -204,6 +205,7 @@ static int dao_set_right_input(struct dao *dao, struct rsc *input)
if (!entry)
return -ENOMEM;
+ dao->ops->clear_right_input(dao);
/* Program master and conjugate resources */
input->ops->master(input);
daio->rscr.ops->master(&daio->rscr);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 192/247] SUNRPC: Ensure we always run the tk_callback before tk_action
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (130 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 191/247] ALSA: ctxfi - Clear input settings before initialization Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 193/247] perf, powerpc: Handle events that raise an exception without overflowing Paul Gortmaker
` (54 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Trond Myklebust, Paul Gortmaker
From: Trond Myklebust <Trond.Myklebust@netapp.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e020c6800c9621a77223bf2c1ff68180e41e8ebf upstream.
This fixes a race in which the task->tk_callback() puts the rpc_task
to sleep, setting a new callback. Under certain circumstances, the current
code may end up executing the task->tk_action before it gets round to the
callback.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/sunrpc/sched.c | 14 ++++++--------
1 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index aae6907..03a5c9e 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -642,14 +642,12 @@ static void __rpc_execute(struct rpc_task *task)
save_callback = task->tk_callback;
task->tk_callback = NULL;
save_callback(task);
- }
-
- /*
- * Perform the next FSM step.
- * tk_action may be NULL when the task has been killed
- * by someone else.
- */
- if (!RPC_IS_QUEUED(task)) {
+ } else {
+ /*
+ * Perform the next FSM step.
+ * tk_action may be NULL when the task has been killed
+ * by someone else.
+ */
if (task->tk_action == NULL)
break;
task->tk_action(task);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 193/247] perf, powerpc: Handle events that raise an exception without overflowing
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (131 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 192/247] SUNRPC: Ensure we always run the tk_callback before tk_action Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 194/247] ext3: Always set dx_node's fake_dirent explicitly Paul Gortmaker
` (53 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Anton Blanchard, Peter Zijlstra, Ingo Molnar,
Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 upstream.
Events on POWER7 can roll back if a speculative event doesn't
eventually complete. Unfortunately in some rare cases they will
raise a performance monitor exception. We need to catch this to
ensure we reset the PMC. In all cases the PMC will be 256 or less
cycles from overflow.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
LKML-Reference: <20110309143842.6c22845e@kryten>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/include/asm/reg.h | 1 +
arch/powerpc/kernel/perf_event.c | 24 +++++++++++++++++++++++-
2 files changed, 24 insertions(+), 1 deletions(-)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 5572e86..f2ac5a6 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -864,6 +864,7 @@
#define PV_970 0x0039
#define PV_POWER5 0x003A
#define PV_POWER5p 0x003B
+#define PV_POWER7 0x003F
#define PV_970FX 0x003C
#define PV_630 0x0040
#define PV_630p 0x0041
diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
index 08460a2..7a3b2d2 100644
--- a/arch/powerpc/kernel/perf_event.c
+++ b/arch/powerpc/kernel/perf_event.c
@@ -1220,6 +1220,28 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
return ip;
}
+static bool pmc_overflow(unsigned long val)
+{
+ if ((int)val < 0)
+ return true;
+
+ /*
+ * Events on POWER7 can roll back if a speculative event doesn't
+ * eventually complete. Unfortunately in some rare cases they will
+ * raise a performance monitor exception. We need to catch this to
+ * ensure we reset the PMC. In all cases the PMC will be 256 or less
+ * cycles from overflow.
+ *
+ * We only do this if the first pass fails to find any overflowing
+ * PMCs because a user might set a period of less than 256 and we
+ * don't want to mistakenly reset them.
+ */
+ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256))
+ return true;
+
+ return false;
+}
+
/*
* Performance monitor interrupt stuff
*/
@@ -1267,7 +1289,7 @@ static void perf_event_interrupt(struct pt_regs *regs)
if (is_limited_pmc(i + 1))
continue;
val = read_pmc(i + 1);
- if ((int)val < 0)
+ if (pmc_overflow(val))
write_pmc(i + 1, 0);
}
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 194/247] ext3: Always set dx_node's fake_dirent explicitly.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (132 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 193/247] perf, powerpc: Handle events that raise an exception without overflowing Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 195/247] call_function_many: fix list delete vs add race Paul Gortmaker
` (52 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Eric Sandeen, Jan Kara, Paul Gortmaker
From: Eric Sandeen <sandeen@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d7433142b63d727b5a217c37b1a1468b116a9771 upstream.
(crossport of 1f7bebb9e911d870fa8f997ddff838e82b5715ea
by Andreas Schlick <schlick@lavabit.com>)
When ext3_dx_add_entry() has to split an index node, it has to ensure that
name_len of dx_node's fake_dirent is also zero, because otherwise e2fsck
won't recognise it as an intermediate htree node and consider the htree to
be corrupted.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext3/namei.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index ee18408..827b573 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1550,8 +1550,8 @@ static int ext3_dx_add_entry(handle_t *handle, struct dentry *dentry,
goto cleanup;
node2 = (struct dx_node *)(bh2->b_data);
entries2 = node2->entries;
+ memset(&node2->fake, 0, sizeof(struct fake_dirent));
node2->fake.rec_len = ext3_rec_len_to_disk(sb->s_blocksize);
- node2->fake.inode = 0;
BUFFER_TRACE(frame->bh, "get_write_access");
err = ext3_journal_get_write_access(handle, frame->bh);
if (err)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 195/247] call_function_many: fix list delete vs add race
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (133 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 194/247] ext3: Always set dx_node's fake_dirent explicitly Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 196/247] call_function_many: add missing ordering Paul Gortmaker
` (51 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Milton Miller, Linus Torvalds, Paul Gortmaker
From: Milton Miller <miltonm@bga.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 upstream.
Peter pointed out there was nothing preventing the list_del_rcu in
smp_call_function_interrupt from running before the list_add_rcu in
smp_call_function_many.
Fix this by not setting refs until we have gotten the lock for the list.
Take advantage of the wmb in list_add_rcu to save an explicit additional
one.
I tried to force this race with a udelay before the lock & list_add and
by mixing all 64 online cpus with just 3 random cpus in the mask, but
was unsuccessful. Still, inspection shows a valid race, and the fix is
a extension of the existing protection window in the current code.
Reported-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/smp.c | 20 +++++++++++++-------
1 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index 0a9e6bd..de11a66 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -470,14 +470,15 @@ void smp_call_function_many(const struct cpumask *mask,
cpumask_clear_cpu(this_cpu, data->cpumask);
/*
- * To ensure the interrupt handler gets an complete view
- * we order the cpumask and refs writes and order the read
- * of them in the interrupt handler. In addition we may
- * only clear our own cpu bit from the mask.
+ * We reuse the call function data without waiting for any grace
+ * period after some other cpu removes it from the global queue.
+ * This means a cpu might find our data block as it is writen.
+ * The interrupt handler waits until it sees refs filled out
+ * while its cpu mask bit is set; here we may only clear our
+ * own cpu mask bit, and must wait to set refs until we are sure
+ * previous writes are complete and we have obtained the lock to
+ * add the element to the queue.
*/
- smp_wmb();
-
- atomic_set(&data->refs, cpumask_weight(data->cpumask));
raw_spin_lock_irqsave(&call_function.lock, flags);
/*
@@ -486,6 +487,11 @@ void smp_call_function_many(const struct cpumask *mask,
* will not miss any other list entries:
*/
list_add_rcu(&data->csd.list, &call_function.queue);
+ /*
+ * We rely on the wmb() in list_add_rcu to order the writes
+ * to func, data, and cpumask before this write to refs.
+ */
+ atomic_set(&data->refs, cpumask_weight(data->cpumask));
raw_spin_unlock_irqrestore(&call_function.lock, flags);
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 196/247] call_function_many: add missing ordering
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (134 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 195/247] call_function_many: fix list delete vs add race Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 197/247] x86: Flush TLB if PGD entry is changed in i386 PAE mode Paul Gortmaker
` (50 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Milton Miller, Linus Torvalds, Paul Gortmaker
From: Milton Miller <miltonm@bga.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 45a5791920ae643eafc02e2eedef1a58e341b736 upstream.
Paul McKenney's review pointed out two problems with the barriers in the
2.6.38 update to the smp call function many code.
First, a barrier that would force the func and info members of data to
be visible before their consumption in the interrupt handler was
missing. This can be solved by adding a smp_wmb between setting the
func and info members and setting setting the cpumask; this will pair
with the existing and required smp_rmb ordering the cpumask read before
the read of refs. This placement avoids the need a second smp_rmb in
the interrupt handler which would be executed on each of the N cpus
executing the call request. (I was thinking this barrier was present
but was not).
Second, the previous write to refs (establishing the zero that we the
interrupt handler was testing from all cpus) was performed by a third
party cpu. This would invoke transitivity which, as a recient or
concurrent addition to memory-barriers.txt now explicitly states, would
require a full smp_mb().
However, we know the cpumask will only be set by one cpu (the data
owner) and any preivous iteration of the mask would have cleared by the
reading cpu. By redundantly writing refs to 0 on the owning cpu before
the smp_wmb, the write to refs will follow the same path as the writes
that set the cpumask, which in turn allows us to keep the barrier in the
interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
will be be executed by N cpus for each of the possible M elements on the
list).
I moved and expanded the comment about our (ab)use of the rcu list
primitives for the concurrent walk earlier into this function. I
considered moving the first two paragraphs to the queue list head and
lock, but felt it would have been too disconected from the code.
Cc: Paul McKinney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/smp.c | 46 +++++++++++++++++++++++++++++++++-------------
1 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index de11a66..9686dbf 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -462,23 +462,42 @@ void smp_call_function_many(const struct cpumask *mask,
data = &__get_cpu_var(cfd_data);
csd_lock(&data->csd);
- BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
- data->csd.func = func;
- data->csd.info = info;
- cpumask_and(data->cpumask, mask, cpu_online_mask);
- cpumask_clear_cpu(this_cpu, data->cpumask);
+ /* This BUG_ON verifies our reuse assertions and can be removed */
+ BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
/*
+ * The global call function queue list add and delete are protected
+ * by a lock, but the list is traversed without any lock, relying
+ * on the rcu list add and delete to allow safe concurrent traversal.
* We reuse the call function data without waiting for any grace
* period after some other cpu removes it from the global queue.
- * This means a cpu might find our data block as it is writen.
- * The interrupt handler waits until it sees refs filled out
- * while its cpu mask bit is set; here we may only clear our
- * own cpu mask bit, and must wait to set refs until we are sure
- * previous writes are complete and we have obtained the lock to
- * add the element to the queue.
+ * This means a cpu might find our data block as it is being
+ * filled out.
+ *
+ * We hold off the interrupt handler on the other cpu by
+ * ordering our writes to the cpu mask vs our setting of the
+ * refs counter. We assert only the cpu owning the data block
+ * will set a bit in cpumask, and each bit will only be cleared
+ * by the subject cpu. Each cpu must first find its bit is
+ * set and then check that refs is set indicating the element is
+ * ready to be processed, otherwise it must skip the entry.
+ *
+ * On the previous iteration refs was set to 0 by another cpu.
+ * To avoid the use of transitivity, set the counter to 0 here
+ * so the wmb will pair with the rmb in the interrupt handler.
*/
+ atomic_set(&data->refs, 0); /* convert 3rd to 1st party write */
+
+ data->csd.func = func;
+ data->csd.info = info;
+
+ /* Ensure 0 refs is visible before mask. Also orders func and info */
+ smp_wmb();
+
+ /* We rely on the "and" being processed before the store */
+ cpumask_and(data->cpumask, mask, cpu_online_mask);
+ cpumask_clear_cpu(this_cpu, data->cpumask);
raw_spin_lock_irqsave(&call_function.lock, flags);
/*
@@ -488,8 +507,9 @@ void smp_call_function_many(const struct cpumask *mask,
*/
list_add_rcu(&data->csd.list, &call_function.queue);
/*
- * We rely on the wmb() in list_add_rcu to order the writes
- * to func, data, and cpumask before this write to refs.
+ * We rely on the wmb() in list_add_rcu to complete our writes
+ * to the cpumask before this write to refs, which indicates
+ * data is on the list and is ready to be processed.
*/
atomic_set(&data->refs, cpumask_weight(data->cpumask));
raw_spin_unlock_irqrestore(&call_function.lock, flags);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 197/247] x86: Flush TLB if PGD entry is changed in i386 PAE mode
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (135 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 196/247] call_function_many: add missing ordering Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 198/247] isdn: avoid calling tty_ldisc_flush() in atomic context Paul Gortmaker
` (49 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Shaohua Li, Ingo Molnar, Paul Gortmaker
From: Shaohua Li <shaohua.li@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4981d01eada5354d81c8929d5b2836829ba3df7b upstream.
According to intel CPU manual, every time PGD entry is changed in i386 PAE
mode, we need do a full TLB flush. Current code follows this and there is
comment for this too in the code.
But current code misses the multi-threaded case. A changed page table
might be used by several CPUs, every such CPU should flush TLB. Usually
this isn't a problem, because we prepopulate all PGD entries at process
fork. But when the process does munmap and follows new mmap, this issue
will be triggered.
When it happens, some CPUs keep doing page faults:
http://marc.info/?l=linux-kernel&m=129915020508238&w=2
Reported-by: Yasunori Goto<y-goto@jp.fujitsu.com>
Tested-by: Yasunori Goto<y-goto@jp.fujitsu.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Shaohua Li<shaohua.li@intel.com>
Cc: Mallick Asit K <asit.k.mallick@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mm <linux-mm@kvack.org>
LKML-Reference: <1300246649.2337.95.camel@sli10-conroe>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/pgtable-3level.h | 11 +++--------
arch/x86/mm/pgtable.c | 3 +--
2 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 177b016..33927d2 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -69,8 +69,6 @@ static inline void native_pmd_clear(pmd_t *pmd)
static inline void pud_clear(pud_t *pudp)
{
- unsigned long pgd;
-
set_pud(pudp, __pud(0));
/*
@@ -79,13 +77,10 @@ static inline void pud_clear(pud_t *pudp)
* section 8.1: in PAE mode we explicitly have to flush the
* TLB via cr3 if the top-level pgd is changed...
*
- * Make sure the pud entry we're updating is within the
- * current pgd to avoid unnecessary TLB flushes.
+ * Currently all places where pud_clear() is called either have
+ * flush_tlb_mm() followed or don't need TLB flush (x86_64 code or
+ * pud_clear_bad()), so we don't need TLB flush here.
*/
- pgd = read_cr3();
- if (__pa(pudp) >= pgd && __pa(pudp) <
- (pgd + sizeof(pgd_t)*PTRS_PER_PGD))
- write_cr3(pgd);
}
#ifdef CONFIG_SMP
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 5c4ee42..2a72049 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -160,8 +160,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
* section 8.1: in PAE mode we explicitly have to flush the
* TLB via cr3 if the top-level pgd is changed...
*/
- if (mm == current->active_mm)
- write_cr3(read_cr3());
+ flush_tlb_mm(mm);
}
#else /* !CONFIG_X86_PAE */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 198/247] isdn: avoid calling tty_ldisc_flush() in atomic context
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (136 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 197/247] x86: Flush TLB if PGD entry is changed in i386 PAE mode Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 199/247] smp_call_function_many: handle concurrent clearing of mask Paul Gortmaker
` (48 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tilman Schmidt, David S. Miller, Paul Gortmaker
From: Tilman Schmidt <tilman@imap.cc>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bc10f96757bd6ab3721510df8defa8f21c32f974 upstream.
Remove the call to tty_ldisc_flush() from the RESULT_NO_CARRIER
branch of isdn_tty_modem_result(), as already proposed in commit
00409bb045887ec5e7b9e351bc080c38ab6bfd33.
This avoids a "sleeping function called from invalid context" BUG
when the hardware driver calls the statcallb() callback with
command==ISDN_STAT_DHUP in atomic context, which in turn calls
isdn_tty_modem_result(RESULT_NO_CARRIER, ~), and from there,
tty_ldisc_flush() which may sleep.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/isdn/i4l/isdn_tty.c | 6 ------
1 files changed, 0 insertions(+), 6 deletions(-)
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index fc8454d..51dc60d 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -2636,12 +2636,6 @@ isdn_tty_modem_result(int code, modem_info * info)
if ((info->flags & ISDN_ASYNC_CLOSING) || (!info->tty)) {
return;
}
-#ifdef CONFIG_ISDN_AUDIO
- if ( !info->vonline )
- tty_ldisc_flush(info->tty);
-#else
- tty_ldisc_flush(info->tty);
-#endif
if ((info->flags & ISDN_ASYNC_CHECK_CD) &&
(!((info->flags & ISDN_ASYNC_CALLOUT_ACTIVE) &&
(info->flags & ISDN_ASYNC_CALLOUT_NOHUP)))) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 199/247] smp_call_function_many: handle concurrent clearing of mask
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (137 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 198/247] isdn: avoid calling tty_ldisc_flush() in atomic context Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 200/247] fix per-cpu flag problem in the cpu affinity checkers Paul Gortmaker
` (47 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Milton Miller, Linus Torvalds, Paul Gortmaker
From: Milton Miller <miltonm@bga.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 723aae25d5cdb09962901d36d526b44d4be1051c upstream.
Mike Galbraith reported finding a lockup ("perma-spin bug") where the
cpumask passed to smp_call_function_many was cleared by other cpu(s)
while a cpu was preparing its call_data block, resulting in no cpu to
clear the last ref and unlock the block.
Having cpus clear their bit asynchronously could be useful on a mask of
cpus that might have a translation context, or cpus that need a push to
complete an rcu window.
Instead of adding a BUG_ON and requiring yet another cpumask copy, just
detect the race and handle it.
Note: arch_send_call_function_ipi_mask must still handle an empty
cpumask because the data block is globally visible before the that arch
callback is made. And (obviously) there are no guarantees to which cpus
are notified if the mask is changed during the call; only cpus that were
online and had their mask bit set during the whole call are guaranteed
to be called.
Reported-by: Mike Galbraith <efault@gmx.de>
Reported-by: Jan Beulich <JBeulich@novell.com>
Acked-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/smp.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/kernel/smp.c b/kernel/smp.c
index 9686dbf..37f3208 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -429,7 +429,7 @@ void smp_call_function_many(const struct cpumask *mask,
{
struct call_function_data *data;
unsigned long flags;
- int cpu, next_cpu, this_cpu = smp_processor_id();
+ int refs, cpu, next_cpu, this_cpu = smp_processor_id();
/*
* Can deadlock when called with interrupts disabled.
@@ -440,7 +440,7 @@ void smp_call_function_many(const struct cpumask *mask,
WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
&& !oops_in_progress);
- /* So, what's a CPU they want? Ignoring this one. */
+ /* Try to fastpath. So, what's a CPU they want? Ignoring this one. */
cpu = cpumask_first_and(mask, cpu_online_mask);
if (cpu == this_cpu)
cpu = cpumask_next_and(cpu, mask, cpu_online_mask);
@@ -498,6 +498,13 @@ void smp_call_function_many(const struct cpumask *mask,
/* We rely on the "and" being processed before the store */
cpumask_and(data->cpumask, mask, cpu_online_mask);
cpumask_clear_cpu(this_cpu, data->cpumask);
+ refs = cpumask_weight(data->cpumask);
+
+ /* Some callers race with other cpus changing the passed mask */
+ if (unlikely(!refs)) {
+ csd_unlock(&data->csd);
+ return;
+ }
raw_spin_lock_irqsave(&call_function.lock, flags);
/*
@@ -511,7 +518,7 @@ void smp_call_function_many(const struct cpumask *mask,
* to the cpumask before this write to refs, which indicates
* data is on the list and is ready to be processed.
*/
- atomic_set(&data->refs, cpumask_weight(data->cpumask));
+ atomic_set(&data->refs, refs);
raw_spin_unlock_irqrestore(&call_function.lock, flags);
/*
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 200/247] fix per-cpu flag problem in the cpu affinity checkers
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (138 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 199/247] smp_call_function_many: handle concurrent clearing of mask Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 201/247] i2c: Fix typo in instantiating-devices document Paul Gortmaker
` (46 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Thomas Gleixner, James Bottomley, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9804c9eaeacfe78651052c5ddff31099f60ef78c upstream.
The CHECK_IRQ_PER_CPU is wrong, it should be checking
irq_to_desc(irq)->status not just irq.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/parisc/kernel/irq.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
index efbcee5..e13fc3f 100644
--- a/arch/parisc/kernel/irq.c
+++ b/arch/parisc/kernel/irq.c
@@ -117,7 +117,7 @@ int cpu_check_affinity(unsigned int irq, const struct cpumask *dest)
int cpu_dest;
/* timer and ipi have to always be received on all CPUs */
- if (CHECK_IRQ_PER_CPU(irq)) {
+ if (CHECK_IRQ_PER_CPU(irq_to_desc(irq)->status)) {
/* Bad linux design decision. The mask has already
* been set; we must reset it */
cpumask_setall(irq_desc[irq].affinity);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 201/247] i2c: Fix typo in instantiating-devices document
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (139 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 200/247] fix per-cpu flag problem in the cpu affinity checkers Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 202/247] mmc: sdio: remember new card RCA when redetecting card Paul Gortmaker
` (45 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Roman Fietze, Jean Delvare, Paul Gortmaker
From: Roman Fietze <roman.fietze@telemotive.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6ced9e6b3901af4ab6ac0a11231402c888286ea6 upstream.
The struct i2c_board_info member holding the name is "type", not
"name".
Signed-off-by: Roman Fietze <roman.fietze@telemotive.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/i2c/instantiating-devices | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/Documentation/i2c/instantiating-devices b/Documentation/i2c/instantiating-devices
index e894902..ed1779c 100644
--- a/Documentation/i2c/instantiating-devices
+++ b/Documentation/i2c/instantiating-devices
@@ -100,7 +100,7 @@ static int __devinit usb_hcd_pnx4008_probe(struct platform_device *pdev)
(...)
i2c_adap = i2c_get_adapter(2);
memset(&i2c_info, 0, sizeof(struct i2c_board_info));
- strlcpy(i2c_info.name, "isp1301_pnx", I2C_NAME_SIZE);
+ strlcpy(i2c_info.type, "isp1301_pnx", I2C_NAME_SIZE);
isp1301_i2c_client = i2c_new_probed_device(i2c_adap, &i2c_info,
normal_i2c);
i2c_put_adapter(i2c_adap);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 202/247] mmc: sdio: remember new card RCA when redetecting card
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (140 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 201/247] i2c: Fix typo in instantiating-devices document Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 203/247] powerpc/kexec: Fix race in kexec shutdown Paul Gortmaker
` (44 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stefan Nilsson XK, Linus Walleij, Chris Ball,
Paul Gortmaker
From: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0aab3995485b8a994bf29a995a008c9ea4a28054 upstream.
During redetection of a SDIO card, a request for a new card RCA
was submitted to the card, but was then overwritten by the old RCA.
This caused the card to be deselected instead of selected when using
the incorrect RCA. This bug's been present since the "oldcard"
handling was introduced in 2.6.32.
Signed-off-by: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com>
Reviewed-by: Ulf Hansson <ulf.hansson@stericsson.com>
Reviewed-by: Pawel Wieczorkiewicz <pawel.wieczorkiewicz@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/core/sdio.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 2dd4cfe..ed7620b 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -303,6 +303,14 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
if (err)
goto remove;
+ /*
+ * Update oldcard with the new RCA received from the SDIO
+ * device -- we're doing this so that it's updated in the
+ * "card" struct when oldcard overwrites that later.
+ */
+ if (oldcard)
+ oldcard->rca = card->rca;
+
mmc_set_bus_mode(host, MMC_BUSMODE_PUSHPULL);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 203/247] powerpc/kexec: Fix race in kexec shutdown
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (141 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 202/247] mmc: sdio: remember new card RCA when redetecting card Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 204/247] powerpc/kdump: Fix race in kdump shutdown Paul Gortmaker
` (43 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michael Neuling, Benjamin Herrenschmidt,
Paul Gortmaker
From: Michael Neuling <mikey@neuling.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1fc711f7ffb01089efc58042cfdbac8573d1b59a upstream.
In kexec_prepare_cpus, the primary CPU IPIs the secondary CPUs to
kexec_smp_down(). kexec_smp_down() calls kexec_smp_wait() which sets
the hw_cpu_id() to -1. The primary does this while leaving IRQs on
which means the primary can take a timer interrupt which can lead to
the IPIing one of the secondary CPUs (say, for a scheduler re-balance)
but since the secondary CPU now has a hw_cpu_id = -1, we IPI CPU
-1... Kaboom!
We are hitting this case regularly on POWER7 machines.
There is also a second race, where the primary will tear down the MMU
mappings before knowing the secondaries have entered real mode.
Also, the secondaries are clearing out any pending IPIs before
guaranteeing that no more will be received.
This changes kexec_prepare_cpus() so that we turn off IRQs in the
primary CPU much earlier. It adds a paca flag to say that the
secondaries have entered the kexec_smp_down() IPI and turned off IRQs,
rather than overloading hw_cpu_id with -1. This new paca flag is
again used to in indicate when the secondaries has entered real mode.
It also ensures that all CPUs have their IRQs off before we clear out
any pending IPI requests (in kexec_cpu_down()) to ensure there are no
trailing IPIs left unacknowledged.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/include/asm/kexec.h | 4 ++
arch/powerpc/include/asm/paca.h | 1 +
arch/powerpc/kernel/asm-offsets.c | 1 +
arch/powerpc/kernel/machine_kexec_64.c | 48 ++++++++++++++++++++++---------
arch/powerpc/kernel/misc_64.S | 8 +++--
arch/powerpc/kernel/paca.c | 2 +
6 files changed, 47 insertions(+), 17 deletions(-)
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 7e06b43..a6ca6da 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -31,6 +31,10 @@
#define KEXEC_ARCH KEXEC_ARCH_PPC
#endif
+#define KEXEC_STATE_NONE 0
+#define KEXEC_STATE_IRQS_OFF 1
+#define KEXEC_STATE_REAL_MODE 2
+
#ifndef __ASSEMBLY__
#include <linux/cpumask.h>
#include <asm/reg.h>
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index a011603..971dfa4 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -82,6 +82,7 @@ struct paca_struct {
s16 hw_cpu_id; /* Physical processor number */
u8 cpu_start; /* At startup, processor spins until */
/* this becomes non-zero. */
+ u8 kexec_state; /* set when kexec down has irqs off */
#ifdef CONFIG_PPC_STD_MMU_64
struct slb_shadow *slb_shadow_ptr;
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index b894721..28a686f 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -183,6 +183,7 @@ int main(void)
#endif /* CONFIG_PPC_STD_MMU_64 */
DEFINE(PACAEMERGSP, offsetof(struct paca_struct, emergency_sp));
DEFINE(PACAHWCPUID, offsetof(struct paca_struct, hw_cpu_id));
+ DEFINE(PACAKEXECSTATE, offsetof(struct paca_struct, kexec_state));
DEFINE(PACA_STARTPURR, offsetof(struct paca_struct, startpurr));
DEFINE(PACA_STARTSPURR, offsetof(struct paca_struct, startspurr));
DEFINE(PACA_USER_TIME, offsetof(struct paca_struct, user_time));
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index f61943d..3e38cdf 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -156,16 +156,23 @@ void kexec_copy_flush(struct kimage *image)
#ifdef CONFIG_SMP
-/* FIXME: we should schedule this function to be called on all cpus based
- * on calling the interrupts, but we would like to call it off irq level
- * so that the interrupt controller is clean.
- */
+static int kexec_all_irq_disabled = 0;
+
static void kexec_smp_down(void *arg)
{
+ local_irq_disable();
+ mb(); /* make sure our irqs are disabled before we say they are */
+ get_paca()->kexec_state = KEXEC_STATE_IRQS_OFF;
+ while(kexec_all_irq_disabled == 0)
+ cpu_relax();
+ mb(); /* make sure all irqs are disabled before this */
+ /*
+ * Now every CPU has IRQs off, we can clear out any pending
+ * IPIs and be sure that no more will come in after this.
+ */
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(0, 1);
- local_irq_disable();
kexec_smp_wait();
/* NOTREACHED */
}
@@ -193,20 +200,18 @@ static void wake_offline_cpus(void)
}
}
-static void kexec_prepare_cpus(void)
+static void kexec_prepare_cpus_wait(int wait_state)
{
int my_cpu, i, notified=-1;
wake_offline_cpus();
- smp_call_function(kexec_smp_down, NULL, /* wait */0);
my_cpu = get_cpu();
-
- /* check the others cpus are now down (via paca hw cpu id == -1) */
+ /* Make sure each CPU has atleast made it to the state we need */
for (i=0; i < NR_CPUS; i++) {
if (i == my_cpu)
continue;
- while (paca[i].hw_cpu_id != -1) {
+ while (paca[i].kexec_state < wait_state) {
barrier();
if (!cpu_possible(i)) {
printk("kexec: cpu %d hw_cpu_id %d is not"
@@ -226,20 +231,35 @@ static void kexec_prepare_cpus(void)
}
if (i != notified) {
printk( "kexec: waiting for cpu %d (physical"
- " %d) to go down\n",
- i, paca[i].hw_cpu_id);
+ " %d) to enter %i state\n",
+ i, paca[i].hw_cpu_id, wait_state);
notified = i;
}
}
}
+ mb();
+}
+
+static void kexec_prepare_cpus(void)
+{
+
+ smp_call_function(kexec_smp_down, NULL, /* wait */0);
+ local_irq_disable();
+ mb(); /* make sure IRQs are disabled before we say they are */
+ get_paca()->kexec_state = KEXEC_STATE_IRQS_OFF;
+
+ kexec_prepare_cpus_wait(KEXEC_STATE_IRQS_OFF);
+ /* we are sure every CPU has IRQs off at this point */
+ kexec_all_irq_disabled = 1;
/* after we tell the others to go down */
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(0, 0);
- put_cpu();
+ /* Before removing MMU mapings make sure all CPUs have entered real mode */
+ kexec_prepare_cpus_wait(KEXEC_STATE_REAL_MODE);
- local_irq_disable();
+ put_cpu();
}
#else /* ! SMP */
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index a5cf9c1..a2b18df 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -24,6 +24,7 @@
#include <asm/asm-offsets.h>
#include <asm/cputable.h>
#include <asm/thread_info.h>
+#include <asm/kexec.h>
.text
@@ -471,6 +472,10 @@ _GLOBAL(kexec_wait)
1: mflr r5
addi r5,r5,kexec_flag-1b
+ li r4,KEXEC_STATE_REAL_MODE
+ stb r4,PACAKEXECSTATE(r13)
+ SYNC
+
99: HMT_LOW
#ifdef CONFIG_KEXEC /* use no memory without kexec */
lwz r4,0(r5)
@@ -494,14 +499,11 @@ kexec_flag:
* note: this is a terminal routine, it does not save lr
*
* get phys id from paca
- * set paca id to -1 to say we got here
* switch to real mode
* join other cpus in kexec_wait(phys_id)
*/
_GLOBAL(kexec_smp_wait)
lhz r3,PACAHWCPUID(r13)
- li r4,-1
- sth r4,PACAHWCPUID(r13) /* let others know we left */
bl real_mode
b .kexec_wait
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index 0c40c6f..f88acf0 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -18,6 +18,7 @@
#include <asm/pgtable.h>
#include <asm/iseries/lpar_map.h>
#include <asm/iseries/hv_types.h>
+#include <asm/kexec.h>
/* This symbol is provided by the linker - let it fill in the paca
* field correctly */
@@ -97,6 +98,7 @@ void __init initialise_paca(struct paca_struct *new_paca, int cpu)
new_paca->kernelbase = (unsigned long) _stext;
new_paca->kernel_msr = MSR_KERNEL;
new_paca->hw_cpu_id = 0xffff;
+ new_paca->kexec_state = KEXEC_STATE_NONE;
new_paca->__current = &init_task;
#ifdef CONFIG_PPC_STD_MMU_64
new_paca->slb_shadow_ptr = &slb_shadow[cpu];
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 204/247] powerpc/kdump: Fix race in kdump shutdown
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (142 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 203/247] powerpc/kexec: Fix race in kexec shutdown Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 205/247] powerpc: Fix default_machine_crash_shutdown #ifdef botch Paul Gortmaker
` (42 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michael Neuling, Benjamin Herrenschmidt,
Paul Gortmaker
From: Michael Neuling <mikey@neuling.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 60adec6226bbcf061d4c2d10944fced209d1847d upstream.
When we are crashing, the crashing/primary CPU IPIs the secondaries to
turn off IRQs, go into real mode and wait in kexec_wait. While this
is happening, the primary tears down all the MMU maps. Unfortunately
the primary doesn't check to make sure the secondaries have entered
real mode before doing this.
On PHYP machines, the secondaries can take a long time shutting down
the IRQ controller as RTAS calls are need. These RTAS calls need to
be serialised which resilts in the secondaries contending in
lock_rtas() and hence taking a long time to shut down.
We've hit this on large POWER7 machines, where some secondaries are
still waiting in lock_rtas(), when the primary tears down the HPTEs.
This patch makes sure all secondaries are in real mode before the
primary tears down the MMU. It uses the new kexec_state entry in the
paca. It times out if the secondaries don't reach real mode after
10sec.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/crash.c | 27 +++++++++++++++++++++++++++
1 files changed, 27 insertions(+), 0 deletions(-)
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index cca7c8f..8c066d6 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -162,6 +162,32 @@ static void crash_kexec_prepare_cpus(int cpu)
/* Leave the IPI callback set */
}
+/* wait for all the CPUs to hit real mode but timeout if they don't come in */
+static void crash_kexec_wait_realmode(int cpu)
+{
+ unsigned int msecs;
+ int i;
+
+ msecs = 10000;
+ for (i=0; i < NR_CPUS && msecs > 0; i++) {
+ if (i == cpu)
+ continue;
+
+ while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
+ barrier();
+ if (!cpu_possible(i)) {
+ break;
+ }
+ if (!cpu_online(i)) {
+ break;
+ }
+ msecs--;
+ mdelay(1);
+ }
+ }
+ mb();
+}
+
/*
* This function will be called by secondary cpus or by kexec cpu
* if soft-reset is activated to stop some CPUs.
@@ -419,6 +445,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
crash_kexec_prepare_cpus(crashing_cpu);
cpu_set(crashing_cpu, cpus_in_crash);
crash_kexec_stop_spus();
+ crash_kexec_wait_realmode(crashing_cpu);
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(1, 0);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 205/247] powerpc: Fix default_machine_crash_shutdown #ifdef botch
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (143 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 204/247] powerpc/kdump: Fix race in kdump shutdown Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 206/247] powerpc: rtas_flash needs to use rtas_data_buf Paul Gortmaker
` (41 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul E. McKenney, Benjamin Herrenschmidt,
Paul Gortmaker
From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c2be05481f6125254c45b78f334d4dd09c701c82 upstream.
crash_kexec_wait_realmode() is defined only if CONFIG_PPC_STD_MMU_64
and CONFIG_SMP, but is called if CONFIG_PPC_STD_MMU_64 even if !CONFIG_SMP.
Fix the conditional compilation around the invocation.
[PG: commit b3df895aebe091b1657 "powerpc/kexec: Add support for FSL-BookE"
introduced the PPC_STD_MMU_64 check this refers to, but we don't want to
cherry pick that whole addition to stable just for one #ifdef line.]
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/crash.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 8c066d6..ddf1fea 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -163,6 +163,7 @@ static void crash_kexec_prepare_cpus(int cpu)
}
/* wait for all the CPUs to hit real mode but timeout if they don't come in */
+#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
static void crash_kexec_wait_realmode(int cpu)
{
unsigned int msecs;
@@ -187,6 +188,7 @@ static void crash_kexec_wait_realmode(int cpu)
}
mb();
}
+#endif
/*
* This function will be called by secondary cpus or by kexec cpu
@@ -445,7 +447,9 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
crash_kexec_prepare_cpus(crashing_cpu);
cpu_set(crashing_cpu, cpus_in_crash);
crash_kexec_stop_spus();
+#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
crash_kexec_wait_realmode(crashing_cpu);
+#endif
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(1, 0);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 206/247] powerpc: rtas_flash needs to use rtas_data_buf
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (144 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 205/247] powerpc: Fix default_machine_crash_shutdown #ifdef botch Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 207/247] x86, binutils, xen: Fix another wrong size directive Paul Gortmaker
` (40 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Milton Miller, Benjamin Herrenschmidt,
Paul Gortmaker
From: Milton Miller <miltonm@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bd2b64a12bf55bec0d1b949e3dca3f8863409646 upstream.
When trying to flash a machine via the update_flash command, Anton received the
following error:
Restarting system.
FLASH: kernel bug...flash list header addr above 4GB
The code in question has a comment that the flash list should be in
the kernel data and therefore under 4GB:
/* NOTE: the "first" block list is a global var with no data
* blocks in the kernel data segment. We do this because
* we want to ensure this block_list addr is under 4GB.
*/
Unfortunately the Kconfig option is marked tristate which means the variable
may not be in the kernel data and could be above 4GB.
Instead of relying on the data segment being below 4GB, use the static
data buffer allocated by the kernel for use by rtas. Since we don't
use the header struct directly anymore, convert it to a simple pointer.
Reported-By: Anton Blanchard <anton@samba.org>
Signed-Off-By: Milton Miller <miltonm@bga.com
Tested-By: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/rtas_flash.c | 39 ++++++++++++++++++++-----------------
1 files changed, 21 insertions(+), 18 deletions(-)
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index bfc2aba..224941f 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -94,12 +94,8 @@ struct flash_block_list {
struct flash_block_list *next;
struct flash_block blocks[FLASH_BLOCKS_PER_NODE];
};
-struct flash_block_list_header { /* just the header of flash_block_list */
- unsigned long num_blocks;
- struct flash_block_list *next;
-};
-static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
+static struct flash_block_list *rtas_firmware_flash_list;
/* Use slab cache to guarantee 4k alignment */
static struct kmem_cache *flash_block_cache = NULL;
@@ -108,13 +104,14 @@ static struct kmem_cache *flash_block_cache = NULL;
/* Local copy of the flash block list.
* We only allow one open of the flash proc file and create this
- * list as we go. This list will be put in the
- * rtas_firmware_flash_list var once it is fully read.
+ * list as we go. The rtas_firmware_flash_list varable will be
+ * set once the data is fully read.
*
* For convenience as we build the list we use virtual addrs,
* we do not fill in the version number, and the length field
* is treated as the number of entries currently in the block
- * (i.e. not a byte count). This is all fixed on release.
+ * (i.e. not a byte count). This is all fixed when calling
+ * the flash routine.
*/
/* Status int must be first member of struct */
@@ -201,16 +198,16 @@ static int rtas_flash_release(struct inode *inode, struct file *file)
if (uf->flist) {
/* File was opened in write mode for a new flash attempt */
/* Clear saved list */
- if (rtas_firmware_flash_list.next) {
- free_flash_list(rtas_firmware_flash_list.next);
- rtas_firmware_flash_list.next = NULL;
+ if (rtas_firmware_flash_list) {
+ free_flash_list(rtas_firmware_flash_list);
+ rtas_firmware_flash_list = NULL;
}
if (uf->status != FLASH_AUTH)
uf->status = flash_list_valid(uf->flist);
if (uf->status == FLASH_IMG_READY)
- rtas_firmware_flash_list.next = uf->flist;
+ rtas_firmware_flash_list = uf->flist;
else
free_flash_list(uf->flist);
@@ -593,7 +590,7 @@ static void rtas_flash_firmware(int reboot_type)
unsigned long rtas_block_list;
int i, status, update_token;
- if (rtas_firmware_flash_list.next == NULL)
+ if (rtas_firmware_flash_list == NULL)
return; /* nothing to do */
if (reboot_type != SYS_RESTART) {
@@ -610,20 +607,25 @@ static void rtas_flash_firmware(int reboot_type)
return;
}
- /* NOTE: the "first" block list is a global var with no data
- * blocks in the kernel data segment. We do this because
- * we want to ensure this block_list addr is under 4GB.
+ /*
+ * NOTE: the "first" block must be under 4GB, so we create
+ * an entry with no data blocks in the reserved buffer in
+ * the kernel data segment.
*/
- rtas_firmware_flash_list.num_blocks = 0;
- flist = (struct flash_block_list *)&rtas_firmware_flash_list;
+ spin_lock(&rtas_data_buf_lock);
+ flist = (struct flash_block_list *)&rtas_data_buf[0];
+ flist->num_blocks = 0;
+ flist->next = rtas_firmware_flash_list;
rtas_block_list = virt_to_abs(flist);
if (rtas_block_list >= 4UL*1024*1024*1024) {
printk(KERN_ALERT "FLASH: kernel bug...flash list header addr above 4GB\n");
+ spin_unlock(&rtas_data_buf_lock);
return;
}
printk(KERN_ALERT "FLASH: preparing saved firmware image for flash\n");
/* Update the block_list in place. */
+ rtas_firmware_flash_list = NULL; /* too hard to backout on error */
image_size = 0;
for (f = flist; f; f = next) {
/* Translate data addrs to absolute */
@@ -664,6 +666,7 @@ static void rtas_flash_firmware(int reboot_type)
printk(KERN_ALERT "FLASH: unknown flash return code %d\n", status);
break;
}
+ spin_unlock(&rtas_data_buf_lock);
}
static void remove_flash_pde(struct proc_dir_entry *dp)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 207/247] x86, binutils, xen: Fix another wrong size directive
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (145 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 206/247] powerpc: rtas_flash needs to use rtas_data_buf Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 208/247] hwmon: (sht15) Fix integer overflow in humidity calculation Paul Gortmaker
` (39 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alexander van Heukelum, Ingo Molnar,
Paul Gortmaker
From: Alexander van Heukelum <heukelum@fastmail.fm>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 371c394af27ab7d1e58a66bc19d9f1f3ac1f67b4 upstream.
The latest binutils (2.21.0.20110302/Ubuntu) breaks the build
yet another time, under CONFIG_XEN=y due to a .size directive that
refers to a slightly differently named (hence, to the now very
strict and unforgiving assembler, non-existent) symbol.
[ mingo:
This unnecessary build breakage caused by new binutils
version 2.21 gets escallated back several kernel releases spanning
several years of Linux history, affecting over 130,000 upstream
kernel commits (!), on CONFIG_XEN=y 64-bit kernels (i.e. essentially
affecting all major Linux distro kernel configs).
Git annotate tells us that this slight debug symbol code mismatch
bug has been introduced in 2008 in commit 3d75e1b8:
3d75e1b8 (Jeremy Fitzhardinge 2008-07-08 15:06:49 -0700 1231) ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
The 'bug' is just a slight assymetry in ENTRY()/END()
debug-symbols sequences, with lots of assembly code between the
ENTRY() and the END():
ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
...
END(do_hypervisor_callback)
Human reviewers almost never catch such small mismatches, and binutils
never even warned about it either.
This new binutils version thus breaks the Xen build on all upstream kernels
since v2.6.27, out of the blue.
This makes a straightforward Git bisection of all 64-bit Xen-enabled kernels
impossible on such binutils, for a bisection window of over hundred
thousand historic commits. (!)
This is a major fail on the side of binutils and binutils needs to turn
this show-stopper build failure into a warning ASAP. ]
Signed-off-by: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Jan Beulich <jbeulich@novell.com>
Cc: H.J. Lu <hjl.tools@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kees Cook <kees.cook@canonical.com>
LKML-Reference: <1299877178-26063-1-git-send-email-heukelum@fastmail.fm>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/entry_64.S | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 0697ff1..a50b6cd 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1268,7 +1268,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
decl PER_CPU_VAR(irq_count)
jmp error_exit
CFI_ENDPROC
-END(do_hypervisor_callback)
+END(xen_do_hypervisor_callback)
/*
* Hypervisor uses this for application faults while it executes.
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 208/247] hwmon: (sht15) Fix integer overflow in humidity calculation
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (146 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 207/247] x86, binutils, xen: Fix another wrong size directive Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 209/247] SUNRPC: Never reuse the socket port after an xs_close() Paul Gortmaker
` (38 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vivien Didelot, Jean Delvare, Paul Gortmaker
From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ccd32e735de7a941906e093f8dca924bb05c5794 upstream.
An integer overflow occurs in the calculation of RHlinear when the
relative humidity is greater than around 30%. The consequence is a subtle
(but noticeable) error in the resulting humidity measurement.
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/sht15.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index a610e78..38a41d2 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -333,11 +333,11 @@ static inline int sht15_calc_humid(struct sht15_data *data)
const int c1 = -4;
const int c2 = 40500; /* x 10 ^ -6 */
- const int c3 = -2800; /* x10 ^ -9 */
+ const int c3 = -28; /* x 10 ^ -7 */
RHlinear = c1*1000
+ c2 * data->val_humid/1000
- + (data->val_humid * data->val_humid * c3)/1000000;
+ + (data->val_humid * data->val_humid * c3) / 10000;
return (temp - 25000) * (10000 + 80 * data->val_humid)
/ 1000000 + RHlinear;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 209/247] SUNRPC: Never reuse the socket port after an xs_close()
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (147 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 208/247] hwmon: (sht15) Fix integer overflow in humidity calculation Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates Paul Gortmaker
` (37 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Trond Myklebust, Paul Gortmaker
From: Trond Myklebust <Trond.Myklebust@netapp.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 246408dcd5dfeef2df437ccb0ef4d6ee87805f58 upstream.
If we call xs_close(), we're in one of two situations:
- Autoclose, which means we don't expect to resend a request
- bind+connect failed, which probably means the port is in use
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/sunrpc/xprtsock.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 054d735..b613cb7 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -724,6 +724,8 @@ static void xs_reset_transport(struct sock_xprt *transport)
if (sk == NULL)
return;
+ transport->srcport = 0;
+
write_lock_bh(&sk->sk_callback_lock);
transport->inet = NULL;
transport->sock = NULL;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (148 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 209/247] SUNRPC: Never reuse the socket port after an xs_close() Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:57 ` Olaf Hering
2011-06-23 17:34 ` [34-longterm 211/247] USB: cdc-acm: fix potential null-pointer dereference on disconnect Paul Gortmaker
` (36 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Olaf Hering, Stefano Stabellini, Dmitry Torokhov,
Paul Gortmaker
From: Olaf Hering <olaf@aepfle.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8c3c283e6bf463ab498d6e7823aff6c4762314b6 upstream.
A virtualized display device is usually viewed with the vncviewer
application, either by 'xm vnc domU' or with vncviewer localhost:port.
vncviewer and the RFB protocol provides absolute coordinates to the
virtual display. These coordinates are either passed through to a PV
guest or converted to relative coordinates for a HVM guest.
A PV guest receives these coordinates and passes them to the kernels
evdev driver. There it can be picked up by applications such as the
xorg-input drivers. Using absolute coordinates avoids issues such as
guest mouse pointer not tracking host mouse pointer due to wrong mouse
acceleration settings in the guests X display.
Advertise either absolute or relative coordinates to the input system
and the evdev driver, depending on what dom0 provides. The xorg-input
driver prefers relative coordinates even if a devices provides both.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/input/xen-kbdfront.c | 45 ++++++++++++++++++++++-------------------
1 files changed, 24 insertions(+), 21 deletions(-)
diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
index e140816..6ad8be1 100644
--- a/drivers/input/xen-kbdfront.c
+++ b/drivers/input/xen-kbdfront.c
@@ -109,7 +109,7 @@ static irqreturn_t input_handler(int rq, void *dev_id)
static int __devinit xenkbd_probe(struct xenbus_device *dev,
const struct xenbus_device_id *id)
{
- int ret, i;
+ int ret, i, abs;
struct xenkbd_info *info;
struct input_dev *kbd, *ptr;
@@ -127,6 +127,11 @@ static int __devinit xenkbd_probe(struct xenbus_device *dev,
if (!info->page)
goto error_nomem;
+ if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-abs-pointer", "%d", &abs) < 0)
+ abs = 0;
+ if (abs)
+ xenbus_printf(XBT_NIL, dev->nodename, "request-abs-pointer", "1");
+
/* keyboard */
kbd = input_allocate_device();
if (!kbd)
@@ -136,11 +141,12 @@ static int __devinit xenkbd_probe(struct xenbus_device *dev,
kbd->id.bustype = BUS_PCI;
kbd->id.vendor = 0x5853;
kbd->id.product = 0xffff;
- kbd->evbit[0] = BIT(EV_KEY);
+
+ __set_bit(EV_KEY, kbd->evbit);
for (i = KEY_ESC; i < KEY_UNKNOWN; i++)
- set_bit(i, kbd->keybit);
+ __set_bit(i, kbd->keybit);
for (i = KEY_OK; i < KEY_MAX; i++)
- set_bit(i, kbd->keybit);
+ __set_bit(i, kbd->keybit);
ret = input_register_device(kbd);
if (ret) {
@@ -159,12 +165,20 @@ static int __devinit xenkbd_probe(struct xenbus_device *dev,
ptr->id.bustype = BUS_PCI;
ptr->id.vendor = 0x5853;
ptr->id.product = 0xfffe;
- ptr->evbit[0] = BIT(EV_KEY) | BIT(EV_REL) | BIT(EV_ABS);
+
+ if (abs) {
+ __set_bit(EV_ABS, ptr->evbit);
+ input_set_abs_params(ptr, ABS_X, 0, XENFB_WIDTH, 0, 0);
+ input_set_abs_params(ptr, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
+ } else {
+ input_set_capability(ptr, EV_REL, REL_X);
+ input_set_capability(ptr, EV_REL, REL_Y);
+ }
+ input_set_capability(ptr, EV_REL, REL_WHEEL);
+
+ __set_bit(EV_KEY, ptr->evbit);
for (i = BTN_LEFT; i <= BTN_TASK; i++)
- set_bit(i, ptr->keybit);
- ptr->relbit[0] = BIT(REL_X) | BIT(REL_Y) | BIT(REL_WHEEL);
- input_set_abs_params(ptr, ABS_X, 0, XENFB_WIDTH, 0, 0);
- input_set_abs_params(ptr, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
+ __set_bit(i, ptr->keybit);
ret = input_register_device(ptr);
if (ret) {
@@ -271,7 +285,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
enum xenbus_state backend_state)
{
struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
- int ret, val;
+ int val;
switch (backend_state) {
case XenbusStateInitialising:
@@ -282,17 +296,6 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
case XenbusStateInitWait:
InitWait:
- ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
- "feature-abs-pointer", "%d", &val);
- if (ret < 0)
- val = 0;
- if (val) {
- ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
- "request-abs-pointer", "1");
- if (ret)
- printk(KERN_WARNING
- "xenkbd: can't request abs-pointer");
- }
xenbus_switch_state(dev, XenbusStateConnected);
break;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates
2011-06-23 17:34 ` [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates Paul Gortmaker
@ 2011-06-23 17:57 ` Olaf Hering
2011-06-23 18:14 ` Paul Gortmaker
0 siblings, 1 reply; 269+ messages in thread
From: Olaf Hering @ 2011-06-23 17:57 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, stable-review, Stefano Stabellini,
Dmitry Torokhov
On Thu, Jun 23, Paul Gortmaker wrote:
> From: Olaf Hering <olaf@aepfle.de>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 8c3c283e6bf463ab498d6e7823aff6c4762314b6 upstream.
This one will introduce a regression, which will be fixed by upstream
commit c36b58e8a9112017c2bcc322cc98e71241814303
Input: xen-kbdfront - fix mouse getting stuck after save/restore
Olaf
^ permalink raw reply [flat|nested] 269+ messages in thread* Re: [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates
2011-06-23 17:57 ` Olaf Hering
@ 2011-06-23 18:14 ` Paul Gortmaker
2011-06-23 18:21 ` Dmitry Torokhov
0 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 18:14 UTC (permalink / raw)
To: Olaf Hering
Cc: stable, linux-kernel, stable-review, Stefano Stabellini,
Dmitry Torokhov
On Thu, Jun 23, 2011 at 1:57 PM, Olaf Hering <olaf@aepfle.de> wrote:
> On Thu, Jun 23, Paul Gortmaker wrote:
>
>> From: Olaf Hering <olaf@aepfle.de>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 8c3c283e6bf463ab498d6e7823aff6c4762314b6 upstream.
>
> This one will introduce a regression, which will be fixed by upstream
> commit c36b58e8a9112017c2bcc322cc98e71241814303
>
> Input: xen-kbdfront - fix mouse getting stuck after save/restore
>
> Olaf
Thanks Olaf, it will appear here shortly.
http://git.kernel.org/?p=linux/kernel/git/longterm/longterm-queue-2.6.34.git;a=summary
[PS: Dmitry - the mail.ru address you've been using in SOB lines always bounces]
Paul.
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
^ permalink raw reply [flat|nested] 269+ messages in thread
* Re: [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates
2011-06-23 18:14 ` Paul Gortmaker
@ 2011-06-23 18:21 ` Dmitry Torokhov
0 siblings, 0 replies; 269+ messages in thread
From: Dmitry Torokhov @ 2011-06-23 18:21 UTC (permalink / raw)
To: Paul Gortmaker
Cc: Olaf Hering, stable, linux-kernel, stable-review,
Stefano Stabellini
On Thu, Jun 23, 2011 at 02:14:48PM -0400, Paul Gortmaker wrote:
> On Thu, Jun 23, 2011 at 1:57 PM, Olaf Hering <olaf@aepfle.de> wrote:
> > On Thu, Jun 23, Paul Gortmaker wrote:
> >
> >> From: Olaf Hering <olaf@aepfle.de>
> >>
> >> -------------------
> >> This is a commit scheduled for the next v2.6.34 longterm release.
> >> If you see a problem with using this for longterm, please comment.
> >> -------------------
> >>
> >> commit 8c3c283e6bf463ab498d6e7823aff6c4762314b6 upstream.
> >
> > This one will introduce a regression, which will be fixed by upstream
> > commit c36b58e8a9112017c2bcc322cc98e71241814303
> >
> > Input: xen-kbdfront - fix mouse getting stuck after save/restore
> >
> > Olaf
>
> Thanks Olaf, it will appear here shortly.
>
> http://git.kernel.org/?p=linux/kernel/git/longterm/longterm-queue-2.6.34.git;a=summary
>
> [PS: Dmitry - the mail.ru address you've been using in SOB lines always bounces]
Hmm, that is wierd. I am getting mail to that address, in fact I just
reseived a letter from Jarod Wilson there...
I am not sure why they don't like your mails but that is the reason I am
keeping both mail.ru and gmail.com addresses.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 211/247] USB: cdc-acm: fix potential null-pointer dereference on disconnect
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (149 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 210/247] Input: xen-kbdfront - advertise either absolute or relative coordinates Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 212/247] USB: cdc-acm: fix potential null-pointer dereference Paul Gortmaker
` (35 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Johan Hovold, Greg Kroah-Hartman, Paul Gortmaker
From: Johan Hovold <jhovold@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7e7797e7f6f7bfab73fca02c65e40eaa5bb9000c upstream.
Fix potential null-pointer exception on disconnect introduced by commit
11ea859d64b69a747d6b060b9ed1520eab1161fe (USB: additional power savings
for cdc-acm devices that support remote wakeup).
Only access acm->dev after making sure it is non-null in control urb
completion handler.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/class/cdc-acm.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a45e6c4..073a9ef 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb)
if (!ACM_READY(acm))
goto exit;
+ usb_mark_last_busy(acm->dev);
+
data = (unsigned char *)(dr + 1);
switch (dr->bNotificationType) {
case USB_CDC_NOTIFY_NETWORK_CONNECTION:
@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb)
break;
}
exit:
- usb_mark_last_busy(acm->dev);
retval = usb_submit_urb(urb, GFP_ATOMIC);
if (retval)
dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 212/247] USB: cdc-acm: fix potential null-pointer dereference
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (150 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 211/247] USB: cdc-acm: fix potential null-pointer dereference on disconnect Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 213/247] USB: cdc-acm: fix memory corruption / panic Paul Gortmaker
` (34 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Johan Hovold, Greg Kroah-Hartman, Paul Gortmaker
From: Johan Hovold <jhovold@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 15e5bee33ffc11d0e5c6f819a65e7881c5c407be upstream.
Must check return value of tty_port_tty_get.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/class/cdc-acm.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 073a9ef..af5ed89 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -534,6 +534,8 @@ static void acm_softint(struct work_struct *work)
if (!ACM_READY(acm))
return;
tty = tty_port_tty_get(&acm->port);
+ if (!tty)
+ return;
tty_wakeup(tty);
tty_kref_put(tty);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 213/247] USB: cdc-acm: fix memory corruption / panic
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (151 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 212/247] USB: cdc-acm: fix potential null-pointer dereference Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 214/247] USB: uss720 fixup refcount position Paul Gortmaker
` (33 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Johan Hovold, Greg Kroah-Hartman, Paul Gortmaker
From: Johan Hovold <jhovold@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 23b80550e2aa61d0ba3af98b831b9195be0db9ee upstream.
Prevent read urbs from being resubmitted from tasklet after port close.
The receive tasklet was not disabled on port close, which could lead to
corruption of receive lists on consecutive port open. In particular,
read urbs could be re-submitted before port open, added to free list in
open, and then added a second time to the free list in the completion
handler.
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: set line: 115200 0 0 8
cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
cdc-acm.c: acm_tty_close
cdc-acm.c: acm_port_down
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: Entering acm_tty_write to write 3 bytes,
cdc-acm.c: Get 3 bytes...
cdc-acm.c: acm_write_start susp_count: 0
cdc-acm.c: Entering acm_read_bulk with status 0
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next->prev should be f57fbc10, but was f57fbaf8
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd8ac>] list_del+0x10c/0x120
[<f8051dbf>] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
[<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082e ]---
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next->prev should be f57fbd50, but was f57fbdb0
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd8ac>] list_del+0x10c/0x120
[<f8051dd6>] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
[<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082f ]---
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: disconnected from network
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: Entering acm_rx_tasklet
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
Hardware name: Vostro 1520
list_del corruption, next is LIST_POISON1 (00100100)
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd875>] ? list_del+0xd5/0x120
[<c11dd875>] ? list_del+0xd5/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd875>] list_del+0xd5/0x120
[<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f00830 ]---
BUG: unable to handle kernel paging request at 00200200
IP: [<c11dd7bd>] list_del+0x1d/0x120
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39 0T816J/Vostro 1520
EIP: 0060:[<c11dd7bd>] EFLAGS: 00010046 CPU: 0
EIP is at list_del+0x1d/0x120
EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
Stack:
c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
Call Trace:
[<f8051fac>] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] ? tasklet_action+0xe6/0x140
[<c104342f>] ? __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ>
[<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 <8b> 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
EIP: [<c11dd7bd>] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
CR2: 0000000000200200
---[ end trace efd9a11434f00831 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 3, comm: ksoftirqd/0 Tainted: G D W 2.6.37+ #39
Call Trace:
[<c13fede1>] ? printk+0x1d/0x24
[<c13fecce>] panic+0x66/0x15c
[<c10067df>] oops_end+0x8f/0x90
[<c1025476>] no_context+0xc6/0x160
[<c10255a8>] __bad_area_nosemaphore+0x98/0x140
[<c103cf68>] ? release_console_sem+0x1d8/0x210
[<c1025667>] bad_area_nosemaphore+0x17/0x20
[<c1025a49>] do_page_fault+0x279/0x420
[<c1006a8f>] ? show_trace+0x1f/0x30
[<c13fede1>] ? printk+0x1d/0x24
[<c10257d0>] ? do_page_fault+0x0/0x420
[<c140333b>] error_code+0x5f/0x64
[<c103007b>] ? select_task_rq_fair+0x37b/0x6a0
[<c10257d0>] ? do_page_fault+0x0/0x420
[<c11dd7bd>] ? list_del+0x1d/0x120
[<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
panic occurred, switching back to text console
------------[ cut here ]------------
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/class/cdc-acm.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index af5ed89..657b434 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -655,8 +655,10 @@ static void acm_port_down(struct acm *acm, int drain)
usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb);
+ tasklet_disable(&acm->urb_task);
for (i = 0; i < nr; i++)
usb_kill_urb(acm->ru[i].urb);
+ tasklet_enable(&acm->urb_task);
acm->control->needs_remote_wakeup = 0;
usb_autopm_put_interface(acm->control);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 214/247] USB: uss720 fixup refcount position
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (152 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 213/247] USB: cdc-acm: fix memory corruption / panic Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 215/247] ehci-hcd: Bug fix: don't set a QH's Halt bit Paul Gortmaker
` (32 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Peter Holik, Greg Kroah-Hartman, Paul Gortmaker
From: Peter Holik <peter@holik.at>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit adaa3c6342b249548ea830fe8e02aa5b45be8688 upstream.
My testprog do a lot of bitbang - after hours i got following warning and my machine lockups:
WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
After debugging uss720 driver i discovered that the completion callback was called before
usb_submit_urb returns. The callback frees the request structure that is krefed on return by
usb_submit_urb.
Signed-off-by: Peter Holik <peter@holik.at>
Acked-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/misc/uss720.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 4ff2158..9727daa 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -177,12 +177,11 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
spin_lock_irqsave(&priv->asynclock, flags);
list_add_tail(&rq->asynclist, &priv->asynclist);
spin_unlock_irqrestore(&priv->asynclock, flags);
+ kref_get(&rq->ref_count);
ret = usb_submit_urb(rq->urb, mem_flags);
- if (!ret) {
- kref_get(&rq->ref_count);
+ if (!ret)
return rq;
- }
- kref_put(&rq->ref_count, destroy_async);
+ destroy_async(&rq->ref_count);
err("submit_async_request submit_urb failed with %d", ret);
return NULL;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 215/247] ehci-hcd: Bug fix: don't set a QH's Halt bit
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (153 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 214/247] USB: uss720 fixup refcount position Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 216/247] uvcvideo: Fix uvc_fixup_video_ctrl() format search Paul Gortmaker
` (31 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alan Stern, Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b5a3b3d985493c173925907adfebf3edab236fe7 upstream.
This patch (as1453) fixes a long-standing bug in the ehci-hcd driver.
There is no need to set the Halt bit in the overlay region for an
unlinked or blocked QH. Contrary to what the comment says, setting
the Halt bit does not cause the QH to be patched later; that decision
(made in qh_refresh()) depends only on whether the QH is currently
pointing to a valid qTD. Likewise, setting the Halt bit does not
prevent completions from activating the QH while it is "stopped"; they
are prevented by the fact that qh_completions() temporarily changes
qh->qh_state to QH_STATE_COMPLETING.
On the other hand, there are circumstances in which the QH will be
reactivated _without_ being patched; this happens after an URB beyond
the head of the queue is unlinked. Setting the Halt bit will then
cause the hardware to see the QH with both the Active and Halt bits
set, an invalid combination that will prevent the queue from
advancing and may even crash some controllers.
Apparently the only reason this hasn't been reported before is that
unlinking URBs from the middle of a running queue is quite uncommon.
However Test 17, recently added to the usbtest driver, does exactly
this, and it confirms the presence of the bug.
In short, there is no reason to set the Halt bit for an unlinked or
blocked QH, and there is a very good reason not to set it. Therefore
the code that sets it is removed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Andiry Xu <andiry.xu@amd.com>
CC: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/ehci-q.c | 12 ------------
1 files changed, 0 insertions(+), 12 deletions(-)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 8952177..d1d4bb1 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -315,7 +315,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
int stopped;
unsigned count = 0;
u8 state;
- const __le32 halt = HALT_BIT(ehci);
struct ehci_qh_hw *hw = qh->hw;
if (unlikely (list_empty (&qh->qtd_list)))
@@ -422,7 +421,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
&& !(qtd->hw_alt_next
& EHCI_LIST_END(ehci))) {
stopped = 1;
- goto halt;
}
/* stop scanning when we reach qtds the hc is using */
@@ -456,16 +454,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
*/
ehci_clear_tt_buffer(ehci, qh, urb, token);
}
-
- /* force halt for unlinked or blocked qh, so we'll
- * patch the qh later and so that completions can't
- * activate it while we "know" it's stopped.
- */
- if ((halt & hw->hw_token) == 0) {
-halt:
- hw->hw_token |= halt;
- wmb ();
- }
}
/* unless we already know the urb's status, collect qtd status
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 216/247] uvcvideo: Fix uvc_fixup_video_ctrl() format search
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (154 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 215/247] ehci-hcd: Bug fix: don't set a QH's Halt bit Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 217/247] nfsd41: modify the members value of nfsd4_op_flags Paul Gortmaker
` (30 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stephan Lachowsky, Mauro Carvalho Chehab,
Paul Gortmaker
From: Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 38a66824d96de8aeeb915e6f46f0d3fe55828eb1 upstream.
The scheme used to index format in uvc_fixup_video_ctrl() is not robust:
format index is based on descriptor ordering, which does not necessarily
match bFormatIndex ordering. Searching for first matching format will
prevent uvc_fixup_video_ctrl() from using the wrong format/frame to make
adjustments.
Signed-off-by: Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/video/uvc/uvc_video.c | 14 +++++++++-----
1 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 821a996..687c970 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -65,15 +65,19 @@ int uvc_query_ctrl(struct uvc_device *dev, __u8 query, __u8 unit,
static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
struct uvc_streaming_control *ctrl)
{
- struct uvc_format *format;
+ struct uvc_format *format = NULL;
struct uvc_frame *frame = NULL;
unsigned int i;
- if (ctrl->bFormatIndex <= 0 ||
- ctrl->bFormatIndex > stream->nformats)
- return;
+ for (i = 0; i < stream->nformats; ++i) {
+ if (stream->format[i].index == ctrl->bFormatIndex) {
+ format = &stream->format[i];
+ break;
+ }
+ }
- format = &stream->format[ctrl->bFormatIndex - 1];
+ if (format == NULL)
+ return;
for (i = 0; i < format->nframes; ++i) {
if (format->frame[i].bFrameIndex == ctrl->bFrameIndex) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 217/247] nfsd41: modify the members value of nfsd4_op_flags
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (155 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 216/247] uvcvideo: Fix uvc_fixup_video_ctrl() format search Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 218/247] fbcon: Bugfix soft cursor detection in Tile Blitting Paul Gortmaker
` (29 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Mi Jinlong, J. Bruce Fields, Paul Gortmaker
From: Mi Jinlong <mijinlong@cn.fujitsu.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5ece3cafbd88d4da5c734e1810c4a2e6474b57b2 upstream.
The members of nfsd4_op_flags, (ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS)
equals to ALLOWED_AS_FIRST_OP, maybe that's not what we want.
OP_PUTROOTFH with op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS,
can't appears as the first operation with out SEQUENCE ops.
This patch modify the wrong value of ALLOWED_WITHOUT_FH etc which
was introduced by f9bb94c4.
Reviewed-by: Benny Halevy <bhalevy@panasas.com>
Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4proc.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 2ab9e85..5046e8b 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -954,8 +954,8 @@ typedef __be32(*nfsd4op_func)(struct svc_rqst *, struct nfsd4_compound_state *,
void *);
enum nfsd4_op_flags {
ALLOWED_WITHOUT_FH = 1 << 0, /* No current filehandle required */
- ALLOWED_ON_ABSENT_FS = 2 << 0, /* ops processed on absent fs */
- ALLOWED_AS_FIRST_OP = 3 << 0, /* ops reqired first in compound */
+ ALLOWED_ON_ABSENT_FS = 1 << 1, /* ops processed on absent fs */
+ ALLOWED_AS_FIRST_OP = 1 << 2, /* ops reqired first in compound */
};
struct nfsd4_operation {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 218/247] fbcon: Bugfix soft cursor detection in Tile Blitting
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (156 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 217/247] nfsd41: modify the members value of nfsd4_op_flags Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 219/247] proc: protect mm start_code/end_code in /proc/pid/stat Paul Gortmaker
` (28 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Henry Nestler, Paul Mundt, Paul Gortmaker
From: Henry Nestler <henry.nestler@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d6244bc0ed0c52a795e6f4dcab3886daf3e74fac upstream.
Use mask 0x10 for "soft cursor" detection on in function tile_cursor.
(Tile Blitting Operation in framebuffer console).
The old mask 0x01 for vc_cursor_type detects CUR_NONE, CUR_LOWER_THIRD
and every second mode value as "software cursor". This hides the cursor
for these modes (cursor.mode = 0). But, only CUR_NONE or "software cursor"
should hide the cursor.
See also 0x10 in functions add_softcursor, bit_cursor and cw_cursor.
Signed-off-by: Henry Nestler <henry.nestler@gmail.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/video/console/tileblit.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c
index 0056a41..15e8e1a 100644
--- a/drivers/video/console/tileblit.c
+++ b/drivers/video/console/tileblit.c
@@ -83,7 +83,7 @@ static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode,
int softback_lines, int fg, int bg)
{
struct fb_tilecursor cursor;
- int use_sw = (vc->vc_cursor_type & 0x01);
+ int use_sw = (vc->vc_cursor_type & 0x10);
cursor.sx = vc->vc_x;
cursor.sy = vc->vc_y;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 219/247] proc: protect mm start_code/end_code in /proc/pid/stat
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (157 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 218/247] fbcon: Bugfix soft cursor detection in Tile Blitting Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 220/247] procfs: fix /proc/<pid>/maps heap check Paul Gortmaker
` (27 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kees Cook, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Kees Cook <kees.cook@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5883f57ca0008ffc93e09cbb9847a1928e50c6f3 upstream.
While mm->start_stack was protected from cross-uid viewing (commit
f83ce3e6b02d5 ("proc: avoid information leaks to non-privileged
processes")), the start_code and end_code values were not. This would
allow the text location of a PIE binary to leak, defeating ASLR.
Note that the value "1" is used instead of "0" for a protected value since
"ps", "killall", and likely other readers of /proc/pid/stat, take
start_code of "0" to mean a kernel thread and will misbehave. Thanks to
Brad Spengler for pointing this out.
Addresses CVE-2011-0726
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Eugene Teo <eugeneteo@kernel.sg>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/proc/array.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index ed2afa6..412e163 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -489,8 +489,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
vsize,
mm ? get_mm_rss(mm) : 0,
rsslim,
- mm ? mm->start_code : 0,
- mm ? mm->end_code : 0,
+ mm ? (permitted ? mm->start_code : 1) : 0,
+ mm ? (permitted ? mm->end_code : 1) : 0,
(permitted && mm) ? mm->start_stack : 0,
esp,
eip,
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 220/247] procfs: fix /proc/<pid>/maps heap check
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (158 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 219/247] proc: protect mm start_code/end_code in /proc/pid/stat Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 221/247] ext3: skip orphan cleanup on rocompat fs Paul Gortmaker
` (26 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Aaro Koskinen, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Aaro Koskinen <aaro.koskinen@nokia.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0db0c01b53a1a421513f91573241aabafb87802a upstream.
The current code fails to print the "[heap]" marking if the heap is split
into multiple mappings.
Fix the check so that the marking is displayed in all possible cases:
1. vma matches exactly the heap
2. the heap vma is merged e.g. with bss
3. the heap vma is splitted e.g. due to locked pages
Test cases. In all cases, the process should have mapping(s) with
[heap] marking:
(1) vma matches exactly the heap
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main (void)
{
if (sbrk(4096) != (void *)-1) {
printf("check /proc/%d/maps\n", (int)getpid());
while (1)
sleep(1);
}
return 0;
}
# ./test1
check /proc/553/maps
[1] + Stopped ./test1
# cat /proc/553/maps | head -4
00008000-00009000 r-xp 00000000 01:00 3113640 /test1
00010000-00011000 rw-p 00000000 01:00 3113640 /test1
00011000-00012000 rw-p 00000000 00:00 0 [heap]
4006f000-40070000 rw-p 00000000 00:00 0
(2) the heap vma is merged
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
char foo[4096] = "foo";
char bar[4096];
int main (void)
{
if (sbrk(4096) != (void *)-1) {
printf("check /proc/%d/maps\n", (int)getpid());
while (1)
sleep(1);
}
return 0;
}
# ./test2
check /proc/556/maps
[2] + Stopped ./test2
# cat /proc/556/maps | head -4
00008000-00009000 r-xp 00000000 01:00 3116312 /test2
00010000-00012000 rw-p 00000000 01:00 3116312 /test2
00012000-00014000 rw-p 00000000 00:00 0 [heap]
4004a000-4004b000 rw-p 00000000 00:00 0
(3) the heap vma is splitted (this fails without the patch)
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/types.h>
int main (void)
{
if ((sbrk(4096) != (void *)-1) && !mlockall(MCL_FUTURE) &&
(sbrk(4096) != (void *)-1)) {
printf("check /proc/%d/maps\n", (int)getpid());
while (1)
sleep(1);
}
return 0;
}
# ./test3
check /proc/559/maps
[1] + Stopped ./test3
# cat /proc/559/maps|head -4
00008000-00009000 r-xp 00000000 01:00 3119108 /test3
00010000-00011000 rw-p 00000000 01:00 3119108 /test3
00011000-00012000 rw-p 00000000 00:00 0 [heap]
00012000-00013000 rw-p 00000000 00:00 0 [heap]
It looks like the bug has been there forever, and since it only results in
some information missing from a procfile, it does not fulfil the -stable
"critical issue" criteria.
Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/proc/task_mmu.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 971fd7a..5fa8933 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -248,8 +248,8 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
const char *name = arch_vma_name(vma);
if (!name) {
if (mm) {
- if (vma->vm_start <= mm->start_brk &&
- vma->vm_end >= mm->brk) {
+ if (vma->vm_start <= mm->brk &&
+ vma->vm_end >= mm->start_brk) {
name = "[heap]";
} else if (vma->vm_start <= mm->start_stack &&
vma->vm_end >= mm->start_stack) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 221/247] ext3: skip orphan cleanup on rocompat fs
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (159 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 220/247] procfs: fix /proc/<pid>/maps heap check Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 222/247] PCI: return correct value when writing to the "reset" attribute Paul Gortmaker
` (25 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Amir Goldstein, Amir Goldstein, Jan Kara,
Paul Gortmaker
From: Amir Goldstein <amir73il@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ce654b37f87980d95f339080e4c3bdb2370bdf22 upstream.
Orphan cleanup is currently executed even if the file system has some
number of unknown ROCOMPAT features, which deletes inodes and frees
blocks, which could be very bad for some RO_COMPAT features.
This patch skips the orphan cleanup if it contains readonly compatible
features not known by this ext3 implementation, which would prevent
the fs from being mounted (or remounted) readwrite.
Signed-off-by: Amir Goldstein <amir73il@users.sf.net>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext3/super.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 1bee604..3614e52 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1441,6 +1441,13 @@ static void ext3_orphan_cleanup (struct super_block * sb,
return;
}
+ /* Check if feature set allows readwrite operations */
+ if (EXT3_HAS_RO_COMPAT_FEATURE(sb, ~EXT3_FEATURE_RO_COMPAT_SUPP)) {
+ ext3_msg(sb, KERN_INFO, "Skipping orphan cleanup due to "
+ "unknown ROCOMPAT features");
+ return;
+ }
+
if (EXT3_SB(sb)->s_mount_state & EXT3_ERROR_FS) {
if (es->s_last_orphan)
jbd_debug(1, "Errors on filesystem, "
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 222/247] PCI: return correct value when writing to the "reset" attribute
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (160 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 221/247] ext3: skip orphan cleanup on rocompat fs Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 223/247] mpt2sas: prevent heap overflows and unchecked reads Paul Gortmaker
` (24 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michal Schmidt, Jesse Barnes, Paul Gortmaker
From: Michal Schmidt <mschmidt@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 447c5dd7338638f526e9bcf7dcf69b4da5835c7d upstream.
A successful write() to the "reset" sysfs attribute should return the
number of bytes written, not 0. Otherwise userspace (bash) retries the
write over and over again.
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/pci-sysfs.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index e1783bb..4d49aea 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -971,7 +971,12 @@ static ssize_t reset_store(struct device *dev,
if (val != 1)
return -EINVAL;
- return pci_reset_function(pdev);
+
+ result = pci_reset_function(pdev);
+ if (result < 0)
+ return result;
+
+ return count;
}
static struct device_attribute reset_attr = __ATTR(reset, 0200, NULL, reset_store);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 223/247] mpt2sas: prevent heap overflows and unchecked reads
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (161 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 222/247] PCI: return correct value when writing to the "reset" attribute Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table Paul Gortmaker
` (23 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, James Bottomley, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream.
At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
length values are used to copy data from userspace into heap buffers
without bounds checking, allowing controllable heap corruption and
subsequently privilege escalation.
Additionally, user-supplied values are used to determine the size of a
copy_to_user() as well as the offset into the buffer to be read, with no
bounds checking, allowing users to read arbitrary kernel memory.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Eric Moore <eric.moore@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/mpt2sas/mpt2sas_ctl.c | 23 +++++++++++++++++++++--
1 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index fa9bf83..3742ac9 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
data_out_sz = karg.data_out_size;
data_in_sz = karg.data_in_size;
+ /* Check for overflow and wraparound */
+ if (karg.data_sge_offset * 4 > ioc->request_sz ||
+ karg.data_sge_offset > (UINT_MAX / 4)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
/* copy in request message frame from user */
if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1877,7 +1884,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
Mpi2DiagBufferPostReply_t *mpi_reply;
int rc, i;
u8 buffer_type;
- unsigned long timeleft;
+ unsigned long timeleft, request_size, copy_size;
u16 smid;
u16 ioc_status;
u8 issue_reset = 0;
@@ -1913,6 +1920,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
return -ENOMEM;
}
+ request_size = ioc->diag_buffer_sz[buffer_type];
+
if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
"or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -1920,13 +1929,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
return -EINVAL;
}
+ if (karg.starting_offset > request_size)
+ return -EINVAL;
+
diag_data = (void *)(request_data + karg.starting_offset);
dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
"offset(%d), sz(%d)\n", ioc->name, __func__,
diag_data, karg.starting_offset, karg.bytes_to_read));
+ /* Truncate data on requests that are too large */
+ if ((diag_data + karg.bytes_to_read < diag_data) ||
+ (diag_data + karg.bytes_to_read > request_data + request_size))
+ copy_size = request_size - karg.starting_offset;
+ else
+ copy_size = karg.bytes_to_read;
+
if (copy_to_user((void __user *)uarg->diagnostic_data,
- diag_data, karg.bytes_to_read)) {
+ diag_data, copy_size)) {
printk(MPT2SAS_ERR_FMT "%s: Unable to write "
"mpt_diag_read_buffer_t data @ %p\n", ioc->name,
__func__, diag_data);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (162 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 223/247] mpt2sas: prevent heap overflows and unchecked reads Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 23:14 ` [Stable-review] " Ben Hutchings
2011-06-23 17:34 ` [34-longterm 225/247] agp: fix arbitrary kernel memory writes Paul Gortmaker
` (22 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c340b1d640001c8c9ecff74f68fd90422ae2448a upstream.
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
a bug that causes a kernel oops on certain corrupted LDM partitions.
A kernel subsystem seems to crash, because, after the oops, the kernel no
longer recognizes newly connected storage devices.
The patch validates the value of vblk_size.
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: Eugene Teo <eugeneteo@kernel.sg>
Cc: Harvey Harrison <harvey.harrison@gmail.com>
Cc: Richard Russon <rich@flatcap.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/ldm.c | 16 ++++++++++++----
1 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index 2cd9e43..a2a14cd 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
BUG_ON (!data || !frags);
+ if (size < 2 * VBLK_SIZE_HEAD) {
+ ldm_error("Value of size is to small.");
+ return false;
+ }
+
group = get_unaligned_be32(data + 0x08);
rec = get_unaligned_be16(data + 0x0C);
num = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
ldm_error ("A VBLK claims to have %d parts.", num);
return false;
}
+ if (rec >= num) {
+ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+ return false;
+ }
list_for_each (item, frags) {
f = list_entry (item, struct frag, list);
@@ -1334,10 +1343,9 @@ found:
f->map |= (1 << rec);
- if (num > 0) {
- data += VBLK_SIZE_HEAD;
- size -= VBLK_SIZE_HEAD;
- }
+ data += VBLK_SIZE_HEAD;
+ size -= VBLK_SIZE_HEAD;
+
memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
return true;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [Stable-review] [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table
2011-06-23 17:34 ` [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table Paul Gortmaker
@ 2011-06-23 23:14 ` Ben Hutchings
2011-06-24 12:12 ` Paul Gortmaker
0 siblings, 1 reply; 269+ messages in thread
From: Ben Hutchings @ 2011-06-23 23:14 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Andrew Morton, Linus Torvalds,
stable-review, Timo Warns
[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]
On Thu, 2011-06-23 at 13:34 -0400, Paul Gortmaker wrote:
> From: Timo Warns <Warns@pre-sense.de>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit c340b1d640001c8c9ecff74f68fd90422ae2448a upstream.
>
> The kernel automatically evaluates partition tables of storage devices.
> The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
> a bug that causes a kernel oops on certain corrupted LDM partitions.
> A kernel subsystem seems to crash, because, after the oops, the kernel no
> longer recognizes newly connected storage devices.
>
> The patch validates the value of vblk_size.
[...]
This doesn't completely fix the possibility of a buffer overflow. You
also need commit cae13fe4cc3f24820ffb990c09110626837e85d4.
Ben.
--
Ben Hutchings
The two most common things in the universe are hydrogen and stupidity.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 269+ messages in thread
* Re: [Stable-review] [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table
2011-06-23 23:14 ` [Stable-review] " Ben Hutchings
@ 2011-06-24 12:12 ` Paul Gortmaker
0 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-24 12:12 UTC (permalink / raw)
To: Ben Hutchings
Cc: stable, linux-kernel, Andrew Morton, Linus Torvalds,
stable-review, Timo Warns
On 11-06-23 07:14 PM, Ben Hutchings wrote:
> On Thu, 2011-06-23 at 13:34 -0400, Paul Gortmaker wrote:
>> From: Timo Warns <Warns@pre-sense.de>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit c340b1d640001c8c9ecff74f68fd90422ae2448a upstream.
>>
>> The kernel automatically evaluates partition tables of storage devices.
>> The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
>> a bug that causes a kernel oops on certain corrupted LDM partitions.
>> A kernel subsystem seems to crash, because, after the oops, the kernel no
>> longer recognizes newly connected storage devices.
>>
>> The patch validates the value of vblk_size.
> [...]
>
> This doesn't completely fix the possibility of a buffer overflow. You
> also need commit cae13fe4cc3f24820ffb990c09110626837e85d4.
Thanks Ben, I will queue that up this morning.
Paul.
>
> Ben.
>
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 225/247] agp: fix arbitrary kernel memory writes
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (163 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 224/247] fs/partitions/ldm.c: fix oops caused by corrupted partition table Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 226/247] agp: fix OOM and buffer overflow Paul Gortmaker
` (21 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Dave Airlie, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 194b3da873fd334ef183806db751473512af29ce upstream.
pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND. As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/agp/generic.c | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index fb86708..13a3446 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1124,8 +1124,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
return -EINVAL;
}
- /* AK: could wrap */
- if ((pg_start + mem->page_count) > num_entries)
+ if (((pg_start + mem->page_count) > num_entries) ||
+ ((pg_start + mem->page_count) < pg_start))
return -EINVAL;
j = pg_start;
@@ -1159,7 +1159,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
{
size_t i;
struct agp_bridge_data *bridge;
- int mask_type;
+ int mask_type, num_entries;
bridge = mem->bridge;
if (!bridge)
@@ -1171,6 +1171,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
if (type != mem->type)
return -EINVAL;
+ num_entries = agp_num_entries();
+ if (((pg_start + mem->page_count) > num_entries) ||
+ ((pg_start + mem->page_count) < pg_start))
+ return -EINVAL;
+
mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
if (mask_type != 0) {
/* The generic routines know nothing of memory types */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 226/247] agp: fix OOM and buffer overflow
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (164 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 225/247] agp: fix arbitrary kernel memory writes Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 227/247] udp: Fix bogus UFO packet generation Paul Gortmaker
` (20 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Dave Airlie, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b522f02184b413955f3bc952e3776ce41edc6355 upstream.
page_count is copied from userspace. agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case. Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.
Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/agp/generic.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 13a3446..22b40c0 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -124,6 +124,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
struct agp_memory *new;
unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+ if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+ return NULL;
+
new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
if (new == NULL)
return NULL;
@@ -243,11 +246,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
int scratch_pages;
struct agp_memory *new;
size_t i;
+ int cur_memory;
if (!bridge)
return NULL;
- if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+ cur_memory = atomic_read(&bridge->current_memory_agp);
+ if ((cur_memory + page_count > bridge->max_memory_agp) ||
+ (cur_memory + page_count < page_count))
return NULL;
if (type >= AGP_USER_TYPES) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 227/247] udp: Fix bogus UFO packet generation
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (165 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 226/247] agp: fix OOM and buffer overflow Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU Paul Gortmaker
` (19 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Herbert Xu, David S. Miller, Paul Gortmaker
From: Herbert Xu <herbert@gondor.apana.org.au>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 26cde9f7e2747b6d254b704594eed87ab959afa5 upstream.
It has been reported that the new UFO software fallback path
fails under certain conditions with NFS. I tracked the problem
down to the generation of UFO packets that are smaller than the
MTU. The software fallback path simply discards these packets.
This patch fixes the problem by not generating such packets on
the UFO path.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/ip_output.c | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e8a6860..d52fe4b 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -871,8 +871,10 @@ int ip_append_data(struct sock *sk,
!exthdrlen)
csummode = CHECKSUM_PARTIAL;
+ skb = skb_peek_tail(&sk->sk_write_queue);
+
inet->cork.length += length;
- if (((length> mtu) || !skb_queue_empty(&sk->sk_write_queue)) &&
+ if (((length > mtu) || (skb && skb_is_gso(skb))) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->u.dst.dev->features & NETIF_F_UFO)) {
err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
@@ -890,7 +892,7 @@ int ip_append_data(struct sock *sk,
* adding appropriate IP header.
*/
- if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+ if (!skb)
goto alloc_new_skb;
while (length > 0) {
@@ -1119,7 +1121,8 @@ ssize_t ip_append_page(struct sock *sk, struct page *page,
return -EINVAL;
inet->cork.length += size;
- if ((sk->sk_protocol == IPPROTO_UDP) &&
+ if ((size + skb->len > mtu) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
(rt->u.dst.dev->features & NETIF_F_UFO)) {
skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (166 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 227/247] udp: Fix bogus UFO packet generation Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-24 9:23 ` Robert Richter
2011-06-23 17:34 ` [34-longterm 229/247] epoll: convert max_user_watches to long Paul Gortmaker
` (18 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Robert Richter, Ingo Molnar, Paul Gortmaker
From: Robert Richter <robert.richter@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c7c25802b39c443b3745cfa973dc49a97a3491f8 upstream.
Disable preemption in init_ibs(). The function only checks the
ibs capabilities and sets up pci devices (if necessary). It runs
only on one cpu but operates with the local APIC and some MSRs,
thus it is better to disable preemption.
[ 7.034377] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/483
[ 7.034385] caller is setup_APIC_eilvt+0x155/0x180
[ 7.034389] Pid: 483, comm: modprobe Not tainted 2.6.37-rc1-20101110+ #1
[ 7.034392] Call Trace:
[ 7.034400] [<ffffffff812a2b72>] debug_smp_processor_id+0xd2/0xf0
[ 7.034404] [<ffffffff8101e985>] setup_APIC_eilvt+0x155/0x180
[ ... ]
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22812
Reported-by: <atswartz@gmail.com>
Signed-off-by: Robert Richter <robert.richter@amd.com>
Cc: oprofile-list@lists.sourceforge.net <oprofile-list@lists.sourceforge.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <20110103111514.GM4739@erda.amd.com>
[ small cleanups ]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/oprofile/op_model_amd.c | 24 ++++++++++++++++--------
1 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
index 090cbbe..c8f46aa 100644
--- a/arch/x86/oprofile/op_model_amd.c
+++ b/arch/x86/oprofile/op_model_amd.c
@@ -497,21 +497,29 @@ static void clear_ibs_nmi(void)
on_each_cpu(apic_clear_ibs_nmi_per_cpu, NULL, 1);
}
-/* initialize the APIC for the IBS interrupts if available */
+/*
+ * check and reserve APIC extended interrupt LVT offset for IBS if
+ * available
+ *
+ * init_ibs() preforms implicitly cpu-local operations, so pin this
+ * thread to its current CPU
+ */
+
static void ibs_init(void)
{
- ibs_caps = get_ibs_caps();
+ preempt_disable();
+ ibs_caps = get_ibs_caps();
if (!ibs_caps)
- return;
+ goto out;
- if (init_ibs_nmi()) {
+ if (init_ibs_nmi() < 0)
ibs_caps = 0;
- return;
- }
+ else
+ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n",
- (unsigned)ibs_caps);
+out:
+ preempt_enable();
}
static void ibs_exit(void)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU
2011-06-23 17:34 ` [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU Paul Gortmaker
@ 2011-06-24 9:23 ` Robert Richter
2011-06-24 13:02 ` Paul Gortmaker
0 siblings, 1 reply; 269+ messages in thread
From: Robert Richter @ 2011-06-24 9:23 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable@kernel.org, linux-kernel@vger.kernel.org,
stable-review@kernel.org, Ingo Molnar
On 23.06.11 13:34:56, Paul Gortmaker wrote:
> From: Robert Richter <robert.richter@amd.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit c7c25802b39c443b3745cfa973dc49a97a3491f8 upstream.
>
> Disable preemption in init_ibs(). The function only checks the
> ibs capabilities and sets up pci devices (if necessary). It runs
> only on one cpu but operates with the local APIC and some MSRs,
> thus it is better to disable preemption.
>
> [ 7.034377] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/483
> [ 7.034385] caller is setup_APIC_eilvt+0x155/0x180
> [ 7.034389] Pid: 483, comm: modprobe Not tainted 2.6.37-rc1-20101110+ #1
> [ 7.034392] Call Trace:
> [ 7.034400] [<ffffffff812a2b72>] debug_smp_processor_id+0xd2/0xf0
> [ 7.034404] [<ffffffff8101e985>] setup_APIC_eilvt+0x155/0x180
> [ ... ]
>
> Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22812
>
> Reported-by: <atswartz@gmail.com>
> Signed-off-by: Robert Richter <robert.richter@amd.com>
> Cc: oprofile-list@lists.sourceforge.net <oprofile-list@lists.sourceforge.net>
> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
> Cc: Frederic Weisbecker <fweisbec@gmail.com>
> Cc: Rafael J. Wysocki <rjw@sisk.pl>
> Cc: Dan Carpenter <error27@gmail.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> LKML-Reference: <20110103111514.GM4739@erda.amd.com>
> [ small cleanups ]
> Signed-off-by: Ingo Molnar <mingo@elte.hu>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> ---
> arch/x86/oprofile/op_model_amd.c | 24 ++++++++++++++++--------
> 1 files changed, 16 insertions(+), 8 deletions(-)
This patch introduces a sleeping-while-atomic bug. There is another
upstream fix on top, see:
commit 3d2606f42984613d324ad3047cf503bcddc3880a
Author: Robert Richter <robert.richter@amd.com>
Date: Fri May 20 09:46:54 2011 +0200
oprofile, x86: Enable preemption during pci device setup in IBS init
This fix should be applied too (or instead).
-Robert
--
Advanced Micro Devices, Inc.
Operating System Research Center
^ permalink raw reply [flat|nested] 269+ messages in thread* Re: [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU
2011-06-24 9:23 ` Robert Richter
@ 2011-06-24 13:02 ` Paul Gortmaker
2011-06-27 13:52 ` Robert Richter
0 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-24 13:02 UTC (permalink / raw)
To: Robert Richter
Cc: stable@kernel.org, linux-kernel@vger.kernel.org,
stable-review@kernel.org, Ingo Molnar
On 11-06-24 05:23 AM, Robert Richter wrote:
> On 23.06.11 13:34:56, Paul Gortmaker wrote:
>> From: Robert Richter <robert.richter@amd.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit c7c25802b39c443b3745cfa973dc49a97a3491f8 upstream.
>>
>> Disable preemption in init_ibs(). The function only checks the
>> ibs capabilities and sets up pci devices (if necessary). It runs
>> only on one cpu but operates with the local APIC and some MSRs,
>> thus it is better to disable preemption.
>>
>> [ 7.034377] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/483
>> [ 7.034385] caller is setup_APIC_eilvt+0x155/0x180
>> [ 7.034389] Pid: 483, comm: modprobe Not tainted 2.6.37-rc1-20101110+ #1
>> [ 7.034392] Call Trace:
>> [ 7.034400] [<ffffffff812a2b72>] debug_smp_processor_id+0xd2/0xf0
>> [ 7.034404] [<ffffffff8101e985>] setup_APIC_eilvt+0x155/0x180
>> [ ... ]
>>
>> Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22812
>>
>> Reported-by: <atswartz@gmail.com>
>> Signed-off-by: Robert Richter <robert.richter@amd.com>
>> Cc: oprofile-list@lists.sourceforge.net <oprofile-list@lists.sourceforge.net>
>> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
>> Cc: Frederic Weisbecker <fweisbec@gmail.com>
>> Cc: Rafael J. Wysocki <rjw@sisk.pl>
>> Cc: Dan Carpenter <error27@gmail.com>
>> Cc: Andrew Morton <akpm@linux-foundation.org>
>> LKML-Reference: <20110103111514.GM4739@erda.amd.com>
>> [ small cleanups ]
>> Signed-off-by: Ingo Molnar <mingo@elte.hu>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
>> ---
>> arch/x86/oprofile/op_model_amd.c | 24 ++++++++++++++++--------
>> 1 files changed, 16 insertions(+), 8 deletions(-)
>
> This patch introduces a sleeping-while-atomic bug. There is another
> upstream fix on top, see:
>
> commit 3d2606f42984613d324ad3047cf503bcddc3880a
> Author: Robert Richter <robert.richter@amd.com>
> Date: Fri May 20 09:46:54 2011 +0200
>
> oprofile, x86: Enable preemption during pci device setup in IBS init
>
> This fix should be applied too (or instead).
Thanks Robert. I guess I'll end up dropping c7c25802b39c
then. I just did a quick test and it appears the 2.6.34
code base is too old for me to be able to apply 3d2606f4298
in anything close to resembling its original form.
Paul.
>
> -Robert
>
^ permalink raw reply [flat|nested] 269+ messages in thread
* Re: [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU
2011-06-24 13:02 ` Paul Gortmaker
@ 2011-06-27 13:52 ` Robert Richter
0 siblings, 0 replies; 269+ messages in thread
From: Robert Richter @ 2011-06-27 13:52 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable@kernel.org, linux-kernel@vger.kernel.org,
stable-review@kernel.org, Ingo Molnar
On 24.06.11 09:02:39, Paul Gortmaker wrote:
> On 11-06-24 05:23 AM, Robert Richter wrote:
> > On 23.06.11 13:34:56, Paul Gortmaker wrote:
> >> From: Robert Richter <robert.richter@amd.com>
> >>
> >> -------------------
> >> This is a commit scheduled for the next v2.6.34 longterm release.
> >> If you see a problem with using this for longterm, please comment.
> >> -------------------
> >>
> >> commit c7c25802b39c443b3745cfa973dc49a97a3491f8 upstream.
> >>
> >> Disable preemption in init_ibs(). The function only checks the
> >> ibs capabilities and sets up pci devices (if necessary). It runs
> >> only on one cpu but operates with the local APIC and some MSRs,
> >> thus it is better to disable preemption.
> >>
> >> [ 7.034377] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/483
> >> [ 7.034385] caller is setup_APIC_eilvt+0x155/0x180
> >> [ 7.034389] Pid: 483, comm: modprobe Not tainted 2.6.37-rc1-20101110+ #1
> >> [ 7.034392] Call Trace:
> >> [ 7.034400] [<ffffffff812a2b72>] debug_smp_processor_id+0xd2/0xf0
> >> [ 7.034404] [<ffffffff8101e985>] setup_APIC_eilvt+0x155/0x180
> >> [ ... ]
> >>
> >> Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22812
> >>
> >> Reported-by: <atswartz@gmail.com>
> >> Signed-off-by: Robert Richter <robert.richter@amd.com>
> >> Cc: oprofile-list@lists.sourceforge.net <oprofile-list@lists.sourceforge.net>
> >> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
> >> Cc: Frederic Weisbecker <fweisbec@gmail.com>
> >> Cc: Rafael J. Wysocki <rjw@sisk.pl>
> >> Cc: Dan Carpenter <error27@gmail.com>
> >> Cc: Andrew Morton <akpm@linux-foundation.org>
> >> LKML-Reference: <20110103111514.GM4739@erda.amd.com>
> >> [ small cleanups ]
> >> Signed-off-by: Ingo Molnar <mingo@elte.hu>
> >> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> >> ---
> >> arch/x86/oprofile/op_model_amd.c | 24 ++++++++++++++++--------
> >> 1 files changed, 16 insertions(+), 8 deletions(-)
> >
> > This patch introduces a sleeping-while-atomic bug. There is another
> > upstream fix on top, see:
> >
> > commit 3d2606f42984613d324ad3047cf503bcddc3880a
> > Author: Robert Richter <robert.richter@amd.com>
> > Date: Fri May 20 09:46:54 2011 +0200
> >
> > oprofile, x86: Enable preemption during pci device setup in IBS init
> >
> > This fix should be applied too (or instead).
>
> Thanks Robert. I guess I'll end up dropping c7c25802b39c
> then. I just did a quick test and it appears the 2.6.34
> code base is too old for me to be able to apply 3d2606f4298
> in anything close to resembling its original form.
This would be ok. Current upstream code is a reimplementation very
different from .34.
Thanks,
-Robert
--
Advanced Micro Devices, Inc.
Operating System Research Center
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 229/247] epoll: convert max_user_watches to long
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (167 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 228/247] arch/x86/oprofile/op_model_amd.c: Perform initialisation on a single CPU Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 230/247] fs: call security_d_instantiate in d_obtain_alias V2 Paul Gortmaker
` (17 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Robin Holt, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Robin Holt <holt@sgi.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 52bd19f7691b2ea6433aef0ef94c08c57efd7e79 upstream.
On a 16TB machine, max_user_watches has an integer overflow. Convert it
to use a long and handle the associated fallout.
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Davide Libenzi <davidel@xmailserver.org>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/eventpoll.c | 20 ++++++++++++--------
include/linux/sched.h | 2 +-
2 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index a8dfe21..85c5a9f 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -227,7 +227,7 @@ struct ep_send_events_data {
* Configuration options available inside /proc/sys/fs/epoll/
*/
/* Maximum number of epoll watched descriptors, per user */
-static int max_user_watches __read_mostly;
+static long max_user_watches __read_mostly;
/*
* This mutex is used to serialize ep_free() and eventpoll_release_file().
@@ -253,16 +253,18 @@ static struct kmem_cache *pwq_cache __read_mostly;
#include <linux/sysctl.h>
-static int zero;
+static long zero;
+static long long_max = LONG_MAX;
ctl_table epoll_table[] = {
{
.procname = "max_user_watches",
.data = &max_user_watches,
- .maxlen = sizeof(int),
+ .maxlen = sizeof(max_user_watches),
.mode = 0644,
- .proc_handler = proc_dointvec_minmax,
+ .proc_handler = proc_doulongvec_minmax,
.extra1 = &zero,
+ .extra2 = &long_max,
},
{ }
};
@@ -574,7 +576,7 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
/* At this point it is safe to free the eventpoll item */
kmem_cache_free(epi_cache, epi);
- atomic_dec(&ep->user->epoll_watches);
+ atomic_long_dec(&ep->user->epoll_watches);
return 0;
}
@@ -910,11 +912,12 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
{
int error, revents, pwake = 0;
unsigned long flags;
+ long user_watches;
struct epitem *epi;
struct ep_pqueue epq;
- if (unlikely(atomic_read(&ep->user->epoll_watches) >=
- max_user_watches))
+ user_watches = atomic_long_read(&ep->user->epoll_watches);
+ if (unlikely(user_watches >= max_user_watches))
return -ENOSPC;
if (!(epi = kmem_cache_alloc(epi_cache, GFP_KERNEL)))
return -ENOMEM;
@@ -978,7 +981,7 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
spin_unlock_irqrestore(&ep->lock, flags);
- atomic_inc(&ep->user->epoll_watches);
+ atomic_long_inc(&ep->user->epoll_watches);
/* We have to call this outside the lock */
if (pwake)
@@ -1512,6 +1515,7 @@ static int __init eventpoll_init(void)
*/
max_user_watches = (((si.totalram - si.totalhigh) / 25) << PAGE_SHIFT) /
EP_ITEM_COST;
+ BUG_ON(max_user_watches < 0);
/*
* Initialize the structure used to perform epoll file descriptor
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 03e34c5..c66e0af 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -672,7 +672,7 @@ struct user_struct {
atomic_t inotify_devs; /* How many inotify devs does this user have opened? */
#endif
#ifdef CONFIG_EPOLL
- atomic_t epoll_watches; /* The number of file descriptors currently watched */
+ atomic_long_t epoll_watches; /* The number of file descriptors currently watched */
#endif
#ifdef CONFIG_POSIX_MQUEUE
/* protected by mq_lock */
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 230/247] fs: call security_d_instantiate in d_obtain_alias V2
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (168 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 229/247] epoll: convert max_user_watches to long Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:34 ` [34-longterm 231/247] dcdbas: force SMI to happen when expected Paul Gortmaker
` (16 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Josef Bacik, Al Viro, Paul Gortmaker
From: Josef Bacik <josef@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 24ff6663ccfdaf088dfa7acae489cb11ed4f43c4 upstream
While trying to track down some NFS problems with BTRFS, I kept noticing I was
getting -EACCESS for no apparent reason. Eric Paris and printk() helped me
figure out that it was SELinux that was giving me grief, with the following
denial
type=AVC msg=audit(1290013638.413:95): avc: denied { 0x800000 } for pid=1772
comm="nfsd" name="" dev=sda1 ino=256 scontext=system_u:system_r:kernel_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
Turns out this is because in d_obtain_alias if we can't find an alias we create
one and do all the normal instantiation stuff, but we don't do the
security_d_instantiate.
Usually we are protected from getting a hashed dentry that hasn't yet run
security_d_instantiate() by the parent's i_mutex, but obviously this isn't an
option there, so in order to deal with the case that a second thread comes in
and finds our new dentry before we get to run security_d_instantiate(), we go
ahead and call it if we find a dentry already. Eric assures me that this is ok
as the code checks to see if the dentry has been initialized already so calling
security_d_instantiate() against the same dentry multiple times is ok. With
this patch I'm no longer getting errant -EACCESS values.
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/dcache.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 2b6f09a..68c70f0 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1187,9 +1187,12 @@ struct dentry *d_obtain_alias(struct inode *inode)
spin_unlock(&tmp->d_lock);
spin_unlock(&dcache_lock);
+ security_d_instantiate(tmp, inode);
return tmp;
out_iput:
+ if (res && !IS_ERR(res))
+ security_d_instantiate(res, inode);
iput(inode);
return res;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 231/247] dcdbas: force SMI to happen when expected
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (169 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 230/247] fs: call security_d_instantiate in d_obtain_alias V2 Paul Gortmaker
@ 2011-06-23 17:34 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 232/247] net: ax25: fix information leak to userland Paul Gortmaker
` (15 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:34 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stuart Hayes, Jiri Kosina, Paul Gortmaker
From: Stuart Hayes <stuart_hayes@yahoo.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit dd65c736d1b5312c80c88a64bf521db4959eded5 upstream.
The dcdbas driver can do an I/O write to cause a SMI to occur. The SMI handler
looks at certain registers and memory locations, so the SMI needs to happen
immediately. On some systems I/O writes are posted, though, causing the SMI to
happen well after the "outb" occurred, which causes random failures. Following
the "outb" with an "inb" forces the write to go through even if it is posted.
Signed-off-by: Stuart Hayes <stuart_hayes@yahoo.com>
Acked-by: Doug Warzecha <douglas_warzecha@dell.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/firmware/dcdbas.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index fb09bb3..385478c 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -268,8 +268,10 @@ int dcdbas_smi_request(struct smi_cmd *smi_cmd)
}
/* generate SMI */
+ /* inb to force posted write through and make SMI happen now */
asm volatile (
- "outb %b0,%w1"
+ "outb %b0,%w1\n"
+ "inb %w1"
: /* no output args */
: "a" (smi_cmd->command_code),
"d" (smi_cmd->command_address),
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 232/247] net: ax25: fix information leak to userland
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (170 preceding siblings ...)
2011-06-23 17:34 ` [34-longterm 231/247] dcdbas: force SMI to happen when expected Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 233/247] net: tipc: " Paul Gortmaker
` (14 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, David S. Miller, Paul Gortmaker
From: Vasiliy Kulikov <segooon@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fe10ae53384e48c51996941b7720ee16995cbcb7 upstream.
Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater
field of fsa struct, also the struct has padding bytes between
sax25_call and sax25_ndigis fields. This structure is then copied to
userland. It leads to leaking of contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ax25/af_ax25.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 65c5801..eb100ce 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
ax25_cb *ax25;
int err = 0;
+ memset(fsa, 0, sizeof(fsa));
lock_sock(sk);
ax25 = ax25_sk(sk);
@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
fsa->fsa_ax25.sax25_family = AF_AX25;
fsa->fsa_ax25.sax25_call = ax25->dest_addr;
- fsa->fsa_ax25.sax25_ndigis = 0;
if (ax25->digipeat != NULL) {
ndigi = ax25->digipeat->ndigi;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 233/247] net: tipc: fix information leak to userland
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (171 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 232/247] net: ax25: fix information leak to userland Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 234/247] inet_diag: Make sure we actually run the same bytecode we audited Paul Gortmaker
` (13 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kulikov Vasiliy, David S. Miller, Paul Gortmaker
From: Kulikov Vasiliy <segooon@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 88f8a5e3e7defccd3925cabb1ee4d3994e5cdb52 upstream.
Structure sockaddr_tipc is copied to userland with padding bytes after
"id" field in union field "name" unitialized. It leads to leaking of
contents of kernel stack memory. We have to initialize them to zero.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/socket.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index cfb20b8..a70214a 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -395,6 +395,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
struct tipc_sock *tsock = tipc_sk(sock->sk);
+ memset(addr, 0, sizeof(*addr));
if (peer) {
if ((sock->state != SS_CONNECTED) &&
((peer != 2) || (sock->state != SS_DISCONNECTING)))
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 234/247] inet_diag: Make sure we actually run the same bytecode we audited.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (172 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 233/247] net: tipc: " Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 235/247] netlink: Make nlmsg_find_attr take a const nlmsghdr* Paul Gortmaker
` (12 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Nelson Elhage, Thomas Graf, David S. Miller,
Paul Gortmaker
From: Nelson Elhage <nelhage@ksplice.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 22e76c849d505d87c5ecf3d3e6742a65f0ff4860 upstream.
We were using nlmsg_find_attr() to look up the bytecode by attribute when
auditing, but then just using the first attribute when actually running
bytecode. So, if we received a message with two attribute elements, where only
the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different
bytecode strings.
Fix this by consistently using nlmsg_find_attr everywhere.
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Signed-off-by: Thomas Graf <tgraf@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/inet_diag.c | 27 ++++++++++++++++-----------
1 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index e5fa2dd..7403b9b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -490,9 +490,11 @@ static int inet_csk_diag_dump(struct sock *sk,
{
struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
struct inet_diag_entry entry;
- struct rtattr *bc = (struct rtattr *)(r + 1);
+ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+ sizeof(*r),
+ INET_DIAG_REQ_BYTECODE);
struct inet_sock *inet = inet_sk(sk);
entry.family = sk->sk_family;
@@ -512,7 +514,7 @@ static int inet_csk_diag_dump(struct sock *sk,
entry.dport = ntohs(inet->inet_dport);
entry.userlocks = sk->sk_userlocks;
- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
return 0;
}
@@ -527,9 +529,11 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
{
struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
struct inet_diag_entry entry;
- struct rtattr *bc = (struct rtattr *)(r + 1);
+ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+ sizeof(*r),
+ INET_DIAG_REQ_BYTECODE);
entry.family = tw->tw_family;
#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
@@ -548,7 +552,7 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
entry.dport = ntohs(tw->tw_dport);
entry.userlocks = 0;
- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
return 0;
}
@@ -618,7 +622,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
struct inet_connection_sock *icsk = inet_csk(sk);
struct listen_sock *lopt;
- struct rtattr *bc = NULL;
+ const struct nlattr *bc = NULL;
struct inet_sock *inet = inet_sk(sk);
int j, s_j;
int reqnum, s_reqnum;
@@ -638,8 +642,9 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
if (!lopt || !lopt->qlen)
goto out;
- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
- bc = (struct rtattr *)(r + 1);
+ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+ bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
+ INET_DIAG_REQ_BYTECODE);
entry.sport = inet->inet_num;
entry.userlocks = sk->sk_userlocks;
}
@@ -672,8 +677,8 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
&ireq->rmt_addr;
entry.dport = ntohs(ireq->rmt_port);
- if (!inet_diag_bc_run(RTA_DATA(bc),
- RTA_PAYLOAD(bc), &entry))
+ if (!inet_diag_bc_run(nla_data(bc),
+ nla_len(bc), &entry))
continue;
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 235/247] netlink: Make nlmsg_find_attr take a const nlmsghdr*.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (173 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 234/247] inet_diag: Make sure we actually run the same bytecode we audited Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 236/247] irda: prevent integer underflow in IRLMP_ENUMDEVICES Paul Gortmaker
` (11 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Nelson Elhage, David S. Miller, Paul Gortmaker
From: Nelson Elhage <nelhage@ksplice.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6b8c92ba07287578718335ce409de8e8d7217e40 upstream.
This will let us use it on a nlmsghdr stored inside a netlink_callback.
Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/net/netlink.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 4fc05b5..28c27d1 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -384,7 +384,7 @@ static inline int nlmsg_parse(const struct nlmsghdr *nlh, int hdrlen,
*
* Returns the first attribute which matches the specified type.
*/
-static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh,
+static inline struct nlattr *nlmsg_find_attr(const struct nlmsghdr *nlh,
int hdrlen, int attrtype)
{
return nla_find(nlmsg_attrdata(nlh, hdrlen),
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 236/247] irda: prevent integer underflow in IRLMP_ENUMDEVICES
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (174 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 235/247] netlink: Make nlmsg_find_attr take a const nlmsghdr* Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 237/247] CAN: Use inode instead of kernel address for /proc file Paul Gortmaker
` (10 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, David S. Miller, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fdac1e0697356ac212259f2147aa60c72e334861 upstream.
If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value. While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures. In any event, this patch fixes it.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/irda/af_irda.c | 16 +++++++++-------
1 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 6fae047..e63c226 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2278,6 +2278,14 @@ static int __irda_getsockopt(struct socket *sock, int level, int optname,
switch (optname) {
case IRLMP_ENUMDEVICES:
+
+ /* Offset to first device entry */
+ offset = sizeof(struct irda_device_list) -
+ sizeof(struct irda_device_info);
+
+ if (len < offset)
+ return -EINVAL;
+
/* Ask lmp for the current discovery log */
discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
self->nslots);
@@ -2287,15 +2295,9 @@ static int __irda_getsockopt(struct socket *sock, int level, int optname,
err = 0;
/* Write total list length back to client */
- if (copy_to_user(optval, &list,
- sizeof(struct irda_device_list) -
- sizeof(struct irda_device_info)))
+ if (copy_to_user(optval, &list, offset))
err = -EFAULT;
- /* Offset to first device entry */
- offset = sizeof(struct irda_device_list) -
- sizeof(struct irda_device_info);
-
/* Copy the list itself - watch for overflow */
if(list.len > 2048)
{
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 237/247] CAN: Use inode instead of kernel address for /proc file
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (175 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 236/247] irda: prevent integer underflow in IRLMP_ENUMDEVICES Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 Paul Gortmaker
` (9 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, David S. Miller, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9f260e0efa4766e56d0ac14f1aeea6ee5eb8fe83 upstream.
Since the socket address is just being used as a unique identifier, its
inode number is an alternative that does not leak potentially sensitive
information.
CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/can/bcm.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index b8f7a2f..dd23fb1 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_sock {
struct list_head tx_ops;
unsigned long dropped_usr_msgs;
struct proc_dir_entry *bcm_proc_read;
- char procname [20]; /* pointer printed in ASCII with \0 */
+ char procname [32]; /* inode number in decimal with \0 */
};
static inline struct bcm_sock *bcm_sk(const struct sock *sk)
@@ -1523,7 +1523,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
if (proc_dir) {
/* unique socket address as filename */
- sprintf(bo->procname, "%p", sock);
+ sprintf(bo->procname, "%lu", sock_i_ino(sk));
bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
proc_dir,
&bcm_proc_fops, sk);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (176 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 237/247] CAN: Use inode instead of kernel address for /proc file Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:49 ` Dan Rosenberg
2011-06-23 17:35 ` [34-longterm 239/247] Bluetooth: sco: fix information leak to userspace Paul Gortmaker
` (8 subsequent siblings)
186 siblings, 1 reply; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, Alex Elder, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba upstream.
The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
xfs_fs_geometry() with a version number of 3. This code path does not
fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
the leaking of four bytes of uninitialized stack data to potentially
unprivileged callers.
v2 switches to memset() to avoid future issues if structure members
change, on suggestion of Dave Chinner.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
Signed-off-by: Alex Elder <aelder@sgi.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/xfs_fsops.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 37a6f62..4e7f02b 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -57,6 +57,9 @@ xfs_fs_geometry(
xfs_fsop_geom_t *geo,
int new_version)
{
+
+ memset(geo, 0, sizeof(*geo));
+
geo->blocksize = mp->m_sb.sb_blocksize;
geo->rtextsize = mp->m_sb.sb_rextsize;
geo->agblocks = mp->m_sb.sb_agblocks;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* Re: [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
2011-06-23 17:35 ` [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 Paul Gortmaker
@ 2011-06-23 17:49 ` Dan Rosenberg
2011-06-23 18:19 ` Paul Gortmaker
0 siblings, 1 reply; 269+ messages in thread
From: Dan Rosenberg @ 2011-06-23 17:49 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel, stable-review, Alex Elder
On Thu, 2011-06-23 at 13:35 -0400, Paul Gortmaker wrote:
> From: Dan Rosenberg <drosenberg@vsecurity.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba upstream.
>
> The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
> xfs_fs_geometry() with a version number of 3. This code path does not
> fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
> the leaking of four bytes of uninitialized stack data to potentially
> unprivileged callers.
>
> v2 switches to memset() to avoid future issues if structure members
> change, on suggestion of Dave Chinner.
>
> Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
> Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
> Signed-off-by: Alex Elder <aelder@sgi.com>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> ---
> fs/xfs/xfs_fsops.c | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
> index 37a6f62..4e7f02b 100644
> --- a/fs/xfs/xfs_fsops.c
> +++ b/fs/xfs/xfs_fsops.c
> @@ -57,6 +57,9 @@ xfs_fs_geometry(
> xfs_fsop_geom_t *geo,
> int new_version)
> {
> +
> + memset(geo, 0, sizeof(*geo));
> +
> geo->blocksize = mp->m_sb.sb_blocksize;
> geo->rtextsize = mp->m_sb.sb_rextsize;
> geo->agblocks = mp->m_sb.sb_agblocks;
> --
> 1.7.4.4
This introduced a regression which was fixed by commit
af24ee9ea8d532e16883251a6684dfa1be8eec29.
-Dan
^ permalink raw reply [flat|nested] 269+ messages in thread* Re: [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
2011-06-23 17:49 ` Dan Rosenberg
@ 2011-06-23 18:19 ` Paul Gortmaker
0 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 18:19 UTC (permalink / raw)
To: Dan Rosenberg; +Cc: stable, linux-kernel, stable-review, Alex Elder
On Thu, Jun 23, 2011 at 1:49 PM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> On Thu, 2011-06-23 at 13:35 -0400, Paul Gortmaker wrote:
>> From: Dan Rosenberg <drosenberg@vsecurity.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba upstream.
>>
>> The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to
>> xfs_fs_geometry() with a version number of 3. This code path does not
>> fill in the logsunit member of the passed xfs_fsop_geom_t, leading to
>> the leaking of four bytes of uninitialized stack data to potentially
>> unprivileged callers.
>>
>> v2 switches to memset() to avoid future issues if structure members
>> change, on suggestion of Dave Chinner.
>>
>> Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
>> Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
>> Signed-off-by: Alex Elder <aelder@sgi.com>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
>> ---
>> fs/xfs/xfs_fsops.c | 3 +++
>> 1 files changed, 3 insertions(+), 0 deletions(-)
>>
>> diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
>> index 37a6f62..4e7f02b 100644
>> --- a/fs/xfs/xfs_fsops.c
>> +++ b/fs/xfs/xfs_fsops.c
>> @@ -57,6 +57,9 @@ xfs_fs_geometry(
>> xfs_fsop_geom_t *geo,
>> int new_version)
>> {
>> +
>> + memset(geo, 0, sizeof(*geo));
>> +
>> geo->blocksize = mp->m_sb.sb_blocksize;
>> geo->rtextsize = mp->m_sb.sb_rextsize;
>> geo->agblocks = mp->m_sb.sb_agblocks;
>> --
>> 1.7.4.4
>
> This introduced a regression which was fixed by commit
> af24ee9ea8d532e16883251a6684dfa1be8eec29.
Thanks Dan,
Fix queued and will appear shortly here.
http://git.kernel.org/?p=linux/kernel/git/longterm/longterm-queue-2.6.34.git;a=summary
Paul.
>
> -Dan
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
^ permalink raw reply [flat|nested] 269+ messages in thread
* [34-longterm 239/247] Bluetooth: sco: fix information leak to userspace
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (177 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 238/247] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 240/247] Bluetooth: bnep: fix buffer overflow Paul Gortmaker
` (7 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Gustavo F. Padovan,
Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c4c896e1471aec3b004a693c689f60be3b17ac86 upstream.
struct sco_conninfo has one padding byte in the end. Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/bluetooth/sco.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index ca6b2ad..5fa81fa 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -704,6 +704,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
break;
}
+ memset(&cinfo, 0, sizeof(cinfo));
cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 240/247] Bluetooth: bnep: fix buffer overflow
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (178 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 239/247] Bluetooth: sco: fix information leak to userspace Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 241/247] bridge: netfilter: fix information leak Paul Gortmaker
` (6 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Gustavo F. Padovan,
Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 43629f8f5ea32a998d06d1bb41eefa0e821ff573 upstream.
Struct ca is copied from userspace. It is not checked whether the "device"
field is NULL terminated. This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/bluetooth/bnep/sock.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 2862f53..d935da7 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
sockfd_put(nsock);
return -EBADFD;
}
+ ca.device[sizeof(ca.device)-1] = 0;
err = bnep_add_connection(&ca, nsock);
if (!err) {
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 241/247] bridge: netfilter: fix information leak
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (179 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 240/247] Bluetooth: bnep: fix buffer overflow Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 242/247] netfilter: arp_tables: fix infoleak to userspace Paul Gortmaker
` (5 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Patrick McHardy, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d846f71195d57b0bbb143382647c2c6638b04c5a upstream.
Struct tmp is copied from userspace. It is not checked whether the "name"
field is NULL terminated. This may lead to buffer overflow and passing
contents of kernel stack as a module name to try_then_request_module() and,
consequently, to modprobe commandline. It would be seen by all userspace
processes.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/bridge/netfilter/ebtables.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index f0865fd..2b8c983 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1112,6 +1112,8 @@ static int do_replace(struct net *net, const void __user *user,
if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name) - 1] = 0;
+
countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
newinfo = vmalloc(sizeof(*newinfo) + countersize);
if (!newinfo)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 242/247] netfilter: arp_tables: fix infoleak to userspace
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (180 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 241/247] bridge: netfilter: fix information leak Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 243/247] netfilter: ip_tables: " Paul Gortmaker
` (4 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Patrick McHardy, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 42eab94fff18cb1091d3501cd284d6bd6cc9c143 upstream.
Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace. Fields of these structs that are
zero-terminated strings are not checked. When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.
The first bug was introduced before the git epoch; the second is
introduced by 6b7d31fc (v2.6.15-rc1); the third is introduced by
6b7d31fc (v2.6.15-rc1). To trigger the bug one should have
CAP_NET_ADMIN.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/netfilter/arp_tables.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index f07d77f..baf7997 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1085,6 +1085,7 @@ static int do_replace(struct net *net, const void __user *user,
/* overflow check */
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1505,6 +1506,7 @@ static int compat_do_replace(struct net *net, void __user *user,
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1757,6 +1759,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
ret = -EFAULT;
break;
}
+ rev.name[sizeof(rev.name)-1] = 0;
try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,
rev.revision, 1, &ret),
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 243/247] netfilter: ip_tables: fix infoleak to userspace
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (181 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 242/247] netfilter: arp_tables: fix infoleak to userspace Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 244/247] ipv6: netfilter: ip6_tables: " Paul Gortmaker
` (3 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Patrick McHardy, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 78b79876761b86653df89c48a7010b5cbd41a84a upstream.
Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace. Fields of these structs that are
zero-terminated strings are not checked. When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.
The first and the third bugs were introduced before the git epoch; the
second was introduced in 2722971c (v2.6.17-rc1). To trigger the bug
one should have CAP_NET_ADMIN.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/netfilter/ip_tables.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index b29c66d..c89ac49 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1294,6 +1294,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
/* overflow check */
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1838,6 +1839,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -2067,6 +2069,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
ret = -EFAULT;
break;
}
+ rev.name[sizeof(rev.name)-1] = 0;
if (cmd == IPT_SO_GET_REVISION_TARGET)
target = 1;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 244/247] ipv6: netfilter: ip6_tables: fix infoleak to userspace
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (182 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 243/247] netfilter: ip_tables: " Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 245/247] econet: 4 byte infoleak to the network Paul Gortmaker
` (2 subsequent siblings)
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Patrick McHardy, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6a8ab060779779de8aea92ce3337ca348f973f54 upstream.
Structures ip6t_replace, compat_ip6t_replace, and xt_get_revision are
copied from userspace. Fields of these structs that are
zero-terminated strings are not checked. When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.
The first bug was introduced before the git epoch; the second was
introduced in 3bc3fe5e (v2.6.25-rc1); the third is introduced by
6b7d31fc (v2.6.15-rc1). To trigger the bug one should have
CAP_NET_ADMIN.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv6/netfilter/ip6_tables.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 9210e31..542edbf 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1325,6 +1325,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
/* overflow check */
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -1871,6 +1872,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
return -ENOMEM;
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
return -ENOMEM;
+ tmp.name[sizeof(tmp.name)-1] = 0;
newinfo = xt_alloc_table_info(tmp.size);
if (!newinfo)
@@ -2100,6 +2102,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
ret = -EFAULT;
break;
}
+ rev.name[sizeof(rev.name)-1] = 0;
if (cmd == IP6T_SO_GET_REVISION_TARGET)
target = 1;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 245/247] econet: 4 byte infoleak to the network
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (183 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 244/247] ipv6: netfilter: ip6_tables: " Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 246/247] net: fix rds_iovec page count overflow Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 247/247] MIPS: secure_computing, syscall audit: syscall number should in r2, not r0 Paul Gortmaker
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, David S. Miller, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 67c5c6cb8129c595f21e88254a3fc6b3b841ae8e upstream.
struct aunhdr has 4 padding bytes between 'pad' and 'handle' fields on
x86_64. These bytes are not initialized in the variable 'ah' before
sending 'ah' to the network. This leads to 4 bytes kernel stack
infoleak.
This bug was introduced before the git epoch.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Acked-by: Phil Blundell <philb@gnu.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/econet/af_econet.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 728d389..4a392c9 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -435,10 +435,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
udpdest.sin_addr.s_addr = htonl(network | addr.station);
}
+ memset(&ah, 0, sizeof(ah));
ah.port = port;
ah.cb = cb & 0x7f;
ah.code = 2; /* magic */
- ah.pad = 0;
/* tack our header on the front of the iovec */
size = sizeof(struct aunhdr);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 246/247] net: fix rds_iovec page count overflow
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (184 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 245/247] econet: 4 byte infoleak to the network Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
2011-06-23 17:35 ` [34-longterm 247/247] MIPS: secure_computing, syscall audit: syscall number should in r2, not r0 Paul Gortmaker
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Linus Torvalds, Andy Grover, David S. Miller,
Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1b1f693d7ad6d193862dcb1118540a030c5e761f upstream.
As reported by Thomas Pollet, the rdma page counting can overflow. We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).
So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.
Catch the case of tot_pages turning negative, and return the appropriate
error code.
[PG: In 34, var names are slightly different, 1b1f6's tot_pages is
34's nr_pages, and 1b1f6's nr_pages is 34's nr; so map accordingly.]
Reported-by: Thomas Pollet <thomas.pollet@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/rds/rdma.c | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index cf0dfa7..3481931 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -498,6 +498,15 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
max_pages = max(nr, max_pages);
nr_pages += nr;
+
+ /*
+ * nr for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
+ * so nr_pages cannot overflow without first going negative.
+ */
+ if ((int)nr_pages < 0) {
+ ret = -EINVAL;
+ goto out;
+ }
}
pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread* [34-longterm 247/247] MIPS: secure_computing, syscall audit: syscall number should in r2, not r0.
2011-06-23 17:32 ` [34-longterm 060/247] drivers: update to pl2303 usb-serial to support Motorola cables Paul Gortmaker
` (185 preceding siblings ...)
2011-06-23 17:35 ` [34-longterm 246/247] net: fix rds_iovec page count overflow Paul Gortmaker
@ 2011-06-23 17:35 ` Paul Gortmaker
186 siblings, 0 replies; 269+ messages in thread
From: Paul Gortmaker @ 2011-06-23 17:35 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Al Viro, Al Viro, Ralf Baechle, Paul Gortmaker
From: Al Viro <viro@ftp.linux.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e5b377a8fb7b05f27647698ac739a0504cb2bf80 upstream.
As it is, audit_syscall_entry() and secure_computing() get the
bogus value (0, in fact)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1697/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/mips/kernel/ptrace.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index c51b95f..c877733 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -536,7 +536,7 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
{
/* do the secure computing check first */
if (!entryexit)
- secure_computing(regs->regs[0]);
+ secure_computing(regs->regs[2]);
if (unlikely(current->audit_context) && entryexit)
audit_syscall_exit(AUDITSC_RESULT(regs->regs[2]),
@@ -565,7 +565,7 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
out:
if (unlikely(current->audit_context) && !entryexit)
- audit_syscall_entry(audit_arch(), regs->regs[0],
+ audit_syscall_entry(audit_arch(), regs->regs[2],
regs->regs[4], regs->regs[5],
regs->regs[6], regs->regs[7]);
}
--
1.7.4.4
^ permalink raw reply related [flat|nested] 269+ messages in thread