30 Sep, 2008

21 commits


29 Sep, 2008

18 commits

  • There's a race between mm->owner assignment and swapoff, more easily
    seen when task slab poisoning is turned on. The condition occurs when
    try_to_unuse() runs in parallel with an exiting task. A similar race
    can occur with callers of get_task_mm(), such as /proc//
    or ptrace or page migration.

    CPU0 CPU1
    try_to_unuse
    looks at mm = task0->mm
    increments mm->mm_users
    task 0 exits
    mm->owner needs to be updated, but no
    new owner is found (mm_users > 1, but
    no other task has task->mm = task0->mm)
    mm_update_next_owner() leaves
    mmput(mm) decrements mm->mm_users
    task0 freed
    dereferencing mm->owner fails

    The fix is to notify the subsystem via mm_owner_changed callback(),
    if no new owner is found, by specifying the new task as NULL.

    Jiri Slaby:
    mm->owner was set to NULL prior to calling cgroup_mm_owner_callbacks(), but
    must be set after that, so as not to pass NULL as old owner causing oops.

    Daisuke Nishimura:
    mm_update_next_owner() may set mm->owner to NULL, but mem_cgroup_from_task()
    and its callers need to take account of this situation to avoid oops.

    Hugh Dickins:
    Lockdep warning and hang below exec_mmap() when testing these patches.
    exit_mm() up_reads mmap_sem before calling mm_update_next_owner(),
    so exec_mmap() now needs to do the same. And with that repositioning,
    there's now no point in mm_need_new_owner() allowing for NULL mm.

    Reported-by: Hugh Dickins
    Signed-off-by: Balbir Singh
    Signed-off-by: Jiri Slaby
    Signed-off-by: Daisuke Nishimura
    Signed-off-by: Hugh Dickins
    Cc: KAMEZAWA Hiroyuki
    Cc: Paul Menage
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Balbir Singh
     
  • …git/tip/linux-2.6-tip

    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
    x86: disable apm on the olpc

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
    cdrom: update ioctl documentation
    ide: note that IDE generic may prevent other drivers from attaching
    ide-tape: fix vendor strings
    Swarm: Fix crash due to missing initialization

    Linus Torvalds
     
  • * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
    [SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices
    [MIPS] BCM47xx: Fix build error due to missing PCI functions
    [MIPS] IP27: Switch to dynamic interrupt routing avoding panic on error.
    [MIPS] au1000: Make sure GPIO value is zero or one

    Linus Torvalds
     
  • * 'linux-m32r' of git://www.linux-m32r.org/git/takata/linux-2.6_dev:
    m32r/kernel/: cleanups
    m32r: export __ndelay
    m32r: export empty_zero_page
    m32r: don't offer CONFIG_ISA
    m32r: remove the unused NOHIGHMEM option

    Linus Torvalds
     
  • * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb:
    kgdboc,tty: Fix tty polling search to use name correctly
    kgdb, x86_64: fix PS CS SS registers in gdb serial
    kgdb, x86_64: gdb serial has BX and DX reversed
    kgdb, x86, arm, mips, powerpc: ignore user space single stepping
    kgdb: could not write to the last of valid memory with kgdb

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
    ALSA: ASoC: Fix another cs4270 error path
    ALSA: make the CS4270 driver a new-style I2C driver

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
    [SCSI] qlogicpti: fix sg list traversal error in continuation entries
    [SCSI] Fix hang with split requests
    [SCSI] qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes.

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
    scsi: fix fall out of sg-chaining patch in qlogicpti

    Linus Torvalds
     
  • * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
    sata_nv: reinstate nv_hardreset() for non generic controllers

    Linus Torvalds
     
  • Commit f072181e6403b0fe2e2aa800a005497b748fd284 ("kconfig: drop the
    ""trying to assign nonexistent symbol" warning") simply dropped the
    warnings, but it does a little more than that, it also marks the current
    .config as needed saving, so add this back.

    Signed-off-by: Roman Zippel
    Signed-off-by: Linus Torvalds

    zippel@linux-m68k.org
     
  • Recent changes to oldconfig have mixed up the silentoldconfig handling,
    so this fixes that by clearly separating that special mode, e.g.
    KCONFIG_NOSILENTUPDATE is only relevant here, the .config is written as
    needed.

    This will also properly close Bug 11230.

    Signed-off-by: Roman Zippel
    Signed-off-by: Linus Torvalds

    zippel@linux-m68k.org
     
  • The VFS interface for the 'd_compare()' is a bit special (read: 'odd'),
    because it really just essentially replaces a memcmp(). The filesystem
    is supposed to just compare the two names with whatever case-independent
    or other function.

    And when I say 'is supposed to', I obviously mean that 'procfs does odd
    things, and actually looks at the dentry that we don't even pass down,
    rather than just the name'. Which results in problems, because we
    actually call d_compare before we have even verified that the dentry is
    still hashed at all.

    And that causes a problm since the inode that procfs looks at may have
    been free'd and the d_inode pointer is NULL. procfs just assumes that
    all dentries are positive, since procfs itself never generates a
    negative one. But memory pressure will still result in the dentry
    getting torn down, and as it is removed by RCU, it still remains visible
    on some lists - and to d_compare.

    If the filesystem just did a name comparison, we wouldn't care. And we
    could just fix procfs to know about negative dentries too. But rather
    than have the low-level filesystems know about internal VFS details,
    just move the check for a unhashed dentry up a bit, so that we will only
    call d_compare on dentries that are still active.

    The actual oops this caused didn't look like a NULL pointer dereference
    because procfs did a 'container_of(inode, struct proc_inode, vfs_inode)'
    to get at its internal proc_inode information from the inode pointer,
    and accessed a field below the inode. So the oops would look something
    like

    BUG: unable to handle kernel paging request at fffffffffffffff0
    IP: [] proc_sys_compare+0x36/0x50

    and was seen on both x86-64 (Alexey Dobriyan and Hugh Dickins) and
    ppc64 (Hugh Dickins).

    Reported-by: Alexey Dobriyan
    Acked-by: Hugh Dickins
    Cc: Al Viro
    Reviewed-by: "Eric W. Biederman"
    Signed-of-by: Linus Torvalds

    Linus Torvalds
     
  • Conversion to new-style i2c driver missed the error path of the
    probe function. Fix it.

    Signed-off-by: Jean Delvare
    Cc: Timur Tabi
    Signed-off-by: Takashi Iwai

    Jean Delvare
     
  • Update the CS4270 ALSA device driver to use the new-style I2C interface.
    Starting with the 2.6.27 PowerPC kernel, I2C devices that have entries in the
    device trees can no longer be probed by old-style I2C drivers. The device
    tree for Freescale MPC8610 HPCD has included an entry for the CS4270 since
    2.6.25, but that entry was previously ignored by the PowerPC I2C subsystem.
    Since that's no longer the case, the best solution is to update the CS4270
    driver to a new-style interface, rather than try to revert the behavior of
    new PowerPC I2C subsystem.

    Signed-off-by: Timur Tabi
    Signed-off-by: Takashi Iwai

    Timur Tabi
     
  • Boaz writes:

    "I've reviewed all patches since Matthew's, and I find one small
    problem.

    In the load_cmd() there is a compound loop where the first 4 sg's are
    set then the rest are set into a memory structure in group of 7 sg's.

    Well the second 7-group and on is a bug because sg pointer does not advance.
    This is a fall out from Jens's patch."

    The reporter, Meelis Roos , verified that this patch
    does indeed fix his problem with qlogicpti.

    Signed-off-by: Jens Axboe

    Boaz Harrosh
     
  • Commit 2fd673ecf0378ddeeeb87b3605e50212e0c0ddc6 which tried to remove
    hardreset for generic accidentally removed it for all flavors as all
    others were inheriting from nv_generic_ops. This patch reinstates
    nv_hardreset() and puts it into nv_common_ops which all flavors
    inherit from. nv_generic_ops now inherits from nv_common_ops and
    overrides .hardreset to ATA_OP_NULL.

    While at it, explain why nv_hardreset and ATA_OP_NULL override are
    necessary.

    Signed-off-by: Tejun Heo
    Signed-off-by: Jeff Garzik

    Tejun Heo
     
  • The current sg list traversal logic for the continuation entries
    doesn't advance the list pointer once all seven slots are used, so the
    next continuation entry (if there is one) wrongly begins again at the
    start of the sg list.

    Fix by advancing the sg pointer after the for_each_sg().

    Reported-by: Meelis Roos
    Cc: David Miller
    Signed-off-by: James Bottomley

    Boaz Harrosh
     

28 Sep, 2008

1 commit