16 May, 2011
1 commit
-
This patch is to fix the real-time scheduler bug reported at:
https://lkml.org/lkml/2011/4/26/13
That is, when running multiple real-time threads on every logical CPUs
and then turning off one CPU, the kernel will bug at function
__disable_runtime().Function __disable_runtime() bugs and reports leakage of rt_rq runtime.
The root cause is __disable_runtime() assumes it iterates through all
the existing rt_rq's while walking rq->leaf_rt_rq_list, which actually
contains only runnable rt_rq's. This problem also applies to
__enable_runtime() and print_rt_stats().The patch is based on above analysis, appears to fix the problem, but is
only lightly tested.Reported-by: Paul E. McKenney
Tested-by: Paul E. McKenney
Signed-off-by: Cheng Xu
Signed-off-by: Peter Zijlstra
Link: http://lkml.kernel.org/r/4DCE1F12.6040609@linux.vnet.ibm.com
Signed-off-by: Ingo Molnar
15 May, 2011
8 commits
-
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
rbd: fix split bio handling
rbd: fix leak of ops struct -
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
libata: fix oops when LPM is used with PMP -
Shame on me! Commit b1dea800ac39 "tmpfs: fix race between umount and
writepage" fixed the advertized race, but introduced another: as even
its comment makes clear, we cannot safely rely on a peek at list_empty()
while holding no lock - until info->swapped is set, shmem_unuse_inode()
may delete any formerly-swapped inode from the shmem_swaplist, which
in this case would leave a swap area impossible to swapoff.Although I don't relish taking the mutex every time, I don't care much
for the alternatives either; and at least the peek at list_empty() in
shmem_evict_inode() (a hotter path since most inodes would never have
been swapped) remains safe, because we already truncated the whole file.Signed-off-by: Hugh Dickins
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds -
ae01b2493c (libata: Implement ATA_FLAG_NO_DIPM and apply it to mcp65)
added ATA_FLAG_NO_DIPM and made ata_eh_set_lpm() check the flag.
However, @ap is NULL if @link points to a PMP link and thus the
unconditional @ap->flags dereference leads to the following oops.BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: [] ata_eh_recover+0x9a1/0x1510
...
Pid: 295, comm: scsi_eh_4 Tainted: P 2.6.38.5-core2 #1 System76, Inc. Serval Professional/Serval Professional
RIP: 0010:[] [] ata_eh_recover+0x9a1/0x1510
RSP: 0018:ffff880132defbf0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff880132f40000 RCX: 0000000000000000
RDX: ffff88013377c000 RSI: ffff880132f40000 RDI: 0000000000000000
RBP: ffff880132defce0 R08: ffff88013377dc58 R09: ffff880132defd98
R10: 0000000000000000 R11: 00000000ffffffff R12: 0000000000000000
R13: 0000000000000000 R14: ffff88013377c000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8800bf700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000018 CR3: 0000000001a03000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process scsi_eh_4 (pid: 295, threadinfo ffff880132dee000, task ffff880133b416c0)
Stack:
0000000000000000 ffff880132defcc0 0000000000000000 ffff880132f42738
ffffffff813ee8f0 ffffffff813eefe0 ffff880132defd98 ffff88013377f190
ffffffffa00b3e30 ffffffff813ef030 0000000032defc60 ffff880100000000
Call Trace:
[] sata_pmp_error_handler+0x607/0xc30
[] ahci_error_handler+0x1f/0x70 [libahci]
[] ata_scsi_error+0x5be/0x900
[] scsi_error_handler+0x124/0x650
[] kthread+0x96/0xa0
[] kernel_thread_helper+0x4/0x10
Code: 8b 95 70 ff ff ff b8 00 00 00 00 48 3b 9a 10 2e 00 00 48 0f 44 c2 48 89 85 70 ff ff ff 48 8b 8d 70 ff ff ff f6 83 69 02 00 00 01 8b 41 18 0f 85 48 01 00 00 48 85 c9 74 12 48 8b 51 08 48 83
RIP [] ata_eh_recover+0x9a1/0x1510
RSP
CR2: 0000000000000018Fix it by testing @link->ap->flags instead.
stable: ATA_FLAG_NO_DIPM was added during 2.6.39 cycle but was
backported to 2.6.37 and 38. This is a fix for that and thus
also applicable to 2.6.37 and 38.Signed-off-by: Tejun Heo
Reported-by: "Nathan A. Mourey II"
LKML-Reference:
Cc: Connor H
Cc: stable@kernel.org
Signed-off-by: Jeff Garzik -
* fbmem:
Further fbcon sanity checking
fbmem: fix remove_conflicting_framebuffers races -
This reverts commit 270dac35c26433d06a89150c51e75ca0181ca7e4.
The commits causes command timeouts on AC plug/unplug. It isn't yet
clear why. As the commit was for a single rather obscure controller,
revert the change for now.The problem was reported and bisected by Gu Rui in bug#34692.
https://bugzilla.kernel.org/show_bug.cgi?id=34692
Also, reported by Rafael and Michael in the following thread.
http://thread.gmane.org/gmane.linux.kernel/1138771
Signed-off-by: Tejun Heo
Reported-by: Gu Rui
Reported-by: Rafael J. Wysocki
Reported-by: Michael Leun
Cc: Jian Peng
Cc: Jeff Garzik
Signed-off-by: Linus Torvalds -
This moves the
if (num_registered_fb == FB_MAX)
return -ENXIO;check _AFTER_ the call to do_remove_conflicting_framebuffers() as this
would (now in a safe way) allow a native driver to replace the
conflicting one even if all slots in registered_fb[] are taken.This also prevents unregistering a framebuffer that is no longer
registered (vga16f will unregister at module unload time even if the
frame buffer had been unregistered earlier due to being found
conflicting).Signed-off-by: Bruno Prémont
Signed-off-by: Linus Torvalds -
When a register_framebuffer() call results in us removing old
conflicting framebuffers, the new registration_lock doesn't protect that
situation. And we can't just add the same locking to the function,
because these functions call each other: register_framebuffer() calls
remove_conflicting_framebuffers, which in turn calls
unregister_framebuffer for any conflicting entry.In order to fix it, this just creates wrapper functions around all three
functions and makes the versions that actually do the work be called
"do_xxx()", leaving just the wrapper that gets the lock and calls the
worker function.So the rule becomes simply that "do_xxxx()" has to be called with the
lock held, and now do_register_framebuffer() can just call
do_remove_conflicting_framebuffers(), and that in turn can call
_do_unregister_framebuffer(), and there is no deadlock, and we can hold
the registration lock over the whole sequence, fixing the races.It also makes error cases simpler, and fixes one situation where we
would return from unregister_framebuffer() without releasing the lock,
pointed out by Bruno Prémont.Tested-by: Bruno Prémont
Tested-by: Anca Emanuel
Signed-off-by: Linus Torvalds
14 May, 2011
11 commits
-
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
alpha: Wire up syscalls new to 2.6.39
alpha: convert to clocksource_register_hz -
Wire up the syscalls:
name_to_handle_at
open_by_handle_at
clock_adjtime
syncfs
and adjust some whitespace in the neighbourhood to align commments.Signed-off-by: Michael Cree
Signed-off-by: Matt Turner -
Converts alpha to use clocksource_register_hz.
Signed-off-by: John Stultz
CC: Richard Henderson
CC: Ivan Kokshaysky
CC: Thomas Gleixner
Signed-off-by: Matt Turner -
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
bridge: fix forwarding of IPv6
bonding,llc: Fix structure sizeof incompatibility for some PDUs
ipv6: restore correct ECN handling on TCP xmit
ne-h8300: Fix regression caused during net_device_ops conversion
hydra: Fix regression caused during net_device_ops conversion
zorro8390: Fix regression caused during net_device_ops conversion
sfc: Always map MCDI shared memory as uncacheable
ehea: Fix memory hotplug oops
libertas: fix cmdpendingq locking
iwlegacy: fix IBSS mode crashes
ath9k: Fix a warning due to a queued work during S3 state
mac80211: don't start the dynamic ps timer if not associated -
* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
NFSv4.1: Ensure that layoutget uses the correct gfp modes
NFSv4.1: remove pnfs_layout_hdr from pnfs_destroy_all_layouts tmp_list
NFSv41: Resend on NFS4ERR_RETRY_UNCACHED_REP -
The rbd driver currently splits bios when they span an object boundary.
However, the blk_end_request expects the completions to roll up the results
in block device order, and the split rbd/ceph ops can complete in any
order. This patch adds a struct rbd_req_coll to track completion of split
requests and ensures that the results are passed back up to the block layer
in order.This fixes errors where the file system gets completion of a read operation
that spans an object boundary before the data has actually arrived. The
bug is easily reproduced with iozone with a working set larger than
available RAM.Reported-by: Fyodor Ustinov
Signed-off-by: Yehuda Sadeh
Signed-off-by: Sage Weil -
The commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e
bridge: Reset IPCB when entering IP stack on NF_FORWARD
broke forwarding of IPV6 packets in bridge because it would
call bp_parse_ip_options with an IPV6 packet.Reported-by: Noah Meyerhans
Signed-off-by: Stephen Hemminger
Reviewed-by: Eric Dumazet
Signed-off-by: David S. Miller -
My Q67 / i7-2600 box has rev09 Sandy Bridge graphics. It hangs
instantly when GNOME loads and it hangs so hard the reset button
doesn't work. Setting i915.semaphore=0 fixes it.Semaphores were disabled in a1656b9090f7 ("drm/i915: Disable GPU
semaphores by default") in 2.6.38 but were then re-enabled (by mistake?)
by the merge 47ae63e0c2e5 ("Merge branch 'drm-intel-fixes' into
drm-intel-next").(It's worth noting that the offending change is i915_drv.c, which was
not marked as a conflict - although a 'git show --cc' on the merge does
show that neither parent had it set to 1)Signed-off-by: Andy Lutomirski
Signed-off-by: Linus Torvalds -
With some combinations of arch/compiler (e.g. arm-linux-gcc) the sizeof
operator on structure returns value greater than expected. In cases when the
structure is used for mapping PDU fields it may lead to unexpected results
(such as holes and alignment problems in skb data). __packed prevents this
undesired behavior.Signed-off-by: Vitalii Demianets
Signed-off-by: David S. Miller -
It's a hot function, and we're better off not mixing types in the mask
calculations. The compiler just ends up mixing 16-bit and 32-bit
operations, for no good reason.So do everything in 'unsigned int' rather than mixing 'unsigned int'
masking with a 'umode_t' (16-bit) mode variable.This, together with the parent commit (47a150edc2ae: "Cache user_ns in
struct cred") makes acl_permission_check() much nicer.Signed-off-by: Linus Torvalds
-
If !CONFIG_USERNS, have current_user_ns() defined to (&init_user_ns).
Get rid of _current_user_ns. This requires nsown_capable() to be
defined in capability.c rather than as static inline in capability.h,
so do that.Request_key needs init_user_ns defined at current_user_ns if
!CONFIG_USERNS, so forward-declare that in cred.h if !CONFIG_USERNS
at current_user_ns() define.Compile-tested with and without CONFIG_USERNS.
Signed-off-by: Serge E. Hallyn
[ This makes a huge performance difference for acl_permission_check(),
up to 30%. And that is one of the hottest kernel functions for loads
that are pathname-lookup heavy. ]
Signed-off-by: Linus Torvalds
13 May, 2011
20 commits
-
The ops vector must be freed by the rbd_do_request caller.
Signed-off-by: Sage Weil
-
…s/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
SELinux: delete debugging printks from filename_trans rule processing -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
net/9p/protocol.c: Fix a memory leak -
* 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
i2c: pnx: Fix crash due to wrong init of timer->data -
alg_data is already a pointer which must be passed directly.
Reported-by: Dieter Ripp
Signed-off-by: Wolfram Sang
Cc: Russell King
Cc: Ben Dooks
Signed-off-by: Ben Dooks -
Since commit e9df2e8fd8fbc9 (Use appropriate sock tclass setting for
routing lookup) we lost ability to properly add ECN codemarks to ipv6
TCP frames.It seems like TCP_ECN_send() calls INET_ECN_xmit(), which only sets the
ECN bit in the IPv4 ToS field (inet_sk(sk)->tos), but after the patch,
what's checked is inet6_sk(sk)->tclass, which is a completely different
field.Close bug https://bugzilla.kernel.org/show_bug.cgi?id=34322
[Eric Dumazet] : added the INET_ECN_dontxmit() fix and replace macros
by inline functions for clarity.Signed-off-by: Steinar H. Gunderson
Signed-off-by: Eric Dumazet
Cc: YOSHIFUJI Hideaki
Cc: Andrew Morton
Signed-off-by: David S. Miller -
kptr_restrict has been triggering bugs in apps such as perf, and it also makes
the system less useful by default, so turn it off by default.This is how we generally handle security features that remove functionality,
such as firewall code or SELinux - they have to be configured and activated
from user-space.Distributions can turn kptr_restrict on again via this line in
/etc/sysctrl.conf:kernel.kptr_restrict = 1
( Also mark the variable __read_mostly while at it, as it's typically modified
only once per bootup, or not at all. )Signed-off-by: Ingo Molnar
Acked-by: David S. Miller
Signed-off-by: Linus Torvalds -
When p9pdu_readf() is called with "s" attribute, it allocates a pointer that
will store a string. In p9dirent_read(), this pointer is not being released,
leading to out of memory errors.
This patch releases this pointer after string is copyed to dirent->d_name.Signed-off-by: Pedro Scarapicchia Junior
Signed-off-by: Eric Van Hensbergen -
Changeset dcd39c90290297f6e6ed8a04bb20da7ac2b043c5 ("ne-h8300: convert to
net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in ne-h8300.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").Signed-off-by: Geert Uytterhoeven
Cc: stable@kernel.org
Signed-off-by: David S. Miller -
Changeset 5618f0d1193d6b051da9b59b0e32ad24397f06a4 ("hydra: convert to
net_device_ops") broke hydra by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in hydra.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").Signed-off-by: Geert Uytterhoeven
Cc: stable@kernel.org
Signed-off-by: David S. Miller -
Changeset b6114794a1c394534659f4a17420e48cf23aa922 ("zorro8390: convert to
net_device_ops") broke zorro8390 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in zorro8390.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").Reported-by: Christian T. Steigies
Suggested-by: Finn Thain
Signed-off-by: Geert Uytterhoeven
Tested-by: Christian T. Steigies
Cc: stable@kernel.org
Signed-off-by: David S. Miller -
The filename_trans rule processing has some printk(KERN_ERR ) messages
which were intended as debug aids in creating the code but weren't removed
before it was submitted. Remove them.Reported-by: Paul Bolle
Signed-off-by: Eric Paris -
* 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ASoC: WM8903: Fix Digital Capture Volume range
ASoC: UDA134x: Remove POWER_OFF_ON_STANDBY define.
ASoC: SSM2602: Fix reg_cache_size
ASoC: SSM2602: Fix 'Mic Boost2' control
ASoC: SSM2602: Properly annotate i2c probe and remove functions
ASoC: sst_platform: add hw_free callback to fix resource leak
ASoC: Don't crash on PM operations
ASoC: JZ4740: Fix i2s shutdown -
* 'stable/bug-fixes-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
x86/mm: Fix section mismatch derived from native_pagetable_reserve()
x86,xen: introduce x86_init.mapping.pagetable_reserve
Revert "xen/mmu: Add workaround "x86-64, mm: Put early page table high"" -
This reverts commit 49183b2818de6899383bb82bc032f9344d6791ff.
Quoth Franz Melchior:
"This patch introduces a bug on my infamous "Acer Travelmate
5735Z-452G32Mnss": when KMS takes over, the frame buffer contents get
completely garbled up on screen, with colored stripes and unreadable
text (photo on request). Only when X11 is started, the screen gets
restored again. Closing and re-opening the lid partly cures the
mess, too: it makes the font readable, though horizontally stretched."Acked-by: Keith Packard
Cc: Chris Wilson
Cc: Daniel Vetter
Cc: Jesse Barnes
Signed-off-by: Linus Torvalds -
* fbmem:
fbmem: make read/write/ioctl use the frame buffer at open time
fbcon: add lifetime refcount to opened frame buffers -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: ads7846 - remove unused variable from struct ads7845_ser_req
Input: ads7846 - make transfer buffers DMA safe -
With CONFIG_DEBUG_SECTION_MISMATCH=y I see these warnings in next-20110415:
LD vmlinux.o
MODPOST vmlinux.o
WARNING: vmlinux.o(.text+0x1ba48): Section mismatch in reference from the function native_pagetable_reserve() to the function .init.text:memblock_x86_reserve_range()
The function native_pagetable_reserve() references
the function __init memblock_x86_reserve_range().
This is often because native_pagetable_reserve lacks a __init
annotation or the annotation of memblock_x86_reserve_range is wrong.This patch fixes the issue.
Thanks to pipacs from PaX project for help on IRC.Acked-by: "H. Peter Anvin"
Signed-off-by: Sedat Dilek
Signed-off-by: Konrad Rzeszutek Wilk
