26 Apr, 2007

3 commits


24 Apr, 2007

2 commits

  • The listxattr() and getxattr() operations are only protected by a read
    lock. As a result, if either of these operations run in parallel, a race
    condition exists where the xattr_root will end up being cached twice, which
    results in the leaking of a reference and a BUG() on umount.

    This patch refactors get_xa_root(), __get_xa_root(), and create_xa_root(),
    into one get_xa_root() function that takes the appropriate locking around
    the entire critical section.

    Reported, diagnosed and tested by Andrea Righi

    Signed-off-by: Jeff Mahoney
    Cc: Andrea Righi
    Cc: "Vladimir V. Saveliev"
    Cc: Edward Shishkin
    Cc: Alex Zarochentsev
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Mahoney
     
  • v9fs_insert uses v9fs_fid_lookup (which also locks the fid) to get the
    primary fid associated with the dentry and destroys the v9fs_fid struct
    after removing the file. If another process called v9fs_fid_lookup on the
    same dentry, it may wait undefinitely for the fid's lock (as the struct is
    freed).

    This patch changes v9fs_remove to use a cloned fid, so the primary fid is
    not locked and freed.

    Signed-off-by: Latchesar Ionkov
    Cc: Eric Van Hensbergen
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Latchesar Ionkov
     

21 Apr, 2007

4 commits


18 Apr, 2007

2 commits

  • This patch should fix or partly fix this bug:
    http://bugzilla.kernel.org/show_bug.cgi?id=8276

    The problem is:

    - if we see "zero link case" during reading inode operation, we call
    ufs_error(which remount fs readonly), but not "mark" inode as bad (1)

    - in readonly case we do not fill some data structures, which are used in
    read and write case (2)

    - VFS call ufs_delete_inode if link count is zero (3)

    so (1)->(3)->(2) cause oops, this patch should fix such scenario

    Signed-off-by: Evgeniy Dushistov
    Cc: Jim Paris
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Evgeniy Dushistov
     
  • The patch checks for "|" in the pattern not the output and doesn't nail a
    pid on to a piped name (as it is a program name not a file)

    Also fixes a very very obscure security corner case. If you happen to have
    decided on a core pattern that starts with the program name then the user
    can run a program called "|myevilhack" as it stands. I doubt anyone does
    this.

    Signed-off-by: Alan Cox
    Confirmed-by: Christopher S. Aker
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alan Cox
     

16 Apr, 2007

1 commit


15 Apr, 2007

3 commits

  • If the writebacks are cancelled via nfs_cancel_dirty_list, or due to the
    memory allocation failing in nfs_flush_one/nfs_flush_multi, then we must
    ensure that the PG_writeback flag is cleared.

    Also ensure that we actually own the PG_writeback flag whenever we
    schedule a new writeback by making nfs_set_page_writeback() return the
    value of test_set_page_writeback().
    The PG_writeback page flag ends up replacing the functionality of the
    PG_FLUSHING nfs_page flag, so we rip that out too.

    Signed-off-by: Trond Myklebust
    Cc: Peter Zijlstra
    Signed-off-by: Linus Torvalds

    Trond Myklebust
     
  • Do not flag an error if the COMMIT call fails and we decide to resend the
    writes. Let the resend flag the error if it fails.

    If a write has failed, then nfs_direct_write_result should not attempt to
    send a commit. It should just exit asap and return the error to the user.

    Signed-off-by: Trond Myklebust
    Cc: Chuck Lever
    Signed-off-by: Linus Torvalds

    Trond Myklebust
     
  • It looks like nfs_setattr() and nfs_rename() also need to test whether the
    target is a regular file before calling nfs_wb_all()...

    Signed-off-by: Trond Myklebust
    Signed-off-by: Linus Torvalds

    Trond Myklebust
     

13 Apr, 2007

2 commits

  • Commit f50b6f8691cae2e0064c499dd3ef3f31142987f0 introduced a race in
    autofs4 between autofs_lookup_unhashed() and autofs_dentry_release().

    autofs_dentry_release() ends up clearing the ->dentry and ->inode members
    of autofs_info before removing it from the rehash list. The list is
    protected by the rehash lock in both functions, but since
    autofs_dentry_release() starts tearing the autofs_info struct down before
    removing it from the list, autofs_lookup_unhashed() can get a autofs_info
    with a NULL dentry.

    This patch moves the clearing of ->dentry and ->inode after the removal
    from the rehash list.

    Signed-off-by: Jeff Mahoney
    Acked-by: Ian Kent
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Mahoney
     
  • This patch fixes a bug in function decrementing a key of stat data item.

    Offset of reiserfs keys are compared as signed values. To set key offset
    to maximal possible value maximal signed value has to be used.

    This bug is responsible for severe reiserfs filesystem corruption which
    shows itself as warning vs-13060. reiserfsck fixes this corruption by
    filesystem tree rebuilding.

    Signed-off-by: Vladimir Saveliev
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vladimir Saveliev
     

09 Apr, 2007

1 commit


05 Apr, 2007

1 commit

  • Revert all this. It can cause device-mapper to receive a different major from
    earlier kernels and it turns out that the Amanda backup program (via GNU tar,
    apparently) checks major numbers on files when performing incremental backups.

    Which is a bit broken of Amanda (or tar), but this feature isn't important
    enough to justify the churn.

    Cc: Ingo Molnar
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     

03 Apr, 2007

4 commits

  • Revert b46be05004abb419e303e66e143eed9f8a6e9f3f. Same reasoning as for ext3.

    Cc: Kirill Korotaev
    Cc: Ingo Molnar
    Cc: Ken Chen
    Cc: Andrey Savochkin
    Cc:
    Cc: Dmitriy Monakhov
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • Revert e92a4d595b464c4aae64be39ca61a9ffe9c8b278.

    Dmitry points out

    "When we block_prepare_write() failed while ext3_prepare_write() we jump to
    "failure" label and call ext3_prepare_failure() witch search last mapped bh
    and invoke commit_write untill it. This is wrong!! because some bh from
    begining to the last mapped bh may be not uptodate. As a result we commit to
    disk not uptodate page content witch contains garbage from previous usage."

    and

    "Unexpected file size increasing."

    Call trace the same as it was in first issue but result is different.
    For example we have file with i_size is zero. we want write two blocks ,
    but fs has only one free block.

    ->ext3_prepare_write(...from == 0, to == 2048)
    retry:
    ->block_prepare_write() == -ENOSPC# we failed but allocated one block here.
    ->ext3_prepare_failure()
    ->commit_write( from == 0, to == 1024) # after this i_size becomes 1024 :)
    if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
    goto retry;

    Finally when all retries will be spended ext3_prepare_failure return
    -ENOSPC, but i_size was increased and later block trimm procedures can't
    help here.

    We don't appear to have the horsepower to fix these issues, so let's put
    things back the way they were for now.

    Cc: Kirill Korotaev
    Cc: Ingo Molnar
    Cc: Ken Chen
    Cc: Andrey Savochkin
    Cc:
    Cc: Dmitriy Monakhov
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • When the dump cannot occur most likely because of a full file system and
    the page to be written is the zero page, the call to page_cache_release()
    is missed.

    Signed-off-by: Brian Pomerantz
    Cc: Hugh Dickins
    Cc: Nick Piggin
    Cc: David Howells
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Brian Pomerantz
     
  • We're using #ifdef CONFIG_SYSCTL, but we should be using CONFIG_PROC_SYSCTL,
    so we get

    fs/built-in.o: In function `proc_root_init':
    /usr/src/linux/fs/proc/root.c:83: undefined reference to `proc_sys_init'

    Fix that up and remove an ifdef-in-C.

    Cc: "Eric W. Biederman"
    Cc: Helge Hafting
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     

29 Mar, 2007

5 commits


28 Mar, 2007

9 commits

  • …inville/wireless-2.6 into upstream-fixes

    Jeff Garzik
     
  • The user can generate console output if they cause do_mmap() to fail
    during sys_io_setup(). This was seen in a regression test that does
    exactly that by spinning calling mmap() until it gets -ENOMEM before
    calling io_setup().

    We don't need this printk at all, just remove it.

    Signed-off-by: Zach Brown
    Signed-off-by: Linus Torvalds

    Zach Brown
     
  • Johannes Berg and Michael Buesch noticed that the WPA ioctls
    were missing from the 6432 bit conversion. This means that when
    using a 32 bits userspace on a 64 bit kernel, those ioctls fail.

    Signed-off-by: Jean Tourrilhes
    Signed-off-by: John W. Linville

    Jean Tourrilhes
     
  • * 'for-linus' of git://git.kernel.dk/data/git/linux-2.6-block:
    Export __splice_from_pipe()
    2/2 splice: dont readpage
    1/2 splice: dont steal
    make elv_register() output atomic
    block: blk_max_pfn is somtimes wrong

    Linus Torvalds
     
  • Without attached patch against current -git I get following with
    !PROC_SYSCTL (with EMBEDDED and PROC_FS set):

    CC init/version.o
    LD init/built-in.o
    LD vmlinux
    fs/built-in.o: In function `do_proc_sys_lookup':
    proc_sysctl.c:(.text+0x26583): undefined reference to `sysctl_head_next'
    fs/built-in.o: In function `proc_sys_revalidate':
    proc_sysctl.c:(.text+0x265bb): undefined reference to `sysctl_head_finish'
    fs/built-in.o: In function `proc_sys_readdir':
    proc_sysctl.c:(.text+0x26720): undefined reference to `sysctl_head_next'
    proc_sysctl.c:(.text+0x267d8): undefined reference to `sysctl_head_finish'
    proc_sysctl.c:(.text+0x268e7): undefined reference to `sysctl_head_next'
    proc_sysctl.c:(.text+0x26910): undefined reference to `sysctl_head_finish'
    fs/built-in.o: In function `proc_sys_write':
    proc_sysctl.c:(.text+0x2695d): undefined reference to `sysctl_perm'
    proc_sysctl.c:(.text+0x2699c): undefined reference to `sysctl_head_finish'
    fs/built-in.o: In function `proc_sys_read':
    proc_sysctl.c:(.text+0x269e9): undefined reference to `sysctl_perm'
    proc_sysctl.c:(.text+0x26a25): undefined reference to `sysctl_head_finish'
    fs/built-in.o: In function `proc_sys_permission':
    proc_sysctl.c:(.text+0x26ad1): undefined reference to `sysctl_perm'
    proc_sysctl.c:(.text+0x26adb): undefined reference to `sysctl_head_finish'
    fs/built-in.o: In function `proc_sys_lookup':
    proc_sysctl.c:(.text+0x26b39): undefined reference to `sysctl_head_finish'
    make: *** [vmlinux] Virhe 1

    All those functions are in fs/proc/proc_sysctl.c, which has no CONFIG_
    #define's in it, so the patch makes the compilation of that file to depend
    on CONFIG_PROC_SYSCTL (the simplest choice).

    Acked-by: "Eric W. Biederman"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mika Kukkonen
     
  • This cancel_delayed_work call is called from a function that is only called
    from a piece of code that immediate follows a cancel and destruction of the
    workqueue, so it's clearly a mistake.

    Cc: Oleg Nesterov
    Signed-off-by: "J. Bruce Fields"
    Signed-off-by: Neil Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    J. Bruce Fields
     
  • The reused clientid here is a more of a problem for the client than the
    server, and the client can report the problem itself if it's serious.

    Signed-off-by: "J. Bruce Fields"
    Signed-off-by: Neil Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Bruce Fields
     
  • A regression introduced in the last set of acl patches removed the
    INHERIT_ONLY flag from aces derived from the posix acl. Fix.

    Signed-off-by: "J. Bruce Fields"
    Signed-off-by: Neil Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Bruce Fields
     
  • ->readdir passes lofft_t offsets (used as nfs cookies) to
    nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it
    becomes an 'off_t', which isn't good.

    So filesystems that returned 64bit offsets would lose.

    Signed-off-by: Neil Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    NeilBrown
     

27 Mar, 2007

3 commits

  • Ocfs2 wants to implement it's own splice write actor so that it can better
    manage cluster / page locks. This lets us re-use the rest of splice write
    while only providing our own code where it's actually important.

    Signed-off-by: Mark Fasheh
    Signed-off-by: Jens Axboe

    Mark Fasheh
     
  • Splice does not need to readpage to bring the page uptodate before writing
    to it, because prepare_write will take care of that for us.

    Splice is also wrong to SetPageUptodate before the page is actually uptodate.
    This results in the old uninitialised memory leak. This gets fixed as a
    matter of course when removing the readpage logic.

    Signed-off-by: Nick Piggin
    Signed-off-by: Jens Axboe

    Nick Piggin
     
  • Stealing pages with splice is problematic because we cannot just insert
    an uptodate page into the pagecache and hope the filesystem can take care
    of it later.

    We also cannot just ClearPageUptodate, then hope prepare_write does not
    write anything into the page, because I don't think prepare_write gives
    that guarantee.

    Remove support for SPLICE_F_MOVE for now. If we really want to bring it
    back, we might be able to do so with a the new filesystem buffered write
    aops APIs I'm working on. If we really don't want to bring it back, then
    we should decide that sooner rather than later, and remove the flag and
    all the stealing infrastructure before anybody starts using it.

    Signed-off-by: Nick Piggin
    Signed-off-by: Jens Axboe

    Nick Piggin