06 Apr, 2011

1 commit

  • There is potential memory leak of journal head in function
    jbd2_journal_commit_transaction. The problem is that JBD2 will not
    reclaim the journal head of commit record if error occurs or journal
    is abotred.

    I use the following script to reproduce this issue, on a RHEL6
    system. I found it very easy to reproduce with async commit enabled.

    mount /dev/sdb /mnt -o journal_checksum,journal_async_commit
    touch /mnt/xxx
    echo offline > /sys/block/sdb/device/state
    sync
    umount /mnt
    rmmod ext4
    rmmod jbd2

    Removal of the jbd2 module will make slab complaining that
    "cache `jbd2_journal_head': can't free all objects".

    Signed-off-by: Zhang Huan
    Signed-off-by: "Theodore Ts'o"

    Zhang Huan
     

05 Apr, 2011

4 commits

  • In ext4_register_li_request, we malloc a ext4_li_request and
    inserts it into ext4_li_info->li_request_list. In case of any
    error later, we free it in the end. But if we have some error
    in ext4_run_lazyinit_thread, the whole li_request_list will be
    dropped and freed in it. So we will double free this ext4_li_request.

    This patch just sets elr to NULL after it is inserted to the list
    so that the latter kfree won't double free it.

    Signed-off-by: Tao Ma
    Reviewed-by: Lukas Czerner
    Signed-off-by: "Theodore Ts'o"
    Cc: stable@kernel.org

    Tao Ma
     
  • When writing a contiguous set of blocks, two indirect blocks could be
    needed depending on how the blocks are aligned, so we need to increase
    the number of credits needed by one.

    [ Also fixed a another bug which could further underestimate the
    number of journal credits needed by 1; the code was using integer
    division instead of DIV_ROUND_UP() -- tytso]

    Signed-off-by: Yongqiang Yang
    Signed-off-by: "Theodore Ts'o"
    Cc: stable@kernel.org

    Yongqiang Yang
     
  • It is not necessary to update [cm]time of quota file on each quota
    file write and it wastes journal space and IO throughput with inode
    writes. So just remove the updating from ext4_quota_write() and only
    update times when quotas are being turned off. Userspace cannot get
    anything reliable from quota files while they are used by the kernel
    anyway.

    Signed-off-by: Jan Kara
    Signed-off-by: "Theodore Ts'o"

    Jan Kara
     
  • bdget() should not be called when we hold spinlocks since
    it might sleep.

    Reviewed-by: Jan Kara
    Signed-off-by: Zhu Yanhai
    Signed-off-by: "Theodore Ts'o"

    Zhu Yanhai
     

30 Mar, 2011

9 commits

  • Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: (26 commits)
    mmc: SDHI should depend on SUPERH || ARCH_SHMOBILE
    mmc: tmio_mmc: Move some defines into a shared header
    mmc: tmio: support aggressive clock gating
    mmc: tmio: fix power-mode interpretation
    mmc: tmio: remove work-around for unmasked SDIO interrupts
    sh: fix SDHI IO address-range
    ARM: mach-shmobile: fix SDHI IO address-range
    mmc: tmio: only access registers above 0xff, if available
    mfd: remove now redundant sh_mobile_sdhi.h header
    sh: convert boards to use linux/mmc/sh_mobile_sdhi.h
    ARM: mach-shmobile: convert boards to use linux/mmc/sh_mobile_sdhi.h
    mmc: tmio: convert the SDHI MMC driver from MFD to a platform driver
    sh: ecovec: use the CONFIG_MMC_TMIO symbols instead of MFD
    mmc: tmio: split core functionality, DMA and MFD glue
    mmc: tmio: use PIO for short transfers
    mmc: tmio-mmc: Improve DMA stability on sh-mobile
    mmc: fix mmc_app_send_scr() for dma transfer
    mmc: sdhci-esdhc: enable esdhc on imx53
    mmc: sdhci-esdhc: use writel/readl as general APIs
    mmc: sdhci: add the abort CMDTYPE bits definition
    ...

    Linus Torvalds
     
  • * 'frv' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-2.6-frv:
    FRV: Use generic show_interrupts()
    FRV: Convert genirq namespace
    frv: Select GENERIC_HARDIRQS_NO_DEPRECATED
    frv: Convert cpu irq_chip to new functions
    frv: Convert mb93493 irq_chip to new functions
    frv: Convert mb93093 irq_chip to new function
    frv: Convert mb93091 irq_chip to new functions
    frv: Fix typo from __do_IRQ overhaul
    frv: Remove stale irq_chip.end
    FRV: Do some cleanups
    FRV: Missing node arg in alloc_thread_info_node() macro
    NOMMU: implement access_remote_vm
    NOMMU: support SMP dynamic percpu_alloc
    NOMMU: percpu should use is_vmalloc_addr().

    Linus Torvalds
     
  • * 'stable/bug-fixes-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
    xen: Use new irq_move functions
    xen: Convert genirq namespace
    xen: fix p2m section mismatches
    xen/p2m: Allocate p2m tracking pages on override
    xen-gntdev: unlock on error path in gntdev_mmap()
    xen-gntdev: return -EFAULT on copy_to_user failure

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
    watchdog: softdog.c: enhancement to optionally invoke panic instead of reboot on timer expiry
    watchdog: fix nv_tco section mismatch
    watchdog: sp5100_tco.c: Check if firmware has set correct value in tcobase.
    watchdog: Convert release_resource to release_region/release_mem_region
    watchdog: s3c2410_wdt.c: Convert release_resource to release_region/release_mem_region

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
    amd64_edac: Fix potential memleak

    Linus Torvalds
     
  • …el/git/tip/linux-2.6-tip

    * 'irq-final-for-linus-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (111 commits)
    gpio: ab8500: Mark broken
    genirq: Remove move_*irq leftovers
    genirq: Remove compat code
    drivers: Final irq namespace conversion
    mn10300: Use generic show_interrupts()
    mn10300: Cleanup irq_desc access
    mn10300: Convert genirq namespace
    frv: Use generic show_interrupts()
    frv: Convert genirq namespace
    frv: Select GENERIC_HARDIRQS_NO_DEPRECATED
    frv: Convert cpu irq_chip to new functions
    frv: Convert mb93493 irq_chip to new functions
    frv: Convert mb93093 irq_chip to new function
    frv: Convert mb93091 irq_chip to new functions
    frv: Fix typo from __do_IRQ overhaul
    frv: Remove stale irq_chip.end
    m68k: Convert irq function namespace
    xen: Use new irq_move functions
    xen: Cleanup genirq namespace
    unicore32: Use generic show_interrupts()
    ...

    Linus Torvalds
     
  • This patch fixes information leakage to the userspace by initializing
    the data buffer to zero.

    Reported-by: Peter Huewe
    Signed-off-by: Peter Huewe
    Signed-off-by: Marcel Selhorst
    [ Also removed the silly "* sizeof(u8)". If that isn't 1, we have way
    deeper problems than a simple multiplication can fix. - Linus ]
    Signed-off-by: Linus Torvalds

    Peter Huewe
     
  • We check the pointers together but at least one of them could be invalid
    due to failed allocation. Since we cannot continue if either of the two
    allocations has failed, exit early by freeing them both.

    Cc: # 38.x
    Reported-by: Mauro Carvalho Chehab
    Signed-off-by: Borislav Petkov

    Borislav Petkov
     

29 Mar, 2011

26 commits