10 Nov, 2010
6 commits
-
Convert direct reads of an inode's i_size to using i_size_read().
i_size_{read,write} use a seqcount to protect reads from accessing
incomple writes. Concurrent i_size_write()s require mutual exclussion
to protect the seqcount that is used by i_size_{read,write}. But
i_size_read() callers do not need to use additional locking.Signed-off-by: Mike Snitzer
Acked-by: NeilBrown
Acked-by: Lars Ellenberg
Signed-off-by: Jens Axboe -
Randy reports that he gets the following stack trace when
removing the cciss module:[ 109.164277] Pid: 3463, comm: rmmod Not tainted 2.6.37-rc1 #7
[ 109.164280] Call Trace:
[ 109.164292] [] warn_slowpath_common+0xc6/0xf3
[ 109.164299] [] warn_slowpath_fmt+0x5b/0x6b
[ 109.164307] [] ? _raw_spin_unlock+0x40/0x4b
[ 109.164313] [] remove_proc_entry+0x156/0x35e
[ 109.164320] [] ? do_raw_spin_unlock+0xff/0x10f
[ 109.164327] [] ? trace_hardirqs_on+0x10/0x4a
[ 109.164333] [] ? _raw_spin_unlock_irq+0x4c/0x7b
[ 109.164339] [] ? wait_for_common+0x145/0x15e
[ 109.164345] [] ? default_wake_function+0x0/0x22
[ 109.164357] [] cciss_cleanup+0xa9/0xc7 [cciss]
[ 109.164365] [] sys_delete_module+0x2d6/0x368
[ 109.164371] [] ? lockdep_sys_exit_thunk+0x35/0x67
[ 109.164377] [] ? audit_syscall_entry+0x172/0x1a5
[ 109.164383] [] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 109.164389] [] system_call_fastpath+0x16/0x1b
[ 109.164394] ---[ end trace 88e8568246ed0b1d ]---which will happen if you don't actually have an HP CISS adapter,
since it'll do an uncondional removal of a proc directory it
never attempted to create in that case.Reported-by: Randy Dunlap
Tested-by: Randy Dunlap
Signed-off-by: Jens Axboe -
If the iovec is being set up in a way that causes uaddr + PAGE_SIZE
to overflow, we could end up attempting to map a huge number of
pages. Check for this invalid input type.Reported-by: Dan Rosenberg
Cc: stable@kernel.org
Signed-off-by: Jens Axboe -
Reported-by: Dan Rosenberg
Cc: stable@kernel.org
Signed-off-by: Jens Axboe -
Reported-by: Dan Rosenberg
Cc: stable@kernel.org
Signed-off-by: Jens Axboe -
Ensure that we pass down properly validated iov segments before
calling into the mapping or copy functions.Reported-by: Dan Rosenberg
Cc: stable@kernel.org
Signed-off-by: Jens Axboe
06 Nov, 2010
23 commits
-
Commit 27ae60f8f7aa ("ipw2x00: replace "ieee80211" with "libipw" where
appropriate") changed DRV_NAME to be "libipw", but didn't properly fix
up the places where it was used to specify the name for the /proc/net/
directory.For backwards compatibility reasons, that directory name remained
"ieee80211", but due to the DRV_NAME change, the error case printouts
and the cleanup functions now used "libipw" instead. Which made it all
fail badly.For example, on module unload as reported by Randy:
WARNING: at fs/proc/generic.c:816 remove_proc_entry+0x156/0x35e()
name 'libipw'because it's trying to unregister a /proc directory that obviously
doesn't even exist.Clean it all up to use DRV_PROCNAME for the actual /proc directory name.
Reported-and-tested-by: Randy Dunlap
Cc: Pavel Roskin
Cc: John W. Linville
Signed-off-by: Linus Torvalds -
* 'kvm-updates/2.6.37' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: PPC: BookE: Load the lower half of MSR
KVM: PPC: BookE: fix sleep with interrupts disabled
KVM: PPC: e500: Call kvm_vcpu_uninit() before kvmppc_e500_tlb_uninit().
PPC: KVM: Book E doesn't have __end_interrupts.
KVM: x86: Issue smp_call_function_many with preemption disabled
KVM: x86: fix information leak to userland
KVM: PPC: fix information leak to userland
KVM: MMU: fix rmap_remove on non present sptes
KVM: Write protect memory after slot swap -
Commit 488211844e0c ("floppy: switch to one queue per drive instead of
sharing a queue") introduced a use-after-free. We do "put_disk()" on
the disk device _before_ we then clean up the queue associated with that
disk.Move the put_disk() down to avoid dereferencing a free'd data structure.
Cc: Jens Axboe
Cc: Vivek Goyal
Reported-and-tested-by: Randy Dunlap
Signed-off-by: Linus Torvalds -
Commit d9ca07a05ce1 ("watchdog: Avoid kernel crash when disabling
watchdog") introduces a section mismatch.Now that we reference no_watchdog from non-__init code it can no longer
be __initdata.Signed-off-by: David Daney
Cc: Stephane Eranian
Cc: Peter Zijlstra
Cc: Ingo Molnar
Signed-off-by: Linus Torvalds -
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (41 commits)
inet_diag: Make sure we actually run the same bytecode we audited.
netlink: Make nlmsg_find_attr take a const nlmsghdr*.
fib: fib_result_assign() should not change fib refcounts
netfilter: ip6_tables: fix information leak to userspace
cls_cgroup: Fix crash on module unload
memory corruption in X.25 facilities parsing
net dst: fix percpu_counter list corruption and poison overwritten
rds: Remove kfreed tcp conn from list
rds: Lost locking in loop connection freeing
de2104x: fix panic on load
atl1 : fix panic on load
netxen: remove unused firmware exports
caif: Remove noisy printout when disconnecting caif socket
caif: SPI-driver bugfix - incorrect padding.
caif: Bugfix for socket priority, bindtodev and dbg channel.
smsc911x: Set Ethernet EEPROM size to supported device's size
ipv4: netfilter: ip_tables: fix information leak to userland
ipv4: netfilter: arp_tables: fix information leak to userland
cxgb4vf: remove call to stop TX queues at load time.
cxgb4: remove call to stop TX queues at load time.
... -
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
firewire: ohci: fix race when reading count in AR descriptor
firewire: ohci: avoid reallocation of AR buffers
firewire: ohci: fix race in AR split packet handling
firewire: ohci: fix buffer overflow in AR split packet handling -
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
cifs: make cifs_set_oplock_level() take a cifsInodeInfo pointer
cifs: dereferencing first then checking
cifs: trivial comment fix: tlink_tree is now a rbtree
[CIFS] Cleanup unused variable build warning
cifs: convert tlink_tree to a rbtree
cifs: store pointer to master tlink in superblock (try #2)
cifs: trivial doc fix: note setlease implemented
CIFS: Add cifs_set_oplock_level
FS: cifs, remove unneeded NULL tests -
posix-cpu-timers.c correctly assumes that the dying process does
posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
timers from signal->cpu_timers list.But, it also assumes that timer->it.cpu.task is always the group
leader, and thus the dead ->task means the dead thread group.This is obviously not true after de_thread() changes the leader.
After that almost every posix_cpu_timer_ method has problems.It is not simple to fix this bug correctly. First of all, I think
that timer->it.cpu should use struct pid instead of task_struct.
Also, the locking should be reworked completely. In particular,
tasklist_lock should not be used at all. This all needs a lot of
nontrivial and hard-to-test changes.Change __exit_signal() to do posix_cpu_timers_exit_group() when
the old leader dies during exec. This is not the fix, just the
temporary hack to hide the problem for 2.6.37 and stable. IOW,
this is obviously wrong but this is what we currently have anyway:
cpu timers do not work after mt exec.In theory this change adds another race. The exiting leader can
detach the timers which were attached to the new leader. However,
the window between de_thread() and release_task() is small, we
can pretend that sys_timer_create() was called before de_thread().Signed-off-by: Oleg Nesterov
Signed-off-by: Linus Torvalds -
* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging:
hwmon: (ltc4261) Fix error message format
hwmon: (ltc4261) Add missing newline in debug message -
All the callers already have a pointer to struct cifsInodeInfo. Use it.
Signed-off-by: Suresh Jayaraman
Signed-off-by: Pavel Shilovsky
Signed-off-by: Steve French -
adapter->id is deprecated and not set by any adapter driver, so this
was certainly not what the author wanted to use. adapter->nr maybe,
but as dev_err() already includes this value, as well as the client's
address, there's no point repeating them. Better print a simple error
message in plain English words.Signed-off-by: Jean Delvare
Cc: Guenter Roeck
Signed-off-by: Guenter Roeck -
Reported-by: Joe Perches
Signed-off-by: Guenter Roeck
Acked-by: Jean Delvare -
* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
arch/tile: mark "hardwall" device as non-seekable
asm-generic/stat.h: support 64-bit file time_t for stat()
arch/tile: don't allow user code to set the PL via ptrace or signal return
arch/tile: correct double syscall restart for nested signals
arch/tile: avoid __must_check warning on one strict_strtol check
arch/tile: bomb raw_local_irq_ to arch_local_irq_
arch/tile: complete migration to new kmap_atomic scheme -
Add MODULE_LICENSE() that matches file comments so that kernel
is not tainted.leds_net5501: module license 'unspecified' taints kernel.
Signed-off-by: Randy Dunlap
Acked-by: Richard Purdie
Signed-off-by: Linus Torvalds -
This was preventing the guest from setting any bits in the
hardware MSR which aren't forced on, such as MSR[SPE].Signed-off-by: Scott Wood
Signed-off-by: Alexander Graf -
It is not legal to call mutex_lock() with interrupts disabled.
This will assert with debug checks enabled.If there's a real need to disable interrupts here, it could be done
after the mutex is acquired -- but I don't see why it's needed at all.Signed-off-by: Scott Wood
Reviewed-by: Christian Ehrhardt
Signed-off-by: Alexander Graf -
The VCPU uninit calls some TLB functions, and the TLB uninit function
frees the memory used by them.Signed-off-by: Scott Wood
Acked-by: Liu Yu
Signed-off-by: Alexander Graf -
Fix an unresolved symbol with CONFIG_KVM_GUEST plus CONFIG_RELOCATABLE on
Book E.Signed-off-by: Scott Wood
Signed-off-by: Alexander Graf -
smp_call_function_many is specified to be called only with preemption
disabled. Fulfill this requirement.Signed-off-by: Jan Kiszka
Signed-off-by: Marcelo Tosatti -
Structures kvm_vcpu_events, kvm_debugregs, kvm_pit_state2 and
kvm_clock_data are copied to userland with some padding and reserved
fields unitialized. It leads to leaking of contents of kernel stack
memory. We have to initialize them to zero.In patch v1 Jan Kiszka suggested to fill reserved fields with zeros
instead of memset'ting the whole struct. It makes sense as these
fields are explicitly marked as padding. No more fields need zeroing.KVM-Stable-Tag.
Signed-off-by: Vasiliy Kulikov
Signed-off-by: Marcelo Tosatti -
Structure kvm_ppc_pvinfo is copied to userland with flags and
pad fields unitialized. It leads to leaking of contents of
kernel stack memory.Signed-off-by: Vasiliy Kulikov
Signed-off-by: Marcelo Tosatti -
drop_spte should not attempt to rmap_remove a non present shadow pte.
This fixes a BUG_ON seen on kvm-autotest.
Signed-off-by: Marcelo Tosatti
Reported-by: Lucas Meneghel Rodrigues
Signed-off-by: Avi Kivity -
I have observed the following bug trigger:
1. userspace calls GET_DIRTY_LOG
2. kvm_mmu_slot_remove_write_access is called and makes a page ro
3. page fault happens and makes the page writeable
fault is logged in the bitmap appropriately
4. kvm_vm_ioctl_get_dirty_log swaps slot pointersa lot of time passes
5. guest writes into the page
6. userspace calls GET_DIRTY_LOGAt point (5), bitmap is clean and page is writeable,
thus, guest modification of memory is not logged
and GET_DIRTY_LOG returns an empty bitmap.The rule is that all pages are either dirty in the current bitmap,
or write-protected, which is violated here.It seems that just moving kvm_mmu_slot_remove_write_access down
to after the slot pointer swap should fix this bug.KVM-Stable-Tag.
Signed-off-by: Michael S. Tsirkin
Signed-off-by: Avi Kivity
05 Nov, 2010
7 commits
-
We can optimize kernel/relay.c::relay_alloc_page_array() slightly by
using vzalloc. The patch makes these changes:- use vzalloc instead of vmalloc+memset.
- remove redundant local variable 'array'.
- declare local 'pa_size' as const.Cuts down nicely on both source and object-code size.
Signed-off-by: Jesper Juhl
Acked-by: Pekka Enberg
Acked-by: Mathieu Desnoyers
Signed-off-by: Linus Torvalds -
* 'for-linus-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68k, m68knommu: Do not include linux/hardirq.h in asm/irqflags.h
m68knommu: add back in declaration of do_IRQ -
This patch is based on Dan's original patch. His original description is
below:Smatch complained about a couple checking for NULL after dereferencing
bugs. I'm not super familiar with the code so I did the conservative
thing and move the dereferences after the checks.The dereferences in cifs_lock() and cifs_fsync() were added in
ba00ba64cf0 "cifs: make various routines use the cifsFileInfo->tcon
pointer". The dereference in find_writable_file() was added in
6508d904e6f "cifs: have find_readable/writable_file filter by fsuid".
The comments there say it's possible to trigger the NULL dereference
under stress.Signed-off-by: Dan Carpenter
Signed-off-by: Jeff Layton
Signed-off-by: Steve French -
Noticed while reviewing (late) the rbtree conversion patchset (which has been merged
already).Cc: Jeff Layton
Signed-off-by: Suresh Jayaraman
Signed-off-by: Steve French -
We were using nlmsg_find_attr() to look up the bytecode by attribute when
auditing, but then just using the first attribute when actually running
bytecode. So, if we received a message with two attribute elements, where only
the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different
bytecode strings.Fix this by consistently using nlmsg_find_attr everywhere.
Signed-off-by: Nelson Elhage
Signed-off-by: Thomas Graf
Signed-off-by: David S. Miller -
This will let us use it on a nlmsghdr stored inside a netlink_callback.
Signed-off-by: Nelson Elhage
Signed-off-by: David S. Miller -
After commit ebc0ffae5 (RCU conversion of fib_lookup()),
fib_result_assign() should not change fib refcounts anymore.Thanks to Michael who did the bisection and bug report.
Reported-by: Michael Ellerman
Tested-by: Michael Ellerman
Signed-off-by: Eric Dumazet
Signed-off-by: David S. Miller
04 Nov, 2010
4 commits
-
Signed-off-by: Jan Engelhardt
Signed-off-by: David S. Miller -
Somewhere along the lines net_cls_subsys_id became a macro when
cls_cgroup is built as a module. Not only did it make cls_cgroup
completely useless, it also causes it to crash on module unload.This patch fixes this by removing that macro.
Thanks to Eric Dumazet for diagnosing this problem.
Reported-by: Randy Dunlap
Signed-off-by: Herbert Xu
Reviewed-by: Li Zefan
Signed-off-by: David S. Miller -
Signed-of-by: Andrew Hendry
Signed-off-by: David S. Miller
