11 Mar, 2011

3 commits


10 Mar, 2011

16 commits

  • * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
    powerpc/pseries: Disable VPNH feature
    powerpc/iseries: Fix early init access to lppaca

    Linus Torvalds
     
  • …s/security-testing-2.6

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
    net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules

    Linus Torvalds
     
  • Fixes this build-check error:

    include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported

    Signed-off-by: Stephen Rothwell
    Signed-off-by: Linus Torvalds

    Stephen Rothwell
     
  • Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with
    CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean
    that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are
    limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't
    allow anybody load any module not related to networking.

    This patch restricts an ability of autoloading modules to netdev modules
    with explicit aliases. This fixes CVE-2011-1019.

    Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior
    of loading netdev modules by name (without any prefix) for processes
    with CAP_SYS_MODULE to maintain the compatibility with network scripts
    that use autoloading netdev modules by aliases like "eth0", "wlan0".

    Currently there are only three users of the feature in the upstream
    kernel: ipip, ip_gre and sit.

    root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) --
    root@albatros:~# grep Cap /proc/$$/status
    CapInh: 0000000000000000
    CapPrm: fffffff800001000
    CapEff: fffffff800001000
    CapBnd: fffffff800001000
    root@albatros:~# modprobe xfs
    FATAL: Error inserting xfs
    (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted
    root@albatros:~# lsmod | grep xfs
    root@albatros:~# ifconfig xfs
    xfs: error fetching interface information: Device not found
    root@albatros:~# lsmod | grep xfs
    root@albatros:~# lsmod | grep sit
    root@albatros:~# ifconfig sit
    sit: error fetching interface information: Device not found
    root@albatros:~# lsmod | grep sit
    root@albatros:~# ifconfig sit0
    sit0 Link encap:IPv6-in-IPv4
    NOARP MTU:1480 Metric:1

    root@albatros:~# lsmod | grep sit
    sit 10457 0
    tunnel4 2957 1 sit

    For CAP_SYS_MODULE module loading is still relaxed:

    root@albatros:~# grep Cap /proc/$$/status
    CapInh: 0000000000000000
    CapPrm: ffffffffffffffff
    CapEff: ffffffffffffffff
    CapBnd: ffffffffffffffff
    root@albatros:~# ifconfig xfs
    xfs: error fetching interface information: Device not found
    root@albatros:~# lsmod | grep xfs
    xfs 745319 0

    Reference: https://lkml.org/lkml/2011/2/24/203

    Signed-off-by: Vasiliy Kulikov
    Signed-off-by: Michael Tokarev
    Acked-by: David S. Miller
    Acked-by: Kees Cook
    Signed-off-by: James Morris

    Vasiliy Kulikov
     
  • This feature triggers nasty races in the scheduler between the
    rebuilding of the topology and the load balancing code, causing
    the machine to hang.

    Disable it for now until the races are fixed.

    Signed-off-by: Benjamin Herrenschmidt

    Benjamin Herrenschmidt
     
  • The combination of commit

    8154c5d22d91cd16bd9985b0638c8957e4688d0e and
    93c22703efa72c7527dbd586d1951c1f4a85fd70

    Broke boot on iSeries.

    The problem is that iSeries very early boot code, which generates
    the device-tree and runs before our normal early initializations
    does need access the lppaca's very early, before the PACA array is
    initialized, and in fact even before the boot PACA has been
    initialized (it contains all 0's at this stage).

    However, the first patch above makes that code use the new
    llpaca_of(cpu) accessor, which itself is changed by the second patch to
    use the PACA array.

    We fix that by reverting iSeries to directly dereferencing the array. In
    addition, we fix all iterators in the iSeries code to always skip CPU
    whose number is above 63 which is the maximum size of that array and
    the maximum number of supported CPUs on these machines.

    Additionally, we make sure the boot_paca is properly initialized
    in our early startup code.

    Signed-off-by: Benjamin Herrenschmidt

    Benjamin Herrenschmidt
     
  • * 'for-2.6.38' of git://linux-nfs.org/~bfields/linux:
    nfsd: wrong index used in inner loop
    nfsd4: fix bad pointer on failure to find delegation
    NFSD: fix decode_cb_sequence4resok

    Linus Torvalds
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
    watchdog: sbc_fitpc2_wdt, fix crash on systems without DMI_BOARD_NAME

    Linus Torvalds
     
  • * 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
    i2c-eg20t: include slab.h for memory allocations
    i2c-ocores: Fix pointer type mismatch error
    i2c-omap: Program I2C_WE on OMAP4 to enable i2c wakeup

    Linus Torvalds
     
  • Signed-off-by: Matt Turner
    Signed-off-by: Linus Torvalds

    Matt Turner
     
  • * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
    [CPUFREQ] pcc-cpufreq: don't load driver if get_freq fails during init.

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
    mmc: fix CONFIG_MMC_UNSAFE_RESUME regression

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
    nd->inode is not set on the second attempt in path_walk()
    unfuck proc_sysctl ->d_compare()
    minimal fix for do_filp_open() race

    Linus Torvalds
     
  • Some systems don't provide DMI_BOARD_NAME in their DMI tables. Avoid
    crash in such situations in fitpc2_wdt_init.

    The fix is to check if the dmi_get_system_info return value is NULL.

    The oops:
    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [] strstr+0x26/0xa0
    PGD 3966e067 PUD 39605067 PMD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
    CPU 1
    Modules linked in: ...
    Pid: 1748, comm: modprobe Not tainted 2.6.37-22-default #1 /Bochs
    RIP: 0010:[] [] strstr+0x26/0xa0
    RSP: 0018:ffff88003ad73f18 EFLAGS: 00010206
    RAX: 0000000000000000 RBX: 00000000ffffffed RCX: 00000000ffffffff
    RDX: ffffffffa003f4cc RSI: ffffffffa003f4c2 RDI: 0000000000000000
    ...
    CR2: 0000000000000000 CR3: 000000003b7ac000 CR4: 00000000000006e0
    ...
    Process modprobe (pid: 1748, threadinfo ffff88003ad72000, task ffff88002e6365c0)
    Stack: ...
    Call Trace:
    [] fitpc2_wdt_init+0x1f/0x13c [sbc_fitpc2_wdt]
    [] do_one_initcall+0x3a/0x170
    ...
    Code: f3 c3 0f 1f 00 80 3e 00 53 48 89 f8 74 1b 48 89 f2 0f 1f 40 00 48 83 c2 01 80 3a 00 75 f7 49 89 d0 48 89 f8 49 29 f0 75 02 5b c3 3f 00 74 0e 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 49 89

    Signed-off-by: Jiri Slaby
    Signed-off-by: Wim Van Sebroeck

    Jiri Slaby
     
  • Return 0 on failure. This will cause the initialization of the driver
    to fail and prevent the driver from loading if the BIOS cannot handle
    the PCC interface command to "get frequency". Otherwise, the driver
    will load and display a very high value like "4294967274" (which is
    actually -EINVAL) for frequency:

    # cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_cur_freq
    4294967274

    Signed-off-by: Naga Chumbalkar
    CC: stable@kernel.org
    Signed-off-by: Dave Jones

    Naga Chumbalkar
     
  • kallsyms has a virtual file name [kernel.kallsyms]. Currently, it can't
    be added to buildid cache successfully because the code
    (build_id_cache__add_s) tries to resolve [kernel.kallsyms] to a real
    absolute pathname and that fails.

    Fixes it by not resolving it and just use the name [kernel.kallsyms].
    So dir ~/.debug/[kernel.kallsyms] is created.

    Original bug report at:
    https://lkml.org/lkml/2011/3/1/524

    Tested-by: Han Pingtian
    Cc: Han Pingtian
    Cc: Ingo Molnar
    Cc: Peter Zijlstra
    LKML-Reference:
    Signed-off-by: Lin Ming
    Signed-off-by: Arnaldo Carvalho de Melo

    Lin Ming
     

09 Mar, 2011

5 commits

  • We leave it at whatever it had been pointing to after the
    first link_path_walk() had failed with -ESTALE. Things
    do not work well after that...

    Signed-off-by: Al Viro

    Al Viro
     
  • Index i was already used in the outer loop

    Cc: stable@kernel.org
    Signed-off-by: Roel Kluin
    Signed-off-by: J. Bruce Fields

    roel
     
  • Fixes (with v2.6.38-rc3/parisc/parisc-allmodconfig):
    src/drivers/i2c/busses/i2c-eg20t.c:720: error: implicit declaration of function 'kzalloc'
    src/drivers/i2c/busses/i2c-eg20t.c:790: error: implicit declaration of function 'kfree'

    Reported-by: Geert Uytterhoeven
    Signed-off-by: Wolfram Sang
    Cc: Tomoya MORINAGA
    Cc: Ben Dooks
    Signed-off-by: Ben Dooks

    Wolfram Sang
     
  • ocores_i2c_of_probe needs to use a const __be32 type for handing
    device tree property values. This patch fixed the following build
    warning:

    CC drivers/i2c/busses/i2c-ocores.o
    drivers/i2c/busses/i2c-ocores.c: In function 'ocores_i2c_of_probe':
    drivers/i2c/busses/i2c-ocores.c:254: warning: assignment discards qualifiers from pointer target type
    drivers/i2c/busses/i2c-ocores.c:261: warning: assignment discards qualifiers from pointer target type

    Signed-off-by: Grant Likely
    Cc: Peter Korsgaard
    Cc: Ben Dooks
    Cc: linux-i2c@vger.kernel.org
    Signed-off-by: Ben Dooks

    Grant Likely
     
  • 30201e7f3 ("mmc: skip detection of nonremovable cards on rescan")
    allowed skipping detection of nonremovable cards on mmc_rescan().
    The intention was to only skip detection of hardwired cards that
    cannot be removed, so make sure this is indeed the case by directly
    checking for (lack of) MMC_CAP_NONREMOVABLE, instead of using
    mmc_card_is_removable(), which is overloaded with
    CONFIG_MMC_UNSAFE_RESUME semantics.

    The user-visible symptom of the bug this patch fixes is that no
    "mmc: card XXXX removed" message appears in dmesg when a card is
    removed and CONFIG_MMC_UNSAFE_RESUME=y.

    Reported-and-tested-by: Dmitry Shmidt
    Reported-and-tested-by: Maxim Levitsky
    Signed-off-by: Ohad Ben-Cohen
    Signed-off-by: Chris Ball

    Ohad Ben-Cohen
     

08 Mar, 2011

14 commits

  • a) struct inode is not going to be freed under ->d_compare();
    however, the thing PROC_I(inode)->sysctl points to just might.
    Fortunately, it's enough to make freeing that sucker delayed,
    provided that we don't step on its ->unregistering, clear
    the pointer to it in PROC_I(inode) before dropping the reference
    and check if it's NULL in ->d_compare().

    b) I'm not sure that we *can* walk into NULL inode here (we recheck
    dentry->seq between verifying that it's still hashed / fetching
    dentry->d_inode and passing it to ->d_compare() and there's no
    negative hashed dentries in /proc/sys/*), but if we can walk into
    that, we really should not have ->d_compare() return 0 on it!
    Said that, I really suspect that this check can be simply killed.
    Nick?

    Signed-off-by: Al Viro

    Al Viro
     
  • Linus Torvalds
     
  • …git/kgene/linux-samsung

    * 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
    ARM: S3C64XX: Update regulator names for debugfs compatiblity on SMDK6410
    ARM: S3C64XX: Fix build with WM1190 disabled and WM1192 enabled on SMDK6410
    ARM: S3C64XX: Reduce output of s3c64xx_dma_init1()
    ARM: S3C64XX: Tone down SDHCI debugging
    ARM: S3C64XX: Add clock for i2c1
    ARM: S3C64XX: Staticise non-exported GPIO to interrupt functions
    ARM: SAMSUNG: Include devs.h in dev-uart.c to prototype devices
    ARM: S3C64XX: Fix keypad setup to configure correct number of rows
    ARM: S3C2440: Fix usage gpio bank j pin definitions on GTA02
    ARM: S5P64X0: Fix number of GPIO lines in Bank F
    ARM: S3C2440: Select missing S3C_DEV_USB_HOST on GTA02

    Linus Torvalds
     
  • * 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm:
    davinci: cpufreq: fix section mismatch warning
    DaVinci: fix compilation warnings in
    davinci: tnetv107x: fix register indexing for GPIOs numbers > 31
    davinci: da8xx/omap-l1x: add platform device for davinci-pcm-audio
    ARM: pxa/tosa: register wm9712 codec device
    ARM: pxa: enable pxa-pcm-audio on pxa210/pxa25x platform
    ARM: pxa/colibri: don't register pxa2xx-pcmcia nodes on non-colibri platforms
    ARM: pxa/tosa: drop setting LED trigger name, as it's unsupported now
    ARM: 6762/1: Update number of VIC for S5P6442 and S5PC100
    ARM: 6761/1: Update number of VIC for S5PV210
    ARM: 6768/1: hw_breakpoint: ensure debug logic is powered up on v7 cores
    ARM: 6767/1: ptrace: fix register indexing in GETHBPREGS request
    ARM: 6765/1: remove obsolete comment from asm/mach/arch.h
    ARM: 6757/1: fix tlb.h induced linux/swap.h build failure

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
    mmc: sdio: Allow sdio operations in other threads during sdio_add_func()

    Linus Torvalds
     
  • * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
    drm: index i shadowed in 2nd loop
    drm/nv50-nvc0: prevent multiple vm/bar flushes occuring simultanenously
    drm/nouveau: fix regression causing ttm to not be able to evict vram
    drm/i915: Rebind the buffer if its alignment constraints changes with tiling
    drm/i915: Disable GPU semaphores by default
    drm/i915: Do not overflow the MMADDR write FIFO
    Revert "drm/i915: fix corruptions on i8xx due to relaxed fencing"

    Linus Torvalds
     
  • Index i was already used in thhe first loop

    Signed-off-by: Roel Kluin
    Signed-off-by: Dave Airlie

    roel
     
  • This fixes a bug introduced by 807e8e40673d ("mmc: Fix sd/sdio/mmc
    initialization frequency retries") that prevented SDIO drivers from
    performing SDIO commands in their probe routines -- the above patch
    called mmc_claim_host() before sdio_add_func(), which causes a deadlock
    if an external SDIO driver calls sdio_claim_host().

    Fix tested on an OLPC XO-1.75 with libertas on SDIO.

    Signed-off-by: Dmitry Shmidt
    Reviewed-and-Tested-by: Chris Ball
    Signed-off-by: Chris Ball

    Dmitry Shmidt
     
  • * ickle/drm-intel-fixes:
    drm/i915: Rebind the buffer if its alignment constraints changes with tiling
    drm/i915: Disable GPU semaphores by default
    drm/i915: Do not overflow the MMADDR write FIFO
    Revert "drm/i915: fix corruptions on i8xx due to relaxed fencing"

    Dave Airlie
     
  • …/git/tmlind/linux-omap-2.6

    * 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
    omap: mailbox: resolve hang issue
    OMAP2+: PM: SmartReflex: fix memory leaks in Smartreflex driver
    arm: mach-omap2: smartreflex: fix another memory leak

    Linus Torvalds
     
  • * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
    [S390] tape: deadlock on system work queue
    [S390] keyboard: integer underflow bug
    [S390] xpram: remove __initdata attribute from module parameters

    Linus Torvalds
     
  • The per-vm mutex doesn't prevent this completely, a flush coming from the
    BAR VM could potentially happen at the same time as one for the channel
    VM. Not to mention that if/when we get per-client/channel VM, this will
    happen far more frequently.

    Signed-off-by: Ben Skeggs
    Signed-off-by: Dave Airlie

    Ben Skeggs
     
  • TTM assumes an error condition from man->func->get_node() means that
    something went horribly wrong, and causes it to bail.

    The driver is supposed to return 0, and leave mm_node == NULL to
    signal that it couldn't allocate any memory.

    Signed-off-by: Ben Skeggs
    Signed-off-by: Dave Airlie

    Ben Skeggs
     
  • In case of a nonempty list, the return on error here is obviously bogus;
    it ends up being a pointer to the list head instead of to any valid
    delegation on the list.

    In particular, if nfsd4_delegreturn() hits this case, and you're quite unlucky,
    then renew_client may oops, and it may take an embarassingly long time to
    figure out why. Facepalm.

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
    IP: [] nfsd4_delegreturn+0x125/0x200
    ...

    Cc: stable@kernel.org
    Signed-off-by: J. Bruce Fields

    J. Bruce Fields
     

07 Mar, 2011

2 commits

  • Early gen3 and gen2 chipset do not have the relaxed per-surface tiling
    constraints of the later chipsets, so we need to check that the GTT
    alignment is correct for the new tiling. If it is not, we need to
    rebind.

    Reported-by: Daniel Vetter
    Reviewed-by: Daniel Vetter
    Signed-off-by: Chris Wilson

    Chris Wilson
     
  • Andi Kleen narrowed his GPU hangs on his Sugar Bay (SNB desktop) rev 09
    down to the use of GPU semaphores, and we already know that they appear
    broken up to Huron River (mobile) rev 08. (I'm optimistic that disabling
    GPU semaphores is simply hiding another bug by the latency and
    side-effects of the additional device interaction it introduces...)

    However, use of semaphores is a massive performance improvement... Only
    as long as the system remains stable. Enable at your peril.

    Reported-by: Andi Kleen
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=33921
    Signed-off-by: Chris Wilson

    Chris Wilson