05 Jan, 2009

1 commit


25 Dec, 2008

4 commits


24 Dec, 2008

9 commits

  • Signed-off-by: Herton Ronaldo Krzesinski
    Cc: stable@kernel.org
    Signed-off-by: Takashi Iwai

    Herton Ronaldo Krzesinski
     
  • there's a new ptrace arch level feature in .28:

    config X86_PTRACE_BTS
    bool "Branch Trace Store"

    it has broken fork() handling: the old DS area gets copied over into
    a new task without clearing it.

    Fixes exist but they came too late:

    c5dee61: x86, bts: memory accounting
    bf53de9: x86, bts: add fork and exit handling

    and are queued up for v2.6.29. This shows that the facility is still not
    tested well enough to release into a stable kernel - disable it for now and
    reactivate in .29. In .29 the hardware-branch-tracer will use the DS/BTS
    facilities too - hopefully resulting in better code.

    Signed-off-by: Ingo Molnar

    Ingo Molnar
     
  • flush_tlb_mm's "optimized" uniprocessor case of allocating a new
    context for userspace is exposing a race where we can suddely return
    to a syscall with the protection id and space id out of sync, trapping
    on the next userspace access.

    Debugged-by: James Bottomley
    Tested-by: Helge Deller
    Signed-off-by: Kyle McMartin
    Signed-off-by: Linus Torvalds

    Kyle McMartin
     
  • * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
    drm/radeon: fix correctness of irq_enabled check for radeon.

    Linus Torvalds
     
  • When deleting an edac device, we have to wait for its edac_dev.work to be
    completed before deleting the whole edac_dev structure. Since we have no
    idea which work in current edac_poller's workqueue is the work we are
    conerned about, we wait for all work in the edac_poller's workqueue to be
    proceseed. This is done via flush_cpu_workqueue() which inserts a
    wq_barrier into the tail of the workqueue and then sleeping on the
    completion of this wq_barrier. The edac_poller will wake up sleepers when
    it is found.

    EDAC core creates only one kernel worker thread, edac_poller, to run the
    works of all current edac devices. They share the same callback function
    of edac_device_workq_function(), which would grab the mutex of
    device_ctls_mutex first before it checks the device. This is exactly
    where edac_poller and rmmod would have a great chance to deadlock.

    In below call trace of rmmod > ... >
    edac_device_del_device >
    edac_device_workq_teardown > flush_workqueue > flush_cpu_workqueue,

    device_ctls_mutex would have already been grabbed by
    edac_device_del_device(). So, on one hand rmmod would sleep on the
    completion of a wq_barrier, holding device_ctls_mutex; on the other hand
    edac_poller would be blocked on the same mutex when it's running any one
    of works of existing edac evices(Note, this edac_dev.work is likely to be
    totally irrelevant to the one that is being removed right now)and never
    would have a chance to run the work of above wq_barrier to wake rmmod up.

    edac_device_workq_teardown() should not be called within the critical
    region of device_ctls_mutex. Just like is done in edac_pci_del_device()
    and edac_mc_del_mc(), where edac_pci_workq_teardown() and
    edac_mc_workq_teardown() are called after related mutex are released.

    Moreover, an edac_dev.work should check first if it is being removed. If
    this is the case, then it should bail out immediately. Since not all of
    existing edac devices are to be removed, this "shutting flag" should be
    contained to edac device being removed. The current edac_dev.op_state can
    be used to serve this purpose.

    The original deadlock problem and the solution have been witnessed and
    tested on actual hardware. Without the solution, rmmod an edac driver
    would result in below deadlock:

    root@localhost:/root> rmmod mv64x60_edac
    EDAC DEBUG: mv64x60_dma_err_remove()
    EDAC DEBUG: edac_device_del_device()
    EDAC DEBUG: find_edac_device_by_dev()

    (hang for a moment)

    INFO: task edac-poller:2030 blocked for more than 120 seconds.
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    edac-poller D 00000000 0 2030 2
    Call Trace:
    [df159dc0] [c0071e3c] free_hot_cold_page+0x17c/0x304 (unreliable)
    [df159e80] [c000a024] __switch_to+0x6c/0xa0
    [df159ea0] [c03587d8] schedule+0x2f4/0x4d8
    [df159f00] [c03598a8] __mutex_lock_slowpath+0xa0/0x174
    [df159f40] [e1030434] edac_device_workq_function+0x28/0xd8 [edac_core]
    [df159f60] [c003beb4] run_workqueue+0x114/0x218
    [df159f90] [c003c674] worker_thread+0x5c/0xc8
    [df159fd0] [c004106c] kthread+0x5c/0xa0
    [df159ff0] [c0013538] original_kernel_thread+0x44/0x60
    INFO: task rmmod:2062 blocked for more than 120 seconds.
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    rmmod D 0ff2c9fc 0 2062 1839
    Call Trace:
    [df119c00] [c0437a74] 0xc0437a74 (unreliable)
    [df119cc0] [c000a024] __switch_to+0x6c/0xa0
    [df119ce0] [c03587d8] schedule+0x2f4/0x4d8
    [df119d40] [c03591dc] schedule_timeout+0xb0/0xf4

    Signed-off-by: Linus Torvalds

    Harry Ciao
     
  • If cgroup_get_rootdir() failed, free_cg_links() will be called in the
    failure path, but tmp_cg_links hasn't been initialized at that time.

    I introduced this bug in the 2.6.27 merge window.

    Signed-off-by: Li Zefan
    Acked-by: Serge Hallyn
    Cc: Paul Menage
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Li Zefan
     
  • Remove spurious warning messages that are thrown onto the console during
    cgroup operations.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Sharyathi Nagesh
    Acked-by: Serge E. Hallyn
    Cc: Paul Menage
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sharyathi Nagesh
     
  • During test of the w1-gpio driver i found that in "w1.c:679
    w1_slave_found()" the device id is converted to little-endian with
    "cpu_to_le64()", but its not converted back to cpu format in "w1_io.c:293
    w1_reset_select_slave()".

    Based on a patch created by Andreas Hummel.

    [akpm@linux-foundation.org: remove unneeded cast]
    Reported-by: Andreas Hummel
    Signed-off-by: Evgeniy Polyakov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Evgeniy Polyakov
     
  • This patch for the rtc-isl1208 driver makes it reject invalid dates.

    Signed-off-by: Chris Elston
    [a.zummo@towertech.it: added comment explaining the check]
    Signed-off-by: Alessandro Zummo
    Cc: Hebert Valerio Riedel
    Cc: David Brownell
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Chris Elston
     

23 Dec, 2008

7 commits


22 Dec, 2008

2 commits


21 Dec, 2008

3 commits

  • Impact: Prevent kernel crash with posix timer clockid CLOCK_MONOTONIC_RAW

    commit 2d42244ae71d6c7b0884b5664cf2eda30fb2ae68 (clocksource:
    introduce CLOCK_MONOTONIC_RAW) introduced a new clockid, which is only
    available to read out the raw not NTP adjusted system time.

    The above commit did not prevent that a posix timer can be created
    with that clockid. The timer_create() syscall succeeds and initializes
    the timer to a non existing hrtimer base. When the timer is deleted
    either by timer_delete() or by the exit() cleanup the kernel crashes.

    Prevent the creation of timers for CLOCK_MONOTONIC_RAW by setting the
    posix clock function to no_timer_create which returns an error code.

    Reported-and-tested-by: Eric Sesterhenn
    Signed-off-by: Thomas Gleixner
    Acked-by: Oleg Nesterov
    Signed-off-by: Linus Torvalds

    Thomas Gleixner
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
    fs/9p: change simple_strtol to simple_strtoul
    9p: convert d_iname references to d_name.name
    9p: Remove potentially bad parameter from function entry debug print.

    Linus Torvalds
     
  • …git/tip/linux-2.6-tip

    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
    x86: fix resume (S2R) broken by Intel microcode module, on A110L
    x86 gart: don't complain if no AMD GART found
    AMD IOMMU: panic if completion wait loop fails
    AMD IOMMU: set cmd buffer pointers to zero manually
    x86: re-enable MCE on secondary CPUS after suspend/resume
    AMD IOMMU: allocate rlookup_table with __GFP_ZERO

    Linus Torvalds
     

20 Dec, 2008

10 commits

  • Impact: fix deadlock

    This is in response to the following bug report:

    Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=12100
    Subject : resume (S2R) broken by Intel microcode module, on A110L
    Submitter : Andreas Mohr
    Date : 2008-11-25 08:48 (19 days old)
    Handled-By : Dmitry Adamushko

    [ The deadlock scenario has been discovered by Andreas Mohr ]

    I think I might have a logical explanation why the system:

    (http://bugzilla.kernel.org/show_bug.cgi?id=12100)

    might hang upon resuming, OTOH it should have likely hanged each and every time.

    (1) possible deadlock in microcode_resume_cpu() if either 'if' section is
    taken;

    (2) now, I don't see it in spec. and can't experimentally verify it (newer
    ucodes don't seem to be available for my Core2duo)... but logically-wise, I'd
    think that when read upon resuming, the 'microcode revision' (MSR 0x8B) should
    be back to its original one (we need to reload ucode anyway so it doesn't seem
    logical if a cpu doesn't drop the version)... if so, the comparison with
    memcmp() for the full 'struct cpu_signature' is wrong... and that's how one of
    the aforementioned 'if' sections might have been triggered - leading to a
    deadlock.

    Obviously, in my tests I simulated loading/resuming with the ucode of the same
    version (just to see that the file is loaded/re-loaded upon resuming) so this
    issue has never popped up.

    I'd appreciate if someone with an appropriate system might give a try to the
    2nd patch (titled "fix a comparison && deadlock...").

    In any case, the deadlock situation is a must-have fix.

    Reported-by: Andreas Mohr
    Signed-off-by: Dmitry Adamushko
    Tested-by: Andreas Mohr
    Signed-off-by: Ingo Molnar
    Cc:

    Signed-off-by: Ingo Molnar

    Dmitry Adamushko
     
  • Since v9ses->uid is unsigned, it would seem better to use simple_strtoul that
    simple_strtol.

    A simplified version of the semantic patch that makes this change is as
    follows: (http://www.emn.fr/x-info/coccinelle/)

    //
    @r2@
    long e;
    position p;
    @@

    e = simple_strtol@p(...)

    @@
    position p != r2.p;
    type T;
    T e;
    @@

    e =
    - simple_strtol@p
    + simple_strtoul
    (...)
    //

    Signed-off-by: Julia Lawall
    Acked-by: Eric Van Hensbergen

    Julia Lawall
     
  • d_iname is rubbish for long file names.
    Use d_name.name in printks instead.

    Signed-off-by: Wu Fengguang
    Acked-by: Eric Van Hensbergen

    Wu Fengguang
     
  • Signed-off-by: Duane Griffin
    Signed-off-by: Eric Van Hensbergen

    Duane Griffin
     
  • * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
    [SCSI] mpt fusion: clear list of outstanding commands on host reset
    [SCSI] scsi_lib: only call scsi_unprep_request() under queue lock
    [SCSI] ibmvstgt: move crq_queue_create to the end of initialization
    [SCSI] libiscsi REGRESSION: fix passthrough support with older iscsi tools
    [SCSI] aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
    ALSA: Fix a Oops bug in omap soc driver.
    ALSA: hda - Remove non-working headphone control for Dell laptops
    ALSA: hda - Add no-jd model for IDT 92HD73xx
    ALSA: Revert "ALSA: hda: removed unneeded hp_nid references"
    ALSA: hda - Add quirk for Dell Studio 17
    ALSA: hda - Fix silent HP output on D975

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
    cciss: fix problem that deleting multiple logical drives could cause a panic

    Linus Torvalds
     
  • * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
    drm/i915: GEM on PAE has problems - disable it for now.
    drm/i915: Don't return busy for buffers left on the flushing list.

    Linus Torvalds
     
  • * 'for-linus' of git://neil.brown.name/md:
    md: Don't read past end of bitmap when reading bitmap.

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
    PCI hotplug: ibmphp: Fix module ref count underflow
    PCI hotplug: acpiphp wants a 64-bit _SUN
    PCI: pciehp: fix unexpected power off with pciehp_force
    PCI: fix aer resume sanity check

    Linus Torvalds
     

19 Dec, 2008

4 commits