1. 10 Mar, 2012 1 commit
  2. 09 Mar, 2012 11 commits
    • Al Viro's avatar
      aio: fix the "too late munmap()" race · c7b28555
      Al Viro authored
      Current code has put_ioctx() called asynchronously from aio_fput_routine();
      that's done *after* we have killed the request that used to pin ioctx,
      so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
      from progressing.  As the result, we can end up with async call of
      put_ioctx() being the last one and possibly happening during exit_mmap()
      or elf_core_dump(), neither of which expects stray munmap() being done
      to them...
      We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
      with that, but that's all we care about - neither io_destroy() nor
      exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
      does really_put_req(), so the ioctx teardown won't be done until then
      and we don't care about the contents of ioctx past that point.
      Since actual freeing of these suckers is RCU-delayed, we don't need to
      bump ioctx refcount when request goes into list for async removal.
      All we need is rcu_read_lock held just over the ->ctx_lock-protected
      area in aio_fput_routine().
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Acked-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Al Viro's avatar
      aio: fix io_setup/io_destroy race · 86b62a2c
      Al Viro authored
      Have ioctx_alloc() return an extra reference, so that caller would drop it
      on success and not bother with re-grabbing it on failure exit.  The current
      code is obviously broken - io_destroy() from another thread that managed
      to guess the address io_setup() would've returned would free ioctx right
      under us; gets especially interesting if aio_context_t * we pass to
      io_setup() points to PROT_READ mapping, so put_user() fails and we end
      up doing io_destroy() on kioctx another thread has just got freed...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Acked-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 86e06008
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "I have two additional and btrfs fixes in my for-linus branch.  One is
        a casting error that leads to memory corruption on i386 during scrub,
        and the other fixes a corner case in the backref walking code (also
        triggered by scrub)."
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: fix casting error in scrub reada code
        btrfs: fix locking issues in find_parent_nodes()
    • Hugh Dickins's avatar
      memcg: revert fix to mapcount check for this release · be22aece
      Hugh Dickins authored
      Respectfully revert commit e6ca7b89
       "memcg: fix mapcount check
      in move charge code for anonymous page" for the 3.3 release, so that
      it behaves exactly like releases 2.6.35 through 3.2 in this respect.
      Horiguchi-san's commit is correct in itself, 1 makes much more sense
      than 2 in that check; but it does not go far enough - swapcount
      should be considered too - if we really want such a check at all.
      We appear to have reached agreement now, and expect that 3.4 will
      remove the mapcount check, but had better not make 3.3 different.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Thomas Gleixner's avatar
      x86: Derandom delay_tsc for 64 bit · a7f4255f
      Thomas Gleixner authored
      Commit f0fbf0ab
       ("x86: integrate delay functions") converted
      delay_tsc() into a random delay generator for 64 bit.  The reason is
      that it merged the mostly identical versions of delay_32.c and
      delay_64.c.  Though the subtle difference of the result was:
       static void delay_tsc(unsigned long loops)
      -	unsigned bclock, now;
      +	unsigned long bclock, now;
      Now the function uses rdtscl() which returns the lower 32bit of the
      TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64
      bit this fails when the lower 32bit are close to wrap around when
      bclock is read, because the following check
             if ((now - bclock) >= loops)
      evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0
      because the unsigned long (now - bclock) of these values results in
      0xffffffff00000001 which is definitely larger than the loops
      value. That explains Tvortkos observation:
      "Because I am seeing udelay(500) (_occasionally_) being short, and
       that by delaying for some duration between 0us (yep) and 491us."
      Make those variables explicitely u32 again, so this works for both 32
      and 64 bit.
      Reported-by: default avatarTvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Cc: stable@vger.kernel.org # >= 2.6.27
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Linus Torvalds's avatar
      Merge tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · c447064d
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Nothing exciting here: just a few regression fixes for HD-audio and
        ASoC, also the support of missing 32bit compat ioctl for HDSPM."
      * tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hdspm - Provide ioctl_compat
        ALSA: hda/realtek - Apply the coef-setup only to ALC269VB
        ALSA: hda - add quirk to detect CD input on Gigabyte EP45-DS3
        ASoC: neo1973: fix neo1973 wm8753 initialization
    • David Brown's avatar
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming · 0ab5d757
      Linus Torvalds authored
      Pull C6X fix from Mark Salter:
       "Fix for C6X KSTK_EIP and KSTK_ESP macros."
      * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
        C6X: fix KSTK_EIP and KSTK_ESP macros
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 0cacaf51
      Linus Torvalds authored
      Pull two IOMMU fixes from Joerg Roedel:
       "The first is an additional fix for the OMAP initialization order issue
        and the second patch fixes a possible section mismatch which can lead
        to a kernel crash in the AMD IOMMU driver when suspend/resume is used
        and the compiler has not inlined the iommu_set_device_table function."
      * tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        x86/amd: iommu_set_device_table() must not be __init
        ARM: OMAP: fix iommu, not mailbox
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 45b8da90
      Linus Torvalds authored
      Pull radeon drm stuff from Dave Airlie:
       "Just some radeon fixes, one is for an oops where we run out of ioremap
        space on some big hardware systems in 32-bit mode, stuff doesn't work
        properly but at least the machine will boot.
        One regression fix, and two bugs, one hw, one blit code."
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/kms: fix hdmi duallink checks
        drm/radeon/kms: set SX_MISC in the r6xx blit code (v2)
        drm/radeon: deal with errors from framebuffer init path.
        drm/radeon: fix a semaphore deadlock on pre cayman asics
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e304dfdb
      Linus Torvalds authored
      Pull networking from David Miller:
      1) IPV4 routing metrics can become stale when routes are changed by the
         administrator, fix from Steffen Klassert.
      2) atl1c does "val |= XXX;" where XXX is a bit number not a bit mask,
         fix by using set_bit.  From Dan Carpenter.
      3) Memory accounting bug in carl9170 driver results in wedged TX queue.
         Fix from Nicolas Cavallari.
      4) iwlwifi accidently uses "sizeof(ptr)" instead of "sizeof(*ptr)", fix
         from Johannes Berg.
      5) Openvswitch doesn't honor dp_ifindex when doing vport lookups, fix
         from Ben Pfaff.
      6) ehea conversion to 64-bit stats lost multicast and rx_errors
         accounting, fix from Eric Dumazet.
      7) Bridge state transition logging in br_stp_disable_port() is busted,
         it's emitted at the wrong time and the message is in the wrong tense,
         fix from Paulius Zaleckas.
      8) mlx4 device erroneously invokes the queue resize firmware operation
         twice, fix from Jack Morgenstein.
      9) Fix deadlock in usbnet, need to drop lock when invoking usb_unlink_urb()
         otherwise we recurse into taking it again.  Fix from Sebastian Siewior.
      10) hyperv network driver uses the wrong driver name string, fix from
          Haiyang Zhang.
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        net/hyperv: Use the built-in macro KBUILD_MODNAME for this driver
        net/usbnet: avoid recursive locking in usbnet_stop()
        route: Remove redirect_genid
        inetpeer: Invalidate the inetpeer tree along with the routing cache
        mlx4_core: fix bug in modify_cq wrapper for resize flow.
        atl1c: set ATL1C_WORK_EVENT_RESET bit correctly
        bridge: fix state reporting when port is disabled
        bridge: br_log_state() s/entering/entered/
        ehea: restore multicast and rx_errors fields
        openvswitch: Fix checksum update for actions on UDP packets.
        openvswitch: Honor dp_ifindex, when specified, for vport lookup by name.
        iwlwifi: fix wowlan suspend
        mwifiex: reset encryption mode flag before association
        carl9170: fix frame delivery if sta is in powersave mode
        carl9170: Fix memory accounting when sta is in power-save mode.
  3. 08 Mar, 2012 21 commits
  4. 07 Mar, 2012 7 commits