- 02 Mar, 2007 1 commit
-
-
Tejun Heo authored
Clearing drvdata in ->remove_one causes NULL pointer deference. Clear drvdata only in ata_host_release() after all resources are freed. Signed-off-by:
Tejun Heo <htejun@gmail.com> Signed-off-by:
Jeff Garzik <jeff@garzik.org>
-
- 01 Mar, 2007 39 commits
-
-
Trond Myklebust authored
Fix invalidate_inode_pages2_range() so that it does not immediately exit just because a single page in the specified range could not be removed. Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Aristeu Sergio Rozanski Filho authored
This patch fixes a possible race that leads to double freeing an idr index. When the master begin to close, release_dev() is called and then pty_close() is called: if (tty->driver->close) tty->driver->close(tty, filp); This is done without helding any locks other than BKL. Inside pty_close(), being a master close, the devpts entry will be removed: #ifdef CONFIG_UNIX98_PTYS if (tty->driver == ptm_driver) devpts_pty_kill(tty->index); #endif But devpts_pty_kill() will call get_node() that may sleep while waiting for &devpts_root->d_inode->i_sem. When this happens and the slave is being opened, tty_open() just found the driver and index: driver = get_tty_driver(device, &index); if (!driver) { mutex_unlock(&tty_mutex); return -ENODEV; } This part of the code is already protected under tty_mute. The problem is that the slave close already got an index. Then init_dev() is called and blocks waiting for the same &devpts_root->d_inode->i_sem. When the master close resumes, it removes the devpts entry, and the relation between idr index and the tty is gone. The master then sleeps waiting for the tty_mutex on release_dev(). Slave open resumes and found no tty for that index. As result, a NULL tty is returned and init_dev() doesn't flow to fast_track: /* check whether we're reopening an existing tty */ if (driver->flags & TTY_DRIVER_DEVPTS_MEM) { tty = devpts_get_tty(idx); if (tty && driver->subtype == PTY_TYPE_MASTER) tty = tty->link; } else { tty = driver->ttys[idx]; } if (tty) goto fast_track; The result of this, is that a new tty will be created and init_dev() returns sucessfull. After returning, tty_mutex is dropped and master close may resume. Master close finds it's the only use and both sides are closing, then releases the tty and the index. At this point, the idr index is free, but slave still has it. Slave open then calls pty_open() and finds that tty->link->count is 0, because there's no master and returns error. Then tty_open() calls release_dev() which executes without any warning, as it was a case of last slave close when the master is already closed (master->count == 0, slave->count == 1). The tty is then released with the already released idr index. This normally would only issue a warning on idr_remove() but in case of a customer's critical application, it's never too simple: thread1: opens master, gets index X thread1: begin closing master thread2: begin opening slave with index X thread1: finishes closing master, index X released thread3: opens master, gets index X, just released thread2: fails opening slave, releases index X <---- thread4: opens master, gets index X, init_dev() then find an already in use and healthy tty and fails If no more indexes are released, ptmx_open() will keep failing, as the first free index available is X, and it will make init_dev() fail because you're trying to "reopen a master" which isn't valid. The patch notices when this race happens and make init_dev() fail imediately. The init_dev() function is called with tty_mutex held, so it's safe to continue with tty till the end of function because release_dev() won't make any further changes without grabbing the tty_mutex. Without the patch, on some machines it's possible get easily idr warnings like this one: idr_remove called for id=15 which is not allocated. [<c02555b9>] idr_remove+0x139/0x170 [<c02a1b62>] release_mem+0x182/0x230 [<c02a28e7>] release_dev+0x4b7/0x700 [<c02a0ea7>] tty_ldisc_enable+0x27/0x30 [<c02a1e64>] init_dev+0x254/0x580 [<c02a0d64>] check_tty_count+0x14/0xb0 [<c02a4f05>] tty_open+0x1c5/0x340 [<c02a4d40>] tty_open+0x0/0x340 [<c017388f>] chrdev_open+0xaf/0x180 [<c017c2ac>] open_namei+0x8c/0x760 [<c01737e0>] chrdev_open+0x0/0x180 [<c0167bc9>] __dentry_open+0xc9/0x210 [<c0167e2c>] do_filp_open+0x5c/0x70 [<c0167a91>] get_unused_fd+0x61/0xd0 [<c0167e93>] do_sys_open+0x53/0x100 [<c0167f97>] sys_open+0x27/0x30 [<c010303b>] syscall_call+0x7/0xb using this test application available on: http://www.ruivo.org/~aris/pty_sodomizer.cSigned-off-by:Aristeu Sergio Rozanski Filho <aris@ruivo.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by:
-
Yoichi Yuasa authored
When it goes to free1_out, dev->dma_mem has not been freed. Signed-off-by:
Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp> Signed-off-by:
-
Karsten Keil authored
The CAPI trace debug functions were using a fixed size buffer, which can be overflowed if wrong formatted CAPI messages were sent to the kernel capi layer. The code was also not protected against multiple callers. This fix bug 8028. Additionally the patch make the CAPI trace functions optional. Signed-off-by:
Karsten Keil <kkeil@suse.de> Signed-off-by:
-
Oleg Nesterov authored
page_lock_anon_vma() uses spin_lock() to block RCU. This doesn't work with PREEMPT_RCU, we have to do rcu_read_lock() explicitely. Otherwise, it is theoretically possible that slab returns anon_vma's memory to the system before we do spin_unlock(&anon_vma->lock). [ Hugh points out that this only matters for PREEMPT_RCU, which isn't merged yet, and may never be. Regardless, this patch is conceptually the right thing to do, even if it doesn't matter at this point. - Linus ] Signed-off-by:
Oleg Nesterov <oleg@tv-sign.ru> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Cc: Christoph Lameter <clameter@engr.sgi.com> Acked-by:
Hugh Dickins <hugh@veritas.com> Signed-off-by:
-
Vassili Karpov authored
Describes how/when the information exported to `/proc/stat' is calculated, and possible problems with this approach. Signed-off-by:
Vassili Karpov <av1474@comtv.ru> Signed-off-by:
-
Ingo Molnar authored
The SMT scheduler incorrectly skips kernel threads even if they are runnable (but they are preempted by a higher-prio user-space task which got SMT-delayed by an even higher-priority task running on a sibling CPU). Fix this for now by only doing the SMT-nice optimization if the to-be-delayed task is the only runnable task. (This should cover most of the real-life cases anyway.) This bug has been in the SMT scheduler since 2.6.17 or so, but has only been noticed now by the active check in the dynticks code. Signed-off-by:
Ingo Molnar <mingo@elte.hu> Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by:
-
Geert Uytterhoeven authored
ps3: Introduce CONFIG_PS3_ADVANCED, as suggested by Roman Zippel, and use it to control questions about PS3 subsystems that may not be obvious for the casual user. This gets rid of the following warning on non-powerpc platforms: | drivers/video/Kconfig:1604:warning: 'select' used by config symbol 'FB_PS3' refer to undefined symbol 'PS3_PS3AV' Signed-off-by:
Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com> Acked-by:
Geoff Levand <geoffrey.levand@am.sony.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Roman Zippel <zippel@linux-m68k.org> Signed-off-by:
-
Mingming Cao authored
There are race issues around ext[34] xattr block release code. ext[34]_xattr_release_block() checks the reference count of xattr block (h_refcount) and frees that xattr block if it is the last one reference it. Unlike ext2, the check of this counter is unprotected by any lock. ext[34]_xattr_release_block() will free the mb_cache entry before freeing that xattr block. There is a small window between the check for the re h_refcount ==1 and the call to mb_cache_entry_free(). During this small window another inode might find this xattr block from the mbcache and reuse it, racing a refcount updates. The xattr block will later be freed by the first inode without notice other inode is still use it. Later if that block is reallocated as a datablock for other file, then more serious problem might happen. We need put a lock around places checking the refount as well to avoid racing issue. Another place need this kind of protection is in ext3_xattr_block_set(), where it will modify the xattr block content in- the-fly if the refcount is 1 (means it's the only inode reference it). This will also fix another issue: the xattr block may not get freed at all if no lock is to protect the refcount check at the release time. It is possible that the last two inodes could release the shared xattr block at the same time. But both of them think they are not the last one so only decreased the h_refcount without freeing xattr block at all. We need to call lock_buffer() after ext3_journal_get_write_access() to avoid deadlock (because the later will call lock_buffer()/unlock_buffer () as well). Signed-off-by:
Mingming Cao <cmm@us.ibm.com> Cc: Andreas Gruenbacher <agruen@suse.de> Cc: <linux-ext4@vger.kernel.org> Signed-off-by:
-
Jeff Dike authored
Fix the fact that pte_mkread set _PAGE_RW instead of _PAGE_USER (the logic is copied from i386 in most place, so it is really as bad as you're thinking). Thus currently page tables are more permissive than they should. Such a change may trigger other latent bugs, so be careful with this. Signed-off-by:
Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Signed-off-by:
Jeff Dike <jdike@addtoit.com> Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Signed-off-by:
-
Jeff Dike authored
This fixes a problem seen by a number of people running UML on newer host kernels. init would hang with an infinite segfault loop. It turns out that the host kernel was providing a AT_SYSINFO_EHDR of 0xffffe000, which faked UML into believing that the host VDSO page could be reused. However, AT_SYSINFO pointed into the middle of the address space, and was unmapped as a result. Because UML was providing AT_SYSINFO_EHDR and AT_SYSINFO to its own processes, these would branch to nowhere when trying to use the VDSO. The fix is to also check the location of AT_SYSINFO when deciding whether to use the host's VDSO. Signed-off-by:
-
Allan Graves authored
Add the RAW device driver options to the UML Kconfig.char file so that you may use them in UML. Signed-off-by: Allan Graves<allan.graves@gmail.com> Signed-off-by:
-
David Howells authored
linux/irq.h uses EINVAL but does not #include linux/errno.h. This results in the compiler spitting out errors on some files. Signed-off-by:
David Howells <dhowells@redhat.com> Signed-off-by:
-
Andrew Morton authored
throttle_vm_writeout() is designed to wait for the dirty levels to subside. But if the caller holds IO or FS locks, we might be holding up that writeout. So change it to take a single nap to give other devices a chance to clean some memory, then return. Cc: Nick Piggin <nickpiggin@yahoo.com.au> Cc: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Cc: Kumar Gala <galak@kernel.crashing.org> Cc: Pete Zaitcev <zaitcev@redhat.com> Cc: <stable@kernel.org> Signed-off-by:
-
Kristen Carlson Accardi authored
Since the bay driver depends on the dock driver for proper notification, make this driver depend on the dock driver. Signed-off-by:
Kristen Carlson Accardi <kristen.c.accardi@intel.com> Acked-by:
Len Brown <lenb@kernel.org> Signed-off-by:
-
David Miller authored
The code is seemingly trying to make sure that rb_next() brings us to successive increasing vma entries. But the two variables, prev and pend, used to perform these checks, are never advanced. Signed-off-by:
David S. Miller <davem@davemloft.net> Cc: Andrea Arcangeli <andrea@novell.com> Signed-off-by:
-
Jeff Dike authored
In the 2.6.20 hang patch, I accidentally threw out an error message. This puts it back. Signed-off-by:
-
Jeff Dike authored
Add some locking to host_ldt_entries to prevent racing when reading LDT information from the host. The locking is somewhat more careful than my previous attempt. Now, only the check of host_ldt_entries is locked. The lock is dropped immediately afterwards, and if the LDT needs initializing, that (and the memory allocations needed) proceed outside the lock. Also fixed some style violations. Signed-off-by:
-
Tilman Schmidt authored
a) Remove #define acrobatics that have become unnecessary by the move of asyncdata.o into the common part. b) Correct the rule for building the common part into the kernel when some or all hardware specific parts are built as modules. Signed-off-by:
Tilman Schmidt <tilman@imap.cc> Cc: Adrian Bunk <bunk@stusta.de> Cc: Karsten Keil <kkeil@suse.de> Signed-off-by:
-
Michael Halcrow authored
Dmitriy Monakhov wrote: > if path_lookup() return non zero code we don't have to worry about > 'nd' parameter, but ecryptfs_read_super does path_release(&nd) after > path_lookup has failed, and dentry counter becomes negative Do not do a path_release after a path_lookup error. Signed-off-by:
Michael Halcrow <mhalcrow@us.ibm.com> Cc: Dmitriy Monakhov <dmonakhov@openvz.org> Signed-off-by:
-
Michael Halcrow authored
Remove unnecessary flush_dcache_page() call. Thanks to Dmitriy Monakhov for pointing this out. Signed-off-by:
-
Michael Halcrow authored
O_LARGEFILE should be set here when opening the lower file. Signed-off-by:
-
David Brownell authored
Fix an oops on the rtc_device_unregister() path by waiting until the last moment before nulling the rtc->ops vector. Fix some potential oopses by having the rtc_class_open()/rtc_class_close() interface increase the RTC's reference count while an RTC handle is available outside the RTC framework. Signed-off-by:
David Brownell <dbrownell@users.sourceforge.net> Cc: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Antonino A. Daplas authored
adaplas@pol.net is still alive, but is choking on the traffic. Signed-off-by:
Antonino Daplas <adaplas@gmail.com> Signed-off-by:
-
Randy Dunlap authored
Add -mm testing to SubmitChecklist. Signed-off-by:
Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by:
-
Sam Ravnborg authored
lockdep_init() is marked __init but used in several places outside __init code. This causes following warnings: $ scripts/mod/modpost kernel/lockdep.o WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.lockdep_init_map after 'lockdep_init_map' (at offset 0x105) WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.lockdep_reset_lock after 'lockdep_reset_lock' (at offset 0x35) WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.__lock_acquire after '__lock_acquire' (at offset 0xb2) The warnings are less obviously due to heavy inlining by gcc - this is not altered. Fix the section mismatch warnings by removing the __init marking, which seems obviously wrong. Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Acked-by:
-
Nick Piggin authored
Rename PG_checked to PG_owner_priv_1 to reflect its availablilty as a private flag for use by the owner/allocator of the page. In the case of pagecache pages (which might be considered to be owned by the mm), filesystems may use the flag. Signed-off-by:
Jeremy Fitzhardinge <jeremy@xensource.com> Signed-off-by:
Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by:
-
Adrian Bunk authored
/home/bunk/linux/kernel-2.6/linux-2.6.20-mm2/kernel/sysctl.c:1411: error: conflicting types for 'register_sysctl_table' /home/bunk/linux/kernel-2.6/linux-2.6.20-mm2/include/linux/sysctl.h:1042: error: previous declaration of 'register_sysctl_table' was here make[2]: *** [kernel/sysctl.o] Error 1 Caused by commit 0b4d4147. Signed-off-by:
Adrian Bunk <bunk@stusta.de> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by:
-
Thomas Gleixner authored
Problem description at: http://bugzilla.kernel.org/show_bug.cgi?id=8048 Commit b18ec803 [PATCH] sched: improve migration accuracy optimized the scheduler time calculations, but broke posix-cpu-timers. The problem is that the p->last_ran value is not updated after a context switch. So a subsequent call to current_sched_time() calculates with a stale p->last_ran value, i.e. accounts the full time, which the task was scheduled away. Signed-off-by:
Thomas Gleixner <tglx@linutronix.de> Acked-by:
-
Michael Halcrow authored
eCryptfs lower file handling code has several issues: - Retval from prepare_write()/commit_write() wasn't checked to equality to AOP_TRUNCATED_PAGE. - In some places page wasn't unmapped and unlocked after error. Signed-off-by: -
Randy Dunlap authored
Fix kernel-doc warnings in 2.6.20-git15 (lib/, mm/, kernel/, include/). Signed-off-by:
-
Randy Dunlap authored
Allow space(s) between "__attribute__" and "((blah))" so that kernel-doc does not complain like: Warning(/tester/linsrc/linux-2.6.20-git15//kernel/timer.c:939): No description found for parameter 'read_persistent_clock(void' Signed-off-by:
-
Daniel Walker authored
Signed-off-by:
Daniel Walker <dwalker@mvista.com> Signed-off-by:
-
David Howells authored
Add some missing lazy MMU hooks for NOMMU mode. Signed-off-by:
-
David Howells authored
FRV does not require a ZONE_DMA, so all DMA'able pages that aren't highmem should be in ZONE_NORMAL. Signed-off-by:
-
NeilBrown authored
i.e. one or more drives can be added and the array will re-stripe while on-line. Most of the interesting work was already done for raid5. This just extends it to raid6. mdadm newer than 2.6 is needed for complete safety, however any version of mdadm which support raid5 reshape will do a good enough job in almost all cases (an 'echo repair > /sys/block/mdX/md/sync_action' is recommended after a reshape that was aborted and had to be restarted with an such a version of mdadm). Signed-off-by:
Neil Brown <neilb@suse.de> Signed-off-by:
-
NeilBrown authored
An error always aborts any resync/recovery/reshape on the understanding that it will immediately be restarted if that still makes sense. However a reshape currently doesn't get restarted. With this patch it does. To avoid restarting when it is not possible to do work, we call into the personality to check that a reshape is ok, and strengthen raid5_check_reshape to fail if there are too many failed devices. We also break some code out into a separate function: remove_and_add_spares as the indent level for that code was getting crazy. Signed-off-by:
-
NeilBrown authored
The mddev and queue might be used for another array which does not set these, so they need to be cleared. Signed-off-by:
-
NeilBrown authored
md tries to warn the user if they e.g. create a raid1 using two partitions of the same device, as this does not provide true redundancy. However it also warns if a raid0 is created like this, and there is nothing wrong with that. At the place where the warning is currently printer, we don't necessarily know what level the array will be, so move the warning from the point where the device is added to the point where the array is started. Signed-off-by:
-
