1. 21 Dec, 2002 11 commits
    • Andrew Morton's avatar
      [PATCH] fix use-after-free bug in move_vma() · 5446f21e
      Andrew Morton authored
      move_vma() calls do_munmap() and then uses the memory at *new_vma.
      
      But when starting X11 it just happens that the memory which do_munmap
      unmapped had the same start address and the range at *new_vma.  So new_vma
      is freed by do_munmap().
      
      This was never noticed before because (vm_flags & VM_LOCKED) evaluates
      false when vm_flags is 0x5a5a5a5a.  But I just changed that to 0x6b6b6b6b
      and boom - we call make_pages_present() with start == end == 0x6b6b6b6b and
      it goes BUG.
      
      So I think the right fix here is for move_vma() to not inspect the values
      of any vma's after it has called do_munmap().
      
      The patch does that, for `new_vma'.
      
      The local variable `vma' is also being used after the call do do_munmap(),
      and this may also be a bug.  Proving that this is not so, and adding a
      comment to explain why is hereby added to Hugh's todo list ;)
      5446f21e
    • Andrew Morton's avatar
      [PATCH] fix a page dirtying race in vmscan.c · 985babe8
      Andrew Morton authored
      There's a small window in which another CPU could dirty the page after
      we've cleaned it, and before we've moved it to mapping->dirty_pages().
      The end result is a dirty page on mapping->locked_pages, which is
      wrong.
      
      So take mapping->page_lock before clearing the dirty bit.
      985babe8
    • Andrew Morton's avatar
      [PATCH] sync_fs deadlock fix · e101875d
      Andrew Morton authored
      Running a `mount -o remount' against ext3 deadlocks if there is heavy
      write activity.  It's a sort of AB/BA deadlock caused by calling
      log_wait_commit() under lock_super().  The caller holds lock_super()
      and is waiting for a commit, but the commit cannot complete because
      lock_super() is also used in the block allocator.
      
      The way we fixed this in tha past is to drop the superblock lock inside
      ext3.  The way this patch fixes it is to arrange for lock_super() to
      not be held around the ->sync_fs() call.
      
      Also: sync_filesystems is on the sys_sync() path and is racy wrt
      unmount.  Check sb->s_root after taking sb->s_umount.
      e101875d
    • Linus Torvalds's avatar
      Sysenter cleanups (originals by Brian Gerst, updated and expanded by me): · d8ce4c5f
      Linus Torvalds authored
       - set up kernel stack pointer for sysenter at each context switch.
       - disable sysenter while in vm86 mode.
       - clean up mtrr number defines and SEP feature testing
      d8ce4c5f
    • Linus Torvalds's avatar
    • Ivan Kokshaysky's avatar
      [PATCH] PCI: setup-xx fixes · 2ce208e5
      Ivan Kokshaysky authored
      Don't disable PCI devices before changing the BARs, as discussed
      recently.  Disabling PCI_COMMAND_MASTER bit is an obvious bug.
      
      Further, pdev_enable_device() is a leftover from very old (2.0, I guess)
      alpha PCI code.  It's used in pci_assign_unassigned_resources() to
      enable *every* PCI device in the system.  So, if we have two graphic
      cards on the same bus, both with legacy VGA IO...  oops.
      
      Actually, only alpha relied on that due to the lack of
      pcibios_enable_device (which has been already fixed).
      2ce208e5
    • Manfred Spraul's avatar
      [PATCH] new attempt at sys_poll allocation (was: Re: Poll patches..) · 9dd405aa
      Manfred Spraul authored
      This replaces the dynamically allocated two-level array in sys_poll with
      a dynamically allocated linked list.  The current implementation causes
      at least two alloc/free calls, even if only one or two descriptors are
      polled.  This reduces that to one alloc/free, and the .text segment is
      around 220 bytes shorter.  The microbenchmark that polls one pipe fd is
      around 30% faster.  [1140 cycles instead of 1604 cycles, Celeron mobile
      1.13 GHz]
      9dd405aa
    • Linus Torvalds's avatar
      Merge bk://linux-dj.bkbits.net/agpgart · 564dede9
      Linus Torvalds authored
      into home.transmeta.com:/home/torvalds/v2.5/linux
      564dede9
    • Dave Jones's avatar
      Merge tetrachloride.(none):/mnt/stuff/kernel/2.5/bk-linus · 01d8392d
      Dave Jones authored
      into tetrachloride.(none):/mnt/stuff/kernel/2.5/agpgart
      01d8392d
    • Dave Jones's avatar
      [AGP] Make things compile again if AGP3=n · add4c230
      Dave Jones authored
      add4c230
    • Linus Torvalds's avatar
      Merge http://lia64.bkbits.net/to-linus-2.5 · c6bb6a89
      Linus Torvalds authored
      into home.transmeta.com:/home/torvalds/v2.5/linux
      c6bb6a89
  2. 20 Dec, 2002 29 commits