The race is that the shrink_dcache_memory shrinker could get called while a
filesystem is being unmounted, and could try to prune a dentry belonging to
that filesystem.

If it does, then it will call in to iput on the inode while the dentry is
no longer able to be found by the umounting process.  If iput takes a
while, generic_shutdown_super could get all the way though
shrink_dcache_parent and shrink_dcache_anon and invalidate_inodes without
ever waiting on this particular inode.

Eventually the superblock gets freed anyway and if the iput tried to touch
it (which some filesystems certainly do), it will lose.  The promised
"Self-destruct in 5 seconds" doesn't lead to a nice day.

The race is closed by holding s_umount while calling prune_one_dentry on
someone else's dentry.  As a down_read_trylock is used,
shrink_dcache_memory will no longer try to prune the dentry of a filesystem
that is being unmounted, and unmount will not be able to start until any
such active prune_one_dentry completes.

This requires that prune_dcache *knows* which filesystem (if any) it is
doing the prune on behalf of so that it can be careful of other
filesystems.  shrink_dcache_memory isn't called it on behalf of any
filesystem, and so is careful of everything.

shrink_dcache_anon is now passed a super_block rather than the s_anon list
out of the superblock, so it can get the s_anon list itself, and can pass
the superblock down to prune_dcache.

If prune_dcache finds a dentry that it cannot free, it leaves it where it
is (at the tail of the list) and exits, on the assumption that some other
thread will be removing that dentry soon.  To try to make sure that some
work gets done, a limited number of dnetries which are untouchable are
skipped over while choosing the dentry to work on.

I believe this race was first found by Kirill Korotaev.

Cc: Jan Blunck <jblunck@suse.de>
Acked-by: Kirill Korotaev <dev@openvz.org>
Cc: Olaf Hering <olh@suse.de>
Acked-by: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Balbir Singh <balbir@in.ibm.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Avoid taking tasklist_lock for at getrusage for the multithreaded case too.
We don't need to take the tasklist lock for thread traversal of a process
since Oleg's do-__unhash_process-under-siglock.patch and related work.
Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch removes the steal_locks() function.

steal_locks() doesn't work correctly with any filesystem that does it's own
lock management, including NFS, CIFS, etc.

In addition it has weird semantics on local filesystems in case tasks
sharing file-descriptor tables are doing POSIX locking operations in
parallel to execve().

The steal_locks() function has an effect on applications doing:

clone(CLONE_FILES)
  /* in child */
  lock
  execve
  lock

POSIX locks acquired before execve (by "child", "parent" or any further
task sharing files_struct) will after the execve be owned exclusively by
"child".

According to Chris Wright some LSB/LTP kind of suite triggers without the
stealing behavior, but there's no known real-world application that would
also fail.

Apps using NPTL are not affected, since all other threads are killed before
execve.

Apps using LinuxThreads are only affected if they

  - have multiple threads during exec (LinuxThreads doesn't kill other
    threads, the app may do it with pthread_kill_other_threads_np())
  - rely on POSIX locks being inherited across exec

Both conditions are documented, but not their interaction.

Apps using clone() natively are affected if they

  - use clone(CLONE_FILES)
  - rely on POSIX locks being inherited across exec

The above scenarios are unlikely, but possible.

If the patch is vetoed, there's a plan B, that involves mostly keeping the
weird stealing semantics, but changing the way lock ownership is handled so
that network and local filesystems work consistently.

That would add more complexity though, so this solution seems to be
preferred by most people.
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Matthew Wilcox <willy@debian.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Steven French <sfrench@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This race became a cause of oops, and can reproduce by the following.

    while true; do
	dd if=/dev/zero of=/dev/.static/dev/hdg1 bs=512 count=1000 & sync
    done

This race condition was between __sync_single_inode() and iput().

          cpu0 (fs's inode)                 cpu1 (bdev's inode)
          -----------------                 -------------------
                                       close("/dev/hda2")
                                       [...]
__sync_single_inode()
   /* copy the bdev's ->i_mapping */
   mapping = inode->i_mapping;

                                       generic_forget_inode()
                                          bdev_clear_inode()
					     /* restre the fs's ->i_mapping */
				             inode->i_mapping = &inode->i_data;
				          /* bdev's inode was freed */
                                          destroy_inode(inode);

   if (wait) {
      /* dereference a freed bdev's mapping->host */
      filemap_fdatawait(mapping);  /* Oops */

Since __sync_single_inode() is only taking a ref-count of fs's inode, the
another process can be close() and freeing the bdev's inode while writing
fs's inode.  So, __sync_signle_inode() accesses the freed ->i_mapping,
oops.

This patch takes a ref-count on the bdev's inode for the fs's inode before
setting a ->i_mapping, and the clear_inode() of the fs's inode does iput() on
the bdev's inode.  So if the fs's inode is still living, bdev's inode
shouldn't be freed.
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Add the vendor-specific extended capability PCI_CAP_ID_VNDR.  It is required
by the Myri-10G Ethernet driver.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Someone changed skb_linearize().

Cc: Brice Goglin <bgoglin@myri.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

kernel/power/main.c: In function 'suspend_prepare':
kernel/power/main.c:89: warning: implicit declaration of function 'suspend_console'
kernel/power/main.c: In function 'suspend_finish':
kernel/power/main.c:137: warning: implicit declaration of function 'resume_console'
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Add a revocation notification method to the key type and calls it whilst
the key's semaphore is still write-locked after setting the revocation
flag.

The patch then uses this to maintain a reference on the task_struct of the
process that calls request_key() for as long as the authorisation key
remains unrevoked.

This fixes a potential race between two processes both of which have
assumed the authority to instantiate a key (one may have forked the other
for example).  The problem is that there's no locking around the check for
revocation of the auth key and the use of the task_struct it points to, nor
does the auth key keep a reference on the task_struct.

Access to the "context" pointer in the auth key must thenceforth be done
with the auth key semaphore held.  The revocation method is called with the
target key semaphore held write-locked and the search of the context
process's keyrings is done with the auth key semaphore read-locked.

The check for the revocation state of the auth key just prior to searching
it is done after the auth key is read-locked for the search.  This ensures
that the auth key can't be revoked between the check and the search.

The revocation notification method is added so that the context task_struct
can be released as soon as instantiation happens rather than waiting for
the auth key to be destroyed, thus avoiding the unnecessary pinning of the
requesting process.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Introduce SELinux hooks to support the access key retention subsystem
within the kernel.  Incorporate new flask headers from a modified version
of the SELinux reference policy, with support for the new security class
representing retained keys.  Extend the "key_alloc" security hook with a
task parameter representing the intended ownership context for the key
being allocated.  Attach security information to root's default keyrings
within the SELinux initialization routine.

Has passed David's testsuite.
Signed-off-by: Michael LeMay <mdlemay@epoch.ncsc.mil>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Many thanks to Pauline Ng for the detailed bug report and analysis!
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

rd_prompt et.al.  depend on CONFIG_BLK_DEV_RAM, not CONFIG_BLK_INITRD; now
that those are independent, setup.c blows with INITRD on and BLK_DEV_RAM
off.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: William Lee Irwin III <wli@holomorphy.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Change a variable from unsigned to signed in order to get sign-extension
when the thing is negated.  Without this, uptime is horribly confused.
Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Jaroslav Kysela <perex@suse.cz>

Show EAPD and pin-detection capabilities in proc files.
They are often required to support the proper audio functionality.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Removed nested mutexes in the removal routine of port connections.
The port is guaranteed to be offline before calling it, so no mutex
is needed.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Remove obsoleted ppc/toonie.c.
The function is replaced with new snd-aoa driver.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch removes from snd-powermac the code that check for the layout-id
and instead adds code that makes it refuse loading when a layout-id property
is present, nothing that snd-aoa should be used.
It also removes the 'toonie' codec from snd-powermac which was only ever
used on the mac mini which has a layout-id property.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This large patch adds all of snd-aoa.
Consisting of many modules, it currently replaces snd-powermac
for all layout-id based machines and handles many more (for
example new powerbooks and powermacs with digital output that
previously couldn't be used at all).
It also has support for all layout-IDs that Apple has (judging
from their Info.plist file) but not all are tested.
The driver currently has 2 known regressions over snd-powermac:
 * it doesn't handle powermac 7,2 and 7,3
 * it doesn't have a DRC control on snapper-based machines
I will fix those during the 2.6.18 development cycle.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Use 3stack model as default for ASUS P5RD2-VM and P5GPL-X SE
boards with AD1986A codec (ALSA bug#2103).
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Justin Sunseri reports that sound is audible on his Lenovo 3000
N100-07684JU by passing 'model=laptop-eapd' to modprobe, so this
patch adds the pci ids for his sound device to patch_analog.c .
This commit closes LP#39517. Alexey Parshin also confirmed the fix at
http://bugs.gentoo.org/137245
TODO: Mute onboard speakers when device is plugged into the headphone
jack. Muting the 'External Amplifier' mixer element while a device is
plugged into the headphone jack allows sound to be played only from the
headphone jack.
From: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Daniel T Chen <crimsun at ubuntu.com>
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>

Removed the CS_AUDIO_* #defines, which were duplicates of the
class-specific USB_DT_CS_* #defines in <linux/usb_ch9.h>.
Signed-off-by: Ben Williamson <ben.williamson@greyinnovation.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch adds a write to an undocumented register, 0x60 Extended
Codec Register Page in the AD1888 codec. It is neccessary in order
to make suspend/resume work with the AD1888.
Signed-off-by: Jaya Kumar <jayakumar.alsa@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch by Rodolfo Giometti disables the AC97 AUX and VIDEO controls
on the WM9705 when the touchscreen is selected as the AUX and VIDEO
lines are shared with the touch controller.
Changes:-
 o Added AC97_HAS_NO_AUX flag
 o Test for AC97_HAS_NO_AUX flag in snd_ac97_mixer_build()
 o Sets AC97_HAS_NO_VIDEO and AC97_HAS_NO_AUX in patch_wolfson05() when
WM9705 touch driver is selected.
Signed-off-by: Rodolfo Giometti <giometti@linux.it>
Signed-off-by: Liam Girdwood <liam.girdwood@wolfsonmicro.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Default to variable samplerate enabled for MSI K8T Neo2-FI
No crackles here with 44100.
Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

http://www.kernel.org/git/?p=linux/kernel/git/bcollins/ubuntu-dapper.git;a=commitdiff;h=eae2cc78de39502595f67b7fc1f821f5963bb8ae
UpstreamStatus: Not merged
Christian Bjalevik reports in LP#38546 that his sound chipset requires
the 'hp_only' quirk to allow him to control sound volume correctly when
headphones are inserted. This patch adds the appropriate pci id to the
via82xx ALSA driver so that the quirk is applied automatically, thereby
removing the need for users to modify /etc/modprobe.d/alsa-base (or to
unload and reload snd-via82xx with ac97_quirk=hp_only).
This patch closes LP#38546.
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

http://www.kernel.org/git/?p=linux/kernel/git/bcollins/ubuntu-dapper.git;a=commitdiff;h=9ad787cd9670c3f3b8f3db235e84baf00a2ea526
Anders Ostling comments in Malone #41015 that his Dell D800 laptop's
volume control works correctly when the hp_only quirk is passed to
modprobe. This commit adds his hardware's sub{vendor,device} ids to
the quirk list for the intel8x0 driver.
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Following is a trivial patch to get more info for boards where
the AC97_VENDOR_ID2 register (or others) time out.
Signed-off-by: Jaya Kumar <jayakumar.alsa@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

First testing if a pointer is NULL and if it is (or might be), proceeding
with code that dereferences that same pointer is clearly a mistake.
This happens in sound/isa/sb/sb8_midi.c::snd_sb8dsp_midi_interrupt()
The patch below reworks the code so this unfortunate case doesn't happen.
Also remove some blank comments.
Found by the Coverity checker as bug #367
Patch is compile testted only due to lack of hardware.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Added IEC958 (SPDIF) output support to Thinkpad T/X/Z60 with
AD1981HD codec.  The spdif jack is on docking station.
Also, renamed 'IEC958 Playback Route' to 'IEC958 Playback Source'
to avoid the mixer name confliction with IEC958 switch.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch conditions AC97 control creation by whether or not the
codec is an AD18xx codec. This fixes the case where the default control
would get created and then snd_ac97_mixer_build fails out when creation
of ad18xx specific control would get attempted. This problem was found
and debuged by Marcelo Tosatti.
Signed-off-by: Jaya Kumar <jayakumar.alsa@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>

From: Remy Bruno <remy.bruno@trinnov.com>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>

Signed-off-by: James Courtier-Dutton <James@superbug.co.uk>

Replaced invalid __init with __devinit in snd-sbawe and snd-opl3sa2
drivers.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Fix printk format warning:
sound/pcmcia/vx/vxp_ops.c:205: warning: format '%x' expects type 'unsigned int', but argument 5 has type 'size_t'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Removed a bogus check of mmap_count in snd_pcm_release().
This is no longer true for the shared streams.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Call ioremap before request_irq for avoiding possible races
in the irq handler.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The last patch that tried to remove zero initializations of static
variables accidentally removed a not-quite-zero initialization too.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>

Added a model entry for HP nx6320 with AD1981HD codec.
It wasn't covered by the generic HP entry because of a hardware
bug (the SSID is reversed).
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Added Thinkpad T41p to the blacklist to disable HP/line jack-sensing
with AD1981B.  The jack-sensing is just harmful on this laptop.
Signed-off-by: Takashi Iwai <tiwai@suse.de>