Skip to content
Commits on May 16, 2010
  1. @torvalds

    Linus 2.6.34

    torvalds committed May 16, 2010
  2. @torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      rtnetlink: make SR-IOV VF interface symmetric
      sctp: delete active ICMP proto unreachable timer when free transport
      tcp: fix MD5 (RFC2385) support
    torvalds committed May 16, 2010
  3. @torvalds

    Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-…

    …linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      MIPS: Oprofile: Fix Loongson irq handler
      MIPS: N32: Use compat version for sys_ppoll.
      MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1
    torvalds committed May 16, 2010
  4. @chriswright @davem330

    rtnetlink: make SR-IOV VF interface symmetric

    Now we have a set of nested attributes:
    
      IFLA_VFINFO_LIST (NESTED)
        IFLA_VF_INFO (NESTED)
          IFLA_VF_MAC
          IFLA_VF_VLAN
          IFLA_VF_TX_RATE
    
    This allows a single set to operate on multiple attributes if desired.
    Among other things, it means a dump can be replayed to set state.
    
    The current interface has yet to be released, so this seems like
    something to consider for 2.6.34.
    
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    chriswright committed with davem330 May 16, 2010
  5. @davem330

    sctp: delete active ICMP proto unreachable timer when free transport

    transport may be free before ICMP proto unreachable timer expire, so
    we should delete active ICMP proto unreachable timer when transport
    is going away.
    
    Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
    Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Wei Yongjun committed with davem330 May 9, 2010
  6. @davem330

    tcp: fix MD5 (RFC2385) support

    TCP MD5 support uses percpu data for temporary storage. It currently
    disables preemption so that same storage cannot be reclaimed by another
    thread on same cpu.
    
    We also have to make sure a softirq handler wont try to use also same
    context. Various bug reports demonstrated corruptions.
    
    Fix is to disable preemption and BH.
    
    Reported-by: Bhaskar Dutta <bhaskie@gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Eric Dumazet committed with davem330 May 16, 2010
Commits on May 15, 2010
  1. @lzufalcon @ralfbaechle

    MIPS: Oprofile: Fix Loongson irq handler

        
        The interrupt enable bit for the performance counters is in the Control
        Register $24, not in the counter register.
        loongson2_perfcount_handler(), we need to use
        
        Reported-by: Xu Hengyang <hengyang@mail.ustc.edu.cn>
        Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
        Cc: linux-mips@linux-mips.org
        Patchwork: http://patchwork.linux-mips.org/patch/1198/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
    lzufalcon committed with ralfbaechle May 7, 2010
  2. @ralfbaechle

    MIPS: N32: Use compat version for sys_ppoll.

        
        The sys_ppoll() takes struct 'struct timespec'. This is different for the
        N32 and N64 ABIs. Use the compat version to do the proper conversions.
        
        Signed-off-by: David Daney <ddaney@caviumnetworks.com>
        To: linux-mips@linux-mips.org
        Patchwork: http://patchwork.linux-mips.org/patch/1210/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
    Chandrakala Chavva committed with ralfbaechle May 10, 2010
  3. @ralfbaechle

    MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1

        
        In the FPU emulator code of the MIPS, the Cause bits of the FCSR register
        are not currently writeable by the ctc1 instruction.  In odd corner cases,
        this can cause problems.  For example, a case existed where a divide-by-zero
        exception was generated by the FPU, and the signal handler attempted to
        restore the FPU registers to their state before the exception occurred.  In
        this particular setup, writing the old value to the FCSR register would
        cause another divide-by-zero exception to occur immediately.  The solution
        is to change the ctc1 instruction emulator code to allow the Cause bits of
        the FCSR register to be writeable.  This is the behaviour of the hardware
        that the code is emulating.
        
        This problem was found by Shane McDonald, but the credit for the fix goes
        to Kevin Kissell.  In Kevin's words:
        
        I submit that the bug is indeed in that ctc_op:  case of the emulator.  The
        Cause bits (17:12) are supposed to be writable by that instruction, but the
        CTC1 emulation won't let them be updated by the instruction.  I think that
        actually if you just completely removed lines 387-388 [...] things would
        work a good deal better.  At least, it would be a more accurate emulation of
        the architecturally defined FPU.  If I wanted to be really, really pedantic
        (which I sometimes do), I'd also protect the reserved bits that aren't
        necessarily writable.
        
        Signed-off-by: Shane McDonald <mcdonald.shane@gmail.com>
        To: anemo@mba.ocn.ne.jp
        To: kevink@paralogos.com
        To: sshtylyov@mvista.com
        Patchwork: http://patchwork.linux-mips.org/patch/1205/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
    Shane McDonald committed with ralfbaechle May 6, 2010
  4. @torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable

    * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
      Btrfs: check for read permission on src file in the clone ioctl
    torvalds committed May 15, 2010
  5. @dkirjanov @torvalds

    lib/btree: fix possible NULL pointer dereference

    mempool_alloc() can return null in atomic case.
    
    Signed-off-by: Denis Kirjanov <kirjanov@gmail.com>
    Cc: Joern Engel <joern@logfs.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    dkirjanov committed with torvalds May 15, 2010
  6. @noglitch @torvalds

    mmc: at91_mci: modify cache flush routines

    As we were using an internal dma flushing routine, this patch changes to
    the DMA API flush_kernel_dcache_page().  Driver is able to compile now.
    
    [akpm@linux-foundation.org: flush_kernel_dcache_page() comes before kunmap_atomic()]
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    noglitch committed with torvalds May 15, 2010
  7. @djrbliss @chrismason-xx

    Btrfs: check for read permission on src file in the clone ioctl

    The existing code would have allowed you to clone a file that was
    only open for writing
    
    Signed-off-by: Chris Mason <chris.mason@oracle.com>
    djrbliss committed with chrismason-xx May 15, 2010
  8. @torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/viro/vfs-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
      JFS: Free sbi memory in error path
      fs/sysv: dereferencing ERR_PTR()
      Fix double-free in logfs
      Fix the regression created by "set S_DEAD on unlink()..." commit
    torvalds committed May 15, 2010
  9. @torvalds

    Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/l…

    …inux/kernel/git/tip/linux-2.6-tip
    
    * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf record: Add a fallback to the reference relocation symbol
    torvalds committed May 15, 2010
  10. JFS: Free sbi memory in error path

    I spotted the missing kfree() while removing the BKL.
    
    [akpm@linux-foundation.org: avoid multiple returns so it doesn't happen again]
    Signed-off-by: Jan Blunck <jblunck@suse.de>
    Cc: Dave Kleikamp <shaggy@austin.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Jan Blunck committed with Al Viro Apr 12, 2010
  11. @error27

    fs/sysv: dereferencing ERR_PTR()

    I moved the dir_put_page() inside the if condition so we don't dereference
    "page", if it's an ERR_PTR().
    
    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    error27 committed with Al Viro Apr 21, 2010
  12. Fix double-free in logfs

    iput() is needed *until* we'd done successful d_alloc_root()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Al Viro committed Apr 28, 2010
  13. Fix the regression created by "set S_DEAD on unlink()..." commit

    1) i_flags simply doesn't work for mount/unlink race prevention;
    we may have many links to file and rm on one of those obviously
    shouldn't prevent bind on top of another later on.  To fix it
    right way we need to mark _dentry_ as unsuitable for mounting
    upon; new flag (DCACHE_CANT_MOUNT) is protected by d_flags and
    i_mutex on the inode in question.  Set it (with dont_mount(dentry))
    in unlink/rmdir/etc., check (with cant_mount(dentry)) in places
    in namespace.c that used to check for S_DEAD.  Setting S_DEAD
    is still needed in places where we used to set it (for directories
    getting killed), since we rely on it for readdir/rmdir race
    prevention.
    
    2) rename()/mount() protection has another bogosity - we unhash
    the target before we'd checked that it's not a mountpoint.  Fixed.
    
    3) ancient bogosity in pivot_root() - we locked i_mutex on the
    right directory, but checked S_DEAD on the different (and wrong)
    one.  Noticed and fixed.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Al Viro committed Apr 30, 2010
  14. @torvalds

    Merge master.kernel.org:/home/rmk/linux-2.6-arm

    * master.kernel.org:/home/rmk/linux-2.6-arm:
      ARM: 6126/1: ARM mpcore_wdt: fix build failure and other fixes
      ARM: 6125/1: ARM TWD: move TWD registers to common header
      ARM: 6110/1: Fix Thumb-2 kernel builds when UACCESS_WITH_MEMCPY is enabled
      ARM: 6112/1: Use the Inner Shareable I-cache and BTB ops on ARMv7 SMP
      ARM: 6111/1: Implement read/write for ownership in the ARMv6 DMA cache ops
      ARM: 6106/1: Implement copy_to_user_page() for noMMU
      ARM: 6105/1: Fix the __arm_ioremap_caller() definition in nommu.c
    torvalds committed May 14, 2010
  15. @torvalds

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/li…

    …nux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86, mrst: Don't blindly access extended config space
    torvalds committed May 14, 2010
  16. @torvalds

    profile: fix stats and data leakage

    If the kernel is large or the profiling step small, /proc/profile
    leaks data and readprofile shows silly stats, until readprofile -r
    has reset the buffer: clear the prof_buffer when it is vmalloc()ed.
    
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: stable@kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Hugh Dickins committed with torvalds May 14, 2010
  17. @torvalds

    hughd: update email address

    My old address will shut down in a couple of weeks: update the tree.
    
    Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Hugh Dickins committed with torvalds May 14, 2010
Commits on May 14, 2010
  1. x86, mrst: Don't blindly access extended config space

    Do not blindly access extended configuration space unless we actively
    know we're on a Moorestown platform.  The fixed-size BAR capability
    lives in the extended configuration space, and thus is not applicable
    if the configuration space isn't appropriately sized.
    
    This fixes booting certain VMware configurations with CONFIG_MRST=y.
    
    Moorestown will add a fake PCI-X 266 capability to advertise the
    presence of extended configuration space.
    
    Reported-and-tested-by: Petr Vandrovec <petr@vandrovec.name>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Acked-by: Jacob Pan <jacob.jun.pan@intel.com>
    Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    LKML-Reference: <AANLkTiltKUa3TrKR1M51eGw8FLNoQJSLT0k0_K5X3-OJ@mail.gmail.com>
    H. Peter Anvin committed May 14, 2010
  2. @torvalds

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/li…

    …nux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86, cacheinfo: Turn off L3 cache index disable feature in virtualized environments
      x86, k8: Fix build error when K8_NB is disabled
      x86, amd: Check X86_FEATURE_OSVW bit before accessing OSVW MSRs
      x86: Fix fake apicid to node mapping for numa emulation
    torvalds committed May 14, 2010
  3. x86, cacheinfo: Turn off L3 cache index disable feature in virtualize…

    …d environments
    
    When running a quest kernel on xen we get:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
    IP: [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df
    PGD 0
    Oops: 0000 [#1] SMP
    last sysfs file:
    CPU 0
    Modules linked in:
    
    Pid: 0, comm: swapper Tainted: G        W  2.6.34-rc3 #1 /HVM domU
    RIP: 0010:[<ffffffff8142f2fb>]  [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x
    2ca/0x3df
    RSP: 0018:ffff880002203e08  EFLAGS: 00010046
    RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000060
    RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000
    RBP: ffff880002203ed8 R08: 00000000000017c0 R09: ffff880002203e38
    R10: ffff8800023d5d40 R11: ffffffff81a01e28 R12: ffff880187e6f5c0
    R13: ffff880002203e34 R14: ffff880002203e58 R15: ffff880002203e68
    FS:  0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000038 CR3: 0000000001a3c000 CR4: 00000000000006f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process swapper (pid: 0, threadinfo ffffffff81a00000, task ffffffff81a44020)
    Stack:
     ffffffff810d7ecb ffff880002203e20 ffffffff81059140 ffff880002203e30
    <0> ffffffff810d7ec9 0000000002203e40 000000000050d140 ffff880002203e70
    <0> 0000000002008140 0000000000000086 ffff880040020140 ffffffff81068b8b
    Call Trace:
     <IRQ>
     [<ffffffff810d7ecb>] ? sync_supers_timer_fn+0x0/0x1c
     [<ffffffff81059140>] ? mod_timer+0x23/0x25
     [<ffffffff810d7ec9>] ? arm_supers_timer+0x34/0x36
     [<ffffffff81068b8b>] ? hrtimer_get_next_event+0xa7/0xc3
     [<ffffffff81058e85>] ? get_next_timer_interrupt+0x19a/0x20d
     [<ffffffff8142fa23>] get_cpu_leaves+0x5c/0x232
     [<ffffffff8106a7b1>] ? sched_clock_local+0x1c/0x82
     [<ffffffff8106a9a0>] ? sched_clock_tick+0x75/0x7a
     [<ffffffff8107748c>] generic_smp_call_function_single_interrupt+0xae/0xd0
     [<ffffffff8101f6ef>] smp_call_function_single_interrupt+0x18/0x27
     [<ffffffff8100a773>] call_function_single_interrupt+0x13/0x20
     <EOI>
     [<ffffffff8143c468>] ? notifier_call_chain+0x14/0x63
     [<ffffffff810295c6>] ? native_safe_halt+0xc/0xd
     [<ffffffff810114eb>] ? default_idle+0x36/0x53
     [<ffffffff81008c22>] cpu_idle+0xaa/0xe4
     [<ffffffff81423a9a>] rest_init+0x7e/0x80
     [<ffffffff81b10dd2>] start_kernel+0x40e/0x419
     [<ffffffff81b102c8>] x86_64_start_reservations+0xb3/0xb7
     [<ffffffff81b103c4>] x86_64_start_kernel+0xf8/0x107
    Code: 14 d5 40 ff ae 81 8b 14 02 31 c0 3b 15 47 1c 8b 00 7d 0e 48 8b 05 36 1c 8b
     00 48 63 d2 48 8b 04 d0 c7 85 5c ff ff ff 00 00 00 00 <8b> 70 38 48 8d 8d 5c ff
     ff ff 48 8b 78 10 ba c4 01 00 00 e8 eb
    RIP  [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df
     RSP <ffff880002203e08>
    CR2: 0000000000000038
    ---[ end trace a7919e7f17c0a726 ]---
    
    The L3 cache index disable feature of AMD CPUs has to be disabled if the
    kernel is running as guest on top of a hypervisor because northbridge
    devices are not available to the guest. Currently, this fixes a boot
    crash on top of Xen. In the future this will become an issue on KVM as
    well.
    
    Check if northbridge devices are present and do not enable the feature
    if there are none.
    
    [ hpa: backported to 2.6.34 ]
    
    Signed-off-by: Frank Arnold <frank.arnold@amd.com>
    LKML-Reference: <1271945222-5283-3-git-send-email-bp@amd64.org>
    Acked-by: Borislav Petkov <borislav.petkov@amd.com>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: <stable@kernel.org>
    Frank Arnold committed with H. Peter Anvin Apr 22, 2010
  4. x86, k8: Fix build error when K8_NB is disabled

    K8_NB depends on PCI and when the last is disabled (allnoconfig) we fail
    at the final linking stage due to missing exported num_k8_northbridges.
    Add a header stub for that.
    
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
    LKML-Reference: <20100503183036.GJ26107@aftab>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: <stable@kernel.org>
    Borislav Petkov committed with H. Peter Anvin Apr 24, 2010
  5. @torvalds

    Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify

    * 'for-linus' of git://git.infradead.org/users/eparis/notify:
      inotify: don't leak user struct on inotify release
      inotify: race use after free/double free in inotify inode marks
      inotify: clean up the inotify_add_watch out path
      Inotify: undefined reference to `anon_inode_getfd'
    
    Manual merge to remove duplicate "select ANON_INODES" from Kconfig file
    torvalds committed May 14, 2010
  6. @torvalds

    Merge branch 'davinci-fixes-for-linus-2' of git://git.kernel.org/pub/…

    …scm/linux/kernel/git/khilman/linux-davinci
    
    * 'davinci-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-davinci:
      DA830: fix USB 2.0 clock entry
    torvalds committed May 14, 2010
  7. DA830: fix USB 2.0 clock entry

    DA8xx OHCI driver fails to load due to failing clk_get() call for the USB 2.0
    clock. Arrange matching USB 2.0 clock by the clock name instead of the device.
    (Adding another CLK() entry for "ohci.0" device won't do -- in the future I'll
    also have to enable USB 2.0 clock to configure CPPI 4.1 module, in which case
    I won't have any device at all.)
    
    Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
    Sergei Shtylyov committed with Kevin Hilman May 13, 2010
  8. @xemul @eparis

    inotify: don't leak user struct on inotify release

    inotify_new_group() receives a get_uid-ed user_struct and saves the
    reference on group->inotify_data.user.  The problem is that free_uid() is
    never called on it.
    
    Issue seem to be introduced by 63c882a (inotify: reimplement inotify
    using fsnotify) after 2.6.30.
    
    Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
    Eric Paris <eparis@parisplace.org>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Eric Paris <eparis@redhat.com>
    xemul committed with eparis May 12, 2010
  9. @eparis

    inotify: race use after free/double free in inotify inode marks

    There is a race in the inotify add/rm watch code.  A task can find and
    remove a mark which doesn't have all of it's references.  This can
    result in a use after free/double free situation.
    
    Task A					Task B
    ------------				-----------
    inotify_new_watch()
     allocate a mark (refcnt == 1)
     add it to the idr
    					inotify_rm_watch()
    					 inotify_remove_from_idr()
    					  fsnotify_put_mark()
    					      refcnt hits 0, free
     take reference because we are on idr
     [at this point it is a use after free]
     [time goes on]
     refcnt may hit 0 again, double free
    
    The fix is to take the reference BEFORE the object can be found in the
    idr.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Cc: <stable@kernel.org>
    eparis committed May 11, 2010
  10. @eparis

    inotify: clean up the inotify_add_watch out path

    inotify_add_watch explictly frees the unused inode mark, but it can just
    use the generic code.  Just do that.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
    eparis committed May 11, 2010
  11. @torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      vhost: fix barrier pairing
    torvalds committed May 14, 2010
  12. @torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      mmap_min_addr check CAP_SYS_RAWIO only for write
    torvalds committed May 14, 2010
Something went wrong with that request. Please try again.