Skip to content
Commits on Apr 25, 2010
  1. @torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      ipv6: Fix inet6_csk_bind_conflict()
      e100: Fix the TX workqueue race
    torvalds committed Apr 25, 2010
  2. @davem330

    ipv6: Fix inet6_csk_bind_conflict()

    Commit fda48a0 (tcp: bind() fix when many ports are bound)
    introduced a bug on IPV6 part.
    We should not call ipv6_addr_any(inet6_rcv_saddr(sk2)) but
    ipv6_addr_any(inet6_rcv_saddr(sk)) because sk2 can be IPV4, while sk is
    IPV6.
    
    Reported-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Tested-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Eric Dumazet committed with davem330 Apr 25, 2010
  3. @torvalds

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/tytso/ext4
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
      ext4: Issue the discard operation *before* releasing the blocks to be reused
      ext4: Fix buffer head leaks after calls to ext4_get_inode_loc()
      ext4: Fix possible lost inode write in no journal mode
    torvalds committed Apr 25, 2010
  4. @davem330

    e100: Fix the TX workqueue race

    Nothing stops the workqueue being left to run in parallel with close or a
    few other operations. This causes double unmaps and the like.
    
    See kerneloops.org #1041230 for an example
    
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Alan Cox committed with davem330 Apr 24, 2010
Commits on Apr 24, 2010
  1. @torvalds

    Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git…

    …/davej/cpufreq
    
    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
      [CPUFREQ] use max load in conservative governor
      [CPUFREQ] fix a lockdep warning
    torvalds committed Apr 24, 2010
  2. @torvalds

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits)
      gianfar: Fix potential oops during OF address translation
      fsl_pq_mdio: Fix kernel oops during OF address translation
      tcp: bind() fix when many ports are bound
      rdma: potential ERR_PTR dereference
      rtnetlink: potential ERR_PTR dereference
      net: ipv6 bind to device issue
      ipv6: allow to send packet after receiving ICMPv6 Too Big message with MTU field less than IPV6_MIN_MTU
      drivers/net/usb: Add new driver ipheth
      cxgb3: fix linkup issue
      X25 fix dead unaccepted sockets
      KS8851: NULL pointer dereference if list is empty
      net: 3c574_cs fix stats.tx_bytes counter
      xfrm6: ensure to use the same dev when building a bundle
      can: Fix possible NULL pointer dereference in ems_usb.c
      net: Fix an RCU warning in dev_pick_tx()
      ipv6: Fix tcp_v6_send_response transport header setting.
      bridge: add a missing ntohs()
      8139too: Fix a typo in the function name.
      mac80211: pass HT changes to driver when off channel
      mac80211: remove bogus TX agg state assignment
      ...
    torvalds committed Apr 24, 2010
  3. @torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      PCI: Ensure we re-enable devices on resume
      x86/PCI: parse additional host bridge window resource types
      PCI: revert broken device warning
      PCI aerdrv: use correct bit defines and add 2ms delay to aer_root_reset
      x86/PCI: ignore Consumer/Producer bit in ACPI window descriptions
    torvalds committed Apr 24, 2010
  4. @torvalds

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/mjg59/platform-drivers-x86
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86:
      eeepc-laptop: add missing sparse_keymap_free
      eeepc-wmi: Build fix
      asus: don't modify bluetooth/wlan on boot
      dell-wmi: Fix memory leak
      eeepc-wmi: add backlight support
      eeepc-wmi: use a platform device as parent device of all sub-devices
      eeepc-wmi: add an eeepc_wmi context structure
    torvalds committed Apr 24, 2010
  5. @plougher @torvalds

    initramfs: handle unrecognised decompressor when unpacking

    The unpack routine fails to handle the decompress_method() returning
    unrecognised decompressor (compress_name == NULL).  This results in the
    routine looping eventually oopsing on an out of bounds memory access.
    
    Note this bug is usually hidden, only triggering on trailing junk after
    one or more correct compressed blocks.  The case of the compressed archive
    being complete junk is (by accident?) caught by the if (state != Reset)
    check because state is initialised to Start, but not updated due to the
    decompressor not having been called.  Obviously if the junk is trailing a
    correctly decompressed buffer, state == Reset from the previous call to
    the decompressor.
    
    Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
    Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    plougher committed with torvalds Apr 23, 2010
  6. @error27 @torvalds

    ksm: check for ERR_PTR from follow_page()

    The follow_page() function can potentially return -EFAULT so I added
    checks for this.
    
    Also I silenced an uninitialized variable warning on my version of gcc
    (version 4.3.2).
    
    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Acked-by: Rik van Riel <riel@redhat.com>
    Acked-by: Izik Eidus <ieidus@redhat.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    error27 committed with torvalds Apr 23, 2010
  7. @torvalds

    VMware Balloon driver

    This is a standalone version of VMware Balloon driver.  Ballooning is a
    technique that allows hypervisor dynamically limit the amount of memory
    available to the guest (with guest cooperation).  In the overcommit
    scenario, when hypervisor set detects that it needs to shuffle some
    memory, it instructs the driver to allocate certain number of pages, and
    the underlying memory gets returned to the hypervisor.  Later hypervisor
    may return memory to the guest by reattaching memory to the pageframes and
    instructing the driver to "deflate" balloon.
    
    We are submitting a standalone driver because KVM maintainer (Avi Kivity)
    expressed opinion (rightly) that our transport does not fit well into
    virtqueue paradigm and thus it does not make much sense to integrate with
    virtio.
    
    There were also some concerns whether current ballooning technique is the
    right thing.  If there appears a better framework to achieve this we are
    prepared to evaluate and switch to using it, but in the meantime we'd like
    to get this driver upstream.
    
    We want to get the driver accepted in distributions so that users do not
    have to deal with an out-of-tree module and many distributions have
    "upstream first" requirement.
    
    The driver has been shipping for a number of years and users running on
    VMware platform will have it installed as part of VMware Tools even if it
    will not come from a distribution, thus there should not be additional
    risk in pulling the driver into mainline.  The driver will only activate
    if host is VMware so everyone else should not be affected at all.
    
    Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
    Cc: Avi Kivity <avi@redhat.com>
    Cc: Jeremy Fitzhardinge <jeremy@goop.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Dmitry Torokhov committed with torvalds Apr 23, 2010
  8. @antonblanchard @torvalds

    fs/block_dev.c: fix performance regression in O_DIRECT|O_SYNC writes …

    …to block devices
    
    We are seeing a large regression in database performance on recent
    kernels.  The database opens a block device with O_DIRECT|O_SYNC and a
    number of threads write to different regions of the file at the same time.
    
    A simple test case is below.  I haven't defined DEVICE since getting it
    wrong will destroy your data :) On an 3 disk LVM with a 64k chunk size we
    see about 17MB/sec and only a few threads in IO wait:
    
    procs  -----io---- -system-- -----cpu------
     r  b     bi    bo   in   cs us sy id wa st
     0  3      0 16170  656 2259  0  0 86 14  0
     0  2      0 16704  695 2408  0  0 92  8  0
     0  2      0 17308  744 2653  0  0 86 14  0
     0  2      0 17933  759 2777  0  0 89 10  0
    
    Most threads are blocking in vfs_fsync_range, which has:
    
            mutex_lock(&mapping->host->i_mutex);
            err = fop->fsync(file, dentry, datasync);
            if (!ret)
                    ret = err;
            mutex_unlock(&mapping->host->i_mutex);
    
    commit 148f948 (vfs: Introduce new
    helpers for syncing after writing to O_SYNC file or IS_SYNC inode) offers
    some explanation of what is going on:
    
        Use these new helpers for syncing from generic VFS functions. This makes
        O_SYNC writes to block devices acquire i_mutex for syncing. If we really
        care about this, we can make block_fsync() drop the i_mutex and reacquire
        it before it returns.
    
    Thanks Jan for such a good commit message!  As well as dropping i_mutex,
    Christoph suggests we should remove the call to sync_blockdev():
    
    > sync_blockdev is an overcomplicated alias for filemap_write_and_wait on
    > the block device inode, which is exactly what we did just before calling
    > into ->fsync
    
    The patch below incorporates both suggestions. With it the testcase improves
    from 17MB/s to 68M/sec:
    
    procs  -----io---- -system-- -----cpu------
     r  b     bi    bo   in   cs us sy id wa st
     0  7      0 65536 1000 3878  0  0 70 30  0
     0 34      0 69632 1016 3921  0  1 46 53  0
     0 57      0 69632 1000 3921  0  0 55 45  0
     0 53      0 69640  754 4111  0  0 81 19  0
    
    Testcase:
    
    #define _GNU_SOURCE
    #include <stdio.h>
    #include <pthread.h>
    #include <unistd.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>
    
    #define NR_THREADS 64
    #define BUFSIZE (64 * 1024)
    
    #define DEVICE "/dev/mapper/XXXXXX"
    
    #define ALIGN(VAL, SIZE) (((VAL)+(SIZE)-1) & ~((SIZE)-1))
    
    static int fd;
    
    static void *doit(void *arg)
    {
    	unsigned long offset = (long)arg;
    	char *b, *buf;
    
    	b = malloc(BUFSIZE + 1024);
    	buf = (char *)ALIGN((unsigned long)b, 1024);
    	memset(buf, 0, BUFSIZE);
    
    	while (1)
    		pwrite(fd, buf, BUFSIZE, offset);
    }
    
    int main(int argc, char *argv[])
    {
    	int flags = O_RDWR|O_DIRECT;
    	int i;
    	unsigned long offset = 0;
    
    	if (argc > 1 && !strcmp(argv[1], "O_SYNC"))
    		flags |= O_SYNC;
    
    	fd = open(DEVICE, flags);
    	if (fd == -1) {
    		perror("open");
    		exit(1);
    	}
    
    	for (i = 0; i < NR_THREADS-1; i++) {
    		pthread_t tid;
    		pthread_create(&tid, NULL, doit, (void *)offset);
    		offset += BUFSIZE;
    	}
    	doit((void *)offset);
    
    	return 0;
    }
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Acked-by: Jan Kara <jack@suse.cz>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    antonblanchard committed with torvalds Apr 23, 2010
  9. @torvalds

    lib/vsprintf.c: add missing EXPORT_SYMBOL(simple_strtoll)

    Add a missing EXPORT_SYMBOL.
    
    I must be the first person that wants to use this function :-)
    
    Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Hans Verkuil committed with torvalds Apr 23, 2010
  10. @torvalds

    w1: fix omap 1-wire driver compilation

    Fixes the following error:
    
      drivers/w1/masters/omap_hdq.c: In function 'hdq_wait_for_flag':
      drivers/w1/masters/omap_hdq.c:137: error: implicit declaration of function 'schedule_timeout_uninterruptible'
      drivers/w1/masters/omap_hdq.c: In function 'hdq_write_byte':
      drivers/w1/masters/omap_hdq.c:177: error: 'TASK_UNINTERRUPTIBLE' undeclared (first use in this function)
      drivers/w1/masters/omap_hdq.c:177: error: (Each undeclared identifier is reported only once
      drivers/w1/masters/omap_hdq.c:177: error: for each function it appears in.)
      drivers/w1/masters/omap_hdq.c:177: error: implicit declaration of function 'schedule_timeout'
      drivers/w1/masters/omap_hdq.c: In function 'hdq_isr':
      drivers/w1/masters/omap_hdq.c:221: error: 'TASK_NORMAL' undeclared (first use in this function)
      drivers/w1/masters/omap_hdq.c: In function 'omap_hdq_break':
      drivers/w1/masters/omap_hdq.c:316: error: 'TASK_UNINTERRUPTIBLE' undeclared (first use in this function)
    
    Signed-off-by: Amit Kucheria <amit.kucheria@canonical.com>
    Acked-by: Tony Lindgren <tony@atomide.com>
    Cc: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Amit Kucheria committed with torvalds Apr 23, 2010
  11. @utrace @torvalds

    rmap: anon_vma_prepare() can leak anon_vma_chain

    If find_mergeable_anon_vma() succeeds but another thread installs
    ->anon_vma before we take ptl, then allocated == NULL but avc should be
    freed.  Change the code to check avc != NULL to detect this case.
    
    Also, a couple of whitespace changes to make the critical section more
    visible.
    
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
    Cc: Pete Zaitcev <zaitcev@redhat.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    utrace committed with torvalds Apr 23, 2010
  12. @torvalds

    keys: fix an RCU warning

    Fix the following RCU warning:
    
      ===================================================
      [ INFO: suspicious rcu_dereference_check() usage. ]
      ---------------------------------------------------
      security/keys/request_key.c:116 invoked rcu_dereference_check() without protection!
    
    This was caused by doing:
    
    	[root@andromeda ~]# keyctl newring fred @s
    	539196288
    	[root@andromeda ~]# keyctl request2 user a a 539196288
    	request_key: Required key not available
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    David Howells committed with torvalds Apr 23, 2010
  13. @torvalds

    lib: fix the use of LZO to decompress initramfs images

    This patch fixes 2 issues with the LZO decompressor:
    
    - It doesn't handle the case where a block isn't compressed at all.  In
      this case, calling lzo1x_decompress_safe will fail, so we need to just
      use memcpy() instead (the upstream LZO code does something similar)
    
    - Since commit 5429136 ("initramfs: add
      missing decompressor error check") , the decompressor return code is
      checked in the init/initramfs.c The LZO decompressor didn't return the
      expected value, causing the initramfs code to falsely believe a
      decompression error occured
    
    Signed-off-by: Albin Tonnerre <albin.tonnerre@free-electrons.com>
    Tested-by: bert schulze <spambemyguest@googlemail.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Albin Tonnerre committed with torvalds Apr 23, 2010
  14. @gormanm @torvalds

    hugetlb: fix infinite loop in get_futex_key() when backed by huge pages

    If a futex key happens to be located within a huge page mapped
    MAP_PRIVATE, get_futex_key() can go into an infinite loop waiting for a
    page->mapping that will never exist.
    
    See https://bugzilla.redhat.com/show_bug.cgi?id=552257 for more details
    about the problem.
    
    This patch makes page->mapping a poisoned value that includes
    PAGE_MAPPING_ANON mapped MAP_PRIVATE.  This is enough for futex to
    continue but because of PAGE_MAPPING_ANON, the poisoned value is not
    dereferenced or used by futex.  No other part of the VM should be
    dereferencing the page->mapping of a hugetlbfs page as its page cache is
    not on the LRU.
    
    This patch fixes the problem with the test case described in the bugzilla.
    
    [akpm@linux-foundation.org: mel cant spel]
    Signed-off-by: Mel Gorman <mel@csn.ul.ie>
    Acked-by: Peter Zijlstra <peterz@infradead.org>
    Acked-by: Darren Hart <darren@dvhart.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    gormanm committed with torvalds Apr 23, 2010
  15. @iandall @torvalds

    w1: w1 temp: fix negative termperature calculation

    Fix regression caused by commit 507e2fb
    ("w1: w1 temp calculation overflow fix") whereby negative temperatures for
    the DS18B20 are not converted properly.
    
    When the temperature exceeds 32767 milli-degrees the temperature overflows
    to -32768 millidegrees.  These are both well within the -55 - +125 degree
    range for the sensor.
    
    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=12646
    
    Signed-of-by: Ian Dall <ian@beware.dropbear.id.au>
    Cc: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
    Tested-by: Karsten Elfenbein <kelfe@gmx.de>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    iandall committed with torvalds Apr 23, 2010
  16. @hkamezawa @torvalds

    cgroups: fix procs documentation

    Writing to cgroup.procs is not supported now.
    
    Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Acked-by: Li Zefan <lizf@cn.fujitsu.com>
    Cc: Ben Blum <bblum@andrew.cmu.edu>
    Cc: Paul Menage <menage@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    hkamezawa committed with torvalds Apr 23, 2010
  17. @celphis @torvalds

    drivers/video/efifb.c: support framebuffer for NVIDIA 9400M in MacBoo…

    …k Pro 5,1
    
    Description of patch:
    ---------------------
    
    This is a patch for the EFI framebuffer driver to enable the framebuffer
    of the NVIDIA 9400M as found in MacBook Pro (MBP) 5,1 and up.  The
    framebuffer of the NVIDIA graphic cards are located at the following
    addresses in memory:
    
    9400M:    0xC0010000
    9600M GT: 0xB0030000
    
    The patch delivered right here only provides the memory location of the
    framebuffer of the 9400M device.  The 9600M GT is not covered.  It is
    assumed that the 9400M is used when powered up the MBP.
    
    The information which device is currently powered and in use is stored in
    the 64 bytes large EFI variable "gpu-power-prefs".  More specifically,
    byte 0x3B indicates whether 9600M GT (0x00) or 9400M (0x01) is online.
    
    The PCI bus IDs are the following:
    9400M:    PCI 03:00:00
    9600M GT: PCI 02:00:00
    
    The EFI variables can be easily read-out and manipulated with "rEFIt", an
    MBP specific bootloader tool.  For more information on how handle rEFIt
    and EFI variables please consult "http://refit.sourceforge.net" and
    "http://ubuntuforums.org/archive/index.php/t-1076879.html".
    
    IMPORTANT NOTE: The information on how to activate the 9400M device given
    at "ubuntuforums.org" is not correct, since it states
    
    gpu-power-prefs[0x3B] = 0x00 -> 9400M (PCI 02:00:00)
    gpu-power-prefs[0x3B] = 0x01 -> 9600M GT (PCI 03:00:00)
    
    Actually, the assignment of the values and the PCI bus IDs are swapped.
    
    Suggestions:
    ------------
    
    To cover framebuffers of both 9400M and 9600M GT, I would suggest to
    implement a conditional on "gpu-power-prefs".  Depending on the value of
    byte 0x3B, the according framebuffer is selected.  However, this requires
    kernel access to the EFI variables.
    
    [akpm@linux-foundation.org: rename optname, per Peter Jones]
    Signed-off-by: Thomas Gerlach <t.m.gerlach@freenet.de>
    Acked-by: Peter Jones <pjones@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    celphis committed with torvalds Apr 23, 2010
  18. @tiwai @torvalds

    lis3: add support for HP ProBook 432x/442x/452x/522x

    Correct axis-mappings for new HP ProBook laptops.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Acked-by: Eric Piel <eric.piel@tremplin-utc.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    tiwai committed with torvalds Apr 23, 2010
  19. @pauliuszaleckas @torvalds

    mtd: fix Orion NAND driver compilation with ARM OABI

    We must tell GCC to use even register for variable passed to ldrd
    instruction.  Without this patch GCC 4.2.1 puts this variable to r2/r3 on
    EABI and r3/r4 on OABI, so force it to r2/r3.  This does not change
    anything when EABI and OABI compilation works OK.
    
    Without this patch and with OABI I get:
    
        CC      drivers/mtd/nand/orion_nand.o
      /tmp/ccMkwOCs.s: Assembler messages:
      /tmp/ccMkwOCs.s:63: Error: first destination register must be even -- `ldrd r3,[ip]'
      make[5]: *** [drivers/mtd/nand/orion_nand.o] Error 1
    
    Signed-off-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
    Acked-by: Nicolas Pitre <nico@fluxnic.net>
    Acked-by: Artem Bityutskiy <dedekind1@gmail.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Jamie Lokier <jamie@shareable.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    pauliuszaleckas committed with torvalds Apr 23, 2010
  20. @xiaosuo @torvalds

    flex_array: fix the panic when calling flex_array_alloc() without __G…

    …FP_ZERO
    
    memset() is called with the wrong address and the kernel panics.
    
    Signed-off-by: Changli Gao <xiaosuo@gmail.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Acked-by: David Rientjes <rientjes@google.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    xiaosuo committed with torvalds Apr 23, 2010
  21. @andreas-schwab @torvalds

    kernel/sys.c: fix compat uname machine

    On ppc64 you get this error:
    
      $ setarch ppc -R true
      setarch: ppc: Unrecognized architecture
    
    because uname still reports ppc64 as the machine.
    
    So mask off the personality flags when checking for PER_LINUX32.
    
    Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Acked-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    andreas-schwab committed with torvalds Apr 23, 2010
  22. @jeffmahoney @torvalds

    reiserfs: fix corruption during shrinking of xattrs

    Commit 48b32a3 ("reiserfs: use generic
    xattr handlers") introduced a problem that causes corruption when extended
    attributes are replaced with a smaller value.
    
    The issue is that the reiserfs_setattr to shrink the xattr file was moved
    from before the write to after the write.
    
    The root issue has always been in the reiserfs xattr code, but was papered
    over by the fact that in the shrink case, the file would just be expanded
    again while the xattr was written.
    
    The end result is that the last 8 bytes of xattr data are lost.
    
    This patch fixes it to use new_size.
    
    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=14826
    
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Reported-by: Christian Kujau <lists@nerdbynature.de>
    Tested-by: Christian Kujau <lists@nerdbynature.de>
    Cc: Edward Shishkin <edward.shishkin@gmail.com>
    Cc: Jethro Beekman <kernel@jbeekman.nl>
    Cc: Greg Surbey <gregsurbey@hotmail.com>
    Cc: Marco Gatti <marco.gatti@gmail.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    jeffmahoney committed with torvalds Apr 23, 2010
  23. @torvalds

    memcg: fix prepare migration

    If a signal is pending (task being killed by sigkill)
    __mem_cgroup_try_charge will write NULL into &mem, and css_put will oops
    on null pointer dereference.
    
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
      IP: [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0
      PGD a5d89067 PUD a5d8a067 PMD 0
      Oops: 0000 [#1] SMP
      last sysfs file: /sys/devices/platform/microcode/firmware/microcode/loading
      CPU 0
      Modules linked in: nfs lockd nfs_acl auth_rpcgss sunrpc acpi_cpufreq pcspkr sg [last unloaded: microcode]
    
      Pid: 5299, comm: largepages Tainted: G        W  2.6.34-rc3 #3 Penryn1600SLI-110dB/To Be Filled By O.E.M.
      RIP: 0010:[<ffffffff810fc6cc>]  [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0
    
    [nishimura@mxp.nes.nec.co.jp: fix merge issues]
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Balbir Singh <balbir@in.ibm.com>
    Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Andrea Arcangeli committed with torvalds Apr 23, 2010
  24. @jeffmahoney @torvalds

    reiserfs: fix permissions on .reiserfs_priv

    Commit 677c9b2 ("reiserfs: remove
    privroot hiding in lookup") removed the magic from the lookup code to hide
    the .reiserfs_priv directory since it was getting loaded at mount-time
    instead.  The intent was that the entry would be hidden from the user via
    a poisoned d_compare, but this was faulty.
    
    This introduced a security issue where unprivileged users could access and
    modify extended attributes or ACLs belonging to other users, including
    root.
    
    This patch resolves the issue by properly hiding .reiserfs_priv.  This was
    the intent of the xattr poisoning code, but it appears to have never
    worked as expected.  This is fixed by using d_revalidate instead of
    d_compare.
    
    This patch makes -oexpose_privroot a no-op.  I'm fine leaving it this way.
    The effort involved in working out the corner cases wrt permissions and
    caching outweigh the benefit of the feature.
    
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Acked-by: Edward Shishkin <edward.shishkin@gmail.com>
    Reported-by: Matt McCutchen <matt@mattmccutchen.net>
    Tested-by: Matt McCutchen <matt@mattmccutchen.net>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    jeffmahoney committed with torvalds Apr 23, 2010
Commits on Apr 23, 2010
  1. @davem330

    gianfar: Fix potential oops during OF address translation

    gianfar driver may pass NULL pointer to the of_translate_address(),
    which may lead to a kernel oops. Fix this by using of_iomap(), which
    is also much simpler and shorter.
    
    Signed-off-by: Anton Vorontsov <avorontsov@mvista.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Anton Vorontsov committed with davem330 Apr 23, 2010
  2. @davem330

    fsl_pq_mdio: Fix kernel oops during OF address translation

    Old P1020RDB device trees were not specifing tbipa address for
    MDIO nodes, which is now causing this kernel oops:
    
     ...
     eth2: TX BD ring size for Q[6]: 256
     eth2: TX BD ring size for Q[7]: 256
     Unable to handle kernel paging request for data at address 0x00000000
     Faulting instruction address: 0xc0015504
     Oops: Kernel access of bad area, sig: 11 [#1]
     ...
     NIP [c0015504] memcpy+0x3c/0x9c
     LR [c000a9f8] __of_translate_address+0xfc/0x21c
     Call Trace:
     [df839e00] [c000a94c] __of_translate_address+0x50/0x21c (unreliable)
     [df839e50] [c01a33e8] get_gfar_tbipa+0xb0/0xe0
     ...
    
    The old device trees are buggy, though having a dead ethernet is
    better than a dead kernel, so fix the issue by using of_iomap().
    
    Also, a somewhat similar issue exist in the probe() routine, though
    there the oops is only a possibility. Nonetheless, fix it too.
    
    Signed-off-by: Anton Vorontsov <avorontsov@mvista.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Anton Vorontsov committed with davem330 Apr 23, 2010
  3. @iksaif

    eeepc-laptop: add missing sparse_keymap_free

    Also remove legacy keymap which was not used since
    we use sparse_keymap.
    
    Signed-off-by: Corentin Chary <corentincj@iksaif.net>
    iksaif committed with Matthew Garrett Apr 10, 2010
  4. @torvalds

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    …/git/tiwai/sound-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio 1558
      ALSA: hda: Use LPIB quirk for DG965OT board version AAD63733-203
      ALSA: snd-meastro3: Ignore spurious HV interrupts during suspend / resume
      ALSA: snd-meastro3: Add amp_gpio quirk for Compaq EVO N600C
      ALSA: hda: Use ALC880_F1734 quirk for Fujitsu Siemens AMILO Xi 1526
      ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio XPS 1645
      ALSA: hda - Fix resume from StR of HP 2510p with docking-station
    torvalds committed Apr 23, 2010
  5. @torvalds

    Cleanup generic block based fiemap

    This cleans up a few of the complaints of __generic_block_fiemap.  I've
    fixed all the typing stuff, used inline functions instead of macros,
    gotten rid of a couple of variables, and made sure the size and block
    requests are all block aligned.  It also fixes a problem where sometimes
    FIEMAP_EXTENT_LAST wasn't being set properly.
    
    Signed-off-by: Josef Bacik <josef@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Josef Bacik committed with torvalds Apr 23, 2010
  6. @jbarnes993 @torvalds

    drm/i915: fix non-Ironlake 965 class crashes

    My PIPE_CONTROL fix (just sent via Eric's tree) was buggy; I was
    testing a whole set of patches together and missed a conversion to the
    new HAS_PIPE_CONTROL macro, which will cause breakage on non-Ironlake
    965 class chips.  Fortunately, the fix is trivial and has been tested.
    
    Be sure to use the HAS_PIPE_CONTROL macro in i915_get_gem_seqno, or
    we'll end up reading the wrong graphics memory, likely causing hangs,
    crashes, or worse.
    
    Reported-by: Zdenek Kabelac <zdenek.kabelac@gmail.com>
    Reported-by: Toralf Förster <toralf.foerster@gmx.de>
    Tested-by: Toralf Förster <toralf.foerster@gmx.de>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    jbarnes993 committed with torvalds Apr 23, 2010
  7. @tiwai
Something went wrong with that request. Please try again.