89.0.3.EL

.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:34:04 2011
+# Sun Jan 23 13:28:48 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

arch/i386/kernel/entry-xen.S

@@ -530,7 +530,9 @@ error_code:
 ENTRY(hypervisor_callback)
 	pushl %eax
 	SAVE_ALL
+	testb $2,CS(%esp)
 	movl EIP(%esp),%eax
+	jnz 11f
 	cmpl $scrit,%eax
 	jb   11f
 	cmpl $ecrit,%eax

configs/kernel-2.6.9-x86_64-largesmp.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:34:04 2011
+# Sun Jan 23 13:28:48 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64-smp.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:34:04 2011
+# Sun Jan 23 13:28:48 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64-xenU.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:34:04 2011
+# Sun Jan 23 13:28:48 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:34:04 2011
+# Sun Jan 23 13:28:48 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

drivers/char/agp/generic.c

@@ -945,6 +945,7 @@ void *agp_generic_alloc_page(void)
 	if (page == NULL)
 		return NULL;
 
+	clear_page(page_address(page));
 	map_page_into_agp(page);
 
 	get_page(page);

drivers/input/input.c

@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/input.h>
 #include <linux/module.h>
 #include <linux/random.h>
@@ -44,6 +45,7 @@ EXPORT_SYMBOL(input_class);
 
 #define INPUT_DEVICES	256
 
+DECLARE_MUTEX(input_mutex);	/* Protects input_{dev|handler}_list */
 static LIST_HEAD(input_dev_list);
 static LIST_HEAD(input_handler_list);
 
@@ -443,6 +445,8 @@ void input_register_device(struct input_dev *dev)
 		dev->rep[REP_PERIOD] = 33;
 	}
 
+	mutex_lock(&input_mutex);
+
 	INIT_LIST_HEAD(&dev->h_list);
 	list_add_tail(&dev->node, &input_dev_list);
 
@@ -452,6 +456,8 @@ void input_register_device(struct input_dev *dev)
 				if ((handle = handler->connect(handler, dev, id)))
 					input_link_handle(handle);
 
+	mutex_unlock(&input_mutex);
+
 #ifdef CONFIG_HOTPLUG
 	input_call_hotplug("add", dev);
 #endif
@@ -473,6 +479,7 @@ void input_unregister_device(struct input_dev *dev)
 
 	del_timer_sync(&dev->timer);
 
+	mutex_lock(&input_mutex);
 	list_for_each_safe(node, next, &dev->h_list) {
 		struct input_handle * handle = to_handle(node);
 		list_del_init(&handle->d_node);
@@ -481,11 +488,15 @@ void input_unregister_device(struct input_dev *dev)
 	}
 
 #ifdef CONFIG_HOTPLUG
+	mutex_unlock(&input_mutex);
 	input_call_hotplug("remove", dev);
+	mutex_lock(&input_mutex);
 #endif
 
 	list_del_init(&dev->node);
 
+	mutex_unlock(&input_mutex);
+
 #ifdef CONFIG_PROC_FS
 	input_devices_state++;
 	wake_up(&input_devices_poll_wait);
@@ -505,6 +516,8 @@ void input_register_handler(struct input_handler *handler)
 	if (handler->fops != NULL)
 		input_table[handler->minor >> 5] = handler;
 
+	mutex_lock(&input_mutex);
+
 	list_add_tail(&handler->node, &input_handler_list);
 
 	list_for_each_entry(dev, &input_dev_list, node)
@@ -513,16 +526,21 @@ void input_register_handler(struct input_handler *handler)
 				if ((handle = handler->connect(handler, dev, id)))
 					input_link_handle(handle);
 
+	mutex_unlock(&input_mutex);
+
 #ifdef CONFIG_PROC_FS
 	input_devices_state++;
 	wake_up(&input_devices_poll_wait);
 #endif
+
 }
 
 void input_unregister_handler(struct input_handler *handler)
 {
 	struct list_head * node, * next;
 
+	mutex_lock(&input_mutex);
+
 	list_for_each_safe(node, next, &handler->h_list) {
 		struct input_handle * handle = to_handle_h(node);
 		list_del_init(&handle->h_node);
@@ -535,6 +553,8 @@ void input_unregister_handler(struct input_handler *handler)
 	if (handler->fops != NULL)
 		input_table[handler->minor >> 5] = NULL;
 
+	mutex_unlock(&input_mutex);
+
 #ifdef CONFIG_PROC_FS
 	input_devices_state++;
 	wake_up(&input_devices_poll_wait);
@@ -613,6 +633,8 @@ static int input_devices_read(char *buf, char **start, off_t pos, int count, int
 	off_t at = 0;
 	int i, len, cnt = 0;
 
+	mutex_lock(&input_mutex);
+
 	list_for_each_entry(dev, &input_dev_list, node) {
 
 		len = sprintf(buf, "I: Bus=%04x Vendor=%04x Product=%04x Version=%04x\n",
@@ -654,6 +676,8 @@ static int input_devices_read(char *buf, char **start, off_t pos, int count, int
 	if (&dev->node == &input_dev_list)
 		*eof = 1;
 
+	mutex_unlock(&input_mutex);
+
 	return (count > cnt) ? cnt : count;
 }
 
@@ -665,6 +689,8 @@ static int input_handlers_read(char *buf, char **start, off_t pos, int count, in
 	int len = 0, cnt = 0;
 	int i = 0;
 
+	mutex_lock(&input_mutex);
+
 	list_for_each_entry(handler, &input_handler_list, node) {
 
 		if (handler->fops)
@@ -689,6 +715,8 @@ static int input_handlers_read(char *buf, char **start, off_t pos, int count, in
 	if (&handler->node == &input_handler_list)
 		*eof = 1;
 
+	mutex_unlock(&input_mutex);
+
 	return (count > cnt) ? cnt : count;
 }
 

drivers/net/e1000/e1000_main.c

@@ -4403,8 +4403,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 		                 PCI_DMA_FROMDEVICE);
 
 		length = le16_to_cpu(rx_desc->length);
-
-		if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
+		if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
 			/* All receives must fit into a single buffer */
 			E1000_DBG("%s: Receive packet consumed multiple"
 				  " buffers\n", netdev->name);

fs/nfs/dir.c

@@ -1764,7 +1764,8 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 #endif
 			goto out;
 		}
-	}
+	} else
+		new_inode->i_nlink--;
 
 go_ahead:
 	/*
@@ -2085,7 +2086,8 @@ int nfs_permission(struct inode *inode, int mask, struct nameidata *nd)
 		case S_IFREG:
 			/* NFSv4 has atomic_open... */
 			if (nfs_server_capable(inode, NFS_CAP_ATOMIC_OPEN)
-			    && nd != NULL && (nd->flags & LOOKUP_OPEN))
+			    && nd != NULL && (nd->flags & LOOKUP_OPEN)
+			    && !(mask & MAY_EXEC))
                                goto out;
 			break;
 		case S_IFDIR:

fs/proc/array.c

@@ -74,6 +74,7 @@
 #include <linux/file.h>
 #include <linux/times.h>
 #include <linux/resource.h>
+#include <linux/ptrace.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -311,6 +312,7 @@ static int do_task_stat(struct task_struct *task, char * buffer, int whole)
 	int res;
  	pid_t ppid, pgid = -1, sid = -1;
 	int num_threads = 0;
+	int permitted;
 	struct mm_struct *mm;
 	unsigned long long start_time;
 	unsigned long cmin_flt = 0, cmaj_flt = 0, cutime = 0, cstime = 0;
@@ -320,11 +322,14 @@ static int do_task_stat(struct task_struct *task, char * buffer, int whole)
 
 	state = *get_task_state(task);
 	vsize = eip = esp = 0;
+	permitted = may_ptrace_attach(task);
 	mm = get_task_mm(task);
 	if (mm) {
 		vsize = task_vsize(mm);
-		eip = KSTK_EIP(task);
-		esp = KSTK_ESP(task);
+		if (permitted) {
+			eip = KSTK_EIP(task);
+			esp = KSTK_ESP(task);
+		}
 	}
 
 	get_task_comm(tcomm, task);
@@ -372,7 +377,7 @@ static int do_task_stat(struct task_struct *task, char * buffer, int whole)
 	ppid = pid_alive(task) ? task->group_leader->real_parent->tgid : 0;
 	read_unlock(&tasklist_lock);
 
-	if ((!whole || num_threads<2) &&
+	if (permitted && (!whole || num_threads<2) &&
 	    (current->uid == task->uid || current->euid == task->uid ||
 	     capable(CAP_SYS_NICE)))
 		wchan = get_wchan(task);
@@ -426,7 +431,7 @@ static int do_task_stat(struct task_struct *task, char * buffer, int whole)
 		task->rlim[RLIMIT_RSS].rlim_cur,
 		mm ? mm->start_code : 0,
 		mm ? mm->end_code : 0,
-		mm ? mm->start_stack : 0,
+		(permitted && mm) ? mm->start_stack : 0,
 		esp,
 		eip,
 		/* The signal information here is obsolete.

fs/proc/base.c

@@ -410,7 +410,7 @@ int __may_ptrace_attach(struct task_struct *task)
 	return retval;
 }
 
-static int may_ptrace_attach(struct task_struct *task)
+int may_ptrace_attach(struct task_struct *task)
 {
 	int res;
 	task_lock(task);
@@ -492,7 +492,10 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
 	sym_name = kallsyms_lookup(wchan, &size, &offset, &modname, namebuf);
 	if (sym_name)
 		return sprintf(buffer, "%s", sym_name);
-	return sprintf(buffer, "%lu", wchan);
+	if (!may_ptrace_attach(task))
+		return 0;
+	else
+		return sprintf(buffer, "%lu", wchan);
 }
 #endif /* CONFIG_KALLSYMS */
 

include/linux/autoconf.h

@@ -1,7 +1,7 @@
 /*
  * Automatically generated C config: don't edit
  * Linux kernel version: 2.6.9-prep
- * Sun Jan 23 13:34:04 2011
+ * Sun Jan 23 13:28:48 2011
  */
 #define AUTOCONF_INCLUDED
 #define CONFIG_X86_64 1

include/linux/capability.h

@@ -103,10 +103,6 @@ typedef __u32 kernel_cap_t;
 
 #define CAP_FSETID           4
 
-/* Used to decide between falling back on the old suser() or fsuser(). */
-
-#define CAP_FS_MASK          0x1f
-
 /* Overrides the restriction that the real or effective user ID of a
    process sending a signal must match the real or effective user ID
    of the process receiving the signal. */
@@ -310,6 +306,16 @@ extern kernel_cap_t cap_bset;
 
 #endif
 
+/* Used to decide between falling back on the old suser() or fsuser(). */
+
+#define CAP_FS_MASK	(CAP_TO_MASK(CAP_CHOWN) |		\
+			 CAP_TO_MASK(CAP_DAC_OVERRIDE) |	\
+			 CAP_TO_MASK(CAP_DAC_READ_SEARCH) |	\
+			 CAP_TO_MASK(CAP_FOWNER) |		\
+			 CAP_TO_MASK(CAP_FSETID) |		\
+			 CAP_TO_MASK(CAP_LINUX_IMMUTABLE) |	\
+			 CAP_TO_MASK(CAP_MKNOD))
+
 #define CAP_EMPTY_SET       to_cap_t(0)
 #define CAP_FULL_SET        to_cap_t(~0)
 #define CAP_INIT_EFF_SET    to_cap_t(~0 & ~CAP_TO_MASK(CAP_SETPCAP))

include/linux/ptrace.h

@@ -79,6 +79,7 @@
 extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);
 extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len);
 extern int ptrace_attach(struct task_struct *tsk);
+extern int may_ptrace_attach(struct task_struct *task);
 extern int ptrace_detach(struct task_struct *, unsigned int);
 extern void __ptrace_detach(struct task_struct *, unsigned int);
 extern void ptrace_disable(struct task_struct *);

include/linux/time.h

@@ -370,7 +370,7 @@ extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
 static inline void
 set_normalized_timespec (struct timespec *ts, time_t sec, long nsec)
 {
-	while (nsec > NSEC_PER_SEC) {
+	while (nsec >= NSEC_PER_SEC) {
 		nsec -= NSEC_PER_SEC;
 		++sec;
 	}

kernel/posix-timers.c

@@ -235,7 +235,7 @@ static void tstojiffie(struct timespec *tp, int res, u64 *jiff)
 	long sec = tp->tv_sec;
 	long nsec = tp->tv_nsec + res - 1;
 
-	if (nsec > NSEC_PER_SEC) {
+	if (nsec >= NSEC_PER_SEC) {
 		sec++;
 		nsec -= NSEC_PER_SEC;
 	}
@@ -1207,13 +1207,9 @@ int do_posix_clock_monotonic_gettime(struct timespec *tp)
 
 	do_posix_clock_monotonic_gettime_parts(tp, &wall_to_mono);
 
-	tp->tv_sec += wall_to_mono.tv_sec;
-	tp->tv_nsec += wall_to_mono.tv_nsec;
+	set_normalized_timespec(tp, tp->tv_sec + wall_to_mono.tv_sec,
+				tp->tv_nsec + wall_to_mono.tv_nsec);
 
-	if ((tp->tv_nsec - NSEC_PER_SEC) > 0) {
-		tp->tv_nsec -= NSEC_PER_SEC;
-		tp->tv_sec++;
-	}
 	return 0;
 }
 

net/core/netpoll.c

@@ -869,10 +869,12 @@ void netpoll_reset_locks(struct netpoll *np)
 
 	if (ndw && ndw->npinfo) {
 		if (spin_is_locked(&ndw->npinfo->poll_lock)) {
-			printk("poll_lock is locked, unable to take a dump!\n");
-			printk("rebooting in 5 seconds\n");
-			mdelay(5000);
-			machine_restart(NULL);
+			/*
+			 * Bust the poll lock and hope for the best, the other
+			 * cpus are frozen by now anyway, so we have no choice
+			 */
+			printk(KERN_CRIT "poll_lock locked! netdump may fail\n");
+			spin_lock_init(&ndw->npinfo->poll_lock);
 		}
 	}
 	spin_lock_init(&skb_list_lock);