Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Commits on Aug 21, 2008
  1. @torvalds

    Linux v2.6.27-rc4

    torvalds authored
Commits on Aug 20, 2008
  1. @torvalds

    cramfs: fix named-pipe handling

    Al Viro authored torvalds committed
    After commit a97c9bf (fix cramfs
    making duplicate entries in inode cache) in kernel 2.6.14, named-pipe
    on cramfs does not work properly.
    It seems the commit make all named-pipe on cramfs share their inode
    (and named-pipe buffer).
    Make ..._test() refuse to merge inodes with ->i_ino == 1, take inode setup
    back to get_cramfs_inode() and make ->drop_inode() evict ones with ->i_ino
    == 1 immediately.
    Reported-by: Atsushi Nemoto <>
    Cc: Al Viro <>
    Cc: <>		[2.6.14 and later]
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  2. @torvalds

    fbdefio: add set_page_dirty handler to deferred IO FB

    Ian Campbell authored torvalds committed
    Fixes kernel BUG at lib/radix-tree.c:473.
    Previously the handler was incidentally provided by tmpfs but this was
    removed with:
      commit 14fcc23
      Author: Hugh Dickins <>
      Date:   Mon Jul 28 15:46:19 2008 -0700
        tmpfs: fix kernel BUG in shmem_delete_inode
    relying on this behaviour was incorrect in any case and the BUG also
    appeared when the device node was on an ext3 filesystem.
    v2: override a_ops at open() time rather than mmap() time to minimise
    races per AKPM's concerns.
    Signed-off-by: Ian Campbell <>
    Cc: Jaya Kumar <>
    Cc: Nick Piggin <>
    Cc: Peter Zijlstra <>
    Cc: Hugh Dickins <>
    Cc: Johannes Weiner <>
    Cc: Jeremy Fitzhardinge <>
    Cc: Kel Modderman <>
    Cc: Markus Armbruster <>
    Cc: Krzysztof Helt <>
    Cc: <> [14fcc23 is in and]
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  3. @torvalds

    rtc: rtc-ds1374: fix 'no irq' case handling

    Anton Vorontsov authored torvalds committed
    On a PowerPC board with ds1374 RTC I'm getting this error while RTC tries
    to probe:
    rtc-ds1374 0-0068: unable to request IRQ
    This happens because I2C probing code (drivers/of/of_i2c.c) is specifying
    IRQ0 for 'no irq' case, which is correct.
    The driver handles this incorrectly, though. This patch fixes it.
    Signed-off-by: Anton Vorontsov <>
    Cc: David Brownell <>
    Cc: Alessandro Zummo <>
    Acked-by: Peter Korsgaard <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  4. @torvalds

    mm: xip/ext2 fix block allocation race

    Nick Piggin authored torvalds committed
    XIP can call into get_xip_mem concurrently with the same file,offset with
    create=1.  This usually maps down to get_block, which expects the page
    lock to prevent such a situation.  This causes ext2 to explode for one
    reason or another.
    Serialise those calls for the moment.  For common usages today, I suspect
    get_xip_mem rarely is called to create new blocks.  In future as XIP
    technologies evolve we might need to look at which operations require
    scalability, and rework the locking to suit.
    Signed-off-by: Nick Piggin <>
    Cc: Jared Hulbert <>
    Acked-by: Carsten Otte <>
    Cc: Hugh Dickins <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  5. @torvalds

    mm: xip fix fault vs sparse page invalidate race

    Nick Piggin authored torvalds committed
    XIP has a race between sparse pages being inserted into page tables, and
    sparse pages being zapped when its time to put a non-sparse page in.
    What can happen is that a process can be left with a dangling sparse page
    in a MAP_SHARED mapping, while the rest of the world sees the non-sparse
    version.  Ie.  data corruption.
    Guard these operations with a seqlock, making fault-in-sparse-pages the
    slowpath, and try-to-unmap-sparse-pages the fastpath.
    Signed-off-by: Nick Piggin <>
    Cc: Jared Hulbert <>
    Acked-by: Carsten Otte <>
    Cc: Hugh Dickins <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  6. @torvalds

    mm: dirty page tracking race fix

    Nick Piggin authored torvalds committed
    There is a race with dirty page accounting where a page may not properly
    be accounted for.
    clear_page_dirty_for_io() calls page_mkclean; then TestClearPageDirty.
    page_mkclean walks the rmaps for that page, and for each one it cleans and
    write protects the pte if it was dirty.  It uses page_check_address to
    find the pte.  That function has a shortcut to avoid the ptl if the pte is
    not present.  Unfortunately, the pte can be switched to not-present then
    back to present by other code while holding the page table lock -- this
    should not be a signal for page_mkclean to ignore that pte, because it may
    be dirty.
    For example, powerpc64's set_pte_at will clear a previously present pte
    before setting it to the desired value.  There may also be other code in
    core mm or in arch which do similar things.
    The consequence of the bug is loss of data integrity due to msync, and
    loss of dirty page accounting accuracy.  XIP's __xip_unmap could easily
    also be unreliable (depending on the exact XIP locking scheme), which can
    lead to data corruption.
    Fix this by having an option to always take ptl to check the pte in
    It's possible to retain this optimization for page_referenced and
    Signed-off-by: Nick Piggin <>
    Cc: Jared Hulbert <>
    Cc: Carsten Otte <>
    Cc: Hugh Dickins <>
    Acked-by: Peter Zijlstra <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  7. @torvalds

    fix setpriority(PRIO_PGRP) thread iterator breakage

    Ken Chen authored torvalds committed
    When user calls sys_setpriority(PRIO_PGRP ...) on a NPTL style multi-LWP
    process, only the task leader of the process is affected, all other
    sibling LWP threads didn't receive the setting.  The problem was that the
    iterator used in sys_setpriority() only iteartes over one task for each
    process, ignoring all other sibling thread.
    Introduce a new macro do_each_pid_thread / while_each_pid_thread to walk
    each thread of a process.  Convert 4 call sites in {set/get}priority and
    Signed-off-by: Ken Chen <>
    Cc: Oleg Nesterov <>
    Cc: Roland McGrath <>
    Cc: Ingo Molnar <>
    Cc: Thomas Gleixner <>
    Cc: Jens Axboe <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  8. @mhennerich @torvalds

    Video/Framebuffer: add fuctional power management support to Blackfin…

    mhennerich authored torvalds committed
    … BF54x LQ043 framebuffer driver
    Fix bug: does nor properply resume after suspend mem
    Fix for PM_SUSPEND_MEM: Save and restore peripheral base and DMA registers
    Signed-off-by: Michael Hennerich <>
    Signed-off-by: Bryan Wu <>
    Acked-by: Krzysztof Helt <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  9. @torvalds

    bootmem: fix aligning of node-relative indexes and offsets

    Johannes Weiner authored torvalds committed
    Absolute alignment requirements may never be applied to node-relative
    offsets.  Andreas Herrmann spotted this flaw when a bootmem allocation on
    an unaligned node was itself not aligned because the combination of an
    unaligned node with an aligned offset into that node is not garuanteed to
    be aligned itself.
    This patch introduces two helper functions that align a node-relative
    index or offset with respect to the node's starting address so that the
    absolute PFN or virtual address that results from combining the two
    satisfies the requested alignment.
    Then all the broken ALIGN()s in alloc_bootmem_core() are replaced by these
    Signed-off-by: Johannes Weiner <>
    Reported-by: Andreas Herrmann <>
    Debugged-by: Andreas Herrmann <>
    Reviewed-by: Andreas Herrmann <>
    Tested-by: Andreas Herrmann <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  10. @torvalds

    drivers/char/ipmi/ipmi_si_intf.c:default_find_bmc(): fix leak

    Andrew Morton authored torvalds committed
    If check_legacy_ioport() returns true, we leak *info.
    Reported-by: Daniel Marjamki <>
    Cc: Christian Krafft <>
    Cc: Michael Ellerman <>
    Cc: Corey Minyard <>
    Cc: Paul Mackerras <>
    Cc: Benjamin Herrenschmidt <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  11. @torvalds

    pm2fb: free cmap memory on module remove

    Krzysztof Helt authored torvalds committed
    Release cmap memory allocated in the probe function.
    Signed-off-by: Krzysztof Helt <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  12. @torvalds

    rtc: fix double lock on UIE emulation

    Atsushi Nemoto authored torvalds committed
    With commit 5ad31a5 ("rtc: remove BKL
    for ioctl()"), RTC_UIE_ON ioctl cause double lock on rtc->ops_lock.
    The ops_lock must not be held while set_uie() calls rtc_read_time()
    which takes the lock.  Also clear_uie() does not need ops_lock.  This
    patch fixes return value of RTC_UIE_OFF ioctl too.
    Signed-off-by: Atsushi Nemoto <>
    Cc: David Brownell <>
    Cc: Russell King <>
    Cc: Alessandro Zummo <>
    Cc: "Rafael J. Wysocki" <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  13. @xemul @torvalds

    binfmt_misc: fix false -ENOEXEC when coupled with other binary handlers

    xemul authored torvalds committed
    In case the binfmt_misc binary handler is registered *before* the e.g.
    script one (when for example being compiled as a module) the following
    situation may occur:
    1. user launches a script, whose interpreter is a misc binary;
    2. the load_misc_binary sets the misc_bang and returns -ENOEVEC,
       since the binary is a script;
    3. the load_script_binary loads one and calls for search_binary_hander
       to run the interpreter;
    4. the load_misc_binary is called again, but refuses to load the
       binary due to misc_bang bit set.
    The fix is to move the misc_bang setting lower - prior to the actual
    call to the search_binary_handler.
    Caused by the commit 3a2e7f4 (binfmt_misc.c: avoid potential kernel
    stack overflow)
    Signed-off-by: Pavel Emelyanov <>
    Reported-by: Kirill A. Shutemov <>
    Tested-by: Kirill A. Shutemov <>
    Cc: <>		[2.6.26.x]
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  14. @mita @torvalds

    brd: fix name argument of unregister_blkdev()

    mita authored torvalds committed
    The name of brd block device is "ramdisk", it's not "brd".
    (The block device is registered by register_blkdev(RAMDISK_MAJOR, "ramdisk")
    So it should be unregistered by unregister_blkdev(RAMDISK_MAJOR, "ramdisk")
    Signed-off-by: Akinobu Mita <>
    Acked-by: Nick Piggin <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  15. @swegener @torvalds

    nbd: fix memory leak of nbd_dev array

    swegener authored torvalds committed
    We leak the memory allocated for the nbd_dev array at multiple places.
    Fix them by either adding a kfree() or by rearranging code to return
    before we allocate the memory.
    Signed-off-by: Sven Wegener <>
    Cc: Paul Clements <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  16. @mslusarz @torvalds

    mm: mminit_loglevel cannot be __meminitdata anymore

    mslusarz authored torvalds committed
    mminit_loglevel is now used from mminit_verify_zonelist <- build_all_zonelists <-
    1. online_pages <- memory_block_action <- memory_block_change_state <- store_mem_state (sys handler)
    2. numa_zonelist_order_handler (proc handler)
    so it cannot be annotated __meminit - drop it
    fixes following section mismatch warning:
    WARNING: vmlinux.o(.text+0x71628): Section mismatch in reference from the function mminit_verify_zonelist() to the variable
    The function mminit_verify_zonelist() references
    the variable __meminitdata mminit_loglevel.
    This is often because mminit_verify_zonelist lacks a __meminitdata
    annotation or the annotation of mminit_loglevel is wrong.
    Signed-off-by: Marcin Slusarz <>
    Acked-by: Mel Gorman <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  17. @torvalds

    mm: show free swap as signed

    Hugh Dickins authored torvalds committed
    Adjust <Alt><SysRq>m show_swap_cache_info() to show "Free swap" as a
    signed long: the signed format is preferable, because during swapoff
    nr_swap_pages can legitimately go negative, so makes more sense thus
    (it used to be shown redundantly, once as signed and once as unsigned).
    Signed-off-by: Hugh Dickins <>
    Reviewed-by: KOSAKI Motohiro <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  18. @torvalds

    mm: page_remove_rmap comments on PageAnon

    Hugh Dickins authored torvalds committed
    Add a comment to s390's page_test_dirty/page_clear_dirty/page_set_dirty
    dance in page_remove_rmap(): I was wrong to think the PageSwapCache test
    could be avoided, and would like a comment in there to remind me.  And
    mention s390, to help us remember that this block is not really common.
    Also move down the "It would be tidy to reset PageAnon" comment: it does
    not belong to s390's block, and it would be unwise to reset PageAnon
    before we're done with testing it.
    Signed-off-by: Hugh Dickins <>
    Acked-by: Martin Schwidefsky <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  19. @torvalds

    Blackfin RTC Driver: dont let RTC programming in bootloaders randomly…

    Mike Frysinger authored torvalds committed
    … cause ~5 second boot delays
    Signed-off-by: Mike Frysinger <>
    Signed-off-by: Bryan Wu <>
    Cc: Alessandro Zummo <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  20. @torvalds

    Blackfin RTC Driver: BF561 not have on-chip RTC

    Graf Yang authored torvalds committed
    Signed-off-by: Graf Yang <>
    Signed-off-by: Bryan Wu <>
    Cc: Alessandro Zummo <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  21. @torvalds

    Blackfin RTC Driver: do all initialization before we register the rtc…

    Mike Frysinger authored torvalds committed
    … and make it available
    Signed-off-by: Mike Frysinger <>
    Signed-off-by: Bryan Wu <>
    Cc: Alessandro Zummo <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  22. @torvalds

    Blackfin RTC Driver: move irq request/free out of open/release and in…

    Mike Frysinger authored torvalds committed
    …to probe/remove so that the non-dev interfaces (like sysfs) work as expected
    Signed-off-by: Mike Frysinger <>
    Signed-off-by: Bryan Wu <>
    Cc: Alessandro Zummo <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  23. @torvalds

    /proc/self/maps doesn't display the real file offset

    Clement Calmels authored torvalds committed
    This addresses

    In function show_map (file: fs/proc/task_mmu.c), if vma->vm_pgoff > 2^20
    than (vma->vm_pgoff << PAGE_SIZE) is greater than 2^32 (with PAGE_SIZE
    equal to 4096 (i.e.  2^12).  The next seq_printf use an unsigned long for
    the conversion of (vma->vm_pgoff << PAGE_SIZE), as a result the offset
    value displayed in /proc/self/maps is truncated if the page offset is
    greater than 2^20.
    A test that shows this issue:
    #define _GNU_SOURCE
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <sys/mman.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <fcntl.h>
    #include <unistd.h>
    #include <string.h>
    #define PAGE_SIZE (getpagesize())
    #if __i386__
    #   define U64_STR "%llx"
    #elif __x86_64
    #   define U64_STR "%lx"
    #   error "Architecture Unsupported"
    int main(int argc, char *argv[])
    	int fd;
    	char *addr;
    	off64_t offset = 0x10000000;
    	char *filename = "/dev/zero";
    	fd = open(filename, O_RDONLY);
    	if (fd < 0) {
    		return 1;
    	offset *= 0x10;
    	printf("offset = " U64_STR "\n", offset);
    	addr = (char*)mmap64(NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd,
    	if ((void*)addr == MAP_FAILED) {
    		return 1;
    		FILE *fmaps;
    		char *line = NULL;
    		size_t len = 0;
    		ssize_t read;
    		size_t filename_len = strlen(filename);
    		fmaps = fopen("/proc/self/maps", "r");
    		if (!fmaps) {
    			return 1;
    		while ((read = getline(&line, &len, fmaps)) != -1) {
    			if ((read > filename_len + 1)
    			    && (strncmp(&line[read - filename_len - 1], filename, filename_len) == 0))
    				printf("%s", line);
    		if (line)
    	return 0;
    [ coding-style fixes]
    Signed-off-by: Clement Calmels <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  24. @torvalds

    documentation: describe bootmem_debug kernel parameter

    Andreas Herrmann authored torvalds committed
    "bootmem_debug" is not mentioned in kernel-parameters.txt. Recently I
    had to use that kernel option and I think it should be documented.
    Signed-off-by: Andreas Herrmann <>
    Cc: Ingo Molnar <>
    Cc: Randy Dunlap <>
    Cc: Johannes Weiner <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  25. @torvalds

    eeepc-laptop: fix use after free

    Matthew Garrett authored torvalds committed
    eeepc-laptop uses the hwmon struct after unregistering the device, causing
    an oops on module unload.  Flip the ordering to fix.
    Signed-off-by: Matthew Garrett <>
    Cc: Henrique de Moraes Holschuh <>
    Cc: Corentin Chary <>
    Cc: Karol Kozimor <>
    Cc: <>		[2.6.26.x]
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  26. @torvalds

    FRV: Provide ioremap_wc() for FRV

    David Howells authored torvalds committed
    Provide ioremap_wc() for FRV.
    Signed-off-by: David Howells <>
    Signed-off-by: Linus Torvalds <>
  27. @torvalds

    MN10300: Supply ioremap_wc() for MN10300

    David Howells authored torvalds committed
    Supply ioremap_wc() for MN10300.
    Signed-off-by: David Howells <>
    Signed-off-by: Linus Torvalds <>
  28. @dwmw2 @torvalds

    Reserve NFS fileid values for btrfs

    dwmw2 authored torvalds committed
    Purely cosmetic for now, but we might as well get it merged ASAP.
    Signed-off-by: David Woodhouse <>
    Signed-off-by: Linus Torvalds <>
  29. @dwmw2 @torvalds

    Reduce brokenness of CRIS headers_install

    dwmw2 authored torvalds committed
    I won't say 'fix', because they still look broken, although this will at
    least allow 'make ARCH=CRIS headers_install' to _complete_.
    For headers which are exported, we should probably choose between
    asm/arch-v10 and asm/arch-v32 by something that GCC defines -- we can't
    rely on a generated symlink. And we certainly can't export an arch/
    directory which doesn't even exist.
    And the only thing that we seem to include from the arch/ directory is
    <asm/arch/ptrace.h> from <asm/ptrace.h> ... and that isn't exported in
    either arch-v10 or arch-v32 _anyway_.
    Signed-off-by: David Woodhouse <>
    Signed-off-by: Linus Torvalds <>
  30. @torvalds

    Merge branch 'sh/for-2.6.27' of git://…

    torvalds authored
    * 'sh/for-2.6.27' of git://
      sh: Provide a FLAT_PLAT_INIT() definition.
      binfmt_flat: Stub in a FLAT_PLAT_INIT().
      video: export sh_mobile_lcdc panel size
      sh: select memchunk size using kernel cmdline
      sh: export sh7723 VEU as VEU2H
      input: migor_ts compile and detection fix
      sh: remove MSTPCR defines from Migo-R header file
      sh: Update sh7763rdp defconfig
      sh: Add support sh7760fb to sh7763rdp board
      sh: Add support sh_eth to sh7763rdp board
      sh: Disable 64kB hugetlbpage size when using 64kB PAGE_SIZE.
      sh: Don't export __{s,u}divsi3_i4i from SH-2 libgcc.
      fix SH7705_CACHE_32KB compilation
      sh: mach-x3proto: Fix up smc91x platform data.
  31. @torvalds

    Merge branch 'merge' of git://…

    torvalds authored
    * 'merge' of git://
      powerpc: Fix vio_bus_probe oops on probe error
      powerpc/ibmebus: Restore "name" sysfs attribute on ibmebus devices
      powerpc: Fix /dev/oldmem interface for kdump
      powerpc/spufs: Remove invalid semicolon after if statement
      powerpc/spufs: reference context while dropping state mutex in scheduler
      powerpc/spufs: fix npc setting for NOSCHED contexts
  32. @torvalds

    Merge branch 'tracehook' of git://…

    torvalds authored
    * 'tracehook' of git://
      tracehook: fix SA_NOCLDWAIT
  33. @torvalds

    Merge git://…

    torvalds authored
    * git:// (22 commits)
      [SCSI] ibmvfc: Driver version 1.0.2
      [SCSI] ibmvfc: Add details to async event log
      [SCSI] ibmvfc: Sanitize response lengths
      [SCSI] ibmvfc: Fix for lost async events
      [SCSI] ibmvfc: Fixup host state during reinit
      [SCSI] ibmvfc: Fix another hang on module removal
      [SCSI] ibmvscsi: Fixup desired DMA value for shared memory partitions
      [SCSI] megaraid_sas: remove sysfs dbg_lvl world writeable permissions
      [SCSI] qla2xxx: Update version number to 8.02.01-k7.
      [SCSI] qla2xxx: Explicitly tear-down vports during PCI remove_one().
      [SCSI] qla2xxx: Reference proper ha during SBR handling.
      [SCSI] qla2xxx: Set npiv_supported flag for FCoE HBAs.
      [SCSI] qla2xxx: Don't leak SG-DMA mappings while aborting commands.
      [SCSI] qla2xxx: Correct vport-state management issues during ISP-ABORT.
      [SCSI] qla2xxx: Correct synchronization of software/firmware fcport states.
      [SCSI] scsi_dh: Initialize lun_state in check_ownership()
      [SCSI] scsi_dh: Do not use scsilun in rdac hardware handler
      [SCSI] megaraid_sas: version and Documentation Update
      [SCSI] megaraid_sas: add new controllers (0x78 0x79)
      [SCSI] megaraid_sas: add the shutdown DCMD cmd to driver shutdown routine
  34. @torvalds

    vfat: fix 'sync' mount deadlock due to BKL->lock_super conversion

    torvalds authored
    There was another FAT BKL conversion deadlock reported by Bart
    Trojanowski due to the BKL being used as a recursive lock by FAT, which
    was missed because it only triggers with 'sync' (or 'dirsync') mounts.
    The recursion worked for the BKL, but after the conversion to lock_super
    (which uses a mutex), it just deadlocks.
    Thanks to Bart for debugging this and testing the fix.  The lock
    debugging information from the original report:
      [ INFO: possible recursive locking detected ]
      2.6.27-rc3-bisect-00448-ga7f5aaf #16
      mv/4020 is trying to acquire lock:
       (&type->s_lock_key#9){--..}, at: [<c01a90fe>] lock_super+0x1e/0x20
      but task is already holding lock:
       (&type->s_lock_key#9){--..}, at: [<c01a90fe>] lock_super+0x1e/0x20
      other info that might help us debug this:
      3 locks held by mv/4020:
       #0:  (&sb->s_type->i_mutex_key#9/1){--..}, at: [<c01b2336>] do_unlinkat+0x66/0x140
       #1:  (&sb->s_type->i_mutex_key#9){--..}, at: [<c01b0954>] vfs_unlink+0x84/0x110
       #2:  (&type->s_lock_key#9){--..}, at: [<c01a90fe>] lock_super+0x1e/0x20
      stack backtrace:
      Pid: 4020, comm: mv Not tainted 2.6.27-rc3-bisect-00448-ga7f5aaf #16
       [<c014e694>] validate_chain+0x984/0xea0
       [<c0108d70>] ? native_sched_clock+0x0/0xf0
       [<c014ee9c>] __lock_acquire+0x2ec/0x9b0
       [<c014f5cf>] lock_acquire+0x6f/0x90
       [<c01a90fe>] ? lock_super+0x1e/0x20
       [<c044e5fd>] mutex_lock_nested+0xad/0x300
       [<c01a90fe>] ? lock_super+0x1e/0x20
       [<c01a90fe>] ? lock_super+0x1e/0x20
       [<c01a90fe>] lock_super+0x1e/0x20
       [<f8b3a700>] fat_write_inode+0x60/0x2b0 [fat]
       [<c0450878>] ? _spin_unlock_irqrestore+0x48/0x80
       [<f8b3a953>] ? fat_sync_inode+0x3/0x20 [fat]
       [<f8b3a962>] fat_sync_inode+0x12/0x20 [fat]
       [<f8b37c7e>] fat_remove_entries+0xbe/0x120 [fat]
       [<f8b422ef>] vfat_unlink+0x5f/0x90 [vfat]
       [<f8b42290>] ? vfat_unlink+0x0/0x90 [vfat]
       [<c01b0968>] vfs_unlink+0x98/0x110
       [<c01b2400>] do_unlinkat+0x130/0x140
       [<c016a8f5>] ? audit_syscall_entry+0x105/0x150
       [<c01b253b>] sys_unlinkat+0x3b/0x40
       [<c01040d3>] sysenter_do_call+0x12/0x3f
    where the deadlock is due to the nesting of lock_super from vfat_unlink
    to fat_write_inode:
     - do_unlinkat
       - vfs_unlink
         - vfat_unlink
           * lock_super
           - fat_remove_entries
             - fat_sync_inode
               - fat_write_inode
                 * lock_super
    and the fix is to simply remove the use of lock_super() in fat_write_inode.
    The lock_super() there had been just an automatic conversion of the
    kernel lock to the superblock lock, but no locking was actually needed
    there, since the code in fat_write_inode already protected all relevant
    accesses with a spinlock (sbi->inode_hash_lock to be exact).  The only
    code inside the BKL (and thus the superblock lock) was accesses tp local
    variables or calls to functions that have long been SMP-safe (i.e.
    sb_bread, mark_buffe_dirty and brlese).
    Bart reports:
     "Looks good.  I ran 10 parallel processes creating 1M files truncating
      them, writing to them again and then deleting them.  This patch fixes
      the issue I ran into.
      Signed-off-by: Bart Trojanowski <>"
    Reported-and-tested-by: Bart Trojanowski <>
    Signed-off-by: Linus Torvalds <>
Something went wrong with that request. Please try again.