Permalink
Commits on Aug 16, 2009
  1. Linux 2.6.27.30

    gregkh committed Aug 16, 2009
  2. NFS: Fix an O_DIRECT Oops...

    commit 1ae88b2 upstream.
    
    We can't call nfs_readdata_release()/nfs_writedata_release() without
    first initialising and referencing args.context. Doing so inside
    nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment()
    causes an Oops.
    
    We should rather be calling nfs_readdata_free()/nfs_writedata_free() in
    those cases.
    
    Looking at the O_DIRECT code, the "struct nfs_direct_req" is already
    referencing the nfs_open_context for us. Since the readdata and writedata
    structures carry a reference to that, we can simplify things by getting rid
    of the extra nfs_open_context references, so that we can replace all
    instances of nfs_readdata_release()/nfs_writedata_release().
    
    Reported-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Tested-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Trond Myklebust committed with gregkh Aug 12, 2009
  3. Make sock_sendpage() use kernel_sendpage()

    commit e694958 upstream.
    
    kernel_sendpage() does the proper default case handling for when the
    socket doesn't have a native sendpage implementation.
    
    Now, arguably this might be something that we could instead solve by
    just specifying that all protocols should do it themselves at the
    protocol level, but we really only care about the common protocols.
    Does anybody really care about sendpage on something like Appletalk? Not
    likely.
    
    Acked-by: David S. Miller <davem@davemloft.net>
    Acked-by: Julien TINNES <julien@cr0.org>
    Acked-by: Tavis Ormandy <taviso@sdf.lonestar.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    torvalds committed with gregkh Aug 13, 2009
  4. mm_for_maps: shift down_read(mmap_sem) to the caller

    commit 00f89d2 upstream.
    
    mm_for_maps() takes ->mmap_sem after security checks, this looks
    strange and obfuscates the locking rules. Move this lock to its
    single caller, m_start().
    
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Acked-by: Serge Hallyn <serue@us.ibm.com>
    Signed-off-by: James Morris <jmorris@namei.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    utrace committed with gregkh Jul 10, 2009
  5. mm_for_maps: simplify, use ptrace_may_access()

    commit 13f0fea upstream.
    
    It would be nice to kill __ptrace_may_access(). It requires task_lock(),
    but this lock is only needed to read mm->flags in the middle.
    
    Convert mm_for_maps() to use ptrace_may_access(), this also simplifies
    the code a little bit.
    
    Also, we do not need to take ->mmap_sem in advance. In fact I think
    mm_for_maps() should not play with ->mmap_sem at all, the caller should
    take this lock.
    
    With or without this patch, without ->cred_guard_mutex held we can race
    with exec() and get the new ->mm but check old creds.
    
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reviewed-by: Serge Hallyn <serue@us.ibm.com>
    Signed-off-by: James Morris <jmorris@namei.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    utrace committed with gregkh Jun 23, 2009
  6. USB: usbfs: fix -ENOENT error code to be -ENODEV

    commit 01105a2 upstream.
    
    This patch (as1272) changes the error code returned when an open call
    for a USB device node fails to locate the corresponding device.  The
    appropriate error code is -ENODEV, not -ENOENT.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: Kay Sievers <kay.sievers@vrfy.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alan Stern committed with gregkh Jul 30, 2009
  7. USB: storage: include Prolific Technology USB drive in unusual_devs list

    commit c15e3ca upstream.
    
    Add a quirk entry for the Leading Driver UD-11 usb flash drive.
    
    As Alan Stern told me, the device doesn't deal correctly with the
    locking media feature of the device, and this patch incorporates it.
    
    Compiled, tested, working.
    
    Signed-off-by: Rogerio Brito <rbrito@ime.usp.br>
    Cc: Phil Dibowitz <phil@ipom.com>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Cc: Robert Hancock <hancockrwd@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    rbrito committed with gregkh Aug 6, 2009
  8. USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client

    commit 50d0678 upstream.
    
    reference:
    http://www.open-rd.org
    
    Signed-off-by: Dhaval Vasa <dhaval.vasa@einfochips.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    dhavalvasa committed with gregkh Aug 7, 2009
  9. USB: ftdi_sio: add vendor and product id for Bayer glucose meter seri…

    …al converter cable
    
    commit c47aacc upstream.
    
    Attached patch adds USB vendor and product IDs for Bayer's USB to serial
    converter cable used by Bayer blood glucose meters. It seems to be a
    FT232RL based device and works without any problem with ftdi_sio driver
    when this patch is applied. See: http://winglucofacts.com/cables/
    
    
    Signed-off-by: Marko Hänninen <bugitus@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Marko Hänninen committed with gregkh Jul 31, 2009
  10. USB: devio: Properly do access_ok() checks

    commit 18753eb upstream.
    
    access_ok() checks must be done on every part of the userspace structure
    that is accessed. If access_ok() on one part of the struct succeeded, it
    does not imply it will succeed on other parts of the struct. (Does
    depend on the architecture implementation of access_ok()).
    
    This changes the __get_user() users to first check access_ok() on the
    data structure.
    
    Signed-off-by: Michael Buesch <mb@bu3sch.de>
    Cc: Pete Zaitcev <zaitcev@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Michael Buesch committed with gregkh Jul 29, 2009
  11. flat: fix uninitialized ptr with shared libs

    commit 3440625 upstream.
    
    The new credentials code broke load_flat_shared_library() as it now uses
    an uninitialized cred pointer.
    
    Reported-by: Bernd Schmidt <bernds_cb1@t-online.de>
    Tested-by: Bernd Schmidt <bernds_cb1@t-online.de>
    Cc: Mike Frysinger <vapier@gentoo.org>
    Cc: David Howells <dhowells@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    torvalds committed with gregkh Aug 6, 2009
  12. execve: must clear current->clear_child_tid

    commit 9c8a822 upstream.
    
    While looking at Jens Rosenboom bug report
    (http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from
    a dying "ps" program, we found following problem.
    
    clone() syscall has special support for TID of created threads.  This
    support includes two features.
    
    One (CLONE_CHILD_SETTID) is to set an integer into user memory with the
    TID value.
    
    One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created
    thread dies.
    
    The integer location is a user provided pointer, provided at clone()
    time.
    
    kernel keeps this pointer value into current->clear_child_tid.
    
    At execve() time, we should make sure kernel doesnt keep this user
    provided pointer, as full user memory is replaced by a new one.
    
    As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and
    CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user
    memory in forked processes.
    
    Following sequence could happen:
    
    1) bash (or any program) starts a new process, by a fork() call that
       glibc maps to a clone( ...  CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID
       ...) syscall
    
    2) When new process starts, its current->clear_child_tid is set to a
       location that has a meaning only in bash (or initial program) context
       (&THREAD_SELF->tid)
    
    3) This new process does the execve() syscall to start a new program.
       current->clear_child_tid is left unchanged (a non NULL value)
    
    4) If this new program creates some threads, and initial thread exits,
       kernel will attempt to clear the integer pointed by
       current->clear_child_tid from mm_release() :
    
            if (tsk->clear_child_tid
                && !(tsk->flags & PF_SIGNALED)
                && atomic_read(&mm->mm_users) > 1) {
                    u32 __user * tidptr = tsk->clear_child_tid;
                    tsk->clear_child_tid = NULL;
    
                    /*
                     * We don't check the error code - if userspace has
                     * not set up a proper pointer then tough luck.
                     */
    << here >>      put_user(0, tidptr);
                    sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
            }
    
    5) OR : if new program is not multi-threaded, but spied by /proc/pid
       users (ps command for example), mm_users > 1, and the exiting program
       could corrupt 4 bytes in a persistent memory area (shm or memory mapped
       file)
    
    If current->clear_child_tid points to a writeable portion of memory of the
    new program, kernel happily and silently corrupts 4 bytes of memory, with
    unexpected effects.
    
    Fix is straightforward and should not break any sane program.
    
    Reported-by: Jens Rosenboom <jens@mcbone.net>
    Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Sonny Rao <sonnyrao@us.ibm.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ulrich Drepper <drepper@redhat.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Eric Dumazet committed with gregkh Aug 6, 2009
  13. compat_ioctl: hook up compat handler for FIEMAP ioctl

    commit 69130c7 upstream.
    
    The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler,
    which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl
    command.
    
    The structure is nicely aligned, padded, and sized, so it is just this
    simple.
    
    Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4.
    
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Cc: <linux-ext4@vger.kernel.org>
    Cc: Mark Lord <lkml@rtr.ca>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Josef Bacik <josef@redhat.com>
    Cc: Jan Kara <jack@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Eric Sandeen committed with gregkh Aug 6, 2009
  14. asix: new device ids

    commit fef7cc0 upstream.
    
    This patch adds two new device ids to the asix driver.
    
    One comes directly from the asix driver on their web site, the other was
    reported by Armani Liao as needed for the MSI X320 to get the driver to
    work properly for it.
    
    Reported-by: Armani Liao <aliao@novell.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    gregkh committed Feb 25, 2009
  15. x86: enable GART-IOMMU only after setting up protection methods

    commit fe2245c upstream.
    
    The current code to set up the GART as an IOMMU enables GART
    translations before it removes the aperture from the kernel memory
    map, sets the GART PTEs to UC, sets up the guard and scratch
    pages, or does a wbinvd().  This leaves the possibility of cache
    aliasing open and can cause system crashes.
    
    Re-order the code so as to enable the GART translations only
    after all safeguards are in place and the tlb has been flushed.
    
    AMD has tested this patch on both Istanbul systems and 1st
    generation Opteron systems with APG enabled and seen no adverse
    effects.  Istanbul systems with HT Assist enabled sometimes
    see MCE errors due to cache artifacts with the unmodified
    code.
    
    Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>
    Cc: Joerg Roedel <joerg.roedel@amd.com>
    Cc: akpm@linux-foundation.org
    Cc: jbarnes@virtuousgeek.org
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Mark Langsdorf committed with gregkh Jul 5, 2009
  16. firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)

    Commit af27194 upstream.
    
    Increase the command ORB data structure to transport up to 16 bytes long
    CDBs (instead of 12 bytes), and tell the SCSI mid layer about it.  This
    is notably necessary for READ CAPACITY(16) and friends, i.e. support of
    large disks.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Stefan Richter committed with gregkh Jul 29, 2009
  17. ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)

    Commit ebbb16b upstream.
    
    Increase the command ORB data structure to transport up to 16 bytes long
    CDBs (instead of 12 bytes), and tell the SCSI mid layer about it.  This
    is notably necessary for READ CAPACITY(16) and friends, i.e. support of
    large disks.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Stefan Richter committed with gregkh Jul 29, 2009
  18. parisc: ensure broadcast tlb purge runs single threaded

    commit e82a3b7 upstream
    
    parisc: ensure broadcast tlb purge runs single threaded
    The TLB flushing functions on hppa, which causes PxTLB broadcasts on the system
    bus, needs to be protected by irq-safe spinlocks to avoid irq handlers to deadlock
    the kernel. The deadlocks only happened during I/O intensive loads and triggered
    pretty seldom, which is why this bug went so long unnoticed.
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    [edited to use spin_lock_irqsave on UP as well since we'd been locking there
      all this time anyway, --kyle]
    Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Helge Deller committed with gregkh Jul 29, 2009
  19. x86: fix assembly constraints in native_save_fl()

    commit f1f029c upstream.
    
    From Gabe Black in bugzilla 13888:
    
    native_save_fl is implemented as follows:
    
      11static inline unsigned long native_save_fl(void)
      12{
      13        unsigned long flags;
      14
      15        asm volatile("# __raw_save_flags\n\t"
      16                     "pushf ; pop %0"
      17                     : "=g" (flags)
      18                     : /* no input */
      19                     : "memory");
      20
      21        return flags;
      22}
    
    If gcc chooses to put flags on the stack, for instance because this is
    inlined into a larger function with more register pressure, the offset
    of the flags variable from the stack pointer will change when the
    pushf is performed. gcc doesn't attempt to understand that fact, and
    address used for pop will still be the same. It will write to
    somewhere near flags on the stack but not actually into it and
    overwrite some other value.
    
    I saw this happen in the ide_device_add_all function when running in a
    simulator I work on. I'm assuming that some quirk of how the simulated
    hardware is set up caused the code path this is on to be executed when
    it normally wouldn't.
    
    A simple fix might be to change "=g" to "=r".
    
    Reported-by: Gabe Black <spamforgabe@umich.edu>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    H. Peter Anvin committed with gregkh Aug 3, 2009
  20. USB: storage: raise timeout in usb_stor_Bulk_max_lun

    commit 7a77791 upstream.
    
    Requests to get max LUN, for certain USB storage devices, require a
    longer timeout before a correct reply is returned. This happens for a
    Realtek USB Card Reader (0bda:0152), which has a max LUN of 3 but is set
    to 0, thus losing functionality, because of the timeout occurring too
    quickly.
    
    Raising the timeout value fixes the issue and might help other devices
    to return a correct max LUN value as well.
    
    Signed-off-by: Giacomo Lozito <james@develia.org>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    giacomolozito committed with gregkh Jul 13, 2009
  21. thinkpad-acpi: disable broken bay and dock subdrivers

    commit 550e7fd upstream.
    
    Currently, the ThinkPad-ACPI bay and dock drivers are completely
    broken, and cause a NULL pointer derreference in kernel mode (and,
    therefore, an OOPS) when they try to issue events (i.e. on dock,
    undock, bay ejection, etc).
    
    OTOH, the standard ACPI dock driver can handle the hotplug bays and
    docks of the ThinkPads just fine (including batteries) as of 2.6.27.
    In fact, it does a much better job of it than thinkpad-acpi ever did.
    
    It is just not worth the hassle to find a way to fix this crap without
    breaking the (deprecated) thinkpad-acpi dock/bay ABI.  This is old,
    deprecated code that sees little testing or use.
    
    As a quick fix suitable for -stable backports, mark the thinkpad-acpi
    bay and dock subdrivers as BROKEN in Kconfig.  The dead code will be
    removed by a later patch.
    
    This fixes bugzilla #13669, and should be applied to 2.6.27 and later.
    
    Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
    Reported-by: Joerg Platte <jplatte@naasa.net>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    hmh committed with gregkh Aug 1, 2009
  22. sysfs: fix hardlink count on device_move

    commit 0f58b44 upstream.
    
    Update directory hardlink count when moving kobjects to a new parent.
    Fixes the following problem which occurs when several devices are
    moved to the same parent and then unregistered:
    
    > ls -laF /sys/devices/css0/defunct/
    > total 0
    > drwxr-xr-x 4294967295 root root    0 2009-07-14 17:02 ./
    > drwxr-xr-x        114 root root    0 2009-07-14 17:02 ../
    > drwxr-xr-x          2 root root    0 2009-07-14 17:01 power/
    > -rw-r--r--          1 root root 4096 2009-07-14 17:01 uevent
    
    Signed-off-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    oberpar committed with gregkh Jul 14, 2009
  23. page-allocator: preserve PFN ordering when __GFP_COLD is set

    commit e084b2d upstream.
    
    Fix a post-2.6.24 performace regression caused by
    3dfa572 ("page-allocator: preserve PFN
    ordering when __GFP_COLD is set").
    
    Narayanan reports "The regression is around 15%.  There is no disk controller
    as our setup is based on Samsung OneNAND used as a memory mapped device on a
    OMAP2430 based board."
    
    The page allocator tries to preserve contiguous PFN ordering when returning
    pages such that repeated callers to the allocator have a strong chance of
    getting physically contiguous pages, particularly when external fragmentation
    is low.  However, of the bulk of the allocations have __GFP_COLD set as they
    are due to aio_read() for example, then the PFNs are in reverse PFN order.
    This can cause performance degration when used with IO controllers that could
    have merged the requests.
    
    This patch attempts to preserve the contiguous ordering of PFNs for users of
    __GFP_COLD.
    
    Signed-off-by: Mel Gorman <mel@csn.ul.ie>
    Reported-by: Narayananu Gopalakrishnan <narayanan.g@samsung.com>
    Tested-by: Narayanan Gopalakrishnan <narayanan.g@samsung.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    gormanm committed with gregkh Jul 29, 2009
  24. Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dep…

    …endency, since udev depends on BSG
    
    commit 14d9fa3 upstream.
    
    Make Block Layer SG support v4 the default, since recent udev versions
    depend on this to access serial numbers and other low level info properly.
    
    This should be backported to older kernels as well, since most distros have
    enabled this for a long time.
    
    Signed-off-by: John Stoffel <john@stoffel.org>
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    l8gravely committed with gregkh Aug 4, 2009
  25. SCSI: libsas: reuse the original port when hotplugging phys in wide p…

    …orts
    
    commit 5381837 upstream.
    
    There's a hotplug problem in the way libsas allocates ports: it loops over the
    available ports first trying to add to an existing for a wide port and
    otherwise allocating the next free port.  This scheme only works if the port
    array is packed from zero, which fails if a port gets hot unplugged and the
    array becomes sparse.  In that case, a new port is formed even if there's a
    wide port it should be part of.  Fix this by creating two loops over all the
    ports:  the first to see if the phy should be part of a wide port and the
    second to form a new port in an empty port slot.
    
    Signed-off-by: Tom Peng <tom_peng@usish.com>
    Signed-off-by: Jack Wang <jack_wang@usish.com>
    Signed-off-by: Lindar Liu <lindar_liu@usish.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Tom Peng committed with gregkh Jul 1, 2009
  26. i2c/tsl2550: Fix lux value in dark environment

    commit 96f699a upstream.
    
    I've tested TSL2550 driver and I've found a bug: when light is off,
    returned value from tsl2550_calculate_lux function is -1 when it should
    be 0 (sensor correctly read that light was off).
    
    I think the bug is that a zero c0 value (approximated value of ch0) is
    misinterpreted as an error.
    
    Signed-off-by: Michele Jr De Candia <michele.decandia@valueteam.com>
    Acked-by: Rodolfo Giometti <giometti@linux.it>
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Michele Jr De Candia committed with gregkh Jul 28, 2009
  27. hwmon: (smsc47m1) Differentiate between LPC47M233 and LPC47M292

    commit 1b54ab4 upstream.
    
    The SMSC LPC47M233 and LPC47M292 chips have the same device ID but
    are not compatible.
    
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Cc: Juerg Haefliger <juergh@gmail.com>
    Acked-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Jean Delvare committed with gregkh Jul 28, 2009
  28. hugetlbfs: fix i_blocks accounting

    commit e4c6f8b upstream.
    
    As reported in Red Hat bz #509671, i_blocks for files on hugetlbfs get
    accounting wrong when doing something like:
    
       $ > foo
       $ date  > foo
       date: write error: Invalid argument
       $ /usr/bin/stat foo
         File: `foo'
         Size: 0          Blocks: 18446744073709547520 IO Block: 2097152 regular
    ...
    
    This is because hugetlb_unreserve_pages() is unconditionally removing
    blocks_per_huge_page(h) on each call rather than using the freed amount.
    If there were 0 blocks, it goes negative, resulting in the above.
    
    This is a regression from commit a551643
    ("hugetlb: modular state for hugetlb page size")
    
    which did:
    
    -	inode->i_blocks -= BLOCKS_PER_HUGEPAGE * freed;
    +	inode->i_blocks -= blocks_per_huge_page(h);
    
    so just put back the freed multiplier, and it's all happy again.
    
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Acked-by: Andi Kleen <andi@firstfloor.org>
    Cc: William Lee Irwin III <wli@holomorphy.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    sandeen committed with gregkh Jul 29, 2009
Commits on Jul 30, 2009
  1. Linux 2.6.27.29

    gregkh committed Jul 30, 2009
  2. NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines.

    [ Upstream commit adeab1a ]
    
    Guido Trentalancia reports:
    
    I am trying to use the kiss driver in the Linux kernel that is being
    shipped with Fedora 10 but unfortunately I get the following oops:
    
    mkiss: AX.25 Multikiss, Hans Albas PE1AYX
    mkiss: ax0: crc mode is auto.
    ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready
    ------------[ cut here ]------------
    WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not
    tainted)
    [...]
    unloaded: microcode]
    Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1
     [<c042ddfb>] warn_on_slowpath+0x65/0x8b
     [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
     [<c04228b4>] ? __enqueue_entity+0xe3/0xeb
     [<c042431e>] ? enqueue_entity+0x203/0x20b
     [<c0424361>] ? enqueue_task_fair+0x3b/0x3f
     [<c041f88c>] ? resched_task+0x3a/0x6e
     [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
     [<c06ab4e2>] ? _spin_lock_bh+0xb/0x16
     [<c043255b>] __local_bh_disable+0x2f/0x83
     [<c04325ba>] local_bh_disable+0xb/0xd
     [<c06ab4e2>] _spin_lock_bh+0xb/0x16
     [<f8b6f600>] mkiss_receive_buf+0x2fb/0x3a6 [mkiss]
     [<c0572a30>] flush_to_ldisc+0xf7/0x198
     [<c0572b12>] tty_flip_buffer_push+0x41/0x51
     [<f89477f2>] ftdi_process_read+0x375/0x4ad [ftdi_sio]
     [<f8947a5a>] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
     [<c05d4bec>] usb_hcd_giveback_urb+0x63/0x93
     [<c05ea290>] uhci_giveback_urb+0xe5/0x15f
     [<c05eaabf>] uhci_scan_schedule+0x52e/0x767
     [<c05f6288>] ? psmouse_handle_byte+0xc/0xe5
     [<c054df78>] ? acpi_ev_gpe_detect+0xd6/0xe1
     [<c05ec5b0>] uhci_irq+0x110/0x125
     [<c05d4834>] usb_hcd_irq+0x40/0xa3
     [<c0465313>] handle_IRQ_event+0x2f/0x64
     [<c046642b>] handle_level_irq+0x74/0xbe
     [<c04663b7>] ? handle_level_irq+0x0/0xbe
     [<c0406e6e>] do_IRQ+0xc7/0xfe
     [<c0405668>] common_interrupt+0x28/0x30
     [<c056821a>] ? acpi_idle_enter_simple+0x162/0x19d
     [<c0617f52>] cpuidle_idle_call+0x60/0x92
     [<c0403c61>] cpu_idle+0x101/0x134
     [<c069b1ba>] rest_init+0x4e/0x50
     =======================
    ---[ end trace b7cc8076093467ad ]---
    ------------[ cut here ]------------
    WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4()
    [...]
    Pid: 0, comm: swapper Tainted: G        W 2.6.27.25-170.2.72.fc10.i686
     [<c042ddfb>] warn_on_slowpath+0x65/0x8b
     [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
     [<c04228b4>] ? __enqueue_entity+0xe3/0xeb
     [<c042431e>] ? enqueue_entity+0x203/0x20b
     [<c0424361>] ? enqueue_task_fair+0x3b/0x3f
     [<c041f88c>] ? resched_task+0x3a/0x6e
     [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
     [<c06ab4e2>] ? _spin_lock_bh+0xb/0x16
     [<f8b6f642>] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss]
     [<c04325f9>] _local_bh_enable_ip+0x3d/0xc4
     [<c0432688>] local_bh_enable_ip+0x8/0xa
     [<c06ab54d>] _spin_unlock_bh+0x11/0x13
     [<f8b6f642>] mkiss_receive_buf+0x33d/0x3a6 [mkiss]
     [<c0572a30>] flush_to_ldisc+0xf7/0x198
     [<c0572b12>] tty_flip_buffer_push+0x41/0x51
     [<f89477f2>] ftdi_process_read+0x375/0x4ad [ftdi_sio]
     [<f8947a5a>] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
     [<c05d4bec>] usb_hcd_giveback_urb+0x63/0x93
     [<c05ea290>] uhci_giveback_urb+0xe5/0x15f
     [<c05eaabf>] uhci_scan_schedule+0x52e/0x767
     [<c05f6288>] ? psmouse_handle_byte+0xc/0xe5
     [<c054df78>] ? acpi_ev_gpe_detect+0xd6/0xe1
     [<c05ec5b0>] uhci_irq+0x110/0x125
     [<c05d4834>] usb_hcd_irq+0x40/0xa3
     [<c0465313>] handle_IRQ_event+0x2f/0x64
     [<c046642b>] handle_level_irq+0x74/0xbe
     [<c04663b7>] ? handle_level_irq+0x0/0xbe
     [<c0406e6e>] do_IRQ+0xc7/0xfe
     [<c0405668>] common_interrupt+0x28/0x30
     [<c056821a>] ? acpi_idle_enter_simple+0x162/0x19d
     [<c0617f52>] cpuidle_idle_call+0x60/0x92
     [<c0403c61>] cpu_idle+0x101/0x134
     [<c069b1ba>] rest_init+0x4e/0x50
     =======================
    ---[ end trace b7cc8076093467ad ]---
    mkiss: ax0: Trying crc-smack
    mkiss: ax0: Trying crc-flexnet
    
    The issue was, that the locking code in mkiss was assuming it was only
    ever being called in process or bh context.  Fixed by converting the
    involved locking code to use irq-safe locks.
    
    Review of other networking line disciplines shows that 6pack, both sync
    and async PPP and STRIP have similar issues.  The ppp_async one is the
    most interesting one as it sorts out half of the issue as far back as
    2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d
    
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Reported-by: Guido Trentalancia <guido@trentalancia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ralfbaechle committed with gregkh Jul 28, 2009
  3. E100: work around the driver using streaming DMA mapping for RX descr…

    …iptors.
    
    [ Upstream commit 303d67c ]
    
    E100 places it's RX packet descriptors inside skb->data and uses them
    with bidirectional streaming DMA mapping. Unfortunately it fails to
    transfer skb->data ownership to the device after it reads the
    descriptor's status, breaking on non-coherent (e.g., ARM) platforms.
    
    This have to be converted to use coherent memory for the descriptors.
    
    Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
    Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Krzysztof Halasa committed with gregkh Jul 14, 2009
  4. r8169: avoid losing MSI interrupts

    [ Upstream commit f11a377 ]
    
    The 8169 chip only generates MSI interrupts when all enabled event
    sources are quiescent and one or more sources transition to active. If
    not all of the active events are acknowledged, or a new event becomes
    active while the existing ones are cleared in the handler, we will not
    see a new interrupt.
    
    The current interrupt handler masks off the Rx and Tx events once the
    NAPI handler has been scheduled, which opens a race window in which we
    can get another Rx or Tx event and never ACK'ing it, stopping all
    activity until the link is reset (ifconfig down/up). Fix this by always
    ACK'ing all event sources, and loop in the handler until we have all
    sources quiescent.
    
    Signed-off-by: David Dillow <dave@thedillows.org>
    Tested-by: Michael Buesch <mb@bu3sch.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    dillow committed with gregkh Jul 22, 2009
  5. usbnet cdc_subset: fix issues talking to PXA gadgets

    [ Upstream commit 6be8325 ]
    
    The host-side CDC subset driver is binding more specifically
    than it should ... only to PXA 210/25x/26x Linux-USB gadgets.
    
    Loosen that restriction to match the gadget driver driver.
    This will various PXA 27x and PXA 3xx devices happier when
    talking to Linux hosts, potentially others.
    
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Tested-by: Aric D. Blumer <aric@sdgsystems.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    David Brownell committed with gregkh Jun 20, 2009
  6. x25: Fix sleep from timer on socket destroy.

    [ Upstream commit 14ebaf8 ]
    
    If socket destuction gets delayed to a timer, we try to
    lock_sock() from that timer which won't work.
    
    Use bh_lock_sock() in that case.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Tested-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    davem330 committed with gregkh Jun 16, 2009
  7. sky2: Fix checksum endianness

    [ Upstream commit b938979 ]
    
    sky2 driver on PowerPC targets floods kernel log with following errors:
    
      eth1: hw csum failure.
      Call Trace:
      [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable)
      [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c
      [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84
      [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24
      [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8
      [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210
      [ef84b960] [c031a788] ip_rcv+0x38c/0x534
      [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c
      [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8
      [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144
    
    The NIC is Yukon-2 EC chip revision 1.
    
    Converting checksum field from le16 to CPU byte order fixes the issue.
    
    Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Anton Vorontsov committed with gregkh Jun 26, 2009