Permalink
Commits on May 16, 2010
  1. Linus 2.6.34

    torvalds committed May 16, 2010
  2. Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    torvalds committed May 16, 2010
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      rtnetlink: make SR-IOV VF interface symmetric
      sctp: delete active ICMP proto unreachable timer when free transport
      tcp: fix MD5 (RFC2385) support
  3. Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-…

    torvalds committed May 16, 2010
    …linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      MIPS: Oprofile: Fix Loongson irq handler
      MIPS: N32: Use compat version for sys_ppoll.
      MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1
  4. rtnetlink: make SR-IOV VF interface symmetric

    chriswright authored and davem330 committed May 16, 2010
    Now we have a set of nested attributes:
    
      IFLA_VFINFO_LIST (NESTED)
        IFLA_VF_INFO (NESTED)
          IFLA_VF_MAC
          IFLA_VF_VLAN
          IFLA_VF_TX_RATE
    
    This allows a single set to operate on multiple attributes if desired.
    Among other things, it means a dump can be replayed to set state.
    
    The current interface has yet to be released, so this seems like
    something to consider for 2.6.34.
    
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  5. sctp: delete active ICMP proto unreachable timer when free transport

    Wei Yongjun authored and davem330 committed May 9, 2010
    transport may be free before ICMP proto unreachable timer expire, so
    we should delete active ICMP proto unreachable timer when transport
    is going away.
    
    Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
    Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
  6. tcp: fix MD5 (RFC2385) support

    Eric Dumazet authored and davem330 committed May 16, 2010
    TCP MD5 support uses percpu data for temporary storage. It currently
    disables preemption so that same storage cannot be reclaimed by another
    thread on same cpu.
    
    We also have to make sure a softirq handler wont try to use also same
    context. Various bug reports demonstrated corruptions.
    
    Fix is to disable preemption and BH.
    
    Reported-by: Bhaskar Dutta <bhaskie@gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Commits on May 15, 2010
  1. MIPS: Oprofile: Fix Loongson irq handler

    lzufalcon authored and ralfbaechle committed May 6, 2010
        
        The interrupt enable bit for the performance counters is in the Control
        Register $24, not in the counter register.
        loongson2_perfcount_handler(), we need to use
        
        Reported-by: Xu Hengyang <hengyang@mail.ustc.edu.cn>
        Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
        Cc: linux-mips@linux-mips.org
        Patchwork: http://patchwork.linux-mips.org/patch/1198/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
  2. MIPS: N32: Use compat version for sys_ppoll.

    Chandrakala Chavva authored and ralfbaechle committed May 11, 2010
        
        The sys_ppoll() takes struct 'struct timespec'. This is different for the
        N32 and N64 ABIs. Use the compat version to do the proper conversions.
        
        Signed-off-by: David Daney <ddaney@caviumnetworks.com>
        To: linux-mips@linux-mips.org
        Patchwork: http://patchwork.linux-mips.org/patch/1210/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
  3. MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1

    shaneroo authored and ralfbaechle committed May 7, 2010
        
        In the FPU emulator code of the MIPS, the Cause bits of the FCSR register
        are not currently writeable by the ctc1 instruction.  In odd corner cases,
        this can cause problems.  For example, a case existed where a divide-by-zero
        exception was generated by the FPU, and the signal handler attempted to
        restore the FPU registers to their state before the exception occurred.  In
        this particular setup, writing the old value to the FCSR register would
        cause another divide-by-zero exception to occur immediately.  The solution
        is to change the ctc1 instruction emulator code to allow the Cause bits of
        the FCSR register to be writeable.  This is the behaviour of the hardware
        that the code is emulating.
        
        This problem was found by Shane McDonald, but the credit for the fix goes
        to Kevin Kissell.  In Kevin's words:
        
        I submit that the bug is indeed in that ctc_op:  case of the emulator.  The
        Cause bits (17:12) are supposed to be writable by that instruction, but the
        CTC1 emulation won't let them be updated by the instruction.  I think that
        actually if you just completely removed lines 387-388 [...] things would
        work a good deal better.  At least, it would be a more accurate emulation of
        the architecturally defined FPU.  If I wanted to be really, really pedantic
        (which I sometimes do), I'd also protect the reserved bits that aren't
        necessarily writable.
        
        Signed-off-by: Shane McDonald <mcdonald.shane@gmail.com>
        To: anemo@mba.ocn.ne.jp
        To: kevink@paralogos.com
        To: sshtylyov@mvista.com
        Patchwork: http://patchwork.linux-mips.org/patch/1205/
        Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    
    ---
  4. Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable

    torvalds committed May 15, 2010
    * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
      Btrfs: check for read permission on src file in the clone ioctl
  5. lib/btree: fix possible NULL pointer dereference

    kirjanov@gmail.com authored and torvalds committed May 15, 2010
    mempool_alloc() can return null in atomic case.
    
    Signed-off-by: Denis Kirjanov <kirjanov@gmail.com>
    Cc: Joern Engel <joern@logfs.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  6. mmc: at91_mci: modify cache flush routines

    Nicolas Ferre authored and torvalds committed May 15, 2010
    As we were using an internal dma flushing routine, this patch changes to
    the DMA API flush_kernel_dcache_page().  Driver is able to compile now.
    
    [akpm@linux-foundation.org: flush_kernel_dcache_page() comes before kunmap_atomic()]
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  7. Btrfs: check for read permission on src file in the clone ioctl

    djrbliss authored and chrismason-xx committed May 15, 2010
    The existing code would have allowed you to clone a file that was
    only open for writing
    
    Signed-off-by: Chris Mason <chris.mason@oracle.com>
  8. Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    torvalds committed May 15, 2010
    …/git/viro/vfs-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
      JFS: Free sbi memory in error path
      fs/sysv: dereferencing ERR_PTR()
      Fix double-free in logfs
      Fix the regression created by "set S_DEAD on unlink()..." commit
  9. Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/l…

    torvalds committed May 15, 2010
    …inux/kernel/git/tip/linux-2.6-tip
    
    * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf record: Add a fallback to the reference relocation symbol
  10. JFS: Free sbi memory in error path

    Jan Blunck Al Viro
    Jan Blunck authored and Al Viro committed Apr 12, 2010
    I spotted the missing kfree() while removing the BKL.
    
    [akpm@linux-foundation.org: avoid multiple returns so it doesn't happen again]
    Signed-off-by: Jan Blunck <jblunck@suse.de>
    Cc: Dave Kleikamp <shaggy@austin.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  11. fs/sysv: dereferencing ERR_PTR()

    error27 authored and Al Viro committed Apr 21, 2010
    I moved the dir_put_page() inside the if condition so we don't dereference
    "page", if it's an ERR_PTR().
    
    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  12. Fix double-free in logfs

    Al Viro
    Al Viro committed Apr 29, 2010
    iput() is needed *until* we'd done successful d_alloc_root()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  13. Fix the regression created by "set S_DEAD on unlink()..." commit

    Al Viro
    Al Viro committed Apr 30, 2010
    1) i_flags simply doesn't work for mount/unlink race prevention;
    we may have many links to file and rm on one of those obviously
    shouldn't prevent bind on top of another later on.  To fix it
    right way we need to mark _dentry_ as unsuitable for mounting
    upon; new flag (DCACHE_CANT_MOUNT) is protected by d_flags and
    i_mutex on the inode in question.  Set it (with dont_mount(dentry))
    in unlink/rmdir/etc., check (with cant_mount(dentry)) in places
    in namespace.c that used to check for S_DEAD.  Setting S_DEAD
    is still needed in places where we used to set it (for directories
    getting killed), since we rely on it for readdir/rmdir race
    prevention.
    
    2) rename()/mount() protection has another bogosity - we unhash
    the target before we'd checked that it's not a mountpoint.  Fixed.
    
    3) ancient bogosity in pivot_root() - we locked i_mutex on the
    right directory, but checked S_DEAD on the different (and wrong)
    one.  Noticed and fixed.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  14. Merge master.kernel.org:/home/rmk/linux-2.6-arm

    torvalds committed May 15, 2010
    * master.kernel.org:/home/rmk/linux-2.6-arm:
      ARM: 6126/1: ARM mpcore_wdt: fix build failure and other fixes
      ARM: 6125/1: ARM TWD: move TWD registers to common header
      ARM: 6110/1: Fix Thumb-2 kernel builds when UACCESS_WITH_MEMCPY is enabled
      ARM: 6112/1: Use the Inner Shareable I-cache and BTB ops on ARMv7 SMP
      ARM: 6111/1: Implement read/write for ownership in the ARMv6 DMA cache ops
      ARM: 6106/1: Implement copy_to_user_page() for noMMU
      ARM: 6105/1: Fix the __arm_ioremap_caller() definition in nommu.c
  15. Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/li…

    torvalds committed May 15, 2010
    …nux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86, mrst: Don't blindly access extended config space
  16. profile: fix stats and data leakage

    Hugh Dickins authored and torvalds committed May 15, 2010
    If the kernel is large or the profiling step small, /proc/profile
    leaks data and readprofile shows silly stats, until readprofile -r
    has reset the buffer: clear the prof_buffer when it is vmalloc()ed.
    
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: stable@kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  17. hughd: update email address

    Hugh Dickins authored and torvalds committed May 15, 2010
    My old address will shut down in a couple of weeks: update the tree.
    
    Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commits on May 14, 2010
  1. x86, mrst: Don't blindly access extended config space

    H. Peter Anvin
    H. Peter Anvin committed May 14, 2010
    Do not blindly access extended configuration space unless we actively
    know we're on a Moorestown platform.  The fixed-size BAR capability
    lives in the extended configuration space, and thus is not applicable
    if the configuration space isn't appropriately sized.
    
    This fixes booting certain VMware configurations with CONFIG_MRST=y.
    
    Moorestown will add a fake PCI-X 266 capability to advertise the
    presence of extended configuration space.
    
    Reported-and-tested-by: Petr Vandrovec <petr@vandrovec.name>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Acked-by: Jacob Pan <jacob.jun.pan@intel.com>
    Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    LKML-Reference: <AANLkTiltKUa3TrKR1M51eGw8FLNoQJSLT0k0_K5X3-OJ@mail.gmail.com>
  2. Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/li…

    torvalds committed May 14, 2010
    …nux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86, cacheinfo: Turn off L3 cache index disable feature in virtualized environments
      x86, k8: Fix build error when K8_NB is disabled
      x86, amd: Check X86_FEATURE_OSVW bit before accessing OSVW MSRs
      x86: Fix fake apicid to node mapping for numa emulation
  3. x86, cacheinfo: Turn off L3 cache index disable feature in virtualize…

    Frank Arnold H. Peter Anvin
    Frank Arnold authored and H. Peter Anvin committed Apr 22, 2010
    …d environments
    
    When running a quest kernel on xen we get:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
    IP: [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df
    PGD 0
    Oops: 0000 [#1] SMP
    last sysfs file:
    CPU 0
    Modules linked in:
    
    Pid: 0, comm: swapper Tainted: G        W  2.6.34-rc3 #1 /HVM domU
    RIP: 0010:[<ffffffff8142f2fb>]  [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x
    2ca/0x3df
    RSP: 0018:ffff880002203e08  EFLAGS: 00010046
    RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000060
    RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000
    RBP: ffff880002203ed8 R08: 00000000000017c0 R09: ffff880002203e38
    R10: ffff8800023d5d40 R11: ffffffff81a01e28 R12: ffff880187e6f5c0
    R13: ffff880002203e34 R14: ffff880002203e58 R15: ffff880002203e68
    FS:  0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000038 CR3: 0000000001a3c000 CR4: 00000000000006f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process swapper (pid: 0, threadinfo ffffffff81a00000, task ffffffff81a44020)
    Stack:
     ffffffff810d7ecb ffff880002203e20 ffffffff81059140 ffff880002203e30
    <0> ffffffff810d7ec9 0000000002203e40 000000000050d140 ffff880002203e70
    <0> 0000000002008140 0000000000000086 ffff880040020140 ffffffff81068b8b
    Call Trace:
     <IRQ>
     [<ffffffff810d7ecb>] ? sync_supers_timer_fn+0x0/0x1c
     [<ffffffff81059140>] ? mod_timer+0x23/0x25
     [<ffffffff810d7ec9>] ? arm_supers_timer+0x34/0x36
     [<ffffffff81068b8b>] ? hrtimer_get_next_event+0xa7/0xc3
     [<ffffffff81058e85>] ? get_next_timer_interrupt+0x19a/0x20d
     [<ffffffff8142fa23>] get_cpu_leaves+0x5c/0x232
     [<ffffffff8106a7b1>] ? sched_clock_local+0x1c/0x82
     [<ffffffff8106a9a0>] ? sched_clock_tick+0x75/0x7a
     [<ffffffff8107748c>] generic_smp_call_function_single_interrupt+0xae/0xd0
     [<ffffffff8101f6ef>] smp_call_function_single_interrupt+0x18/0x27
     [<ffffffff8100a773>] call_function_single_interrupt+0x13/0x20
     <EOI>
     [<ffffffff8143c468>] ? notifier_call_chain+0x14/0x63
     [<ffffffff810295c6>] ? native_safe_halt+0xc/0xd
     [<ffffffff810114eb>] ? default_idle+0x36/0x53
     [<ffffffff81008c22>] cpu_idle+0xaa/0xe4
     [<ffffffff81423a9a>] rest_init+0x7e/0x80
     [<ffffffff81b10dd2>] start_kernel+0x40e/0x419
     [<ffffffff81b102c8>] x86_64_start_reservations+0xb3/0xb7
     [<ffffffff81b103c4>] x86_64_start_kernel+0xf8/0x107
    Code: 14 d5 40 ff ae 81 8b 14 02 31 c0 3b 15 47 1c 8b 00 7d 0e 48 8b 05 36 1c 8b
     00 48 63 d2 48 8b 04 d0 c7 85 5c ff ff ff 00 00 00 00 <8b> 70 38 48 8d 8d 5c ff
     ff ff 48 8b 78 10 ba c4 01 00 00 e8 eb
    RIP  [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df
     RSP <ffff880002203e08>
    CR2: 0000000000000038
    ---[ end trace a7919e7f17c0a726 ]---
    
    The L3 cache index disable feature of AMD CPUs has to be disabled if the
    kernel is running as guest on top of a hypervisor because northbridge
    devices are not available to the guest. Currently, this fixes a boot
    crash on top of Xen. In the future this will become an issue on KVM as
    well.
    
    Check if northbridge devices are present and do not enable the feature
    if there are none.
    
    [ hpa: backported to 2.6.34 ]
    
    Signed-off-by: Frank Arnold <frank.arnold@amd.com>
    LKML-Reference: <1271945222-5283-3-git-send-email-bp@amd64.org>
    Acked-by: Borislav Petkov <borislav.petkov@amd.com>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: <stable@kernel.org>
  4. x86, k8: Fix build error when K8_NB is disabled

    Borislav Petkov H. Peter Anvin
    Borislav Petkov authored and H. Peter Anvin committed Apr 24, 2010
    K8_NB depends on PCI and when the last is disabled (allnoconfig) we fail
    at the final linking stage due to missing exported num_k8_northbridges.
    Add a header stub for that.
    
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
    LKML-Reference: <20100503183036.GJ26107@aftab>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: <stable@kernel.org>
  5. Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify

    torvalds committed May 14, 2010
    * 'for-linus' of git://git.infradead.org/users/eparis/notify:
      inotify: don't leak user struct on inotify release
      inotify: race use after free/double free in inotify inode marks
      inotify: clean up the inotify_add_watch out path
      Inotify: undefined reference to `anon_inode_getfd'
    
    Manual merge to remove duplicate "select ANON_INODES" from Kconfig file
  6. Merge branch 'davinci-fixes-for-linus-2' of git://git.kernel.org/pub/…

    torvalds committed May 14, 2010
    …scm/linux/kernel/git/khilman/linux-davinci
    
    * 'davinci-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-davinci:
      DA830: fix USB 2.0 clock entry
  7. DA830: fix USB 2.0 clock entry

    Sergei Shtylyov Kevin Hilman
    Sergei Shtylyov authored and Kevin Hilman committed May 13, 2010
    DA8xx OHCI driver fails to load due to failing clk_get() call for the USB 2.0
    clock. Arrange matching USB 2.0 clock by the clock name instead of the device.
    (Adding another CLK() entry for "ohci.0" device won't do -- in the future I'll
    also have to enable USB 2.0 clock to configure CPPI 4.1 module, in which case
    I won't have any device at all.)
    
    Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
  8. inotify: don't leak user struct on inotify release

    xemul authored and eparis committed May 12, 2010
    inotify_new_group() receives a get_uid-ed user_struct and saves the
    reference on group->inotify_data.user.  The problem is that free_uid() is
    never called on it.
    
    Issue seem to be introduced by 63c882a (inotify: reimplement inotify
    using fsnotify) after 2.6.30.
    
    Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
    Eric Paris <eparis@parisplace.org>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Eric Paris <eparis@redhat.com>
  9. inotify: race use after free/double free in inotify inode marks

    eparis committed May 11, 2010
    There is a race in the inotify add/rm watch code.  A task can find and
    remove a mark which doesn't have all of it's references.  This can
    result in a use after free/double free situation.
    
    Task A					Task B
    ------------				-----------
    inotify_new_watch()
     allocate a mark (refcnt == 1)
     add it to the idr
    					inotify_rm_watch()
    					 inotify_remove_from_idr()
    					  fsnotify_put_mark()
    					      refcnt hits 0, free
     take reference because we are on idr
     [at this point it is a use after free]
     [time goes on]
     refcnt may hit 0 again, double free
    
    The fix is to take the reference BEFORE the object can be found in the
    idr.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Cc: <stable@kernel.org>
  10. inotify: clean up the inotify_add_watch out path

    eparis committed May 11, 2010
    inotify_add_watch explictly frees the unused inode mark, but it can just
    use the generic code.  Just do that.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
  11. Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

    torvalds committed May 14, 2010
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      vhost: fix barrier pairing
  12. Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel…

    torvalds committed May 14, 2010
    …/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      mmap_min_addr check CAP_SYS_RAWIO only for write