Al Viro [Wed, 21 Mar 2012 02:05:02 +0000 (22:05 -0400)]
ext4: initialization of ext4_li_mtx needs to be done earlier
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 20 Mar 2012 10:00:24 +0000 (06:00 -0400)]
debugfs-related mode_t whack-a-mole
all of those should be umode_t...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Matthew Garrett [Mon, 6 Feb 2012 20:14:40 +0000 (15:14 -0500)]
hfsplus: add an ioctl to bless files
Making an hfsplus partition bootable requires the ability to "bless" a
file by putting its inode number in the volume header. Doing this from
userspace on a mounted filesystem is impractical since the kernel will
write back the original values on unmount. Add an ioctl to allow userspace
to update the volume header information based on the target file.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Matthew Garrett [Thu, 2 Feb 2012 20:39:50 +0000 (15:39 -0500)]
hfsplus: change finder_info to u32
The finder_info block in the hfsplus volume header is currently defined as
an array of 8 bit values, but TN1150 defines it as being an array of 32 bit
values. Fix for convenience.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Matthew Garrett [Tue, 13 Mar 2012 16:10:34 +0000 (12:10 -0400)]
hfsplus: initialise userflags
The userflags field was being written to the filesystem without being
initialised. Make sure it's clear, since otherwise files end up with
garbage attributes.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 14 Feb 2012 22:48:20 +0000 (17:48 -0500)]
qnx4: new helper - try_extent()
checking if an extent is the one we are looking for is done twice
in qnx4_block_map(); gather that code into a helper function.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 14 Feb 2012 01:57:12 +0000 (20:57 -0500)]
qnx4: get rid of qnx4_bread/qnx4_getblk
pointless, since the only caller will want the physical block
number anyway; might as well call qnx4_block_map() and use
sb_bread()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 24 Feb 2012 03:29:17 +0000 (22:29 -0500)]
take removal of PF_FORKNOEXEC to flush_old_exec()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 7 Dec 2011 18:17:19 +0000 (13:17 -0500)]
trim includes in inode.c
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 Feb 2012 06:37:19 +0000 (01:37 -0500)]
um: uml_dup_mmap() relies on ->mmap_sem being held, but activate_mm() doesn't hold it
... while calling uml_dup_mmap()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 Feb 2012 06:33:19 +0000 (01:33 -0500)]
um: embed ->stub_pages[] into mmu_context
seriously, kmalloc() for two-element array of pointers?
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 8 Jan 2012 21:13:28 +0000 (16:13 -0500)]
gadgetfs: list_for_each_safe() misuse
really weirdly spelled "while the list is non-empty, pick its
first element, remove it from the list and free it" kind of loop...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 18 Mar 2012 02:03:58 +0000 (22:03 -0400)]
ocfs2: fix leaks on failure exits in module_init
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 18 Mar 2012 01:29:13 +0000 (21:29 -0400)]
ecryptfs: make register_filesystem() the last potential failure exit
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 22:19:57 +0000 (18:19 -0400)]
ntfs: forgets to unregister sysctls on register_filesystem() failure
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 22:16:24 +0000 (18:16 -0400)]
logfs: missing cleanup on register_filesystem() failure
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 22:14:34 +0000 (18:14 -0400)]
jfs: mising cleanup on register_filesystem() failure
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 20:53:29 +0000 (16:53 -0400)]
make configfs_pin_fs() return root dentry on success
... and make configfs_mnt static
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 20:49:20 +0000 (16:49 -0400)]
configfs: configfs_create_dir() has parent dentry in dentry->d_parent
no need to play sick games with parent item, internal mount, etc.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 20:41:55 +0000 (16:41 -0400)]
configfs: sanitize configfs_create()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 20:24:54 +0000 (16:24 -0400)]
configfs: kill configfs_sb
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 20:13:25 +0000 (16:13 -0400)]
configfs: don't bother with checks for mkdir/rmdir/unlink/symlink in root
just give root directory separate inode_operations without all those
methods...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 07:05:16 +0000 (03:05 -0400)]
__register_binfmt() made void
Just don't pass NULL to it - nobody does, anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 06:55:49 +0000 (02:55 -0400)]
autofs: set things up *before* registering fs type
it's not a serious race, but we really want misc device before anybody
gets to mount this sucker.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 06:52:29 +0000 (02:52 -0400)]
anon_inodes: move allocation of anon_inode into ->mount()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 06:37:05 +0000 (02:37 -0400)]
9p: make register_filesystem() the last failure exit
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 06:17:32 +0000 (02:17 -0400)]
usbfs: kill racy detection of simple_pin_fs()
can check MS_KERNMOUNT in flags now
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 06:13:52 +0000 (02:13 -0400)]
make simple_pin_fs() pass MS_KERNMOUNT - it's a kernel-internal one
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:50:32 +0000 (01:50 -0400)]
ibmasmfs: make register_filesystem the last failure exit
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:37:51 +0000 (01:37 -0400)]
spufs: make register_filesystem the last potential failure exit
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:19:24 +0000 (01:19 -0400)]
kill reiserfs_fs_{i,sb}.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:16:43 +0000 (01:16 -0400)]
move private bits of reiserfs_fs.h to fs/reiserfs/reiserfs.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:06:11 +0000 (01:06 -0400)]
kill pointless includes of reiserfs_fs_{i,sb}.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 05:03:10 +0000 (01:03 -0400)]
move reiserfs_acl.h to fs/reiserfs/acl.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 17 Mar 2012 04:59:06 +0000 (00:59 -0400)]
take private bits of reiserfs_xattr.h to fs/reiserfs/xattr.h
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 18:48:55 +0000 (14:48 -0400)]
vfs: take path_get_longterm() out of write_seqcount scope
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 18:48:29 +0000 (14:48 -0400)]
no need to play with fs->seq in exit_fs()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 12:21:57 +0000 (08:21 -0400)]
switch touch_atime to struct path
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 01:54:32 +0000 (21:54 -0400)]
switch unix_sock to struct path
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 01:51:10 +0000 (21:51 -0400)]
constify path argument of trace_seq_path()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 15 Mar 2012 01:48:20 +0000 (21:48 -0400)]
constify path argument of audit_log_d_path()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 14 Mar 2012 02:06:28 +0000 (22:06 -0400)]
aio: fix the comment in aio_kick_handler()
It should've been changed when queue_work() became
queue_delayed_work(..., 0) in there. It's always had been
about not needing a delay, not about not using specific
function...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 11 Mar 2012 05:59:07 +0000 (00:59 -0500)]
aio: don't bother with cancel_delayed_work() in exit_aio()
__put_ioctx() will cover it anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 11 Mar 2012 05:58:40 +0000 (00:58 -0500)]
aio: use cancel_delayed_work_sync()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 11 Mar 2012 04:14:05 +0000 (23:14 -0500)]
aio: aio_nr_lock is taken only synchronously now
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 11 Mar 2012 04:10:35 +0000 (23:10 -0500)]
aio: aio_nr decrements don't need to be delayed
we can do that right in __put_ioctx(); as the result, the loop
in ioctx_alloc() can be killed.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 6 Mar 2012 19:33:22 +0000 (14:33 -0500)]
aio: don't bother with async freeing on failure in ioctx_alloc()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Kai Bankett [Fri, 17 Feb 2012 04:59:20 +0000 (05:59 +0100)]
fs: initial qnx6fs addition
Adds support for qnx6fs readonly support to the linux kernel.
* Mount option
The option mmi_fs can be used to mount Harman Becker/Audi MMI 3G
HDD qnx6fs filesystems.
* Documentation
A high level filesystem stucture description can be found in the
Documentation/filesystems directory. (qnx6.txt)
* Additional features
- Active (stable) superblock selection
- Superblock checksum check (enforced)
- Supports mount of qnx6 filesystems with to host different endianess
- Automatic endianess detection
- Longfilename support (with non-enfocing crc check)
- All blocksizes (512, 1024, 2048 and 4096 supported)
Signed-off-by: Kai Bankett <chaosman@ontika.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Kai Bankett [Mon, 13 Feb 2012 01:43:41 +0000 (02:43 +0100)]
qnx4fs: small cleanup
Small qnx4 cleanup patch.
- removes .writepage, .write_begin and .write_end (+callback functions)
- removes '.' path checking in namei.c (handled on upper layers)
Signed-off-by: Kai Bankett <chaosman@ontika.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:15:47 +0000 (22:15 -0500)]
vfs: d_alloc_root() gone
all callers converted to d_make_root() by now
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:08:01 +0000 (22:08 -0500)]
tidy up after d_make_root() conversion
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:07:43 +0000 (22:07 -0500)]
minixfs: switch to d_make_root()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:07:07 +0000 (22:07 -0500)]
hfsplus: switch to d_make_root()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:06:33 +0000 (22:06 -0500)]
fat: switch to d_make_root()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 03:04:09 +0000 (22:04 -0500)]
ntfs: switch to d_make_root()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 9 Jan 2012 03:15:13 +0000 (22:15 -0500)]
switch open-coded instances of d_make_root() to new helper
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 02:56:08 +0000 (21:56 -0500)]
procfs: clean proc_fill_super() up
First of all, there's no need to zero ->i_uid/->i_gid on root inode -
both had been set to zero already. Moreover, let's take the iput()
on failure to the failure exit it belongs to...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 02:46:49 +0000 (21:46 -0500)]
... and the same failure exits cleanup for ocfs2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 02:15:58 +0000 (21:15 -0500)]
coda: clean failure exits in coda_fill_super()
same as for cifs, move iput() to the right place, make it unconditional
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 02:06:12 +0000 (21:06 -0500)]
clean up the failure exits in cifs_read_super()
no need to make that iput() conditional, just take it to the right place...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 13 Feb 2012 00:43:17 +0000 (19:43 -0500)]
vfs: turn generic_drop_inode() into static inline
Once upon a time it used to be much bigger, but these days there's
no point whatsoever keeping it in fs/inode.c, especially since
it's not even needed as initializer for ->drop_inode() - it's the
default and leaving ->drop_inode NULL will do just as well.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 12 Feb 2012 07:58:14 +0000 (02:58 -0500)]
ecryptfs: don't bother with ->drop_inode()
generic_drop_inode() is the default
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 12 Feb 2012 07:38:16 +0000 (02:38 -0500)]
vfs: drop_file_write_access() made static
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 6 Feb 2012 17:45:27 +0000 (12:45 -0500)]
vfs: check i_nlink limits in vfs_{mkdir,rename_dir,link}
New field of struct super_block - ->s_max_links. Maximal allowed
value of ->i_nlink or 0; in the latter case all checks still need
to be done in ->link/->mkdir/->rename instances. Note that this
limit applies both to directoris and to non-directories.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Linus Torvalds [Sun, 18 Mar 2012 23:15:34 +0000 (16:15 -0700)]
Linux 3.3
Jason Baron [Fri, 16 Mar 2012 20:34:03 +0000 (16:34 -0400)]
Don't limit non-nested epoll paths
Commit
28d82dc1c4ed ("epoll: limit paths") that I did to limit the
number of possible wakeup paths in epoll is causing a few applications
to longer work (dovecot for one).
The original patch is really about limiting the amount of epoll nesting
(since epoll fds can be attached to other fds). Thus, we probably can
allow an unlimited number of paths of depth 1. My current patch limits
it at 1000. And enforce the limits on paths that have a greater depth.
This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578
Signed-off-by: Jason Baron <jbaron@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sun, 18 Mar 2012 02:22:24 +0000 (19:22 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking changes from David Miller:
"1) icmp6_dst_alloc() returns NULL instead of ERR_PTR() leading to
crashes, particularly during shutdown. Reported by Dave Jones and
fixed by Eric Dumazet.
2) hyperv and wimax/i2400m return NETDEV_TX_BUSY when they have
already freed the SKB, which causes crashes as to the caller this
means requeue the packet. Fixes from Eric Dumazet.
3) usbnet driver doesn't allocate the right amount of headroom on
fresh RX SKBs, fix from Eric Dumazet.
4) Fix regression in ip6_mc_find_dev_rcu(), as an RCU lookup it
abolutely should not take a reference to 'dev', this leads to
leaks. Fix from RonQing Li.
5) Fix netfilter ctnetlink race between delete and timeout expiration.
From Pablo Neira Ayuso.
6) Revert SFQ change which causes regressions, specifically queueing
to tail can lead to unavoidable flow starvation. From Eric
Dumazet.
7) Fix a memory leak and a crash on corrupt firmware files in bnx2x,
from Michal Schmidt."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
netfilter: ctnetlink: fix race between delete and timeout expiration
ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
net/hyperv: fix erroneous NETDEV_TX_BUSY use
net/usbnet: reserve headroom on rx skbs
bnx2x: fix memory leak in bnx2x_init_firmware()
bnx2x: fix a crash on corrupt firmware file
sch_sfq: revert dont put new flow at the end of flows
ipv6: fix icmp6_dst_alloc()
Linus Torvalds [Sat, 17 Mar 2012 16:54:16 +0000 (09:54 -0700)]
Merge branch 'perf-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar.
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf tools, x86: Build perf on older user-space as well
perf tools: Use scnprintf where applicable
perf tools: Incorrect use of snprintf results in SEGV
Pablo Neira Ayuso [Fri, 16 Mar 2012 02:00:34 +0000 (02:00 +0000)]
netfilter: ctnetlink: fix race between delete and timeout expiration
Kerin Millar reported hardlockups while running `conntrackd -c'
in a busy firewall. That system (with several processors) was
acting as backup in a primary-backup setup.
After several tries, I found a race condition between the deletion
operation of ctnetlink and timeout expiration. This patch fixes
this problem.
Tested-by: Kerin Millar <kerframil@gmail.com>
Reported-by: Kerin Millar <kerframil@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
RongQing.Li [Thu, 15 Mar 2012 22:54:14 +0000 (22:54 +0000)]
ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't
need to dev_hold().
With dev_hold(), not corresponding dev_put(), will lead to leak.
[ bug introduced in
96b52e61be1 (ipv6: mcast: RCU conversions) ]
Signed-off-by: RongQing.Li <roy.qing.li@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sat, 17 Mar 2012 00:14:55 +0000 (17:14 -0700)]
Merge branch 'akpm' (more patches from Andrew)
Merge some more email patches from Andrew Morton:
"A couple of nilfs fixes"
* emailed from Andrew Morton <akpm@linux-foundation.org>:
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
nilfs2: clamp ns_r_segments_percentage to [1, 99]
Ryusuke Konishi [Sat, 17 Mar 2012 00:08:39 +0000 (17:08 -0700)]
nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
According to the report from Slicky Devil, nilfs caused kernel oops at
nilfs_load_super_block function during mount after he shrank the
partition without resizing the filesystem:
BUG: unable to handle kernel NULL pointer dereference at
00000048
IP: [<
d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2]
*pde =
00000000
Oops: 0000 [#1] PREEMPT SMP
...
Call Trace:
[<
d0d7a87b>] init_nilfs+0x4b/0x2e0 [nilfs2]
[<
d0d6f707>] nilfs_mount+0x447/0x5b0 [nilfs2]
[<
c0226636>] mount_fs+0x36/0x180
[<
c023d961>] vfs_kern_mount+0x51/0xa0
[<
c023ddae>] do_kern_mount+0x3e/0xe0
[<
c023f189>] do_mount+0x169/0x700
[<
c023fa9b>] sys_mount+0x6b/0xa0
[<
c04abd1f>] sysenter_do_call+0x12/0x28
Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43
20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72
48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00
EIP: [<
d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:
ca9bbdcc
CR2:
0000000000000048
This turned out due to a defect in an error path which runs if the
calculated location of the secondary super block was invalid.
This patch fixes it and eliminates the reported oops.
Reported-by: Slicky Devil <slicky.dvl@gmail.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Slicky Devil <slicky.dvl@gmail.com>
Cc: <stable@vger.kernel.org> [2.6.30+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Haogang Chen [Sat, 17 Mar 2012 00:08:38 +0000 (17:08 -0700)]
nilfs2: clamp ns_r_segments_percentage to [1, 99]
ns_r_segments_percentage is read from the disk. Bogus or malicious
value could cause integer overflow and malfunction due to meaningless
disk usage calculation. This patch reports error when mounting such
bogus volumes.
Signed-off-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 17 Mar 2012 00:04:02 +0000 (17:04 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/linux-security
Pull maintainer update from James Morris:
"Please pull this patch which adds Serge as maintainer of the
capabilities code, as discussed on lwn and the lsm list.
New capabilities must be signed off by the maintainer, and new uses of
any capabilities should at be cc'd to the maintainer."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
MAINTAINERS: Add Serge as maintainer of capabilities
Linus Torvalds [Sat, 17 Mar 2012 00:03:15 +0000 (17:03 -0700)]
Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming
Pull c6x bugfix from Mark Salter:
"Remove dead code from entry.S which causes a build failure when using
a newer assembler (v2.22 complains about it, v2.20 ignores it)."
* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
C6X: remove dead code from entry.S
Anton Blanchard [Fri, 16 Mar 2012 10:28:19 +0000 (10:28 +0000)]
afs: Remote abort can cause BUG in rxrpc code
When writing files to afs I sometimes hit a BUG:
kernel BUG at fs/afs/rxrpc.c:179!
With a backtrace of:
afs_free_call
afs_make_call
afs_fs_store_data
afs_vnode_store_data
afs_write_back_from_locked_page
afs_writepages_region
afs_writepages
The cause is:
ASSERT(skb_queue_empty(&call->rx_queue));
Looking at a tcpdump of the session the abort happens because we
are exceeding our disk quota:
rx abort fs reply store-data error diskquota exceeded (32)
So the abort error is valid. We hit the BUG because we haven't
freed all the resources for the call.
By freeing any skbs in call->rx_queue before calling afs_free_call
we avoid hitting leaking memory and avoid hitting the BUG.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Anton Blanchard [Fri, 16 Mar 2012 10:28:07 +0000 (10:28 +0000)]
afs: Read of file returns EBADMSG
A read of a large file on an afs mount failed:
# cat junk.file > /dev/null
cat: junk.file: Bad message
Looking at the trace, call->offset wrapped since it is only an
unsigned short. In afs_extract_data:
_enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count);
...
if (call->offset < count) {
if (last) {
_leave(" = -EBADMSG [%d < %zu]", call->offset, count);
return -EBADMSG;
}
Which matches the trace:
[cat ] ==> afs_extract_data({65132},{524},1,,65536)
[cat ] <== afs_extract_data() = -EBADMSG [0 < 65536]
call->offset went from 65132 to 0. Fix this by making call->offset an
unsigned int.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mark Salter [Fri, 16 Mar 2012 13:27:57 +0000 (09:27 -0400)]
C6X: remove dead code from entry.S
The ENDPROC() on sys_fadvise64_c6x() in arch/c6x/kernel/entry.S is
outside of the conditional block with the matching ENTRY() macro. This
leads a newer (v2.22 vs. v2.20) assembler to complain:
/tmp/ccGZBaPT.s: Assembler messages:
/tmp/ccGZBaPT.s: Error: .size expression for sys_fadvise64_c6x does not evaluate to a constant
The conditional block became dead code when c6x switched to generic
unistd.h and should be removed along with the offending ENDPROC().
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Eric Dumazet [Wed, 14 Mar 2012 09:21:44 +0000 (09:21 +0000)]
wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.
In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.
In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK
Also increments tx_dropped counter
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 14 Mar 2012 08:53:34 +0000 (08:53 +0000)]
net/hyperv: fix erroneous NETDEV_TX_BUSY use
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.
This is mostly a revert of commit
bf769375c (staging: hv: fix the return
status of netvsc_start_xmit())
In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.
In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 14 Mar 2012 06:56:25 +0000 (06:56 +0000)]
net/usbnet: reserve headroom on rx skbs
network drivers should reserve some headroom on incoming skbs so that we
dont need expensive reallocations, eg forwarding packets in tunnels.
This NET_SKB_PAD padding is done in various helpers, like
__netdev_alloc_skb_ip_align() in this patch, combining NET_SKB_PAD and
NET_IP_ALIGN magic.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Oliver Neukum <oneukum@suse.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Schmidt [Thu, 15 Mar 2012 14:08:29 +0000 (14:08 +0000)]
bnx2x: fix memory leak in bnx2x_init_firmware()
When cycling the interface down and up, bnx2x_init_firmware() knows that
the firmware is already loaded, but nevertheless it allocates certain
arrays anew (init_data, init_ops, init_ops_offsets, iro_arr). The old
arrays are leaked.
Fix the leaks by returning early if the firmware was already loaded.
Because if the firmware is loaded, so are the arrays.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Schmidt [Thu, 15 Mar 2012 14:08:28 +0000 (14:08 +0000)]
bnx2x: fix a crash on corrupt firmware file
If the requested firmware is deemed corrupt and then released, reset the
pointer to NULL in order to avoid double-freeing it in
bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware().
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Tue, 13 Mar 2012 18:04:25 +0000 (18:04 +0000)]
sch_sfq: revert dont put new flow at the end of flows
This reverts commit
d47a0ac7b6 (sch_sfq: dont put new flow at the end of
flows)
As Jesper found out, patch sounded great but has bad side effects.
In stress situation, pushing new flows in front of the queue can prevent
old flows doing any progress. Packets can stay in SFQ queue for
unlimited amount of time.
It's possible to add heuristics to limit this problem, but this would
add complexity outside of SFQ scope.
A more sensible answer to Dave Taht concerns (who reported the issued I
tried to solve in original commit) is probably to use a qdisc hierarchy
so that high prio packets dont enter a potentially crowded SFQ qdisc.
Reported-by: Jesper Dangaard Brouer <jdb@comx.dk>
Cc: Dave Taht <dave.taht@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 14 Mar 2012 21:13:11 +0000 (21:13 +0000)]
ipv6: fix icmp6_dst_alloc()
commit
87a115783 ( ipv6: Move xfrm_lookup() call down into
icmp6_dst_alloc().) forgot to convert one error path, leading
to crashes in mld_sendpack()
Many thanks to Dave Jones for providing a very complete bug report.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
James Morris [Fri, 16 Mar 2012 01:05:48 +0000 (12:05 +1100)]
MAINTAINERS: Add Serge as maintainer of capabilities
Add Serge as maintainer of capabilities, per suggestion on LWN:
http://lwn.net/Articles/486306/
Signed-off-by: James Morris <james.l.morris@oracle.com>
Linus Torvalds [Fri, 16 Mar 2012 00:16:22 +0000 (17:16 -0700)]
Merge branch 'akpm' (Andrew's patch-bomb)
Merge patches from Andrew Morton:
"Nine patches - some bug fixes and some MAINTAINERS fiddling."
* emailed from Andrew Morton <akpm@linux-foundation.org>:
drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
MAINTAINERS: add entry for exynos mipi display drivers
MAINTAINERS: fix link to Gustavo Padovans tree
MAINTAINERS: add Johan to Bluetooth maintainers
MAINTAINERS: Gustavo has moved
prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
rapidio/tsi721: fix bug in register offset definitions
MAINTAINERS: update ST's Mailing list for SPEAr
memcg: free mem_cgroup by RCU to fix oops
Linus Torvalds [Fri, 16 Mar 2012 00:14:35 +0000 (17:14 -0700)]
Merge branch 'i2c-for-linus' of git://git./linux/kernel/git/jdelvare/staging
Pull i2c subsystem fixes from Jean Delvare.
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c-algo-bit: Fix spurious SCL timeouts under heavy load
i2c-core: Comment says "transmitted" but means "received"
Linus Torvalds [Fri, 16 Mar 2012 00:13:39 +0000 (17:13 -0700)]
Merge tag 'hwmon-for-linus' of git://git./linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck.
* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (zl6100) Enable interval between chip accesses for all chips
hwmon: (w83627ehf) Describe undocumented pwm attributes
hwmon: (w83627ehf) Fix temp2 source for W83627UHG
hwmon: (w83627ehf) Fix memory leak in probe function
hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F
Linus Torvalds [Fri, 16 Mar 2012 00:07:25 +0000 (17:07 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm exynos/intel updates from Dave Airlie:
"Two minor updates from Jesse for Intel SNB fixes, and a few fixes from
Samsung for exynos. The pull req has Alan's commit in it since Intel
based their tree on my tree at that time, but it all seems fine wrt
merging."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm exynos: use drm_fb_helper_set_par directly
drm/exynos: Fix fb_videomode <-> drm_mode_modeinfo conversion
drm/exynos: fix runtime_pm fimd device state on probe
drm/exynos: use correct 'exynos-drm' name for platform device
drm/i915: support 32 bit BGR formats in sprite planes
drm/i915: fix color order for BGR formats on SNB
drm/gma500: Fix Cedarview boot failures in 3.3-rc
Linus Torvalds [Fri, 16 Mar 2012 00:06:05 +0000 (17:06 -0700)]
Merge branch 'v4l_for_linus' of git://git./linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"For 4 fixes for 3.3 (all trivial):
- uvc video driver: fixes a division by zero;
- davinci: add module.h to fix compilation;
- smsusb: fix the delivery system setting;
- smsdvb: the get_frontend implementation there is broken.
The smsdvb patch has 127 lines, but it is trivial: instead of
returning a cache of the set_frontend (with is wrong, as it doesn't
have the updated values for the data, and the implementation there is
buggy), it copies the information of the detected DVB parameters from
the smsdvb private structures into the corresponding DVBv5 struct
fields."
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] smsdvb: fix get_frontend
[media] smsusb: fix the default delivery system setting
[media] media: davinci: added module.h to resolve unresolved macros
[media] [FOR,v3.3] uvcvideo: Avoid division by 0 in timestamp calculation
Linus Torvalds [Fri, 16 Mar 2012 00:04:56 +0000 (17:04 -0700)]
Merge branch '3.3-urgent' of git://git./linux/kernel/git/nab/target-pending
Pull target fixes from Nicholas Bellinger:
"This series addresses two recently reported regression bugs related to
legacy SCSI reservation usage in target core, and iscsi-target
reservation conflict handling.
The second patch in particular addresses possible data-corruption with
SCSI reservations that is specific to iscsi-target fabric LUNs with
multiple client writers. Both patches need to go into v3.2 stable
ASAP, and the branch based on the last target-pending/3.3-rc-fixes
HEAD.
Again, thanks to Martin Svec for his help to identify and address this
regression bug with iscsi-target."
* '3.3-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
iscsi-target: Fix reservation conflict -EBUSY response handling bug
target: Fix compatible reservation handling (CRH=1) with legacy RESERVE/RELEASE
Dan Carpenter [Thu, 15 Mar 2012 22:17:12 +0000 (15:17 -0700)]
drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
strict_strtoul() writes a long but ->gamma_mode only has space to store an
int, so on 64 bit systems we end up scribbling over ->gamma_table_count as
well. I've changed it to use kstrtouint() instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Donghwa Lee [Thu, 15 Mar 2012 22:17:11 +0000 (15:17 -0700)]
MAINTAINERS: add entry for exynos mipi display drivers
I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers
who developers for exynos mipi display drivers for
video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*.
Signed-off-by: Donghwa Lee <dh09.lee@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Kukjin Kim <kgene.kim@samsung.com>
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johan Hedberg [Thu, 15 Mar 2012 22:17:11 +0000 (15:17 -0700)]
MAINTAINERS: fix link to Gustavo Padovans tree
Gustavo's tree is called just bluetooth.git and not bluetooth-2.6.git
anymore.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: "Gustavo F. Padovan" <padovan@profusion.mobi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johan Hedberg [Thu, 15 Mar 2012 22:17:11 +0000 (15:17 -0700)]
MAINTAINERS: add Johan to Bluetooth maintainers
I've been coordinating Bluetooth patches in my tree for some time and
it's possible I'll do it in the future too, so add myself to the
Bluetooth sections as well as mention my tree there.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: "Gustavo F. Padovan" <padovan@profusion.mobi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Gustavo Padovan [Thu, 15 Mar 2012 22:17:10 +0000 (15:17 -0700)]
MAINTAINERS: Gustavo has moved
This is going to be the primary e-mail for kernel development.
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cyrill Gorcunov [Thu, 15 Mar 2012 22:17:10 +0000 (15:17 -0700)]
prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
CAP_SYS_ADMIN is already overloaded left and right, so to have more
fine-grained access control use CAP_SYS_RESOURCE here.
The CAP_SYS_RESOUCE is chosen because this prctl option allows a current
process to adjust some fields of memory map descriptor which rather
represents what the process owns: pointers to code, data, stack
segments, command line, auxiliary vector data and etc.
Suggested-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Paul Bolle <pebolle@tiscali.nl>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Alexandre Bounine [Thu, 15 Mar 2012 22:17:09 +0000 (15:17 -0700)]
rapidio/tsi721: fix bug in register offset definitions
Fix indexed register offset definitions that use decimal (wrong) instead
of hexadecimal (correct) notation for indexing multipliers.
Incorrect definitions do not affect Tsi721 driver in its current default
configuration because it uses only IDB queue 0. Loss of inbound
doorbell functionality should be observed if queue other than 0 is used.
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Chul Kim <chul.kim@idt.com>
Cc: <stable@vger.kernel.org> [3.2+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Viresh Kumar [Thu, 15 Mar 2012 22:17:09 +0000 (15:17 -0700)]
MAINTAINERS: update ST's Mailing list for SPEAr
We have created a ST's Mailing list for SPEAr. This can be accessed
from non-st email ids. I want people to cc this list, when they have
changes specific to SPEAr. So, its better to get this updated in
MAINTAINERS file.
linux-arm-kernel@lists.infradead.org is also added for SPEAr.
Signed-off-by: Viresh Kumar <viresh.kumar@st.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This page took 0.04606 seconds and 5 git commands to generate.