summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' into for-nextJiri Kosina2010-04-235526-43399/+96455
|\
| * Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6Linus Torvalds2010-04-2216-53/+60
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] zcore: Fix reipl device detection [S390] vdso: use ntp adjusted clock multiplier [S390] cio: use exception-save stsch [S390] add hook to reenable mss after hibernation [S390] cio: allow enable_facility from outside init functions [S390] dasd: fix endless loop in erp
| | * [S390] zcore: Fix reipl device detectionMichael Holzheu2010-04-221-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The reipl device information is passed from the kernel to zfcpdump using a pointer in the lowcore (0xe00) that points to the reipl information Currently if that pointer is not zero, we copy the reipl information. If the pointer is not initialized and points outside the accessible memory, it can happen that the memory copy fails. In that case we currently stop the initialization of zcore which leads to a failing kernel dump. The correct behavior is to disable the reipl after dump and continue with zcore intialization. Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| | * [S390] vdso: use ntp adjusted clock multiplierHendrik Brueckner2010-04-227-12/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit "timekeeping: Fix clock_gettime vsyscall time warp" (0696b711e) introduced the new parameter "mult" to update_vsyscall(). This parameter contains the internal NTP adjusted clock multiplier. The s390x vdso did not use this adjusted multiplier. Instead, it used the constant clock multiplier for gettimeofday() and clock_gettime() variants. This may result in observable time warps as explained in commit 0696b711e. Make the NTP adjusted clock multiplier available to the s390x vdso implementation and use it for time calculations. Cc: <stable@kernel.org> Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| | * [S390] cio: use exception-save stschSebastian Ott2010-04-223-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using stsch on schids with ssid != 0 can lead to an operand exception. Use stsch_err to handle potential exceptions if we fail to reenable mss after hibernation. Cc: <stable@kernel.org> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| | * [S390] add hook to reenable mss after hibernationSebastian Ott2010-04-222-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Reenable multiple subchannel sets after hibernation, prior to the device callbacks. Cc: <stable@kernel.org> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| | * [S390] cio: allow enable_facility from outside init functionsSebastian Ott2010-04-222-23/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prepare chsc_enable_facility to be used from outside init functions. Use static memory for the chsc call and protect its access by a spinlock (although there is no concurrent usage). Cc: <stable@kernel.org> Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| | * [S390] dasd: fix endless loop in erpStefan Haberland2010-04-222-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | If not enough memory is available to build a new erp request it ended up in an endless loop trying to build erp requests. Fixed the loop to proceed the next request instead. Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
| * | Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds2010-04-2212-46/+45
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] bnx2i: Bug fixes related to MTU change issue when there are active iscsi sessions [SCSI] ibmvscsi: fix DMA API misuse [SCSI] wd7000: fix reset handler typo spin_unlock_irq() => spin_lock_irq() [SCSI] zfcp: Fix tracing of requests with error status [SCSI] zfcp: Update MAINTAINERS entry [SCSI] iscsi_tcp: fix relogin/shutdown hang [SCSI] qla2xxx: fix lock imbalance [SCSI] lpfc: fix lock imbalances [SCSI] be2iscsi: fix lock imbalance [SCSI] dpt_i2o: several use after free issues
| | * | [SCSI] bnx2i: Bug fixes related to MTU change issue when there are active ↵Anil Veerabhadrappa2010-04-113-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iscsi sessions bnx2i driver has to wait and cleanup all iscsi endpoints before returning from bnx2i_stop(). This is to make sure all chip resources are freed before chip is reset. As the requirements for 1G and 10G chipsets is different, added per-device 'hba_shutdown_tmo' parameter to adapter structure If the connections are not torn down by the daemon within this timeout period, 'cid's will be leaked in 10G device. 1G devices are more flexible and do not leak any resources because the whole chip ports gets reset when MTU is changed or ethtool selftest is run fixed a minor issue in bnx2i_ep_poll() which unnecessarily forced error return code when driver timed out waiting for TCP connect request to complete Signed-off-by: Anil Veerabhadrappa <anilgv@broadcom.com> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] ibmvscsi: fix DMA API misuseFUJITA Tomonori2010-04-111-27/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ibmvscsi uses dma_unmap_single() for buffers mapped via dma_map_sg(). It works however it's the API violation. The DMA debug facility complains about it: http://marc.info/?l=linux-scsi&m=127018555013151&w=2 Reported-by: Sachin Sant <sachinp@in.ibm.com> Tested-by: Sachin Sant <sachinp@in.ibm.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] wd7000: fix reset handler typo spin_unlock_irq() => spin_lock_irq()Dan Carpenter2010-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was introduced back in 2005 at the very start of the git era by: df0ae2497ddefd72a87f3a3b34ff32455d7d4ae0 [SCSI] allow sleeping in ->eh_host_reset_handler() Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] zfcp: Fix tracing of requests with error statusChristof Schmitt2010-04-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a FSF request is returned with an error it should be reported through blktrace for the ziomon tools, but the latency information should not be read. Fix this by also calling zfcp_fsf_req_trace for the error case, but skip reading the latencies inside the function. Reviewed-by: Swen Schillig <swen@vnet.ibm.com> Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] zfcp: Update MAINTAINERS entryChristof Schmitt2010-04-111-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Martin no longer works on zfcp, remove his entry from the MAINTAINERS file and add Swen as co-maintainer. Also remove the reference to the zfcpdump.txt file, zfcpdump is not part of the zfcp device driver. Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com> Acked-by: Martin Peschke <mpeschke@linux.vnet.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] iscsi_tcp: fix relogin/shutdown hangMike Christie2010-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When I made this patch: b64e77f70b8c11766e967e3485331a9e6ef01390 it was to solve a problem where we were already on the waitqueue becuase a connection problem/logout caused us to be on there when we were cleaning up the session. If we happen to get on queue for more normal reasons like their just does not happen to be any send space at the same time we are closing the connection we hit a race and get stuck in the wait. We should not check if the waitqueue is active because we could race with the network code. If the network xmit code is just about to enter the prepare to wait when we check for the waitqueue to be active then we will miss each other and the network code will fall into the wait and we will not run wake_up. Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] qla2xxx: fix lock imbalanceJiri Slaby2010-04-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stanse found that one error path in qla24xx_bsg_timeout omits to unlock ha->hardware_lock. Fix that. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] lpfc: fix lock imbalancesJiri Slaby2010-04-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stanse found that two error paths in lpfc_bsg_rport_els_cmp and lpfc_issue_ct_rsp_cmp omits to unlock phba->ct_ev_lock. It is because they wrongly unlock phba->hbalock instead. Fix that. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: James Smart <james.smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] be2iscsi: fix lock imbalanceJiri Slaby2010-04-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stanse found that one error path in mgmt_invalidate_icds omits to unlock ctrl->mbox_lock. Fix that. Added in 756d29c8c7ed8887ed7d752371ce2f (Enable async mode for mcc rings) where the spinlock was moved. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: Jayamohan Kallickal <jayamohank@serverengines.com> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| | * | [SCSI] dpt_i2o: several use after free issuesDan Carpenter2010-04-081-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | adpt_i2o_delete_hba() calls kfree() so we have to save "pHba->next" before calling it. Also inside adpt_i2o_delete_hba() itself, there was another use after free bug which I fixed by moving the kfree() down a line. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
| * | | virtio: Fix GFP flags passed from the virtio balloon driverBalbir Singh2010-04-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The virtio balloon driver can dig into the reservation pools of the OS to satisfy a balloon request. This is not advisable and other balloon drivers (drivers/xen/balloon.c) avoid this as well. The patch also adds changes to avoid printing a warning if allocation fails, since we retry after sometime anyway. Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Cc: kvm <kvm@vger.kernel.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | Merge branch 'for-linus/i2c' of git://git.fluff.org/bjdooks/linuxLinus Torvalds2010-04-224-8/+18
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'for-linus/i2c' of git://git.fluff.org/bjdooks/linux: i2c-stu300: off by one issue i2c-pnx: Add stop conditions for end of transfer i2c-pnx: Limit maximum divider to 1023 i2c-omap: fix OOPS in omap_i2c_unidle() during probe i2c-imx: fix error handling
| | * | | i2c-stu300: off by one issueDan Carpenter2010-04-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we don't find the correct rate, we want to end the loop with "i" pointing to the last element in the array. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
| | * | | i2c-pnx: Add stop conditions for end of transferKevin Wells2010-04-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a stop condition bit flag to the last byte in the transfer. This will generate an extra clock to handle the stop condition and prevent devices from staying in an ACK'd state. Signed-off-by: Kevin Wells <wellsk40@gmail.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
| | * | | i2c-pnx: Limit maximum divider to 1023Kevin Wells2010-04-201-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Limit maximum divider to 0x3ff to divider computations. On high I2C parent clock rates, the divider can exceed 0x3ff. This will help prevent some very odd clock rates. Signed-off-by: Kevin Wells <wellsk40@gmail.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
| | * | | i2c-omap: fix OOPS in omap_i2c_unidle() during probeMika Westerberg2010-04-201-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit d84d3ea317ce0db89ce0903b4037f800c5d4c477 added register shift to allow also 16-bit register access. However, omap_i2c_unidle() is called before these are set which causes the following OOPS: Unhandled fault: alignment exception (0x801) at 0xfa070009 Internal error: : 801 [#1] last sysfs file: Modules linked in: CPU: 0 Not tainted (2.6.34-rc2-00052-gae6be51 #3) PC is at omap_i2c_unidle+0x44/0x138 LR is at trace_hardirqs_on_caller+0x158/0x18c pc : [<c01cd2c4>] lr : [<c00743f8>] psr: 20000013 sp : cfc2bf10 ip : 00000009 fp : 00000000 r10: 00000000 r9 : 00000000 r8 : c0378560 r7 : c0378b88 r6 : c0378558 r5 : cfcadc00 r4 : cfcadc00 r3 : 00000009 r2 : fa070000 r1 : 00000000 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5387f Table: 80004019 DAC: 00000017 Process swapper (pid: 1, stack limit = 0xcfc2a2e8) Stack: (0xcfc2bf10 to 0xcfc2c000) bf00: c0372cf8 c027225c 00000000 c0a69678 bf20: cfc3e508 c0500898 c0378560 c0378560 c0500898 cfcac8c0 c04fc280 c017d4f4 bf40: c0378560 c017c63c c0378560 c0378594 c0500898 cfcac8c0 c04fc280 c017c754 bf60: 00000000 c017c6f4 c0500898 c017beac cfc16a5c cfc3fd94 c0023448 c0500898 bf80: c0500898 c017b7d4 c032dc7f 00000093 cfc28d40 c0023448 00000000 c0500898 bfa0: 00000000 00000000 00000000 c017ca48 c0023448 00000000 c001d274 00000000 bfc0: 00000000 c002b344 00000031 00000000 00000000 00000192 00000000 c0023448 bfe0: 00000000 00000000 00000000 c0008578 00000000 c002c304 ffdfffff ffffffff [<c01cd2c4>] (omap_i2c_unidle+0x44/0x138) from [<c027225c>] (omap_i2c_probe+0x1a4/0x398) [<c027225c>] (omap_i2c_probe+0x1a4/0x398) from [<c017d4f4>] (platform_drv_probe+0x18/0x1c) [<c017d4f4>] (platform_drv_probe+0x18/0x1c) from [<c017c63c>] (driver_probe_device+0xc0/0x178) [<c017c63c>] (driver_probe_device+0xc0/0x178) from [<c017c754>] (__driver_attach+0x60/0x84) [<c017c754>] (__driver_attach+0x60/0x84) from [<c017beac>] (bus_for_each_dev+0x44/0x74) [<c017beac>] (bus_for_each_dev+0x44/0x74) from [<c017b7d4>] (bus_add_driver+0x9c/0x218) [<c017b7d4>] (bus_add_driver+0x9c/0x218) from [<c017ca48>] (driver_register+0xa8/0x130) [<c017ca48>] (driver_register+0xa8/0x130) from [<c002b344>] (do_one_initcall+0x5c/0x1b8) [<c002b344>] (do_one_initcall+0x5c/0x1b8) from [<c0008578>] (kernel_init+0x90/0x144) [<c0008578>] (kernel_init+0x90/0x144) from [<c002c304>] (kernel_thread_exit+0x0/0x8) Code: e5942004 e3a0c009 e1a0331c e3a01000 (e18210b3) ---[ end trace 1b75b31a2719ed1c ]--- This patch moves register shift setting before any register accesses are done. Signed-off-by: Mika Westerberg <ext-mika.1.westerberg@nokia.com> Cc: Cory Maccarrone <darkstar6262@gmail.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
| | * | | i2c-imx: fix error handlingArnaud Patard2010-04-201-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Return -ETIMEDOUT on bus busy error - Fix timeout test "time_after(jiffies, orig_jiffies + HZ / 1000)" : By default, HZ=100 on arm. This means that this test has no chances to work and may result in a dead loop. Set timeout to 500ms. - Don't try to send a new message if we failed to transmit previous one. This was preventing to recover from error on my system Signed-off-by: Arnaud Patard <apatard@mandriva.com> Signed-off-by: Ben Dooks <ben-linux@fluff.org>
| * | | | staging: fix dt3155 buildRandy Dunlap2010-04-221-11/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the dt3155 driver is built-in (not as a loadable module), these build errors happen: drivers/staging/dt3155/dt3155_drv.c:1047: error: implicit declaration of function 'request_irq' drivers/staging/dt3155/dt3155_drv.c:1048: error: 'IRQF_SHARED' undeclared (first use in this function) drivers/staging/dt3155/dt3155_drv.c:1048: error: 'IRQF_DISABLED' undeclared (first use in this function) drivers/staging/dt3155/dt3155_drv.c:1091: error: implicit declaration of function 'free_irq' so remove the #ifdef MODULE check since it's not needed. Also remove the CONFIG_PCI check since the Kconfig file already requires that. Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Scott Smedley <ss@aao.gov.au> Tested-by: Jan III Sobieski <jan3sobi3ski@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | | Merge branch 'for-linus' of ↵Linus Torvalds2010-04-222-4/+4
| |\ \ \ \ | | |_|_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: security: testing the wrong variable in create_by_name() CRED: Fix a race in creds_are_invalid() in credentials debugging CRED: Fix double free in prepare_usermodehelper_creds() error handling
| | * | | security: testing the wrong variable in create_by_name()Dan Carpenter2010-04-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a typo here. We should be testing "*dentry" instead of "dentry". If "*dentry" is an ERR_PTR, it gets dereferenced in either mkdir() or create() which would cause an OOPs. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: James Morris <jmorris@namei.org>
| | * | | CRED: Fix a race in creds_are_invalid() in credentials debuggingDavid Howells2010-04-221-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | creds_are_invalid() reads both cred->usage and cred->subscribers and then compares them to make sure the number of processes subscribed to a cred struct never exceeds the refcount of that cred struct. The problem is that this can cause a race with both copy_creds() and exit_creds() as the two counters, whilst they are of atomic_t type, are only atomic with respect to themselves, and not atomic with respect to each other. This means that if creds_are_invalid() can read the values on one CPU whilst they're being modified on another CPU, and so can observe an evolving state in which the subscribers count now is greater than the usage count a moment before. Switching the order in which the counts are read cannot help, so the thing to do is to remove that particular check. I had considered rechecking the values to see if they're in flux if the test fails, but I can't guarantee they won't appear the same, even if they've changed several times in the meantime. Note that this can only happen if CONFIG_DEBUG_CREDENTIALS is enabled. The problem is only likely to occur with multithreaded programs, and can be tested by the tst-eintr1 program from glibc's "make check". The symptoms look like: CRED: Invalid credentials CRED: At include/linux/cred.h:240 CRED: Specified credentials: ffff88003dda5878 [real][eff] CRED: ->magic=43736564, put_addr=(null) CRED: ->usage=766, subscr=766 CRED: ->*uid = { 0,0,0,0 } CRED: ->*gid = { 0,0,0,0 } CRED: ->security is ffff88003d72f538 CRED: ->security {359, 359} ------------[ cut here ]------------ kernel BUG at kernel/cred.c:850! ... RIP: 0010:[<ffffffff81049889>] [<ffffffff81049889>] __invalid_creds+0x4e/0x52 ... Call Trace: [<ffffffff8104a37b>] copy_creds+0x6b/0x23f Note the ->usage=766 and subscr=766. The values appear the same because they've been re-read since the check was made. Reported-by: Roland McGrath <roland@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
| | * | | CRED: Fix double free in prepare_usermodehelper_creds() error handlingDavid Howells2010-04-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch 570b8fb505896e007fd3bb07573ba6640e51851d: Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Date: Tue Mar 30 00:04:00 2010 +0100 Subject: CRED: Fix memory leak in error handling attempts to fix a memory leak in the error handling by making the offending return statement into a jump down to the bottom of the function where a kfree(tgcred) is inserted. This is, however, incorrect, as it does a kfree() after doing put_cred() if security_prepare_creds() fails. That will result in a double free if 'error' is jumped to as put_cred() will also attempt to free the new tgcred record by virtue of it being pointed to by the new cred record. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
| * | | | Merge branch 'for-linus' of ↵Linus Torvalds2010-04-216-6/+12
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: allow 4 coldfire serial ports m68knommu: fix coldfire tcdrain m68knommu: remove a duplicate vector setting line for 68360 Fix m68k-uclinux's rt_sigreturn trampoline m68knommu: correct the CC flags for Coldfire M5272 targets uclinux: error message when FLAT reloc symbol is invalid, v2
| | * | | | m68knommu: allow 4 coldfire serial portsPhilippe De Muyter2010-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix driver/serial/mcf.c for 4-ports coldfire's (e.g. MCF5484). Signed-off-by: Philippe De Muyter <phdm@macqel.be> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| | * | | | m68knommu: fix coldfire tcdrainPhilippe De Muyter2010-04-212-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix tcdrain on coldfire uarts. Currently with coldfire uarts tcdrain returns without waiting for txempty, because (tx)fifosize is 0. Fix that and call uart_update_timeout when setting the baud rate, otherwise tcdrain will wait for an half our :) Also constify mcf_uart_ops. Signed-off-by: Philippe De Muyter <phdm@macqel.be> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| | * | | | m68knommu: remove a duplicate vector setting line for 68360Greg Ungerer2010-04-211-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove a duplicate vector setting line for the 68360 interrupt setup. Pointed out by Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| | * | | | Fix m68k-uclinux's rt_sigreturn trampolineMaxim Kuvyrkov2010-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Maxim Kuvyrkov <maxim@codesourcery.com> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| | * | | | m68knommu: correct the CC flags for Coldfire M5272 targetsPhilip Nye2010-04-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Philip Nye <philipn@engarts.com> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| | * | | | uclinux: error message when FLAT reloc symbol is invalid, v2Jun Sun2010-04-211-1/+1
| | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a cosmetic error in printk. Text segment and data/bss segment are allocated from two different areas. It is not meaningful to give the diff between them in the error reporting messages. Signed-off-by: Jun Sun <jsun@junsun.net> Signed-off-by: Greg Ungerer <gerg@uclinux.org>
| * | | | Merge branch 'for-linus' of ↵Linus Torvalds2010-04-212-2/+9
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6: mc13783-regulator: fix a memory leak in mc13783_regulator_remove regulator: Let drivers know when they use the stub API
| | * | | | mc13783-regulator: fix a memory leak in mc13783_regulator_removeAxel Lin2010-04-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a memory leak by freeing priv in mc13783_regulator_remove Signed-off-by: Axel Lin <axel.lin@gmail.com> Cc: Sascha Hauer <s.hauer@pengutronix.de> Cc: Liam Girdwood <lrg@slimlogic.co.uk> Cc: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
| | * | | | regulator: Let drivers know when they use the stub APIJean Delvare2010-04-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Have the stub variant of regulator_get() return NULL, so that drivers can (but still don't have to) handle this case specifically. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: Jerome Oufella <jerome.oufella@savoirfairelinux.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
| * | | | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfsLinus Torvalds2010-04-216-55/+91
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfs: [LogFS] Split large truncated into smaller chunks [LogFS] Set s_bdi [LogFS] Prevent mempool_destroy NULL pointer dereference [LogFS] Move assertion [LogFS] Plug 8 byte information leak [LogFS] Prevent memory corruption on large deletes [LogFS] Remove unused method Fix trivial conflict with added header includes in fs/logfs/super.c
| | * | | | | [LogFS] Split large truncated into smaller chunksJoern Engel2010-04-201-8/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Truncate would do an almost limitless amount of work without invoking the garbage collector in between. Split it up into more manageable, though still large, chunks. Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Set s_bdiJoern Engel2010-04-171-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since 32a88aa1 sync() was turned into a NOP for logfs. Worse, sync() would not return an error, giving the illusion that writeout had actually happened. Afaics jffs2 was broken as well. Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Prevent mempool_destroy NULL pointer dereferenceJoern Engel2010-04-154-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It would probably be better to just accept NULL pointers in mempool_destroy(). But for the current -rc series let's keep things simple. This patch was lost in the cracks for a while. Kevin Cernekee <cernekee@gmail.com> had to rediscover the problem and send a similar patch because of it. :( Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Move assertionJoern Engel2010-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The assertion is valid independently of the condition. Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Plug 8 byte information leakJoern Engel2010-04-131-10/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Within each journal segment, 8 bytes at offset 24 would remain uninitialized. Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Prevent memory corruption on large deletesJoern Engel2010-04-135-1/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removing sufficiently large files would create aliases for a large number of segments. This in turn results in a large number of journal entries and an overflow of s_je_array. Cheap fix is to add a BUG_ON, turning memory corruption into something annoying, but less dangerous. Real fix is to count the number of affected segments and prevent the problem completely. Signed-off-by: Joern Engel <joern@logfs.org>
| | * | | | | [LogFS] Remove unused methodJoern Engel2010-03-303-28/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All callers are long gone. Signed-off-by: Joern Engel <joern@logfs.org>
| * | | | | | Merge branch 'for-linus' of ↵Linus Torvalds2010-04-217-16/+33
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6: jfs: add jfs specific ->setattr call jfs: fix diAllocExt error in resizing filesystem jfs_dmap.[ch]: trivial typo fix: s/heigth/height/g
OpenPOWER on IntegriCloud