- 13 Mar, 2011 1 commit
-
-
Andrea Arcangeli authored
When vmscan.c calls page_referenced(), if an anon page was created before a process forked, rmap will search for it in both of the processes, even though one of them might have since broken COW. If the child process mlocks the vma where the COWed page belongs to, page_referenced() running on the page mapped by the parent would lead to *vm_flags getting VM_LOCKED set erroneously (leading to the references on the parent page being ignored and evicting the parent page too early). *mapcount would also be decremented by page_referenced_one even if the page wasn't found by page_check_address. This also lets pmdp_clear_flush_young_notify() go ahead on a pmd_trans_splitting() pmd. We hold the page_table_lock so __split_huge_page_map() must wait the pmdp_clear_flush_young_notify() to complete before it can modify the pmd. The pmd is also still mapped in userland so the young bit may materialize through a tlb miss before split_huge_page_map runs. This will provide a more accurate page_referenced() behavior during split_huge_page(). Signed-off-by:
Andrea Arcangeli <aarcange@redhat.com> Reported-by:
Michel Lespinasse <walken@google.com> Reviewed-by:
Michel Lespinasse <walken@google.com> Reviewed-by:
Minchan Kim <minchan.kim@gmail.com> Reviewed-by:
Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Rik van Riel<riel@redhat.com> Reviewed-by:
KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
- 11 Mar, 2011 1 commit
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ariadne: remove redundant NULL check ip6ip6: autoload ip6 tunnel net: bridge builtin vs. ipv6 modular ipv6: Don't create clones of host routes. pktgen: fix errata in show results ipv4: Fix erroneous uses of ifa_address. vxge: update MAINTAINERS r6040: bump to version 0.27 and date 23Feb2011 r6040: fix multicast operations rds: prevent BUG_ON triggering on congestion map updates bonding 802.3ad: Rename rx_machine_lock to state_machine_lock bonding 802.3ad: Fix the state machine locking v2 drivers/net/macvtap: fix error check net: fix multithreaded signal handling in unix recv routines net: Enter net/ipv6/ even if CONFIG_IPV6=n net/smsc911x.c: Set the VLAN1 register to fix VLAN MTU problem bnx2x: fix MaxBW configuration bnx2x: (NPAR) prevent HW access in D3 state bnx2x: fix link notification bnx2x: fix non-pmf device load flow Doing my first --no-ff merge here, to get the explicit merge commit. David did a back-merge in order to get commit 8909c9ad ("net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules") so that we can add Stephen Hemminger's fix to handle ip6 tunnels as well, which uses the MODULE_ALIAS_NETDEV() macro created by that change.
-
- 10 Mar, 2011 26 commits
-
-
j223yang@asset.uwaterloo.ca authored
Simply remove redundant 'dev' NULL check. Signed-off-by:
Jinqiu Yang <crindy646@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
stephen hemminger authored
Add necessary alias to autoload ip6ip6 tunnel module. Signed-off-by:
Stephen Hemminger <shemminger@vyatta.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
David S. Miller authored
-
Randy Dunlap authored
When configs BRIDGE=y and IPV6=m, this build error occurs: br_multicast.c:(.text+0xa3341): undefined reference to `ipv6_dev_get_saddr' BRIDGE_IGMP_SNOOPING is boolean; if it were tristate, then adding depends on IPV6 || IPV6=n to BRIDGE_IGMP_SNOOPING would be a good fix. As it is currently, making BRIDGE depend on the IPV6 config works. Reported-by:
Patrick Schaaf <netdev@bof.de> Signed-off-by:
Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6Linus Torvalds authored
* 'media_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] mantis_pci: remove asm/pgtable.h include [media] tda829x: fix regression in probe functions [media] mceusb: don't claim multifunction device non-IR parts [media] nuvoton-cir: fix wake from suspend [media] cx18: Add support for Hauppauge HVR-1600 models with s5h1411 [media] ivtv: Fix corrective action taken upon DMA ERR interrupt to avoid hang [media] cx25840: fix probing of cx2583x chips [media] cx23885: Remove unused 'err:' labels to quiet compiler warning [media] cx23885: Revert "Check for slave nack on all transactions" [media] DiB7000M: add pid filtering [media] Fix sysfs rc protocol lookup for rc-5-sz [media] au0828: fix VBI handling when in V4L2 streaming mode [media] ir-raw: Properly initialize the IR event (BZ#27202) [media] s2255drv: firmware re-loading changes [media] Fix double free of video_device in mem2mem_testdev [media] DM04/QQBOX memcpy to const char fix
-
Doe, YiCheng authored
This patch fixes an issue in OpenIPMI module where sometimes an ABORT command is sent after sending an IPMI request to BMC causing the IPMI request to fail. Signed-off-by:
YiCheng Doe <yicheng.doe@hp.com> Signed-off-by:
Corey Minyard <cminyard@mvista.com> Acked-by:
Tom Mingarelli <thomas.mingarelli@hp.com> Tested-by:
Andy Cress <andy.cress@us.kontron.com> Tested-by:
Mika Lansirine <Mika.Lansirinne@stonesoft.com> Tested-by:
Brian De Wolf <bldewolf@csupomona.edu> Cc: Jean Michel Audet <Jean-Michel.Audet@ca.Kontron.com> Cc: Jozef Sudelsky <jozef.sudolsky@elbiahosting.sk> Acked-by:
Matthew Garrett <mjg@redhat.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6Linus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: fs/dcache: allow d_obtain_alias() to return unhashed dentries Check for immutable/append flag in fallocate path sysctl: the include of rcupdate.h is only needed in the kernel fat: fix d_revalidate oopsen on NFS exports jfs: fix d_revalidate oopsen on NFS exports ocfs2: fix d_revalidate oopsen on NFS exports gfs2: fix d_revalidate oopsen on NFS exports fuse: fix d_revalidate oopsen on NFS exports ceph: fix d_revalidate oopsen on NFS exports reiserfs xattr ->d_revalidate() shouldn't care about RCU /proc/self is never going to be invalidated...
-
Linus Torvalds authored
Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, UV: Initialize the broadcast assist unit base destination node id properly x86, numa: Fix numa_emulation code with memory-less node0 x86, build: Make sure mkpiggy fails on read error
-
Linus Torvalds authored
Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Fix sched rt group scheduling when hierachy is enabled
-
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tipLinus Torvalds authored
* 'perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf symbols: Avoid resolving [kernel.kallsyms] to real path for buildid cache perf symbols: Fix vmlinux path when not using --symfs
-
Takashi Iwai authored
This reverts commit 951f3512 drm/i915: Do not handle backlight combination mode specially since this commit introduced other regressions due to untouched LBPC register, e.g. the backlight dimmed after resume. In addition to the revert, this patch includes a fix for the original issue (weird backlight levels) by removing the wrong bit shift for computing the current backlight level. Also, including typo fixes (lpbc -> lbpc). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34524Acked-by:
Indan Zupancic <indan@nul.nu> Reviewed-by:
Keith Packard <keithp@keithp.com> Reviewed-by:
Jesse Barnes <jbarnes@virtuousgeek.org> Cc: <stable@kernel.org> Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
J. Bruce Fields authored
Without this patch, inodes are not promptly freed on last close of an unlinked file by an nfs client: client$ mount -tnfs4 server:/export/ /mnt/ client$ tail -f /mnt/FOO ... server$ df -i /export server$ rm /export/FOO (^C the tail -f) server$ df -i /export server$ echo 2 >/proc/sys/vm/drop_caches server$ df -i /export the df's will show that the inode is not freed on the filesystem until the last step, when it could have been freed after killing the client's tail -f. On-disk data won't be deallocated either, leading to possible spurious ENOSPC. This occurs because when the client does the close, it arrives in a compound with a putfh and a close, processed like: - putfh: look up the filehandle. The only alias found for the inode will be DCACHE_UNHASHED alias referenced by the filp this, so it creates a new DCACHE_DISCONECTED dentry and returns that instead. - close: closes the existing filp, which is destroyed immediately by dput() since it's DCACHE_UNHASHED. - end of the compound: release the reference to the current filehandle, and dput() the new DCACHE_DISCONECTED dentry, which gets put on the unused list instead of being destroyed immediately. Nick Piggin suggested fixing this by allowing d_obtain_alias to return the unhashed dentry that is referenced by the filp, instead of making it create a new dentry. Leave __d_find_alias() alone to avoid changing behavior of other callers. Also nfsd doesn't need all the checks of __d_find_alias(); any dentry, hashed or unhashed, disconnected or not, should work. Signed-off-by:
J. Bruce Fields <bfields@redhat.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Marco Stornelli authored
In the fallocate path the kernel doesn't check for the immutable/append flag. It's possible to have a race condition in this scenario: an application open a file in read/write and it does something, meanwhile root set the immutable flag on the file, the application at that point can call fallocate with success. In addition, we don't allow to do any unreserve operation on an append only file but only the reserve one. Signed-off-by:
Marco Stornelli <marco.stornelli@gmail.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Stephen Rothwell authored
Fixes this built error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by:
Stephen Rothwell <sfr@canb.auug.org.au> Acked-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
can't blindly check nd->flags in ->d_revalidate() Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
... it returns an error unconditionally Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
Al Viro authored
Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
-
David S. Miller authored
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=29252 Addresses https://bugzilla.kernel.org/show_bug.cgi?id=30462 In commit d80bc0fd ("ipv6: Always clone offlink routes.") we forced the kernel to always clone offlink routes. The reason we do that is to make sure we never bind an inetpeer to a prefixed route. The logic turned on here has existed in the tree for many years, but was always off due to a protecting CPP define. So perhaps it's no surprise that there is a logic bug here. The problem is that we canot clone a route that is already a host route (ie. has DST_HOST set). Because if we do, an identical entry already exists in the routing tree and therefore the ip6_rt_ins() call is going to fail. This sets off a series of failures and high cpu usage, because when ip6_rt_ins() fails we loop retrying this operation a few times in order to handle a race between two threads trying to clone and insert the same host route at the same time. Fix this by simply using the route as-is when DST_HOST is set. Reported-by: slash@ac.auone-net.jp Reported-by:
Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpcLinus Torvalds authored
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/pseries: Disable VPNH feature powerpc/iseries: Fix early init access to lppaca
-
Linus Torvalds authored
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules
-
Stephen Rothwell authored
Fixes this build-check error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
- 09 Mar, 2011 12 commits
-
-
Vasiliy Kulikov authored
Since a8f80e8f any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203Signed-off-by:
Vasiliy Kulikov <segoon@openwall.com> Signed-off-by:
Michael Tokarev <mjt@tls.msk.ru> Acked-by:
David S. Miller <davem@davemloft.net> Acked-by:
Kees Cook <kees.cook@canonical.com> Signed-off-by:
James Morris <jmorris@namei.org>
-
Benjamin Herrenschmidt authored
This feature triggers nasty races in the scheduler between the rebuilding of the topology and the load balancing code, causing the machine to hang. Disable it for now until the races are fixed. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org>
-
Benjamin Herrenschmidt authored
The combination of commit 8154c5d2 and 93c22703 Broke boot on iSeries. The problem is that iSeries very early boot code, which generates the device-tree and runs before our normal early initializations does need access the lppaca's very early, before the PACA array is initialized, and in fact even before the boot PACA has been initialized (it contains all 0's at this stage). However, the first patch above makes that code use the new llpaca_of(cpu) accessor, which itself is changed by the second patch to use the PACA array. We fix that by reverting iSeries to directly dereferencing the array. In addition, we fix all iterators in the iSeries code to always skip CPU whose number is above 63 which is the maximum size of that array and the maximum number of supported CPUs on these machines. Additionally, we make sure the boot_paca is properly initialized in our early startup code. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org>
-
git://linux-nfs.org/~bfields/linuxLinus Torvalds authored
* 'for-2.6.38' of git://linux-nfs.org/~bfields/linux: nfsd: wrong index used in inner loop nfsd4: fix bad pointer on failure to find delegation NFSD: fix decode_cb_sequence4resok
-
Daniel Turull authored
The units in show_results in pktgen were not correct. The results are in usec but it was displayed nsec. Reported-by:
Jong-won Lee <ljw@handong.edu> Signed-off-by:
Daniel Turull <daniel.turull@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdogLinus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: watchdog: sbc_fitpc2_wdt, fix crash on systems without DMI_BOARD_NAME
-
git://git.fluff.org/bjdooks/linuxLinus Torvalds authored
* 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux: i2c-eg20t: include slab.h for memory allocations i2c-ocores: Fix pointer type mismatch error i2c-omap: Program I2C_WE on OMAP4 to enable i2c wakeup
-
Matt Turner authored
Signed-off-by:
Matt Turner <mattst88@gmail.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreqLinus Torvalds authored
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] pcc-cpufreq: don't load driver if get_freq fails during init.
-
git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmcLinus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: fix CONFIG_MMC_UNSAFE_RESUME regression
-
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6Linus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: nd->inode is not set on the second attempt in path_walk() unfuck proc_sysctl ->d_compare() minimal fix for do_filp_open() race
-
Jiri Slaby authored
Some systems don't provide DMI_BOARD_NAME in their DMI tables. Avoid crash in such situations in fitpc2_wdt_init. The fix is to check if the dmi_get_system_info return value is NULL. The oops: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81253ae6>] strstr+0x26/0xa0 PGD 3966e067 PUD 39605067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map CPU 1 Modules linked in: ... Pid: 1748, comm: modprobe Not tainted 2.6.37-22-default #1 /Bochs RIP: 0010:[<ffffffff81253ae6>] [<ffffffff81253ae6>] strstr+0x26/0xa0 RSP: 0018:ffff88003ad73f18 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 00000000ffffffed RCX: 00000000ffffffff RDX: ffffffffa003f4cc RSI: ffffffffa003f4c2 RDI: 0000000000000000 ... CR2: 0000000000000000 CR3: 000000003b7ac000 CR4: 00000000000006e0 ... Process modprobe (pid: 1748, threadinfo ffff88003ad72000, task ffff88002e6365c0) Stack: ... Call Trace: [<ffffffffa004201f>] fitpc2_wdt_init+0x1f/0x13c [sbc_fitpc2_wdt] [<ffffffff810002da>] do_one_initcall+0x3a/0x170 ... Code: f3 c3 0f 1f 00 80 3e 00 53 48 89 f8 74 1b 48 89 f2 0f 1f 40 00 48 83 c2 01 80 3a 00 75 f7 49 89 d0 48 89 f8 49 29 f0 75 02 5b c3 <80> 3f 00 74 0e 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 49 89 Signed-off-by:
Jiri Slaby <jslaby@suse.cz> Signed-off-by:
Wim Van Sebroeck <wim@iguana.be>
-