1. 22 Jul, 2007 10 commits
  2. 30 May, 2007 1 commit
  3. 24 May, 2007 1 commit
  4. 22 May, 2007 9 commits
  5. 09 May, 2007 1 commit
  6. 04 May, 2007 4 commits
  7. 03 May, 2007 7 commits
    • Jean Delvare's avatar
      hwmon/w83627ehf: Don't redefine REGION_OFFSET · 76e01e5b
      Jean Delvare authored
      On ia64, kernel headers define REGION_OFFSET so we can't use that.
      Reported by Andrew Morton.
      Signed-off-by: default avatarJean Delvare <khali@linux-fr.org>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      76e01e5b
    • Jorge Boncompte's avatar
      [NETFILTER]: ip_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT · c5807ace
      Jorge Boncompte authored
      While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
      and nat modules to a 2.4.32 kernel I noticed that the gre_key function
      returns a wrong pointer to the GRE key of a version 0 packet thus
      corrupting the packet payload.
      
      The intended behaviour for GREv0 packets is to act like
      ip_conntrack_proto_generic/ip_nat_proto_unknown so I have ripped the
      offending functions (not used anymore) and modified the
      ip_nat_proto_gre modules to not touch version 0 (non PPTP) packets.
      Signed-off-by: default avatarJorge Boncompte <jorge@dti2.net>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      c5807ace
    • Hugh Dickins's avatar
      holepunch: fix mmap_sem i_mutex deadlock · 4879e0df
      Hugh Dickins authored
      sys_madvise has down_write of mmap_sem, then madvise_remove calls
      vmtruncate_range which takes i_mutex and i_alloc_sem: no, we can
      easily devise deadlocks from that ordering.
      
      madvise_remove drop mmap_sem while calling vmtruncate_range: luckily,
      since madvise_remove doesn't split or merge vmas, it's easy to handle
      this case with a NULL prev, without restructuring sys_madvise.  (Though
      sad to retake mmap_sem when it's unlikely to be needed, and certainly
      down_read is sufficient for MADV_REMOVE, unlike the other madvices.)
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      4879e0df
    • Hugh Dickins's avatar
      holepunch: fix disconnected pages after second truncate · 7943951f
      Hugh Dickins authored
      shmem_truncate_range has its own truncate_inode_pages_range, to free any
      pages racily instantiated while it was in progress: a SHMEM_PAGEIN flag
      is set when this might have happened.  But holepunching gets no chance
      to clear that flag at the start of vmtruncate_range, so it's always set
      (unless a truncate came just before), so holepunch almost always does
      this second truncate_inode_pages_range.
      
      shmem holepunch has unlikely swap<->file races hereabouts whatever we do
      (without a fuller rework than is fit for this release): I was going to
      skip the second truncate in the punch_hole case, but Miklos points out
      that would make holepunch correctness more vulnerable to swapoff.  So
      keep the second truncate, but follow it by an unmap_mapping_range to
      eliminate the disconnected pages (freed from pagecache while still
      mapped in userspace) that it might have left behind.
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      7943951f
    • Hugh Dickins's avatar
      holepunch: fix shmem_truncate_range punch locking · ffd0472d
      Hugh Dickins authored
      Miklos Szeredi observes that during truncation of shmem page directories,
      info->lock is released to improve latency (after lowering i_size and
      next_index to exclude races); but this is quite wrong for holepunching,
      which receives no such protection from i_size or next_index, and is left
      vulnerable to races with shmem_unuse, shmem_getpage and shmem_writepage.
      
      Hold info->lock throughout when holepunching?  No, any user could prevent
      rescheduling for far too long.  Instead take info->lock just when needed:
      in shmem_free_swp when removing the swap entries, and whenever removing
      a directory page from the level above.  But so long as we remove before
      scanning, we can safely skip taking the lock at the lower levels, except
      at misaligned start and end of the hole.
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      ffd0472d
    • Hugh Dickins's avatar
      holepunch: fix shmem_truncate_range punching too far · 0e846d67
      Hugh Dickins authored
      Miklos Szeredi observes BUG_ON(!entry) in shmem_writepage() triggered
      in rare circumstances, because shmem_truncate_range() erroneously
      removes partially truncated directory pages at the end of the range:
      later reclaim on pages pointing to these removed directories triggers
      the BUG.  Indeed, and it can also cause data loss beyond the hole.
      
      Fix this as in the patch proposed by Miklos, but distinguish between
      "limit" (how far we need to search: ignore truncation's next_index
      optimization in the holepunch case - if there are races it's more
      consistent to act on the whole range specified) and "upper_limit"
      (how far we can free directory pages: generally we must be careful
      to keep partially punched pages, but can relax at end of file -
      i_size being held stable by i_mutex).
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      0e846d67
    • Adrian Bunk's avatar
      Linux 2.6.16.50 · e76e407e
      Adrian Bunk authored
      e76e407e
  8. 01 May, 2007 1 commit
  9. 30 Apr, 2007 2 commits
  10. 25 Apr, 2007 4 commits