1. 02 12月, 2010 1 次提交
    • L
      Call the filesystem back whenever a page is removed from the page cache · 6072d13c
      Linus Torvalds 提交于
      NFS needs to be able to release objects that are stored in the page
      cache once the page itself is no longer visible from the page cache.
      
      This patch adds a callback to the address space operations that allows
      filesystems to perform page cleanups once the page has been removed
      from the page cache.
      
      Original patch by: Linus Torvalds <torvalds@linux-foundation.org>
      [trondmy: cover the cases of invalidate_inode_pages2() and
                truncate_inode_pages()]
      Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
      6072d13c
  2. 01 12月, 2010 2 次提交
    • O
      exec: copy-and-paste the fixes into compat_do_execve() paths · 114279be
      Oleg Nesterov 提交于
      Note: this patch targets 2.6.37 and tries to be as simple as possible.
      That is why it adds more copy-and-paste horror into fs/compat.c and
      uglifies fs/exec.c, this will be cleanuped later.
      
      compat_copy_strings() plays with bprm->vma/mm directly and thus has
      two problems: it lacks the RLIMIT_STACK check and argv/envp memory
      is not visible to oom killer.
      
      Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
      to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
      as do_execve() does.
      
      Add the fatal_signal_pending/cond_resched checks into compat_count() and
      compat_copy_strings(), this matches the code in fs/exec.c and certainly
      makes sense.
      Signed-off-by: NOleg Nesterov <oleg@redhat.com>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: stable@kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      114279be
    • O
      exec: make argv/envp memory visible to oom-killer · 3c77f845
      Oleg Nesterov 提交于
      Brad Spengler published a local memory-allocation DoS that
      evades the OOM-killer (though not the virtual memory RLIMIT):
      http://www.grsecurity.net/~spender/64bit_dos.c
      
      execve()->copy_strings() can allocate a lot of memory, but
      this is not visible to oom-killer, nobody can see the nascent
      bprm->mm and take it into account.
      
      With this patch get_arg_page() increments current's MM_ANONPAGES
      counter every time we allocate the new page for argv/envp. When
      do_execve() succeds or fails, we change this counter back.
      
      Technically this is not 100% correct, we can't know if the new
      page is swapped out and turn MM_ANONPAGES into MM_SWAPENTS, but
      I don't think this really matters and everything becomes correct
      once exec changes ->mm or fails.
      Reported-by: NBrad Spengler <spender@grsecurity.net>
      Reviewed-and-discussed-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: NOleg Nesterov <oleg@redhat.com>
      Cc: stable@kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3c77f845
  3. 29 11月, 2010 2 次提交
    • L
      Un-inline get_pipe_info() helper function · 72083646
      Linus Torvalds 提交于
      This avoids some include-file hell, and the function isn't really
      important enough to be inlined anyway.
      Reported-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      72083646
    • L
      Export 'get_pipe_info()' to other users · c66fb347
      Linus Torvalds 提交于
      And in particular, use it in 'pipe_fcntl()'.
      
      The other pipe functions do not need to use the 'careful' version, since
      they are only ever called for things that are already known to be pipes.
      
      The normal read/write/ioctl functions are called through the file
      operations structures, so if a file isn't a pipe, they'd never get
      called.  But pipe_fcntl() is special, and called directly from the
      generic fcntl code, and needs to use the same careful function that the
      splice code is using.
      
      Cc: Jens Axboe <jaxboe@fusionio.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Dave Jones <davej@redhat.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      c66fb347
  4. 26 11月, 2010 3 次提交
  5. 25 11月, 2010 2 次提交
    • K
      memcg: fix false positive VM_BUG on non-SMP · 112bc2e1
      Kirill A. Shutemov 提交于
      Fix this:
      
        kernel BUG at mm/memcontrol.c:2155!
        invalid opcode: 0000 [#1]
        last sysfs file:
      
        Pid: 18, comm: sh Not tainted 2.6.37-rc3 #3 /Bochs
        EIP: 0060:[<c10731b2>] EFLAGS: 00000246 CPU: 0
        EIP is at mem_cgroup_move_account+0xe2/0xf0
        EAX: 00000004 EBX: c6f931d4 ECX: c681c300 EDX: c681c000
        ESI: c681c300 EDI: ffffffea EBP: c681c000 ESP: c46f3e30
         DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
        Process sh (pid: 18, ti=c46f2000 task=c6826e60 task.ti=c46f2000)
        Stack:
         00000155 c681c000 0805f000 c46ee180 c46f3e5c c7058820 c1074d37 00000000
         08060000 c46db9a0 c46ec080 c7058820 0805f000 08060000 c46f3e98 c1074c50
         c106c75e c46f3e98 c46ec080 08060000 0805ffff c46db9a0 c46f3e98 c46e0340
        Call Trace:
         [<c1074d37>] ? mem_cgroup_move_charge_pte_range+0xe7/0x130
         [<c1074c50>] ? mem_cgroup_move_charge_pte_range+0x0/0x130
         [<c106c75e>] ? walk_page_range+0xee/0x1d0
         [<c10725d6>] ? mem_cgroup_move_task+0x66/0x90
         [<c1074c50>] ? mem_cgroup_move_charge_pte_range+0x0/0x130
         [<c1072570>] ? mem_cgroup_move_task+0x0/0x90
         [<c1042616>] ? cgroup_attach_task+0x136/0x200
         [<c1042878>] ? cgroup_tasks_write+0x48/0xc0
         [<c1041e9e>] ? cgroup_file_write+0xde/0x220
         [<c101398d>] ? do_page_fault+0x17d/0x3f0
         [<c108a79d>] ? alloc_fd+0x2d/0xd0
         [<c1041dc0>] ? cgroup_file_write+0x0/0x220
         [<c1077ba2>] ? vfs_write+0x92/0xc0
         [<c1077c81>] ? sys_write+0x41/0x70
         [<c1140e3d>] ? syscall_call+0x7/0xb
        Code: 03 00 74 09 8b 44 24 04 e8 1c f1 ff ff 89 73 04 8d 86 b0 00 00 00 b9 01 00 00 00 89 da 31 ff e8 65 f5 ff ff e9 4d ff ff ff 0f 0b <0f> 0b 0f 0b 0f 0b 90 8d b4 26 00 00 00 00 83 ec 10 8b 0d f4 e3
        EIP: [<c10731b2>] mem_cgroup_move_account+0xe2/0xf0 SS:ESP 0068:c46f3e30
        ---[ end trace 7daa1582159b6532 ]---
      
      lock_page_cgroup and unlock_page_cgroup are implemented using
      bit_spinlock.  bit_spinlock doesn't touch the bit if we are on non-SMP
      machine, so we can't use the bit to check whether the lock was taken.
      
      Let's introduce is_page_cgroup_locked based on bit_spin_is_locked instead
      of PageCgroupLocked to fix it.
      
      [akpm@linux-foundation.org: s/is_page_cgroup_locked/page_is_cgroup_locked/]
      Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
      Reviewed-by: NJohannes Weiner <hannes@cmpxchg.org>
      Acked-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujtisu.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      112bc2e1
    • L
      include/linux/fs.h: fix userspace build · 3a3a1af3
      Loïc Minier 提交于
      dpkg uses fiemap but didn't particularly need to include stdint.h so far.
      Since 367a51a3 ("fs: Add FITRIM ioctl"), build of linux/fs.h failed in
      dpkg with:
      
        In file included from ../../src/filesdb.c:27:0:
        /usr/include/linux/fs.h:37:2: error: expected specifier-qualifier-list before 'uint64_t'
      
      Use exportable type __u64 to avoid the dependency on stdint.h.
      
      b31d42a5 ("Fix compile brekage with !CONFIG_BLOCK") fixed only the
      kernel build by including linux/types.h, but this also fixed "make
      headers_check", so don't revert it.
      Signed-off-by: NLoïc Minier <loic.minier@linaro.org>
      Tested-by: NArnd Bergmann <arnd.bergmann@linaro.org>
      Cc: Lukas Czerner <lczerner@redhat.com>
      Cc: Dmitry Monakhov <dmonakhov@openvz.org>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3a3a1af3
  6. 24 11月, 2010 1 次提交
  7. 23 11月, 2010 3 次提交
  8. 20 11月, 2010 2 次提交
  9. 19 11月, 2010 1 次提交
    • L
      hardirq.h: needs sched.h if using BKL · ed1d77b1
      Linus Torvalds 提交于
      This really isn't the right thing to do, and strictly speaking we should
      have the BKL depth count in the thread info right next to the preempt
      count.  The two really do go together.
      
      However, since that would involve a patch to all architectures, and the
      BKL is finally going away, it's simply not worth the effort to do the
      RightThing(tm).  Just re-instate the <linux/sched.h> include that we
      used to get accidentally from the smp_lock.h one.
      
      This is all fallout from the same old "BKL: remove extraneous #include
      <smp_lock.h>" commit.
      Reported-by: NIngo Molnar <mingo@elte.hu>
      Tested-by: NRandy Dunlap <randy.dunlap@oracle.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ed1d77b1
  10. 18 11月, 2010 3 次提交
  11. 17 11月, 2010 3 次提交
    • D
      fbcmap: integer overflow bug · 1e7c7804
      Dan Carpenter 提交于
      There is an integer overflow in fb_set_user_cmap() because cmap->len * 2
      can wrap.  It's basically harmless.  Your terminal will be messed up
      until you type reset.
      
      This patch does three things to fix the bug.
      
      First, it checks the return value of fb_copy_cmap() in fb_alloc_cmap().
      That is enough to fix address the overflow.
      
      Second it checks for the integer overflow in fb_set_user_cmap().
      
      Lastly I wanted to cap "cmap->len" in fb_set_user_cmap() much lower
      because it gets used to determine the size of allocation.  Unfortunately
      no one knows what the limit should be.  Instead what this patch does
      is makes the allocation happen with GFP_KERNEL instead of GFP_ATOMIC
      and lets the kmalloc() decide what values of cmap->len are reasonable.
      To do this, the patch introduces a function called fb_alloc_cmap_gfp()
      which is like fb_alloc_cmap() except that it takes a GFP flag.
      Signed-off-by: NDan Carpenter <error27@gmail.com>
      Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
      1e7c7804
    • J
      SCSI host lock push-down · f281233d
      Jeff Garzik 提交于
      Move the mid-layer's ->queuecommand() invocation from being locked
      with the host lock to being unlocked to facilitate speeding up the
      critical path for drivers who don't need this lock taken anyway.
      
      The patch below presents a simple SCSI host lock push-down as an
      equivalent transformation.  No locking or other behavior should change
      with this patch.  All existing bugs and locking orders are preserved.
      
      Additionally, add one parameter to queuecommand,
      	struct Scsi_Host *
      and remove one parameter from queuecommand,
      	void (*done)(struct scsi_cmnd *)
      
      Scsi_Host* is a convenient pointer that most host drivers need anyway,
      and 'done' is redundant to struct scsi_cmnd->scsi_done.
      
      Minimal code disturbance was attempted with this change.  Most drivers
      needed only two one-line modifications for their host lock push-down.
      Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
      Acked-by: NJames Bottomley <James.Bottomley@suse.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f281233d
    • J
      nfs: trivial: remove unused nfs_wait_event macro · 5685b971
      Jeff Layton 提交于
      Nothing uses this macro anymore.
      Signed-off-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
      5685b971
  12. 16 11月, 2010 6 次提交
  13. 15 11月, 2010 4 次提交
  14. 13 11月, 2010 1 次提交
  15. 12 11月, 2010 6 次提交
    • A
      backlight: add low threshold to pwm backlight · fef7764f
      Arun Murthy 提交于
      The intensity of the backlight can be varied from a range of
      max_brightness to zero.  Though most, if not all the pwm based backlight
      devices start flickering at lower brightness value.  And also for each
      device there exists a brightness value below which the backlight appears
      to be turned off though the value is not equal to zero.
      
      If the range of brightness for a device is from zero to max_brightness.  A
      graph is plotted for brightness Vs intensity for the pwm based backlight
      device has to be a linear graph.
      
      intensity
      	  |   /
      	  |  /
      	  | /
      	  |/
      	  ---------
      	 0	max_brightness
      
      But pratically on measuring the above we note that the intensity of
      backlight goes to zero(OFF) when the value in not zero almost nearing to
      zero(some x%).  so the graph looks like
      
      intensity
      	  |    /
      	  |   /
      	  |  /
      	  |  |
      	  ------------
      	 0   x	 max_brightness
      
      In order to overcome this drawback knowing this x% i.e nothing but the low
      threshold beyond which the backlight is off and will have no effect, the
      brightness value is being offset by the low threshold value(retaining the
      linearity of the graph).  Now the graph becomes
      
      intensity
      	  |     /
      	  |    /
      	  |   /
      	  |  /
      	  -------------
      	   0	  max_brightness
      
      With this for each and every digit increment in the brightness from zero
      there is a change in the intensity of backlight.  Devices having this
      behaviour can set the low threshold brightness(lth_brightness) and pass
      the same as platform data else can have it as zero.
      
      [akpm@linux-foundation.org: coding-style fixes]
      Signed-off-by: NArun Murthy <arun.murthy@stericsson.com>
      Acked-by: NLinus Walleij <linus.walleij@stericsson.com>
      Acked-by: NRichard Purdie <rpurdie@linux.intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      fef7764f
    • S
      leds: driver for National Semiconductors LP5523 chip · 0efba16c
      Samu Onkalo 提交于
      LP5523 chip is nine channel led driver with programmable engines.  Driver
      provides support for that chip for direct access via led class or via
      programmable engines.
      Signed-off-by: NSamu Onkalo <samu.p.onkalo@nokia.com>
      Cc: Richard Purdie <rpurdie@rpsys.net>
      Cc: Jean Delvare <khali@linux-fr.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0efba16c
    • S
      leds: driver for National Semiconductor LP5521 chip · 500fe141
      Samu Onkalo 提交于
      This patchset provides support for LP5521 and LP5523 LED driver chips from
      National Semicondutor.  Both drivers supports programmable engines and
      naturally LED class features.
      
      Documentation is provided as a part of the patchset.  I created "leds"
      subdirectory under Documentation.  Perhaps the rest of the leds*
      documentation should be moved there.
      
      Datasheets are freely available at National Semiconductor www pages.
      
      This patch:
      
      LP5521 chip is three channel led driver with programmable engines.  Driver
      provides support for that chip for direct access via led class or via
      programmable engines.
      Signed-off-by: NSamu Onkalo <samu.p.onkalo@nokia.com>
      Cc: Richard Purdie <rpurdie@rpsys.net>
      Cc: Jean Delvare <khali@linux-fr.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      500fe141
    • J
      led-class: always implement blinking · 5ada28bf
      Johannes Berg 提交于
      Currently, blinking LEDs can be awkward because it is not guaranteed that
      all LEDs implement blinking.  The trigger that wants it to blink then
      needs to implement its own timer solution.
      
      Rather than require that, add led_blink_set() API that triggers can use.
      This function will attempt to use hw blinking, but if that fails
      implements a timer for it.  To stop blinking again, brightness_set() also
      needs to be wrapped into API that will stop the software blink.
      
      As a result of this, the timer trigger becomes a very trivial one, and
      hopefully we can finally see triggers using blinking as well because it's
      always easy to use.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Acked-by: NRichard Purdie <rpurdie@linux.intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      5ada28bf
    • N
      radix-tree: fix RCU bug · 27d20fdd
      Nick Piggin 提交于
      Salman Qazi describes the following radix-tree bug:
      
      In the following case, we get can get a deadlock:
      
      0.  The radix tree contains two items, one has the index 0.
      1.  The reader (in this case find_get_pages) takes the rcu_read_lock.
      2.  The reader acquires slot(s) for item(s) including the index 0 item.
      3.  The non-zero index item is deleted, and as a consequence the other item is
          moved to the root of the tree. The place where it used to be is queued for
          deletion after the readers finish.
      3b. The zero item is deleted, removing it from the direct slot, it remains in
          the rcu-delayed indirect node.
      4.  The reader looks at the index 0 slot, and finds that the page has 0 ref
          count
      5.  The reader looks at it again, hoping that the item will either be freed or
          the ref count will increase. This never happens, as the slot it is looking
          at will never be updated. Also, this slot can never be reclaimed because
          the reader is holding rcu_read_lock and is in an infinite loop.
      
      The fix is to re-use the same "indirect" pointer case that requires a slot
      lookup retry into a general "retry the lookup" bit.
      Signed-off-by: NNick Piggin <npiggin@kernel.dk>
      Reported-by: NSalman Qazi <sqazi@google.com>
      Cc: <stable@kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      27d20fdd
    • D
      Restrict unprivileged access to kernel syslog · eaf06b24
      Dan Rosenberg 提交于
      The kernel syslog contains debugging information that is often useful
      during exploitation of other vulnerabilities, such as kernel heap
      addresses.  Rather than futilely attempt to sanitize hundreds (or
      thousands) of printk statements and simultaneously cripple useful
      debugging functionality, it is far simpler to create an option that
      prevents unprivileged users from reading the syslog.
      
      This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the
      dmesg_restrict sysctl.  When set to "0", the default, no restrictions are
      enforced.  When set to "1", only users with CAP_SYS_ADMIN can read the
      kernel syslog via dmesg(8) or other mechanisms.
      
      [akpm@linux-foundation.org: explain the config option in kernel.txt]
      Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
      Acked-by: NIngo Molnar <mingo@elte.hu>
      Acked-by: NEugene Teo <eugeneteo@kernel.org>
      Acked-by: NKees Cook <kees.cook@canonical.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      eaf06b24