1. 08 8月, 2010 27 次提交
  2. 02 8月, 2010 1 次提交
  3. 31 7月, 2010 1 次提交
  4. 30 7月, 2010 2 次提交
    • D
      CRED: Fix __task_cred()'s lockdep check and banner comment · 8f92054e
      David Howells 提交于
      Fix __task_cred()'s lockdep check by removing the following validation
      condition:
      
      	lockdep_tasklist_lock_is_held()
      
      as commit_creds() does not take the tasklist_lock, and nor do most of the
      functions that call it, so this check is pointless and it can prevent
      detection of the RCU lock not being held if the tasklist_lock is held.
      
      Instead, add the following validation condition:
      
      	task->exit_state >= 0
      
      to permit the access if the target task is dead and therefore unable to change
      its own credentials.
      
      Fix __task_cred()'s comment to:
      
       (1) discard the bit that says that the caller must prevent the target task
           from being deleted.  That shouldn't need saying.
      
       (2) Add a comment indicating the result of __task_cred() should not be passed
           directly to get_cred(), but rather than get_task_cred() should be used
           instead.
      
      Also put a note into the documentation to enforce this point there too.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Acked-by: NJiri Olsa <jolsa@redhat.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8f92054e
    • D
      CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials · de09a977
      David Howells 提交于
      It's possible for get_task_cred() as it currently stands to 'corrupt' a set of
      credentials by incrementing their usage count after their replacement by the
      task being accessed.
      
      What happens is that get_task_cred() can race with commit_creds():
      
      	TASK_1			TASK_2			RCU_CLEANER
      	-->get_task_cred(TASK_2)
      	rcu_read_lock()
      	__cred = __task_cred(TASK_2)
      				-->commit_creds()
      				old_cred = TASK_2->real_cred
      				TASK_2->real_cred = ...
      				put_cred(old_cred)
      				  call_rcu(old_cred)
      		[__cred->usage == 0]
      	get_cred(__cred)
      		[__cred->usage == 1]
      	rcu_read_unlock()
      							-->put_cred_rcu()
      							[__cred->usage == 1]
      							panic()
      
      However, since a tasks credentials are generally not changed very often, we can
      reasonably make use of a loop involving reading the creds pointer and using
      atomic_inc_not_zero() to attempt to increment it if it hasn't already hit zero.
      
      If successful, we can safely return the credentials in the knowledge that, even
      if the task we're accessing has released them, they haven't gone to the RCU
      cleanup code.
      
      We then change task_state() in procfs to use get_task_cred() rather than
      calling get_cred() on the result of __task_cred(), as that suffers from the
      same problem.
      
      Without this change, a BUG_ON in __put_cred() or in put_cred_rcu() can be
      tripped when it is noticed that the usage count is not zero as it ought to be,
      for example:
      
      kernel BUG at kernel/cred.c:168!
      invalid opcode: 0000 [#1] SMP
      last sysfs file: /sys/kernel/mm/ksm/run
      CPU 0
      Pid: 2436, comm: master Not tainted 2.6.33.3-85.fc13.x86_64 #1 0HR330/OptiPlex
      745
      RIP: 0010:[<ffffffff81069881>]  [<ffffffff81069881>] __put_cred+0xc/0x45
      RSP: 0018:ffff88019e7e9eb8  EFLAGS: 00010202
      RAX: 0000000000000001 RBX: ffff880161514480 RCX: 00000000ffffffff
      RDX: 00000000ffffffff RSI: ffff880140c690c0 RDI: ffff880140c690c0
      RBP: ffff88019e7e9eb8 R08: 00000000000000d0 R09: 0000000000000000
      R10: 0000000000000001 R11: 0000000000000040 R12: ffff880140c690c0
      R13: ffff88019e77aea0 R14: 00007fff336b0a5c R15: 0000000000000001
      FS:  00007f12f50d97c0(0000) GS:ffff880007400000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f8f461bc000 CR3: 00000001b26ce000 CR4: 00000000000006f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process master (pid: 2436, threadinfo ffff88019e7e8000, task ffff88019e77aea0)
      Stack:
       ffff88019e7e9ec8 ffffffff810698cd ffff88019e7e9ef8 ffffffff81069b45
      <0> ffff880161514180 ffff880161514480 ffff880161514180 0000000000000000
      <0> ffff88019e7e9f28 ffffffff8106aace 0000000000000001 0000000000000246
      Call Trace:
       [<ffffffff810698cd>] put_cred+0x13/0x15
       [<ffffffff81069b45>] commit_creds+0x16b/0x175
       [<ffffffff8106aace>] set_current_groups+0x47/0x4e
       [<ffffffff8106ac89>] sys_setgroups+0xf6/0x105
       [<ffffffff81009b02>] system_call_fastpath+0x16/0x1b
      Code: 48 8d 71 ff e8 7e 4e 15 00 85 c0 78 0b 8b 75 ec 48 89 df e8 ef 4a 15 00
      48 83 c4 18 5b c9 c3 55 8b 07 8b 07 48 89 e5 85 c0 74 04 <0f> 0b eb fe 65 48 8b
      04 25 00 cc 00 00 48 3b b8 58 04 00 00 75
      RIP  [<ffffffff81069881>] __put_cred+0xc/0x45
       RSP <ffff88019e7e9eb8>
      ---[ end trace df391256a100ebdd ]---
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Acked-by: NJiri Olsa <jolsa@redhat.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      de09a977
  5. 28 7月, 2010 1 次提交
  6. 25 7月, 2010 2 次提交
  7. 23 7月, 2010 3 次提交
    • S
      vmlinux.lds: fix .data..init_task output section (fix popwerpc boot) · da5e37ef
      Sam Ravnborg 提交于
      The .data..init_task output section was missing
      a load offset causing a popwerpc target to fail to boot.
      
      Sean MacLennan tracked it down to the definition of
      INIT_TASK_DATA_SECTION().
      
      There are only two users of INIT_TASK_DATA_SECTION()
      in the kernel today: cris and popwerpc.
      cris do not support relocatable kernels and is thus not
      impacted by this change.
      
      Fix INIT_TASK_DATA_SECTION() to specify load offset like
      all other output sections.
      Reported-by: NSean MacLennan <smaclennan@pikatech.com>
      Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
      Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
      da5e37ef
    • L
      ACPI: skip checking BM_STS if the BIOS doesn't ask for it · 718be4aa
      Len Brown 提交于
      It turns out that there is a bit in the _CST for Intel FFH C3
      that tells the OS if we should be checking BM_STS or not.
      
      Linux has been unconditionally checking BM_STS.
      If the chip-set is configured to enable BM_STS,
      it can retard or completely prevent entry into
      deep C-states -- as illustrated by turbostat:
      
      http://userweb.kernel.org/~lenb/acpi/utils/pmtools/turbostat/
      
      ref: Intel Processor Vendor-Specific ACPI Interface Specification
      table 4 "_CST FFH GAS Field Encoding"
      Bit 1: Set to 1 if OSPM should use Bus Master avoidance for this C-state
      
      https://bugzilla.kernel.org/show_bug.cgi?id=15886Signed-off-by: NLen Brown <len.brown@intel.com>
      718be4aa
    • H
      macvtap: Limit packet queue length · 8a35747a
      Herbert Xu 提交于
      Mark Wagner reported OOM symptoms when sending UDP traffic over
      a macvtap link to a kvm receiver.
      
      This appears to be caused by the fact that macvtap packet queues
      are unlimited in length.  This means that if the receiver can't
      keep up with the rate of flow, then we will hit OOM. Of course
      it gets worse if the OOM killer then decides to kill the receiver.
      
      This patch imposes a cap on the packet queue length, in the same
      way as the tuntap driver, using the device TX queue length.
      
      Please note that macvtap currently has no way of giving congestion
      notification, that means the software device TX queue cannot be
      used and packets will always be dropped once the macvtap driver
      queue fills up.
      
      This shouldn't be a great problem for the scenario where macvtap
      is used to feed a kvm receiver, as the traffic is most likely
      external in origin so congestion notification can't be applied
      anyway.
      
      Of course, if anybody decides to complain about guest-to-guest
      UDP packet loss down the track, then we may have to revisit this.
      
      Incidentally, this patch also fixes a real memory leak when
      macvtap_get_queue fails.
      
      Chris Wright noticed that for this patch to work, we need a
      non-zero TX queue length.  This patch includes his work to change
      the default macvtap TX queue length to 500.
      Reported-by: NMark Wagner <mwagner@redhat.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Acked-by: NChris Wright <chrisw@sous-sol.org>
      Acked-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8a35747a
  8. 22 7月, 2010 1 次提交
  9. 21 7月, 2010 2 次提交
    • M
      math-emu: correct test for downshifting fraction in _FP_FROM_INT() · f8324e20
      Mikael Pettersson 提交于
      The kernel's math-emu code contains a macro _FP_FROM_INT() which is
      used to convert an integer to a raw normalized floating-point value.
      It does this basically in three steps:
      
      1. Compute the exponent from the number of leading zero bits.
      2. Downshift large fractions to put the MSB in the right position
         for normalized fractions.
      3. Upshift small fractions to put the MSB in the right position.
      
      There is an boundary error in step 2, causing a fraction with its
      MSB exactly one bit above the normalized MSB position to not be
      downshifted.  This results in a non-normalized raw float, which when
      packed becomes a massively inaccurate representation for that input.
      
      The impact of this depends on a number of arch-specific factors,
      but it is known to have broken emulation of FXTOD instructions
      on UltraSPARC III, which was originally reported as GCC bug 44631
      <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44631>.
      
      Any arch which uses math-emu to emulate conversions from integers to
      same-size floats may be affected.
      
      The fix is simple: the exponent comparison used to determine if the
      fraction should be downshifted must be "<=" not "<".
      
      I'm sending a kernel module to test this as a reply to this message.
      There are also SPARC user-space test cases in the GCC bug entry.
      Signed-off-by: NMikael Pettersson <mikpe@it.uu.se>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f8324e20
    • D
      include/linux/vgaarb.h: add missing part of include guard · a6a1a095
      Doug Goldstein 提交于
      vgaarb.h was missing the #define of the #ifndef at the top for the guard
      to prevent multiple #include's from causing re-define errors
      Signed-off-by: NDoug Goldstein <cardoe@gentoo.org>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      a6a1a095