1. 10 9月, 2009 21 次提交
  2. 09 9月, 2009 3 次提交
    • E
      aoe: allocate unused request_queue for sysfs · 7135a71b
      Ed Cashin 提交于
      Andy Whitcroft reported an oops in aoe triggered by use of an
      incorrectly initialised request_queue object:
      
        [ 2645.959090] kobject '<NULL>' (ffff880059ca22c0): tried to add
      		an uninitialized object, something is seriously wrong.
        [ 2645.959104] Pid: 6, comm: events/0 Not tainted 2.6.31-5-generic #24-Ubuntu
        [ 2645.959107] Call Trace:
        [ 2645.959139] [<ffffffff8126ca2f>] kobject_add+0x5f/0x70
        [ 2645.959151] [<ffffffff8125b4ab>] blk_register_queue+0x8b/0xf0
        [ 2645.959155] [<ffffffff8126043f>] add_disk+0x8f/0x160
        [ 2645.959161] [<ffffffffa01673c4>] aoeblk_gdalloc+0x164/0x1c0 [aoe]
      
      The request queue of an aoe device is not used but can be allocated in
      code that does not sleep.
      
      Bruno bisected this regression down to
      
        cd43e26f
      
        block: Expose stacked device queues in sysfs
      
      "This seems to generate /sys/block/$device/queue and its contents for
       everyone who is using queues, not just for those queues that have a
       non-NULL queue->request_fn."
      
      Addresses http://bugs.launchpad.net/bugs/410198
      Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13942
      
      Note that embedding a queue inside another object has always been
      an illegal construct, since the queues are reference counted and
      must persist until the last reference is dropped. So aoe was
      always buggy in this respect (Jens).
      Signed-off-by: NEd Cashin <ecashin@coraid.com>
      Cc: Andy Whitcroft <apw@canonical.com>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Cc: Bruno Premont <bonbons@linux-vserver.org>
      Cc: Martin K. Petersen <martin.petersen@oracle.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NJens Axboe <jens.axboe@oracle.com>
      7135a71b
    • L
      i915: disable interrupts before tearing down GEM state · e6890f6f
      Linus Torvalds 提交于
      Reinette Chatre reports a frozen system (with blinking keyboard LEDs)
      when switching from graphics mode to the text console, or when
      suspending (which does the same thing). With netconsole, the oops
      turned out to be
      
      	BUG: unable to handle kernel NULL pointer dereference at 0000000000000084
      	IP: [<ffffffffa03ecaab>] i915_driver_irq_handler+0x26b/0xd20 [i915]
      
      and it's due to the i915_gem.c code doing drm_irq_uninstall() after
      having done i915_gem_idle(). And the i915_gem_idle() path will do
      
        i915_gem_idle() ->
          i915_gem_cleanup_ringbuffer() ->
            i915_gem_cleanup_hws() ->
              dev_priv->hw_status_page = NULL;
      
      but if an i915 interrupt comes in after this stage, it may want to
      access that hw_status_page, and gets the above NULL pointer dereference.
      
      And since the NULL pointer dereference happens from within an interrupt,
      and with the screen still in graphics mode, the common end result is
      simply a silently hung machine.
      
      Fix it by simply uninstalling the irq handler before idling rather than
      after. Fixes
      
          http://bugzilla.kernel.org/show_bug.cgi?id=13819Reported-and-tested-by: NReinette Chatre <reinette.chatre@intel.com>
      Acked-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      e6890f6f
    • Z
      drm/i915: fix mask bits setting · 7c8460db
      Zhenyu Wang 提交于
      eDP is exclusive connector too, and add missing crtc_mask
      setting for TV.
      
      This fixes
      
      	http://bugzilla.kernel.org/show_bug.cgi?id=14139Signed-off-by: NZhenyu Wang <zhenyuw@linux.intel.com>
      Reported-and-tested-by: NCarlos R. Mafra <crmafra2@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      7c8460db
  3. 07 9月, 2009 1 次提交
  4. 06 9月, 2009 3 次提交
    • D
      gianfar: Fix build. · d9d8e041
      David S. Miller 提交于
      Reported by Michael Guntsche <mike@it-loops.com>
      
      --------------------
      Commit
      38bddf04 gianfar: gfar_remove needs to call unregister_netdev()
      
      breaks the build of the gianfar driver because "dev" is undefined in
      this function. To quickly test rc9 I changed this to priv->ndev but I do
      not know if this is the correct one.
      --------------------
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d9d8e041
    • L
      pty: don't limit the writes to 'pty_space()' inside 'pty_write()' · ac89a917
      Linus Torvalds 提交于
      The whole write-room thing is something that is up to the _caller_ to
      worry about, not the pty layer itself.  The total buffer space will
      still be limited by the buffering routines themselves, so there is no
      advantage or need in having pty_write() artificially limit the size
      somehow.
      
      And what happened was that the caller (the n_tty line discipline, in
      this case) may have verified that there is room for 2 bytes to be
      written (for NL -> CRNL expansion), and it used to then do those writes
      as two single-byte writes.  And if the first byte written (CR) then
      caused a new tty buffer to be allocated, pty_space() may have returned
      zero when trying to write the second byte (LF), and then incorrectly
      failed the write - leading to a lost newline character.
      
      This should finally fix
      
      	http://bugzilla.kernel.org/show_bug.cgi?id=14015Reported-by: NMikael Pettersson <mikpe@it.uu.se>
      Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ac89a917
    • L
      n_tty: do O_ONLCR translation as a single write · 37f81fa1
      Linus Torvalds 提交于
      When translating CR to CRNL in the n_tty line discipline, we did it as
      two tty_put_char() calls.  Which works, but is stupid, and has caused
      problems before too with bad interactions with the write_room() logic.
      The generic USB serial driver had that problem, for example.
      
      Now the pty layer had similar issues after being moved to the generic
      tty buffering code (in commit d945cb9c:
      "pty: Rework the pty layer to use the normal buffering logic").
      
      So stop doing the silly separate two writes, and do it as a single write
      instead.  That's what the n_tty layer already does for the space
      expansion of tabs (XTABS), and it means that we'll now always have just
      a single write for the CRNL to match the single 'tty_write_room()' test,
      which hopefully means that the next time somebody screws up buffering,
      it won't cause weeks of debugging.
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      37f81fa1
  5. 05 9月, 2009 12 次提交
    • S
      firewire: sbp2: fix freeing of unallocated memory · baed6b82
      Stefan Richter 提交于
      If a target writes invalid status (typically status of a command that
      already timed out), firewire-sbp2 attempts to put away an ORB that
      doesn't exist.  https://bugzilla.redhat.com/show_bug.cgi?id=519772Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
      baed6b82
    • S
      firewire: ohci: fix Ricoh R5C832, video reception · 4fe0badd
      Stefan Richter 提交于
      In dual-buffer DMA mode, no video frames are ever received from R5C832
      by libdc1394.  Fallback to packet-per-buffer DMA works reliably.
      http://thread.gmane.org/gmane.linux.kernel.firewire.devel/13393/focus=13476Reported-by: NJonathan Cameron <jic23@cam.ac.uk>
      Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
      4fe0badd
    • S
      firewire: ohci: fix Agere FW643 and multiple cameras · fc383796
      Stefan Richter 提交于
      An Agere FW643 OHCI 1.1 card works fine for video reception from one
      camera but fails early if receiving from two cameras.  After a short
      while, no IR IRQ events occur and the context control register does not
      react anymore.  This happens regardless whether both IR DMA contexts are
      dual-buffer or one is dual-buffer and the other packet-per-buffer.
      
      This can be worked around by disabling dual buffer DMA mode entirely.
      http://sourceforge.net/mailarchive/message.php?msg_name=4A7C0594.2020208%40gmail.com
      (Reported by Samuel Audet.)
      
      In another report (by Jonathan Cameron), an FW643 works OK with two
      cameras in dual buffer mode.  Whether this is due to different chip
      revisions or different usage patterns (different video formats) is not
      yet clear.  However, as far as the current capabilities of
      firewire-core's isochronous I/O interface are concerned, simply
      switching off dual-buffer on non-working and working FW643s alike is not
      a problem in practice.  We only need to revisit this issue if we are
      going to enhance the interface, e.g. so that applications can explicitly
      choose modes.
      Reported-by: NSamuel Audet <samuel.audet@gmail.com>
      Reported-by: NJonathan Cameron <jic23@cam.ac.uk>
      Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
      fc383796
    • S
      firewire: core: fix crash in iso resource management · 1821bc19
      Stefan Richter 提交于
      This fixes a regression due to post 2.6.30 commit "firewire: core: do
      not DMA-map stack addresses" 6fdc0370.
      
      As David Moore noted, a previously correct sizeof() expression became
      wrong since the commit changed its argument from an array to a pointer.
      This resulted in an oops in ohci_cancel_packet in the shared workqueue
      thread's context when an isochronous resource was to be freed.
      Reported-by: NJonathan Cameron <jic23@cam.ac.uk>
      Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
      1821bc19
    • M
      dm snapshot: fix on disk chunk size validation · ae0b7448
      Mikulas Patocka 提交于
      Fix some problems seen in the chunk size processing when activating a
      pre-existing snapshot.
      
      For a new snapshot, the chunk size can either be supplied by the creator
      or a default value can be used.  For an existing snapshot, the
      chunk size in the snapshot header on disk should always be used.
      
      If someone attempts to load an existing snapshot and has the 'default
      chunk size' option set, the kernel uses its default value even when it
      is incorrect for the snapshot being loaded.  This patch ensures the
      correct on-disk value is always used.
      
      Secondly, when the code does use the chunk size stored on the disk it is
      prudent to revalidate it, so the code can exit cleanly if it got
      corrupted as happened in
      https://bugzilla.redhat.com/show_bug.cgi?id=461506 .
      
      Cc: stable@kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      ae0b7448
    • M
      dm exception store: split set_chunk_size · 2defcc3f
      Mikulas Patocka 提交于
      Break the function set_chunk_size to two functions in preparation for
      the fix in the following patch.
      
      Cc: stable@kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      2defcc3f
    • M
      dm snapshot: fix header corruption race on invalidation · 61578dcd
      Mikulas Patocka 提交于
      If a persistent snapshot fills up, a race can corrupt the on-disk header
      which causes a crash on any future attempt to activate the snapshot
      (typically while booting).  This patch fixes the race.
      
      When the snapshot overflows, __invalidate_snapshot is called, which calls
      snapshot store method drop_snapshot. It goes to persistent_drop_snapshot that
      calls write_header. write_header constructs the new header in the "area"
      location.
      
      Concurrently, an existing kcopyd job may finish, call copy_callback
      and commit_exception method, that goes to persistent_commit_exception.
      persistent_commit_exception doesn't do locking, relying on the fact that
      callbacks are single-threaded, but it can race with snapshot invalidation and
      overwrite the header that is just being written while the snapshot is being
      invalidated.
      
      The result of this race is a corrupted header being written that can
      lead to a crash on further reactivation (if chunk_size is zero in the
      corrupted header).
      
      The fix is to use separate memory areas for each.
      
      See the bug: https://bugzilla.redhat.com/show_bug.cgi?id=461506
      
      Cc: stable@kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      61578dcd
    • M
      dm snapshot: refactor zero_disk_area to use chunk_io · 02d2fd31
      Mikulas Patocka 提交于
      Refactor chunk_io to prepare for the fix in the following patch.
      
      Pass an area pointer to chunk_io and simplify zero_disk_area to use
      chunk_io.  No functional change.
      
      Cc: stable@kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      02d2fd31
    • J
      dm log: userspace add luid to distinguish between concurrent log instances · 7ec23d50
      Jonathan Brassow 提交于
      Device-mapper userspace logs (like the clustered log) are
      identified by a universally unique identifier (UUID).  This
      identifier is used to associate requests from the kernel to
      a specific log in userspace.  The UUID must be unique everywhere,
      since multiple machines may use this identifier when communicating
      about a particular log, as is the case for cluster logs.
      
      Sometimes, device-mapper/LVM may re-use a UUID.  This is the
      case during pvmoves, when moving from one segment of an LV
      to another, or when resizing a mirror, etc.  In these cases,
      a new log is created with the same UUID and loaded in the
      "inactive" slot.  When a device-mapper "resume" is issued,
      the "live" table is deactivated and the new "inactive" table
      becomes "live".  (The "inactive" table can also be removed
      via a device-mapper 'clear' command.)
      
      The above two issues were colliding.  More than one log was being
      created with the same UUID, and there was no way to distinguish
      between them.  So, sometimes the wrong log would be swapped
      out during the exchange.
      
      The solution is to create a locally unique identifier,
      'luid', to go along with the UUID.  This new identifier is used
      to determine exactly which log is being referenced by the kernel
      when the log exchange is made.  The identifier is not
      universally safe, but it does not need to be, since
      create/destroy/suspend/resume operations are bound to a specific
      machine; and these are the operations that make up the exchange.
      Signed-off-by: NJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      7ec23d50
    • J
      dm raid1: do not allow log_failure variable to unset after being set · d2b69864
      Jonathan Brassow 提交于
      This patch fixes a bug which was triggering a case where the primary leg
      could not be changed on failure even when the mirror was in-sync.
      
      The case involves the failure of the primary device along with
      the transient failure of the log device.  The problem is that
      bios can be put on the 'failures' list (due to log failure)
      before 'fail_mirror' is called due to the primary device failure.
      Normally, this is fine, but if the log device failure is transient,
      a subsequent iteration of the work thread, 'do_mirror', will
      reset 'log_failure'.  The 'do_failures' function then resets
      the 'in_sync' variable when processing bios on the failures list.
      The 'in_sync' variable is what is used to determine if the
      primary device can be switched in the event of a failure.  Since
      this has been reset, the primary device is incorrectly assumed
      to be not switchable.
      
      The case has been seen in the cluster mirror context, where one
      machine realizes the log device is dead before the other machines.
      As the responsibilities of the server migrate from one node to
      another (because the mirror is being reconfigured due to the failure),
      the new server may think for a moment that the log device is fine -
      thus resetting the 'log_failure' variable.
      
      In any case, it is inappropiate for us to reset the 'log_failure'
      variable.  The above bug simply illustrates that it can actually
      hurt us.
      
      Cc: stable@kernel.org
      Signed-off-by: NJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      d2b69864
    • J
      dm log: remove incorrect field from userspace table output · b8313b6d
      Jonathan Brassow 提交于
      The output of 'dmsetup table' includes an internal field that should not
      be there.  This patch removes it.  To make the fix simpler, we first
      reorder a constructor argument
      
      The 'device size' argument is generated internally.  Currently it is
      placed as the last space-separated word of the constructor string.
      However, we need to use a version of the string without this word, so we
      move it to the beginning instead so it is trivial to skip past it.
      
      We keep a copy of the arguments passed to userspace for creating a log,
      just in case we need to resend them.  These are the same arguments that
      are desired in the STATUSTYPE_TABLE request, except for one.  When
      creating the userspace log, the userspace daemon must know the size of
      the mirror, so that is added to the arguments given in the constructor
      table.  We were printing this extra argument out as well, which is a
      mistake.
      Signed-off-by: NJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      b8313b6d
    • J
      dm log: fix userspace status output · 4142a969
      Jonathan Brassow 提交于
      Fix 'dmsetup table' output.
      
      There is a missing ' ' at the end of the string causing two
      words to run together.
      Signed-off-by: NJonathan Brassow <jbrassow@redhat.com>
      Signed-off-by: NAlasdair G Kergon <agk@redhat.com>
      4142a969