1. 23 8月, 2008 30 次提交
  2. 21 8月, 2008 10 次提交
    • J
      pkt_sched: Fix qdisc_watchdog() vs. dev_deactivate() race · 2540e051
      Jarek Poplawski 提交于
      dev_deactivate() can skip rescheduling of a qdisc by qdisc_watchdog()
      or other timer calling netif_schedule() after dev_queue_deactivate().
      We prevent this checking aliveness before scheduling the timer. Since
      during deactivation the root qdisc is available only as qdisc_sleeping
      additional accessor qdisc_root_sleeping() is created.
      
      With feedback from Herbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2540e051
    • V
      sctp: fix potential panics in the SCTP-AUTH API. · 5e739d17
      Vlad Yasevich 提交于
      All of the SCTP-AUTH socket options could cause a panic
      if the extension is disabled and the API is envoked.
      
      Additionally, there were some additional assumptions that
      certain pointers would always be valid which may not
      always be the case.
      
      This patch hardens the API and address all of the crash
      scenarios.
      Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5e739d17
    • L
      Linux v2.6.27-rc4 · 6a55617e
      Linus Torvalds 提交于
      6a55617e
    • A
      cramfs: fix named-pipe handling · 82d63fc9
      Al Viro 提交于
      After commit a97c9bf3 (fix cramfs
      making duplicate entries in inode cache) in kernel 2.6.14, named-pipe
      on cramfs does not work properly.
      
      It seems the commit make all named-pipe on cramfs share their inode
      (and named-pipe buffer).
      
      Make ..._test() refuse to merge inodes with ->i_ino == 1, take inode setup
      back to get_cramfs_inode() and make ->drop_inode() evict ones with ->i_ino
      == 1 immediately.
      Reported-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@kernel.org>		[2.6.14 and later]
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      82d63fc9
    • I
      fbdefio: add set_page_dirty handler to deferred IO FB · d847471d
      Ian Campbell 提交于
      Fixes kernel BUG at lib/radix-tree.c:473.
      
      Previously the handler was incidentally provided by tmpfs but this was
      removed with:
      
        commit 14fcc23f
        Author: Hugh Dickins <hugh@veritas.com>
        Date:   Mon Jul 28 15:46:19 2008 -0700
      
          tmpfs: fix kernel BUG in shmem_delete_inode
      
      relying on this behaviour was incorrect in any case and the BUG also
      appeared when the device node was on an ext3 filesystem.
      
      v2: override a_ops at open() time rather than mmap() time to minimise
      races per AKPM's concerns.
      Signed-off-by: NIan Campbell <ijc@hellion.org.uk>
      Cc: Jaya Kumar <jayakumar.lkml@gmail.com>
      Cc: Nick Piggin <npiggin@suse.de>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: Hugh Dickins <hugh@veritas.com>
      Cc: Johannes Weiner <hannes@saeurebad.de>
      Cc: Jeremy Fitzhardinge <jeremy@goop.org>
      Cc: Kel Modderman <kel@otaku42.de>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Cc: <stable@kernel.org> [14fcc23f is in 2.6.25.14 and 2.6.26.1]
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      d847471d
    • A
      rtc: rtc-ds1374: fix 'no irq' case handling · b42f9317
      Anton Vorontsov 提交于
      On a PowerPC board with ds1374 RTC I'm getting this error while RTC tries
      to probe:
      
      rtc-ds1374 0-0068: unable to request IRQ
      
      This happens because I2C probing code (drivers/of/of_i2c.c) is specifying
      IRQ0 for 'no irq' case, which is correct.
      
      The driver handles this incorrectly, though. This patch fixes it.
      Signed-off-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
      Cc: David Brownell <david-b@pacbell.net>
      Cc: Alessandro Zummo <a.zummo@towertech.it>
      Acked-by: NPeter Korsgaard <jacmet@sunsite.dk>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      b42f9317
    • N
      mm: xip/ext2 fix block allocation race · 14bac5ac
      Nick Piggin 提交于
      XIP can call into get_xip_mem concurrently with the same file,offset with
      create=1.  This usually maps down to get_block, which expects the page
      lock to prevent such a situation.  This causes ext2 to explode for one
      reason or another.
      
      Serialise those calls for the moment.  For common usages today, I suspect
      get_xip_mem rarely is called to create new blocks.  In future as XIP
      technologies evolve we might need to look at which operations require
      scalability, and rework the locking to suit.
      Signed-off-by: NNick Piggin <npiggin@suse.de>
      Cc: Jared Hulbert <jaredeh@gmail.com>
      Acked-by: NCarsten Otte <cotte@freenet.de>
      Cc: Hugh Dickins <hugh@veritas.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      14bac5ac
    • N
      mm: xip fix fault vs sparse page invalidate race · 538f8ea6
      Nick Piggin 提交于
      XIP has a race between sparse pages being inserted into page tables, and
      sparse pages being zapped when its time to put a non-sparse page in.
      
      What can happen is that a process can be left with a dangling sparse page
      in a MAP_SHARED mapping, while the rest of the world sees the non-sparse
      version.  Ie.  data corruption.
      
      Guard these operations with a seqlock, making fault-in-sparse-pages the
      slowpath, and try-to-unmap-sparse-pages the fastpath.
      Signed-off-by: NNick Piggin <npiggin@suse.de>
      Cc: Jared Hulbert <jaredeh@gmail.com>
      Acked-by: NCarsten Otte <cotte@freenet.de>
      Cc: Hugh Dickins <hugh@veritas.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      538f8ea6
    • N
      mm: dirty page tracking race fix · 479db0bf
      Nick Piggin 提交于
      There is a race with dirty page accounting where a page may not properly
      be accounted for.
      
      clear_page_dirty_for_io() calls page_mkclean; then TestClearPageDirty.
      
      page_mkclean walks the rmaps for that page, and for each one it cleans and
      write protects the pte if it was dirty.  It uses page_check_address to
      find the pte.  That function has a shortcut to avoid the ptl if the pte is
      not present.  Unfortunately, the pte can be switched to not-present then
      back to present by other code while holding the page table lock -- this
      should not be a signal for page_mkclean to ignore that pte, because it may
      be dirty.
      
      For example, powerpc64's set_pte_at will clear a previously present pte
      before setting it to the desired value.  There may also be other code in
      core mm or in arch which do similar things.
      
      The consequence of the bug is loss of data integrity due to msync, and
      loss of dirty page accounting accuracy.  XIP's __xip_unmap could easily
      also be unreliable (depending on the exact XIP locking scheme), which can
      lead to data corruption.
      
      Fix this by having an option to always take ptl to check the pte in
      page_check_address.
      
      It's possible to retain this optimization for page_referenced and
      try_to_unmap.
      Signed-off-by: NNick Piggin <npiggin@suse.de>
      Cc: Jared Hulbert <jaredeh@gmail.com>
      Cc: Carsten Otte <cotte@freenet.de>
      Cc: Hugh Dickins <hugh@veritas.com>
      Acked-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      479db0bf
    • K
      fix setpriority(PRIO_PGRP) thread iterator breakage · 2d70b68d
      Ken Chen 提交于
      When user calls sys_setpriority(PRIO_PGRP ...) on a NPTL style multi-LWP
      process, only the task leader of the process is affected, all other
      sibling LWP threads didn't receive the setting.  The problem was that the
      iterator used in sys_setpriority() only iteartes over one task for each
      process, ignoring all other sibling thread.
      
      Introduce a new macro do_each_pid_thread / while_each_pid_thread to walk
      each thread of a process.  Convert 4 call sites in {set/get}priority and
      ioprio_{set/get}.
      Signed-off-by: NKen Chen <kenchen@google.com>
      Cc: Oleg Nesterov <oleg@tv-sign.ru>
      Cc: Roland McGrath <roland@redhat.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Jens Axboe <jens.axboe@oracle.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      2d70b68d