1. 15 9月, 2010 1 次提交
    • A
      drm/radeon/kms: only warn on mipmap size checks in r600 cs checker (v2) · fe725d4f
      Alex Deucher 提交于
      The texture base address registers are in units of 256 bytes.
      The original CS checker treated these offsets as bytes, so the
      original check was wrong.  I fixed the units in a patch during
      the 2.6.36 cycle, but this ended up breaking some existing
      userspace (probably due to a bug in either userspace texture allocation
      or the drm texture mipmap checker).  So for now, until we come
      up with a better fix, just warn if the mipmap size it too large.
      This will keep existing userspace working and it should be just
      as safe as before when we were checking the wrong units.  These
      are GPU MC addresses, so if they fall outside of the VRAM or
      GART apertures, they end up at the GPU default page, so this should
      be safe from a security perspective.
      
      v2: Just disable the warning.  It just spams the log and there's
      nothing the user can do about it.
      Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
      Cc: Jerome Glisse <glisse@freedesktop.org>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      fe725d4f
  2. 14 9月, 2010 3 次提交
  3. 13 9月, 2010 11 次提交
  4. 12 9月, 2010 6 次提交
  5. 11 9月, 2010 8 次提交
  6. 10 9月, 2010 11 次提交
    • D
      xfs: log IO completion workqueue is a high priority queue · 51749e47
      Dave Chinner 提交于
      The workqueue implementation in 2.6.36-rcX has changed, resulting
      in the workqueues no longer having dedicated threads for work
      processing. This has caused severe livelocks under heavy parallel
      create workloads because the log IO completions have been getting
      held up behind metadata IO completions.  Hence log commits would
      stall, memory allocation would stall because pages could not be
      cleaned, and lock contention on the AIL during inode IO completion
      processing was being seen to slow everything down even further.
      
      By making the log Io completion workqueue a high priority workqueue,
      they are queued ahead of all data/metadata IO completions and
      processed before the data/metadata completions. Hence the log never
      gets stalled, and operations needed to clean memory can continue as
      quickly as possible. This avoids the livelock conditions and allos
      the system to keep running under heavy load as per normal.
      Signed-off-by: NDave Chinner <dchinner@redhat.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NAlex Elder <aelder@sgi.com>
      51749e47
    • R
      execve: make responsive to SIGKILL with large arguments · 9aea5a65
      Roland McGrath 提交于
      An execve with a very large total of argument/environment strings
      can take a really long time in the execve system call.  It runs
      uninterruptibly to count and copy all the strings.  This change
      makes it abort the exec quickly if sent a SIGKILL.
      
      Note that this is the conservative change, to interrupt only for
      SIGKILL, by using fatal_signal_pending().  It would be perfectly
      correct semantics to let any signal interrupt the string-copying in
      execve, i.e. use signal_pending() instead of fatal_signal_pending().
      We'll save that change for later, since it could have user-visible
      consequences, such as having a timer set too quickly make it so that
      an execve can never complete, though it always happened to work before.
      Signed-off-by: NRoland McGrath <roland@redhat.com>
      Reviewed-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9aea5a65
    • R
      execve: improve interactivity with large arguments · 7993bc1f
      Roland McGrath 提交于
      This adds a preemption point during the copying of the argument and
      environment strings for execve, in copy_strings().  There is already
      a preemption point in the count() loop, so this doesn't add any new
      points in the abstract sense.
      
      When the total argument+environment strings are very large, the time
      spent copying them can be much more than a normal user time slice.
      So this change improves the interactivity of the rest of the system
      when one process is doing an execve with very large arguments.
      Signed-off-by: NRoland McGrath <roland@redhat.com>
      Reviewed-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      7993bc1f
    • R
      setup_arg_pages: diagnose excessive argument size · 1b528181
      Roland McGrath 提交于
      The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not
      check the size of the argument/environment area on the stack.
      When it is unworkably large, shift_arg_pages() hits its BUG_ON.
      This is exploitable with a very large RLIMIT_STACK limit, to
      create a crash pretty easily.
      
      Check that the initial stack is not too large to make it possible
      to map in any executable.  We're not checking that the actual
      executable (or intepreter, for binfmt_elf) will fit.  So those
      mappings might clobber part of the initial stack mapping.  But
      that is just userland lossage that userland made happen, not a
      kernel problem.
      Signed-off-by: NRoland McGrath <roland@redhat.com>
      Reviewed-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      1b528181
    • L
      Merge branch 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm · be6200aa
      Linus Torvalds 提交于
      * 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Perform hardware_enable in CPU_STARTING callback
        KVM: i8259: fix migration
        KVM: fix i8259 oops when no vcpus are online
        KVM: x86 emulator: fix regression with cmpxchg8b on i386 hosts
      be6200aa
    • L
      Merge branch 'perf-fixes-for-linus' of... · f2955b49
      Linus Torvalds 提交于
      Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
      
      * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
        tracing: t_start: reset FTRACE_ITER_HASH in case of seek/pread
        perf symbols: Fix multiple initialization of symbol system
        perf: Fix CPU hotplug
        perf, trace: Fix module leak
        tracing/kprobe: Fix handling of C-unlike argument names
        tracing/kprobes: Fix handling of argument names
        perf probe: Fix handling of arguments names
        perf probe: Fix return probe support
        tracing/kprobe: Fix a memory leak in error case
        tracing: Do not allow llseek to set_ftrace_filter
      f2955b49
    • D
      KEYS: Fix bug in keyctl_session_to_parent() if parent has no session keyring · 3d96406c
      David Howells 提交于
      Fix a bug in keyctl_session_to_parent() whereby it tries to check the ownership
      of the parent process's session keyring whether or not the parent has a session
      keyring [CVE-2010-2960].
      
      This results in the following oops:
      
        BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
        IP: [<ffffffff811ae4dd>] keyctl_session_to_parent+0x251/0x443
        ...
        Call Trace:
         [<ffffffff811ae2f3>] ? keyctl_session_to_parent+0x67/0x443
         [<ffffffff8109d286>] ? __do_fault+0x24b/0x3d0
         [<ffffffff811af98c>] sys_keyctl+0xb4/0xb8
         [<ffffffff81001eab>] system_call_fastpath+0x16/0x1b
      
      if the parent process has no session keyring.
      
      If the system is using pam_keyinit then it mostly protected against this as all
      processes derived from a login will have inherited the session keyring created
      by pam_keyinit during the log in procedure.
      
      To test this, pam_keyinit calls need to be commented out in /etc/pam.d/.
      Reported-by: NTavis Ormandy <taviso@cmpxchg8b.com>
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Acked-by: NTavis Ormandy <taviso@cmpxchg8b.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3d96406c
    • D
      KEYS: Fix RCU no-lock warning in keyctl_session_to_parent() · 9d1ac65a
      David Howells 提交于
      There's an protected access to the parent process's credentials in the middle
      of keyctl_session_to_parent().  This results in the following RCU warning:
      
        ===================================================
        [ INFO: suspicious rcu_dereference_check() usage. ]
        ---------------------------------------------------
        security/keys/keyctl.c:1291 invoked rcu_dereference_check() without protection!
      
        other info that might help us debug this:
      
        rcu_scheduler_active = 1, debug_locks = 0
        1 lock held by keyctl-session-/2137:
         #0:  (tasklist_lock){.+.+..}, at: [<ffffffff811ae2ec>] keyctl_session_to_parent+0x60/0x236
      
        stack backtrace:
        Pid: 2137, comm: keyctl-session- Not tainted 2.6.36-rc2-cachefs+ #1
        Call Trace:
         [<ffffffff8105606a>] lockdep_rcu_dereference+0xaa/0xb3
         [<ffffffff811ae379>] keyctl_session_to_parent+0xed/0x236
         [<ffffffff811af77e>] sys_keyctl+0xb4/0xb6
         [<ffffffff81001eab>] system_call_fastpath+0x16/0x1b
      
      The code should take the RCU read lock to make sure the parents credentials
      don't go away, even though it's holding a spinlock and has IRQ disabled.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9d1ac65a
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block · ff3cb3fe
      Linus Torvalds 提交于
      * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
        block: Range check cpu in blk_cpu_to_group
        scatterlist: prevent invalid free when alloc fails
        writeback: Fix lost wake-up shutting down writeback thread
        writeback: do not lose wakeup events when forking bdi threads
        cciss: fix reporting of max queue depth since init
        block: switch s390 tape_block and mg_disk to elevator_change()
        block: add function call to switch the IO scheduler from a driver
        fs/bio-integrity.c: return -ENOMEM on kmalloc failure
        bio-integrity.c: remove dependency on __GFP_NOFAIL
        BLOCK: fix bio.bi_rw handling
        block: put dev->kobj in blk_register_queue fail path
        cciss: handle allocation failure
        cfq-iosched: Documentation help for new tunables
        cfq-iosched: blktrace print per slice sector stats
        cfq-iosched: Implement tunable group_idle
        cfq-iosched: Do group share accounting in IOPS when slice_idle=0
        cfq-iosched: Do not idle if slice_idle=0
        cciss: disable doorbell reset on reset_devices
        blkio: Fix return code for mkdir calls
      ff3cb3fe
    • L
      Merge branch 'at91-fixes-for-linus' of git://github.com/at91linux/linux-2.6-at91 · 6ccaa317
      Linus Torvalds 提交于
      * 'at91-fixes-for-linus' of git://github.com/at91linux/linux-2.6-at91:
        AT91: at91sam9261ek: remove C99 comments but keep information
        AT91: at91sam9261ek board: remove warnings related to use of SPI or SD/MMC
        AT91: dm9000 initialization update
        AT91: SAM9G45 - add a separate clock entry for every single TC block
        AT91: clock: peripheral clocks can have other parent than mck
        AT91: change dma resource index
      6ccaa317
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 · 3657423c
      Linus Torvalds 提交于
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
        ALSA: rawmidi: fix the get next midi device ioctl
        ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()
        ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()
        ALSA: msnd-classic: Fix invalid cfg parameter
        ALSA: hda - Enable PC-beep for EeePC with ALC269 codec
        ALSA: hda - Add errata initverb sequence for CS42xx codecs
        ALSA: usb - Release capture substream URBs properly
        ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controls
        ALSA: virtuoso: work around missing reset in the Xonar DS Windows driver
        ALSA: hda - Add quirk for Lenovo T400s
        ALSA: usb-audio: fix detection of vendor-specific device protocol settings
        ALSA: usb-audio: Assume first control interface is for audio
        ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60
      3657423c