aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-10-01lib/list_sort: do not pass bad pointers to cmp callbackDon Mullis1-1/+1
If the original list is a POT in length, the first callback from line 73 will pass a==b both pointing to the original list_head. This is dangerous because the 'list_sort()' user can use 'container_of()' and accesses the "containing" object, which does not necessary exist for the list head. So the user can access RAM which does not belong to him. If this is a write access, we can end up with memory corruption. Signed-off-by: Don Mullis <[email protected]> Tested-by: Artem Bityutskiy <[email protected]> Signed-off-by: Artem Bityutskiy <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01sys_semctl: fix kernel stack leakageDan Rosenberg1-0/+2
The semctl syscall has several code paths that lead to the leakage of uninitialized kernel stack memory (namely the IPC_INFO, SEM_INFO, IPC_STAT, and SEM_STAT commands) during the use of the older, obsolete version of the semid_ds struct. The copy_semid_to_user() function declares a semid_ds struct on the stack and copies it back to the user without initializing or zeroing the "sem_base", "sem_pending", "sem_pending_last", and "undo" pointers, allowing the leakage of 16 bytes of kernel stack memory. The code is still reachable on 32-bit systems - when calling semctl() newer glibc's automatically OR the IPC command with the IPC_64 flag, but invoking the syscall directly allows users to use the older versions of the struct. Signed-off-by: Dan Rosenberg <[email protected]> Cc: Manfred Spraul <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01i7core_edac: fix panic in udimm sysfs attributes registrationMarcin Slusarz1-0/+1
Array of udimm sysfs attributes was not ended with NULL marker, leading to dereference of random memory. EDAC DEBUG: edac_create_mci_instance_attributes: edac_create_mci_instance_attributes() file udimm0 EDAC DEBUG: edac_create_mci_instance_attributes: edac_create_mci_instance_attributes() file udimm1 EDAC DEBUG: edac_create_mci_instance_attributes: edac_create_mci_instance_attributes() file udimm2 BUG: unable to handle kernel NULL pointer dereference at 00000000000001a4 IP: [<ffffffff81330b36>] edac_create_mci_instance_attributes+0x148/0x1f1 Pid: 1, comm: swapper Not tainted 2.6.36-rc3-nv+ #483 P6T SE/System Product Name RIP: 0010:[<ffffffff81330b36>] [<ffffffff81330b36>] edac_create_mci_instance_attributes+0x148/0x1f1 (...) Call Trace: [<ffffffff81330b86>] edac_create_mci_instance_attributes+0x198/0x1f1 [<ffffffff81330c9a>] edac_create_sysfs_mci_device+0xbb/0x2b2 [<ffffffff8132f533>] edac_mc_add_mc+0x46b/0x557 [<ffffffff81428901>] i7core_probe+0xccf/0xec0 RIP [<ffffffff81330b36>] edac_create_mci_instance_attributes+0x148/0x1f1 ---[ end trace 20de320855b81d78 ]--- Kernel panic - not syncing: Attempted to kill init! Signed-off-by: Marcin Slusarz <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Acked-by: Doug Thompson <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01drivers/serial/mrst_max3110.c needs linux/irq.hAndrew Morton1-0/+1
sparc64 allmodconfig: drivers/serial/mrst_max3110.c: In function `serial_m3110_startup': drivers/serial/mrst_max3110.c:470: error: `IRQ_TYPE_EDGE_FALLING' undeclared (first use in this function) Cc: Greg KH <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01arch/m68k/mac/macboing.c: use unsigned long for irqflagsAndrew Morton1-3/+3
Fix the warnings arch/m68k/mac/macboing.c: In function 'mac_mksound': arch/m68k/mac/macboing.c:189: warning: comparison of distinct pointer types lacks a cast arch/m68k/mac/macboing.c:211: warning: comparison of distinct pointer types lacks a cast arch/m68k/mac/macboing.c: In function 'mac_quadra_start_bell': arch/m68k/mac/macboing.c:241: warning: comparison of distinct pointer types lacks a cast arch/m68k/mac/macboing.c:263: warning: comparison of distinct pointer types lacks a cast arch/m68k/mac/macboing.c: In function 'mac_quadra_ring_bell': arch/m68k/mac/macboing.c:283: warning: comparison of distinct pointer types lacks a cast Cc: Geert Uytterhoeven <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01drivers/serial/mfd.c needs slab.hAndrew Morton1-0/+1
alpha allmodconfig: drivers/serial/mfd.c:144: error: implicit declaration of function 'kzalloc' drivers/serial/mfd.c:144: warning: assignment makes pointer from integer without a cast Cc: Greg Kroah-Hartman <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01kfifo: fix scatterlist usageIra W. Snyder2-10/+9
The kfifo_dma family of functions use sg_mark_end() on the last element in their scatterlist. This forces use of a fresh scatterlist for each DMA operation, which makes recycling a single scatterlist impossible. Change the behavior of the kfifo_dma functions to match the usage of the dma_map_sg function. This means that users must respect the returned nents value. The sample code is updated to reflect the change. This bug is trivial to cause: call kfifo_dma_in_prepare() such that it prepares a scatterlist with a single entry comprising the whole fifo. This is the case when you map the entirety of a newly created empty fifo. This causes the setup_sgl() function to mark the first scatterlist entry as the end of the chain, no matter what comes after it. Afterwards, add and remove some data from the fifo such that another call to kfifo_dma_in_prepare() will create two scatterlist entries. It returns nents=2. However, due to the previous sg_mark_end() call, sg_is_last() will now return true for the first scatterlist element. This causes the sample code to print a single scatterlist element when it should print two. By removing the call to sg_mark_end(), we make the API as similar as possible to the DMA mapping API. All users are required to respect the returned nents. Signed-off-by: Ira W. Snyder <[email protected]> Cc: Stefani Seibold <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-10-01cifs: prevent infinite recursion in cifs_reconnect_tconJeff Layton1-16/+33
cifs_reconnect_tcon is called from smb_init. After a successful reconnect, cifs_reconnect_tcon will call reset_cifs_unix_caps. That function will, in turn call CIFSSMBQFSUnixInfo and CIFSSMBSetFSUnixInfo. Those functions also call smb_init. It's possible for the session and tcon reconnect to succeed, and then for another cifs_reconnect to occur before CIFSSMBQFSUnixInfo or CIFSSMBSetFSUnixInfo to be called. That'll cause those functions to call smb_init and cifs_reconnect_tcon again, ad infinitum... Break the infinite recursion by having those functions use a new smb_init variant that doesn't attempt to perform a reconnect. Reported-and-Tested-by: Michal Suchanek <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2010-10-01vmwgfx: Fix fb VRAM pinning failure due to fragmentationThomas Hellstrom1-0/+5
If the soon-to-be scanout buffer is partly covering the intended VRAM region, move and pin will fail. In that case, just move it out to system before attempting to move it in again. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01vmwgfx: Remove initialisation of dev::devnameThomas Hellstrom1-6/+0
The removed code causes oopses with newer drms on master drop. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01vmwgfx: Enable use of the vblank systemThomas Hellstrom4-31/+49
This is to avoid accessing uninitialized data during drm_irq_uninstall and vblank ioctls. At the same time, enable error check from drm_kms_init which previously appeared to ignore all errors. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01vmwgfx: vt-switch (master drop) fixesThomas Hellstrom5-13/+115
We add an option not to enable fbdev, this option is off (0) by default. Not enabling fbdev at load time makes it possible to co-operate with vga16fb and vga text mode when VT switching. However, if 3D resources are active when VT switching, we're currently not able to switch over to vga, due to device limitations. This fixes a bug where we previously lost 3D state during VT switch. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01drm/vmwgfx: Fix breakage introduced by commit "drm: block userspace under ↵Thomas Hellstrom1-1/+1
allocating buffer and having drivers overwrite it (v2)" The mentioned commit breaks the vmwgfx ioctl argument sanity check. Signed-off-by: Thomas Hellstrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01drm: Hold the mutex when dropping the last GEM reference (v2)Chris Wilson2-26/+6
In order to be fully threadsafe we need to check that the drm_gem_object refcount is still 0 after acquiring the mutex in order to call the free function. Otherwise, we may encounter scenarios like: Thread A: Thread B: drm_gem_close unreference_unlocked kref_put mutex_lock ... i915_gem_evict ... kref_get -> BUG ... i915_gem_unbind ... kref_put ... i915_gem_object_free ... mutex_unlock mutex_lock i915_gem_object_free -> BUG i915_gem_object_unbind kfree mutex_unlock Note that no driver is currently using the free_unlocked vfunc and it is scheduled for removal, hasten that process. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30454 Reported-and-Tested-by: Magnus Kessler <[email protected]> Signed-off-by: Chris Wilson <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-10-01drm/i915: Fix refleak during eviction.Chris Wilson1-25/+20
Now that we hold onto a reference whilst evicting objects, we need to be sure that we drop all the references taken -- even on the error paths. Signed-off-by: Chris Wilson <[email protected]>
2010-09-30intel_idle: Voluntary leave_mm before entering deeperSuresh Siddha2-4/+15
Avoid TLB flush IPIs for the cores in deeper c-states by voluntary leave_mm() before entering into that state. CPUs tend to flush TLB in those c-states anyways. acpi_idle does this with C3-type states, but it was not caried over when intel_idle was introduced. intel_idle can apply it to C-states in addition to those that ACPI might export as C3... Signed-off-by: Suresh Siddha <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-30vlan: dont drop packets from unknown vlans in promiscuous modeEric Dumazet1-4/+10
Roger Luethi noticed packets for unknown VLANs getting silently dropped even in promiscuous mode. Check for promiscuous mode in __vlan_hwaccel_rx() and vlan_gro_common() before drops. As suggested by Patrick, mark such packets to have skb->pkt_type set to PACKET_OTHERHOST to make sure they are dropped by IP stack. Reported-by: Roger Luethi <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> CC: Patrick McHardy <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-10-01drm/gem: handlecount isn't really a kref so don't make it one.Dave Airlie11-34/+33
There were lots of places being inconsistent since handle count looked like a kref but it really wasn't. Fix this my just making handle count an atomic on the object, and have it increase the normal object kref. Now i915/radeon/nouveau drivers can drop the normal reference on userspace object creation, and have the handle hold it. This patch fixes a memory leak or corruption on unload, because the driver had no way of knowing if a handle had been actually added for this object, and the fbcon object needed to know this to clean itself up properly. Reviewed-by: Chris Wilson <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-10-01i2c-s3c2410: fix calculation of SDA line delayMyungJoo Ham1-2/+2
S3C2440 style I2C controller uses PCLK to calculate the SDA line delay. The driver wrongly assumed that this delay is calculated from the frequency that the controller is operating on. This patch fixes this issue. Signed-off-by: MyungJoo Ham <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Ben Dooks <[email protected]>
2010-09-30x86, hpet: Fix bogus error check in hpet_assign_irq()Thomas Gleixner1-1/+1
create_irq() returns -1 if the interrupt allocation failed, but the code checks for irq == 0. Use create_irq_nr() instead. Signed-off-by: Thomas Gleixner <[email protected]> Cc: Venkatesh Pallipadi <[email protected]> LKML-Reference: <[email protected]> Cc: [email protected] Signed-off-by: H. Peter Anvin <[email protected]>
2010-09-30x86, irq: Plug memory leak in sparse irqThomas Gleixner1-3/+8
free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this triggers a use after free caused by the fact that copying struct irq_cfg is done with memcpy, which copies the pointer not the cpumask. Fix both places. Signed-off-by: Thomas Gleixner <[email protected]> Cc: Yinghai Lu <[email protected]> LKML-Reference: <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Cc: [email protected] Signed-off-by: H. Peter Anvin <[email protected]>
2010-09-30ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=nTakashi Iwai1-1/+1
Signed-off-by: Takashi Iwai <[email protected]>
2010-09-30[CPUFREQ] Fix memory leaks in pcc_cpufreq_do_oscPekka Enberg1-6/+12
If acpi_evaluate_object() function call doesn't fail, we must kfree() output.buffer before returning from pcc_cpufreq_do_osc(). Signed-off-by: Pekka Enberg <[email protected]> Acked-by: David Rientjes <[email protected]> Signed-off-by: Dave Jones <[email protected]>
2010-09-30[CPUFREQ] acpi-cpufreq: add missing __percpu markupNamhyung Kim1-1/+1
acpi_perf_data is a percpu pointer but was missing __percpu markup. Add it. Signed-off-by: Namhyung Kim <[email protected]> Acked-by: Tejun Heo <[email protected]> Signed-off-by: Dave Jones <[email protected]>
2010-09-30Merge branch 'master' of ↵David S. Miller3-6/+2
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2010-09-30Fix up more fallout form alpha signal cleanupsLinus Torvalds1-1/+1
Commit c52c2ddc1dfa ("alpha: switch osf_sigprocmask() to use of sigprocmask()") had several problems. The more obvious compile issues got fixed in commit 0f44fbd297e1 ("alpha: fix compile problem in arch/alpha/kernel/signal.c"), but it also caused a regression. Since _BLOCKABLE is already the set of signals that can be blocked, the code should do "newmask & _BLOCKABLE" rather than inverting _BLOCKABLE before masking. Reported-by: Michael Cree <[email protected]> Patch-by: Al Viro <[email protected]> Patch-by: Ivan Kokshaysky <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-30perf, x86: Handle in flight NMIs on P4 platformCyrill Gorcunov1-1/+5
Stephane reported we've forgot to guard the P4 platform against spurious in-flight performance IRQs. Fix it. This fixes potential spurious 'dazed and confused' NMI messages. Reported-by: Stephane Eranian <[email protected]> Signed-off-by: Cyrill Gorcunov <[email protected]> Signed-off-by: Don Zickus <[email protected]> Cc: [email protected] Cc: [email protected] Cc: Robert Richter <[email protected]> Cc: Lin Ming <[email protected]> LKML-Reference: <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2010-09-30oprofile, ARM: Release resources on failureRobert Richter1-2/+5
This patch fixes a resource leak on failure, where the oprofilefs and some counters may not released properly. Signed-off-by: Robert Richter <[email protected]> Acked-by: Will Deacon <[email protected]> Cc: [email protected] Cc: <[email protected]> # .35.x LKML-Reference: <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2010-09-29Merge branch 'fixes' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2: Don't walk off the end of fast symlinks.
2010-09-30drm: i810/i830: fix locked ioctl variantArnd Bergmann2-2/+2
The i810 and i830 device drivers may replace their file operations on an open file descriptor. My previous patch to move the BKL out of the common DRM code into these drivers only caught the default file operations, not the ones that actually end up being used. Found while trying to come up with a way to kill the BKL for good in these drivers. Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2010-09-29Phonet: Correct header retrieval after pskb_may_pullKumar Sanghvi1-1/+2
Retrieve the header after doing pskb_may_pull since, pskb_may_pull could change the buffer structure. This is based on the comment given by Eric Dumazet on Phonet Pipe controller patch for a similar problem. Signed-off-by: Kumar Sanghvi <[email protected]> Acked-by: Linus Walleij <[email protected]> Acked-by: Eric Dumazet <[email protected]> Acked-by: Rémi Denis-Courmont <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-29um: Proper Fix for f25c80a4: remove duplicate structure field initializationBoaz Harrosh1-14/+3
uml_net_set_mac() was broken and luckily it was never used, before. What it was trying to do is spin_lock before memcopy the mac address. Linus attempted to fix it in assumption that someone decided the lock was needed. But since it was never ever used at all, and was just dead code, I think we can assume that it is not needed, after all. On the other hand patch [f25c80a4] was trying to use eth_mac_addr() in eth_configure(), *which was the real fallout*. Because of state checks done inside eth_mac_addr() the address was never set. I have not reintroduced the memcpy wrapper, but I've put a comment for future cats. The code now is back to exactly as it was before [f25c80a4]. With the cleanup applied. If the spin_lock is indeed needed then a contender should supply a test case that fails, then fix it with the proper locking, as a separate unrelated patch. CC: Julia Lawall <[email protected]> CC: David S. Miller <[email protected]> CC: Andrew Morton <[email protected]> CC: Al Viro <[email protected]> Tested-by: Boaz Harrosh <[email protected]> Signed-off-by: Boaz Harrosh <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-29Merge branch 'fixes' of ↵Linus Torvalds2-2/+3
git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: dmaengine: fix interrupt clearing for mv_xor missing inline keyword for static function in linux/dmaengine.h dma/shdma: move dereference below the NULL check
2010-09-29ocfs2: Don't walk off the end of fast symlinks.Joel Becker1-1/+1
ocfs2 fast symlinks are NUL terminated strings stored inline in the inode data area. However, disk corruption or a local attacker could, in theory, remove that NUL. Because we're using strlen() (my fault, introduced in a731d1 when removing vfs_follow_link()), we could walk off the end of that string. Signed-off-by: Joel Becker <[email protected]> Cc: [email protected]
2010-09-29Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfsLinus Torvalds2-19/+30
* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: force background CIL push under sustained load
2010-09-29Merge branch 'for-linus' of ↵Linus Torvalds2-8/+14
git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: mfd: Fix max8925 irq control bit incorrect setting mfd: Ignore non-GPIO IRQs when setting wm831x IRQ types
2010-09-29fix OMAP2 MTD build failureDaniel J Blueman1-1/+1
Fix build failure from recent interface change and merge. Tested on OMAP3430. Signed-off-by: Daniel J Blueman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-29cifs: set backing_dev_info on new S_ISREG inodesJeff Layton1-0/+2
Testing on very recent kernel (2.6.36-rc6) made this warning pop: WARNING: at fs/fs-writeback.c:87 inode_to_bdi+0x65/0x70() Hardware name: Dirtiable inode bdi default != sb bdi cifs ...the following patch fixes it and seems to be the obviously correct thing to do for cifs. Cc: [email protected] Acked-by: Dave Kleikamp <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2010-09-29Merge branches 'apei', 'battery-mwh-fix', 'bugzilla-10807', ↵Len Brown19-57/+112
'bugzilla-14736', 'bugzilla-14679', 'bugzilla-16396', 'launchpad-613381' and 'misc' into release
2010-09-29ACPI: invoke DSDT corruption workaround on all Toshiba SatelliteLen Brown1-11/+3
Our list of Toshiba Satellite models that require this workaround is growing -- so invoke the workaround for the entire product line. https://bugzilla.kernel.org/show_bug.cgi?id=14679 Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI, APEI, Fix ERST MOVE_DATA instruction implementationHuang Ying1-3/+20
The src_base and dst_base fields in apei_exec_context are physical address, so they should be ioremaped before being used in ERST MOVE_DATA instruction. Reported-by: Javier Martinez Canillas <[email protected]> Reported-by: Andrew Morton <[email protected]> Signed-off-by: Huang Ying <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI: fan: Fix more unbalanced code blockLuis Henriques1-0/+2
commit 934231de706d2579fae14f5857fcd8de991009ff fixes an unbalanced CONFIG_ACPI_PROCFS code block during module initialisation. This patch fixes similar issue but for the module exit. Signed-off-by: Luis Henriques <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI: acpi_pad: simplify code to avoid false gcc build warningLen Brown1-16/+18
acpi_pad.c:432: warning: ‘num_cpus’ may be used uninitialized in this function gcc 4.4.4 was unable to notice that num_cpus is always set. Re-arrange the code to un-confuse gcc, and also make it easier for humans to read.... Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI, APEI, Fix error path for memory allocationHuang Ying2-11/+26
In ERST debug/test support patch, a dynamic allocated buffer is used. The may-failed memory allocation should be tried firstly before free the previous buffer. APEI resource management memory allocation related error path is fixed too. v2: - Fix error messages for APEI resources management Signed-off-by: Huang Ying <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI, APEI, HEST Fix the unsuitable usage of platform_dataJin Dongming2-5/+8
platform_data in hest_parse_ghes() is used for saving the address of entry information of erst_tab. When the device is failed to be added, platform_data will be freed by platform_device_put(). But the value saved in platform_data should not be freed here. If it is done, it will make system panic. So I think platform_data should save the address of allocated memory which saves entry information of erst_tab. This patch fixed it and I confirmed it on x86_64 next-tree. v2: Transport the pointer of hest_hdr to platform_data using platform_device_add_data() Signed-off-by: Jin Dongming <[email protected]> Signed-off-by: Huang Ying <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI, APEI, Fix acpi_pre_map() return valueJin Dongming1-1/+1
After we ioremap() a new region, we call __acpi_try_ioremap() to see whether another thread has already mapped the same region. This check clobbers "vaddr", so compute the return value of acpi_pre_map() using the ioremap() result "map->vaddr" instead. v2: Modified the unsuitable description of patch. v3: Removed unlikely() check and made description simpler. Signed-off-by: Jin Dongming <[email protected]> Reviewed-by: Andi Kleen <[email protected]> Signed-off-by: Huang Ying <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29ACPI, APEI, Fix APEI related table size checkingHuang Ying2-2/+6
On Huang Ying's machine: erst_tab->header_length == sizeof(struct acpi_table_einj) but Yinghai reported that on his machine, erst_tab->header_length == sizeof(struct acpi_table_einj) - sizeof(struct acpi_table_header) To make erst table size checking code works on all systems, both testing are treated as PASS. Same situation applies to einj_tab->header_length, so corresponding table size checking is changed in similar way too. v2: - Treat both table size as valid Originally-by: Yinghai Lu <[email protected]> Signed-off-by: Huang Ying <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-09-29xfs: force background CIL push under sustained loadDave Chinner2-19/+30
I have been seeing occasional pauses in transaction throughput up to 30s long under heavy parallel workloads. The only notable thing was that the xfsaild was trying to be active during the pauses, but making no progress. It was running exactly 20 times a second (on the 50ms no-progress backoff), and the number of pushbuf events was constant across this time as well. IOWs, the xfsaild appeared to be stuck on buffers that it could not push out. Further investigation indicated that it was trying to push out inode buffers that were pinned and/or locked. The xfsbufd was also getting woken at the same frequency (by the xfsaild, no doubt) to push out delayed write buffers. The xfsbufd was not making any progress because all the buffers in the delwri queue were pinned. This scan- and-make-no-progress dance went one in the trace for some seconds, before the xfssyncd came along an issued a log force, and then things started going again. However, I noticed something strange about the log force - there were way too many IO's issued. 516 log buffers were written, to be exact. That added up to 129MB of log IO, which got me very interested because it's almost exactly 25% of the size of the log. He delayed logging code is suppose to aggregate the minimum of 25% of the log or 8MB worth of changes before flushing. That's what really puzzled me - why did a log force write 129MB instead of only 8MB? Essentially what has happened is that no CIL pushes had occurred since the previous tail push which cleared out 25% of the log space. That caused all the new transactions to block because there wasn't log space for them, but they kick the xfsaild to push the tail. However, the xfsaild was not making progress because there were buffers it could not lock and flush, and the xfsbufd could not flush them because they were pinned. As a result, both the xfsaild and the xfsbufd could not move the tail of the log forward without the CIL first committing. The cause of the problem was that the background CIL push, which should happen when 8MB of aggregated changes have been committed, is being held off by the concurrent transaction commit load. The background push does a down_write_trylock() which will fail if there is a concurrent transaction commit holding the push lock in read mode. With 8 CPUs all doing transactions as fast as they can, there was enough concurrent transaction commits to hold off the background push until tail-pushing could no longer free log space, and the halt would occur. It should be noted that there is no reason why it would halt at 25% of log space used by a single CIL checkpoint. This bug could definitely violate the "no transaction should be larger than half the log" requirement and hence result in corruption if the system crashed under heavy load. This sort of bug is exactly the reason why delayed logging was tagged as experimental.... The fix is to start blocking background pushes once the threshold has been exceeded. Rework the threshold calculations to keep the amount of log space a CIL checkpoint can use to below that of the AIL push threshold to avoid the problem completely. Signed-off-by: Dave Chinner <[email protected]> Reviewed-by: Alex Elder <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]>
2010-09-29mfd: Fix max8925 irq control bit incorrect settingKevin Liu1-6/+7
In max8925_irq_sync_unlock(), irq control bit is set at the same time. Zero means enabling irq, and one means disabling irq. The original code is: irq_chg[0] &= irq_data->enable; It should be changed to: irq_chg[0] &= ~irq_data->enable; Otherwise, irq control bit is mess. Signed-off-by: Kevin Liu <[email protected]> Signed-off-by: Haojian Zhuang <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]>
2010-09-29mfd: Ignore non-GPIO IRQs when setting wm831x IRQ typesMark Brown1-2/+7
The driver was originally tested with an additional patch which made this unneeded but that patch had issuges and got lost on the way to mainline, causing problems when the errors are reported. Signed-off-by: Mark Brown <[email protected]> Signed-off-by: Samuel Ortiz <[email protected]> Cc: [email protected]
Powered by cgit, Gruvboxed by Blaster4385.