aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-04-21CIFS: Fix memory over bound bug in cifs_parse_mount_optionsPavel Shilovsky1-2/+3
While password processing we can get out of options array bound if the next character after array is delimiter. The patch adds a check if we reach the end. Signed-off-by: Pavel Shilovsky <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2011-04-21Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfsLinus Torvalds1-1/+3
* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix duplicate message output
2011-04-21Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds4-56/+20
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, numa: Fix cpu nodemasks for NUMA emulation and CONFIG_DEBUG_PER_CPU_MAPS Revert "x86, NUMA: Fix fakenuma boot failure"
2011-04-21raid5: fix build error, sector_t usageRandy Dunlap1-1/+1
Change <sectors> from unsigned long long to sector_t. This matches its source field. ERROR: "__udivdi3" [drivers/md/raid456.ko] undefined! Signed-off-by: Randy Dunlap <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-04-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linusLinus Torvalds3-18/+9
* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: virtio: console: Enable call to hvc_remove() on console port remove virtio_pci: Prevent double-free of pci regions after device hot-unplug virtio: Decrement avail idx on buffer detach
2011-04-21Merge branch 'drm-fixes' of ↵Linus Torvalds3-6/+17
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: agp: fix arbitrary kernel memory writes agp: fix OOM and buffer overflow drm/radeon/kms: fix IH writeback on r6xx+ on big endian machines
2011-04-21Merge branch 'drm-intel-fixes' of ↵Linus Torvalds2-37/+45
git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6 * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6: drm/i915: Initialise g4x watermarks for disabled pipes drm/i915: Sanitize the output registers after resume drm/i915/tv: Fix modeset flickering introduced in 7f58aabc3 drm/i915/tv: Only poll for TV connections drm/i915/tv: Remember the detected TV type
2011-04-21Merge git://git.infradead.org/iommu-2.6Linus Torvalds1-12/+43
* git://git.infradead.org/iommu-2.6: intel_iommu: disable all VT-d PMRs when TXT launched intel-iommu: Fix get_domain_for_dev() error path intel-iommu: Unlink domain from iommu intel-iommu: Fix use after release during device attach
2011-04-21vfs: Pass setxattr(2) flags properlyJan Kara1-1/+1
For some reason generic_setxattr() did not pass flags (XATTR_CREATE, XATTR_REPLACE) to the filesystem specific helper. This caused that setxattr(2) syscall just ignored these flags. Fix the bug by passing flags correctly. Signed-off-by: Jan Kara <[email protected]> Acked-by: Christoph Hellwig <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-04-21[PARISC] set memory ranges in N_NORMAL_MEMORY when onlinedDavid Rientjes1-1/+3
When a DISCONTIGMEM memory range is brought online as a NUMA node, it also needs to have its bet set in N_NORMAL_MEMORY. This is necessary for generic kernel code that utilizes N_NORMAL_MEMORY as a subset of N_ONLINE for memory savings. These types of hacks can hopefully be removed once DISCONTIGMEM is either removed or abstracted away from CONFIG_NUMA. Fixes a panic in the slub code which only initializes structures for N_NORMAL_MEMORY to save memory: Backtrace: [<000000004021c938>] add_partial+0x28/0x98 [<000000004021faa0>] __slab_free+0x1d0/0x1d8 [<000000004021fd04>] kmem_cache_free+0xc4/0x128 [<000000004033bf9c>] ida_get_new_above+0x21c/0x2c0 [<00000000402a8980>] sysfs_new_dirent+0xd0/0x238 [<00000000402a974c>] create_dir+0x5c/0x168 [<00000000402a9ab0>] sysfs_create_dir+0x98/0x128 [<000000004033d6c4>] kobject_add_internal+0x114/0x258 [<000000004033d9ac>] kobject_add_varg+0x7c/0xa0 [<000000004033df20>] kobject_add+0x50/0x90 [<000000004033dfb4>] kobject_create_and_add+0x54/0xc8 [<00000000407862a0>] cgroup_init+0x138/0x1f0 [<000000004077ce50>] start_kernel+0x5a0/0x840 [<000000004011fa3c>] start_parisc+0xa4/0xb8 [<00000000404bb034>] packet_ioctl+0x16c/0x208 [<000000004049ac30>] ip_mroute_setsockopt+0x260/0xf20 Signed-off-by: David Rientjes <[email protected]> Cc: [email protected] Signed-off-by: James Bottomley <[email protected]>
2011-04-21virtio: console: Enable call to hvc_remove() on console port removeAmit Shah1-11/+0
This call was disabled as hot-unplugging one virtconsole port led to another virtconsole port freezing. Upon testing it again, this now works, so enable it. In addition, a bug was found in qemu wherein removing a port of one type caused the guest output from another port to stop working. I doubt it was just this bug that caused it (since disabling the hvc_remove() call did allow other ports to continue working), but since it's all solved now, we're fine with hot-unplugging of virtconsole ports. Signed-off-by: Amit Shah <[email protected]> Signed-off-by: Rusty Russell <[email protected]>
2011-04-21virtio_pci: Prevent double-free of pci regions after device hot-unplugAmit Shah1-7/+8
In the case where a virtio-console port is in use (opened by a program) and a virtio-console device is removed, the port is kept around but all the virtio-related state is assumed to be gone. When the port is finally released (close() called), we call device_destroy() on the port's device. This results in the parent device's structures to be freed as well. This includes the PCI regions for the virtio-console PCI device. Once this is done, however, virtio_pci_release_dev() kicks in, as the last ref to the virtio device is now gone, and attempts to do pci_iounmap(pci_dev, vp_dev->ioaddr); pci_release_regions(pci_dev); pci_disable_device(pci_dev); which results in a double-free warning. Move the code that releases regions, etc., to the virtio_pci_remove() function, and all that's now left in release_dev is the final freeing of the vp_dev. Signed-off-by: Amit Shah <[email protected]> Signed-off-by: Rusty Russell <[email protected]>
2011-04-21virtio: Decrement avail idx on buffer detachAmit Shah1-0/+1
When detaching a buffer from a vq, the avail.idx value should be decremented as well. This was noticed by hot-unplugging a virtio console port and then plugging in a new one on the same number (re-using the vqs which were just 'disowned'). qemu reported 'Guest moved used index from 0 to 256' when any IO was attempted on the new port. CC: [email protected] Reported-by: juzhang <[email protected]> Signed-off-by: Amit Shah <[email protected]> Signed-off-by: Rusty Russell <[email protected]>
2011-04-21intel_iommu: disable all VT-d PMRs when TXT launchedJoseph Cihula1-9/+29
Intel VT-d Protected Memory Regions (PMRs) are supposed to be disabled, on each VT-d engine, after DMA remapping is enabled on the engines. This is because the behavior of having both enabled is not deterministic and because, if TXT has been used to launch the kernel, the PMRs may be programmed to cover memory regions that will be used for DMA. Under some circumstances (certain quirks detected, lack of multiple devices, etc.), the current code does not set up DMA remapping on some VT-d engines. In such cases it also skips disabling the PMRs. This causes failures when the kernel is launched with TXT (most often this occurs on the graphics engine and results in colored vertical bars on the display). This patch detects when the kernel has been launched with TXT and then disables the PMRs on all VT-d engines. In some cases where the reason that remapping is not being enabled is due to possible ACPI DMAR table errors, the VT-d engine addresses may not be correct and thus not able to be safely programmed even to disable PMRs. Because part of the TXT launch process is the verification of these addresses, it will always be safe to disable PMRs if the TXT launch has succeeded and hence only doing this in such cases. Signed-off-by: Joseph Cihula <[email protected]> Signed-off-by: David Woodhouse <[email protected]>
2011-04-21UBIFS: fix master node recoveryArtem Bityutskiy1-0/+26
This patch fixes the following symptoms: 1. Unmount UBIFS cleanly. 2. Start mounting UBIFS R/W and have a power cut immediately 3. Start mounting UBIFS R/O, this succeeds 4. Try to re-mount UBIFS R/W - this fails immediately or later on, because UBIFS will write the master node to the flash area which has been written before. The analysis of the problem: 1. UBIFS is unmounted cleanly, both copies of the master node are clean. 2. UBIFS is being mounter R/W, starts changing master node copy 1, and a power cut happens. The copy N1 becomes corrupted. 3. UBIFS is being mounted R/O. It notices the copy N1 is corrupted and reads copy N2. Copy N2 is clean. 4. Because of R/O mode, UBIFS cannot recover copy 1. 5. The mount code (ubifs_mount()) sees that the master node is clean, so it decides that no recovery is needed. 6. We are re-mounting R/W. UBIFS believes no recovery is needed and starts updating the master node, but copy N1 is still corrupted and was not recovered! Fix this problem by marking the master node as dirty every time we recover it and we are in R/O mode. This forces further recovery and the UBIFS cleans-up the corruptions and recovers the copy N1 when re-mounting R/W later. Signed-off-by: Artem Bityutskiy <[email protected]> Cc: [email protected]
2011-04-21UBIFS: fix false assertion warning in case of I/O failuresArtem Bityutskiy1-4/+6
When UBIFS switches to R/O mode because it detects I/O failures, then when we unmount, we still may have allocated budget, and the assertions which verify that we have not budget will fire. But it is expected to have the budget in case of I/O failures, so the assertion warnings will be false. Suppress them for the I/O failure case. Signed-off-by: Artem Bityutskiy <[email protected]>
2011-04-21EDAC: Remove debugging output in scrub rate handlingMarkus Trippelsdorf2-8/+5
This patch removes superfluous debugging output in the sysfs scrub rate handler. It also consolidates the error handling in the scrub rate accessors. Signed-off-by: Markus Trippelsdorf <[email protected]> Signed-off-by: Borislav Petkov <[email protected]>
2011-04-21Merge branch 'fix/hda' into for-linusTakashi Iwai3-4/+31
2011-04-21x86, numa: Fix cpu nodemasks for NUMA emulation and CONFIG_DEBUG_PER_CPU_MAPSDavid Rientjes3-33/+20
The cpu<->node mappings under CONFIG_DEBUG_PER_CPU_MAPS=y when NUMA emulation is enabled is currently broken because it does not iterate through every emulated node and bind cpus that have affinity to it. NUMA emulation should bind each cpu to every local node to accurately represent the true NUMA topology of the underlying machine. debug_cpumask_set_cpu() needs to be fixed at the same time so that the debugging information that it emits shows the new cpumask of the node being assigned when the cpu is being added or removed. It can now take responsibility of setting or clearing the cpu itself to remove the need for duplicate code. Also change its last parameter, "enable", to have the correct bool type since it can only be true or false. -v2: Fix the return statements, by Kosaki Motohiro Acked-and-Tested-by: KOSAKI Motohiro <[email protected]> Signed-off-by: David Rientjes <[email protected]> Cc: Andreas Herrmann <[email protected]> Cc: Tejun Heo <[email protected]> Cc: Linus Torvalds <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2011-04-21Revert "x86, NUMA: Fix fakenuma boot failure"David Rientjes1-23/+0
Andreas Herrmann reported that 7d6b46707f24 ("x86, NUMA: Fix fakenuma boot failure") causes certain physical NUMA topologies (for example AMD Magny-Cours) to move sibling cpus to a single node when in reality they are in separate domains. This may result in some nodes being completely void of cpus, which doesn't accurately represent the correct topology. The system will boot, but will have suboptimal NUMA performance. This commit was intended as a fix for NUMA emulation, but should not cause a regression for real NUMA machines as a side effect. ( There will be a separate fix for the numa-debug code, which will not affect physical topologies. ) Reported-by: Andreas Herrmann <[email protected]> Signed-off-by: David Rientjes <[email protected]> Acked-by: KOSAKI Motohiro <[email protected]> Cc: Tejun Heo <[email protected]> Cc: Linus Torvalds <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
2011-04-21agp: fix arbitrary kernel memory writesVasiliy Kulikov1-3/+8
pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2011-04-21agp: fix OOM and buffer overflowVasiliy Kulikov1-1/+7
page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2011-04-20Merge branch 'hwmon-for-linus' of ↵Linus Torvalds7-31/+331
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (max34440) Add driver documentation hwmon: (max16064) Add driver documentation hwmon: (max8688) Add driver documentation hwmon: (pmbus) Documentation updates hwmon: (smm665) Fix spelling error in driver documentation hwmon: (pmbus) Removed unused variable from struct pmbus_data hwmon: Add submitting-patches checklist to documentation
2011-04-20Merge branch 'for-2.6.39' of git://linux-nfs.org/~bfields/linuxLinus Torvalds2-2/+10
* 'for-2.6.39' of git://linux-nfs.org/~bfields/linux: Open with O_CREAT flag set fails to open existing files on non writable directories nfsd4: Fix filp leak nfsd4: fix struct file leak on delegation
2011-04-20Merge branch 'fixes' of master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds3-0/+9
* 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm: ARM: 6881/1: cputype.h uses __attribute_const__ which requires including kernel.h ARM: Add new syscalls
2011-04-20Merge branch 'stable/bug-fixes-rc4' of ↵Linus Torvalds2-5/+10
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen * 'stable/bug-fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen: mask_rw_pte: do not apply the early_ioremap checks on x86_32 xen: do not create the extra e820 region at an addr lower than 4G
2011-04-20Merge branch 'for-linus' of git://neil.brown.name/mdLinus Torvalds3-1/+15
* 'for-linus' of git://neil.brown.name/md: md: Update documentation for sync_min and sync_max entries md: Cleanup after raid45->raid0 takeover md: Fix dev_sectors on takeover from raid0 to raid4/5 md/raid5: remove setting of ->queue_lock
2011-04-20ALSA: hda - Fix unused warnings when !SND_HDA_NEEDS_RESUMEMike Waychison1-0/+4
When SND_HDA_NEEDS_RESUME is not defined, the compiler identifies that the following symbols are static but not used: restore_shutup_pins hda_cleanup_all_streams Fix warnings by adding SND_HDA_NEEDS_RESUME guards. Signed-off-by: Mike Waychison <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2011-04-20Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds7-73/+31
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: Remove the extra check in queue_requests_store block, blk-sysfs: Fix an err return path in blk_register_queue() block: remove stale kerneldoc member from __blk_run_queue() block: get rid of QUEUE_FLAG_REENTER cfq-iosched: read_lock() does not always imply rcu_read_lock() block: kill blk_flush_plug_list() export
2011-04-20rtc: fix coh901331 startup crashLinus Walleij1-2/+2
The rtc_device_register() call has changed semantics so that it will immediately call out to rtc_read_alarm() and since the callbacks require the drvdata to be set, we need to set it before the registration call to avoid NULL dereference. Signed-off-by: Linus Walleij <[email protected]>
2011-04-20mach-ux500: fix i2c0 device setup regressionLinus Walleij1-9/+10
Adding two sets of I2C devices to the same bus doesn't quite work, atleast not anymore. Stash one array and determine how much of it shall be added instead. Signed-off-by: Linus Walleij <[email protected]>
2011-04-20xfs: fix duplicate message outputDave Chinner1-1/+3
Commit 957935dc ("xfs: fix xfs_debug warnings" broke the logic in __xfs_printk(). Instead of only printing one of two possible output strings based on whether the fs has a name or not, it outputs both. Fix it to only output one message again. Signed-off-by: Dave Chinner <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Alex Elder <[email protected]>
2011-04-20UBIFS: fix false space checking failureArtem Bityutskiy1-4/+15
This patch fixes UBIFS mount failure when the debugging support is enabled, we are recovering from a power cut, we were first mounter R/O and we are re-mounting R/W. In this case we should not assume that the amount of free space before we have re-mounted R/W and after are equivalent, because when we have mounted R/O the file-system is in a non-committed state so the amount of free space is slightly smaller, due to the fact that we cannot predict the amount of free space precisely before we commit. This patch fixes the issue by skipping the debugging check in case of recovery. This issue was reported by Caizhiyong <[email protected]> here: http://thread.gmane.org/gmane.linux.drivers.mtd/34350/focus=34387 Signed-off-by: Artem Bityutskiy <[email protected]> Reported-by: Caizhiyong <[email protected]> Cc: [email protected] [2.6.30+]
2011-04-20Open with O_CREAT flag set fails to open existing files on non writable ↵Sachin Prabhu1-1/+8
directories An open on a NFS4 share using the O_CREAT flag on an existing file for which we have permissions to open but contained in a directory with no write permissions will fail with EACCES. A tcpdump shows that the client had set the open mode to UNCHECKED which indicates that the file should be created if it doesn't exist and encountering an existing flag is not an error. Since in this case the file exists and can be opened by the user, the NFS server is wrong in attempting to check create permissions on the parent directory. The patch adds a conditional statement to check for create permissions only if the file doesn't exist. Signed-off-by: Sachin S. Prabhu <[email protected]> Signed-off-by: J. Bruce Fields <[email protected]>
2011-04-20xen: mask_rw_pte: do not apply the early_ioremap checks on x86_32Stefano Stabellini1-4/+9
The two "is_early_ioremap_ptep" checks in mask_rw_pte are only used on x86_64, in fact early_ioremap is not used at all to setup the initial pagetable on x86_32. Moreover on x86_32 the two checks are wrong because the range pgt_buf_start..pgt_buf_end initially should be mapped RW because the pages in the range are not pagetable pages yet and haven't been cleared yet. Afterwards considering the pgt_buf_start..pgt_buf_end is part of the initial mapping, xen_alloc_pte is capable of turning the ptes RO when they become pagetable pages. Fix the issue and improve the readability of the code providing two different implementation of mask_rw_pte for x86_32 and x86_64. Signed-off-by: Stefano Stabellini <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-04-20xen: do not create the extra e820 region at an addr lower than 4GStefano Stabellini1-1/+1
Do not add the extra e820 region at a physical address lower than 4G because it breaks e820_end_of_low_ram_pfn(). It is OK for us to move the xen_extra_mem_start up and down because this is the index of the memory that can be ballooned in/out - it is memory not available to the kernel during bootup. Signed-off-by: Stefano Stabellini <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2011-04-20[S390] kvm-390: Let kernel exit SIE instruction on workCarsten Otte1-2/+2
From: Christian Borntraeger <[email protected]> This patch fixes the sie exit on interrupts. The low level interrupt handler returns to the PSW address in pt_regs and not to the PSW address in the lowcore. Without this fix a cpu bound guest might never leave guest state since the host interrupt handler would blindly return to the SIE instruction, even on need_resched and friends. Cc: [email protected] Signed-off-by: Carsten Otte <[email protected]> Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] dasd: check sense type in device change handlerStefan Weinhuber1-2/+3
When evaluating sense data in dasd_eckd_check_for_device_change, we must always check for the type of sense data in byte 27, bit 0, to make sure that the rest of the sense data is interpreted correctly. Signed-off-by: Stefan Weinhuber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] pfault: fix token handlingHeiko Carstens1-2/+2
f6649a7e "[S390] cleanup lowcore access from external interrupts" changed handling of external interrupts. Instead of letting the external interrupt handlers accessing the per cpu lowcore the entry code of the kernel reads already all fields that are necessary and passes them to the handlers. The pfault interrupt handler was incorrectly converted. It tries to dereference a value which used to be a pointer to a lowcore field. After the conversion however it is not anymore the pointer to the field but its content. So instead of a dereference only a cast is needed to get the task pointer that caused the pfault. Fixes a NULL pointer dereference and a subsequent kernel crash: Unable to handle kernel pointer dereference at virtual kernel address (null) Oops: 0004 [#1] SMP Modules linked in: nfsd exportfs nfs lockd fscache nfs_acl auth_rpcgss sunrpc loop qeth_l3 qeth vmur ccwgroup ext3 jbd mbcache dm_mod dasd_eckd_mod dasd_diag_mod dasd_mod CPU: 0 Not tainted 2.6.38-2-s390x #1 Process cron (pid: 1106, task: 000000001f962f78, ksp: 000000001fa0f9d0) Krnl PSW : 0404200180000000 000000000002c03e (pfault_interrupt+0xa2/0x138) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3 Krnl GPRS: 0000000000000000 0000000000000001 0000000000000000 0000000000000001 000000001f962f78 0000000000518968 0000000090000002 000000001ff03280 0000000000000000 000000000064f000 000000001f962f78 0000000000002603 0000000006002603 0000000000000000 000000001ff7fe68 000000001ff7fe48 Krnl Code: 000000000002c036: 5820d010 l %r2,16(%r13) 000000000002c03a: 1832 lr %r3,%r2 000000000002c03c: 1a31 ar %r3,%r1 >000000000002c03e: ba23d010 cs %r2,%r3,16(%r13) 000000000002c042: a744fffc brc 4,2c03a 000000000002c046: a7290002 lghi %r2,2 000000000002c04a: e320d0000024 stg %r2,0(%r13) 000000000002c050: 07f0 bcr 15,%r0 Call Trace: ([<000000001f962f78>] 0x1f962f78) [<000000000001acda>] do_extint+0xf6/0x138 [<000000000039b6ca>] ext_no_vtime+0x30/0x34 [<000000007d706e04>] 0x7d706e04 Last Breaking-Event-Address: [<0000000000000000>] 0x0 For stable maintainers: the first kernel which contains this bug is 2.6.37. Reported-by: Stephen Powell <[email protected]> Cc: Jonathan Nieder <[email protected]> Cc: [email protected] Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] qdio: reset error states immediatelyJan Glauber1-5/+12
The qdio hardware may surpress further interrupts as long as a SBAL is in the error state. That can lead to unnotified data in the SBALs following the error state. To prevent this behaviour change the SBAL[s] in error state immediately to another program owned state so interrupts are again received for further traffic on the device. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] fix page table walk for changing page attributesJan Glauber1-2/+3
The page table walk for changing page attributes used the wrong address for pgd/pud/pmd lookups if the range was bigger than a pmd entry. Fix the lookup by using the correct address. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] prng: prevent access beyond end of stackJan Glauber1-1/+1
While initializing the state of the prng only the first 8 bytes of random data where used, the second 8 bytes were read from the memory after the stack. If only 64 bytes of the kernel stack are used and CONFIG_DEBUG_PAGEALLOC is enabled a kernel panic may occur because of the invalid page access. Use the correct multiplicator to stay within the random data buffer. Signed-off-by: Jan Glauber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20[S390] dasd: fix race between open and offlineStefan Weinhuber5-60/+143
The dasd_open function uses the private_data pointer of the gendisk to find the dasd_block structure that matches the gendisk. When a DASD device is set offline, we set the private_data pointer of the gendisk to NULL and later remove the dasd_block structure, but there is still a small race window, in which dasd_open could first read a pointer from the private_data field and then try to use it, after the structure has already been freed. To close this race window, we will store a pointer to the dasd_devmap structure of the base device in the private_data field. The devmap entries are not deleted, and we already have proper locking and reference counting in place, so that we can safely get from a devmap pointer to the dasd_device and dasd_block structures of the device. Signed-off-by: Stefan Weinhuber <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2011-04-20md: Update documentation for sync_min and sync_max entriesCoolCold1-0/+10
linux/Documentation/md.txt is missing description for sync_min and sync_max entries. This patch adds description for sync_min and sync_max entries. Signed-off-by: Roman Ovchinnikov <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2011-04-20md: Cleanup after raid45->raid0 takeoverKrzysztof Wojcik1-0/+1
Problem: After raid4->raid0 takeover operation, another takeover operation (e.g raid0->raid10) results "kernel oops". Root cause: Variables 'degraded' in mddev structure is not cleared on raid45->raid0 takeover. This patch reset this variable. Signed-off-by: Krzysztof Wojcik <[email protected]> Signed-off-by: NeilBrown <[email protected]>
2011-04-20md: Fix dev_sectors on takeover from raid0 to raid4/5NeilBrown1-0/+4
A raid0 array doesn't set 'dev_sectors' as each device might contribute a different number of sectors. So when converting to a RAID4 or RAID5 we need to set dev_sectors as they need the number. We have already verified that in fact all devices do contribute the same number of sectors, so use that number. Signed-off-by: NeilBrown <[email protected]>
2011-04-20md/raid5: remove setting of ->queue_lockNeilBrown1-1/+0
We previously needed to set ->queue_lock to match the raid5 device_lock so we could safely use queue_flag_* operations (e.g. for plugging). which test the ->queue_lock is in fact locked. However that need has completely gone away and is unlikely to come back to remove this now-pointless setting. Signed-off-by: NeilBrown <[email protected]>
2011-04-19Merge branch 'drm-fixes' of ↵Linus Torvalds16-92/+102
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: pll tweaks for r7xx drm/nouveau: fix allocation of notifier object drm/nouveau: fix notifier memory corruption bug drm/nouveau: fix pinning of notifier block drm/nouveau: populate ttm_alloced with false, when it's not drm/nouveau: fix nv30 pcie boards drm/nouveau: split ramin_lock into two locks, one hardirq safe drm/radeon/kms: adjust evergreen display watermark setup drm/radeon/kms: add connectors even if i2c fails drm/radeon/kms: fix bad shift in atom iio table parser
2011-04-20drm/radeon/kms: fix IH writeback on r6xx+ on big endian machinesCédric Cano2-2/+2
agd5f: fix commit message. Signed-off-by: Cedric Cano <[email protected]> Reviewed-by: Michel Dänzer <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
2011-04-19Btrfs: do some plugging in the submit_bio threadsChris Mason1-0/+10
The Btrfs submit bio threads have a small number of threads responsible for pushing down bios we've collected for a large number of devices. Since we do all the bios for a single device at once, we want to make sure we unplug and send down the bios for each device as we're done processing them. The new plugging API removed the btrfs code to unplug while processing bios, this adds it back with the new API. Signed-off-by: Chris Mason <[email protected]>