aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-04-21KS8851: NULL pointer dereference if list is emptyAbraham Arce1-5/+7
Fix NULL pointer dereference in ks8851_tx_work by checking if dequeued list is already empty before writing the packet to TX FIFO Unable to handle kernel NULL pointer dereference at virtual address 00000050 PC is at ks8851_tx_work+0xdc/0x1b0 LR is at wait_for_common+0x148/0x164 pc : [<c01c0df4>] lr : [<c025a980>] psr: 20000013 Backtrace: ks8851_tx_work+0x0/0x1b0 worker_thread+0x0/0x190 kthread+0x0/0x90 Signed-off-by: Abraham Arce <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-21net: 3c574_cs fix stats.tx_bytes counterAlexander Kurz1-2/+5
Update the stats counter calculation in 3c574_cs, similar to the method used in 3c589_cs. This corrects the contents of the counter on tests using a "Megahertz 574B" card. [[email protected]: clean up commit message] Signed-off-by: Alexander Kurz <[email protected]> Signed-off-by: Dominik Brodowski <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-21xfrm6: ensure to use the same dev when building a bundleNicolas Dichtel1-1/+1
When building a bundle, we set dst.dev and rt6.rt6i_idev. We must ensure to set the same device for both fields. Signed-off-by: Nicolas Dichtel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-21can: Fix possible NULL pointer dereference in ems_usb.cHans J. Koch1-4/+4
In ems_usb_probe(), a pointer is dereferenced after making sure it is NULL... This patch replaces netdev->dev.parent with &intf->dev in dev_err() calls to avoid this. Signed-off-by: "Hans J. Koch" <[email protected]> Acked-by: Wolfgang Grandegger <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-22CRED: Fix a race in creds_are_invalid() in credentials debuggingDavid Howells1-2/+0
creds_are_invalid() reads both cred->usage and cred->subscribers and then compares them to make sure the number of processes subscribed to a cred struct never exceeds the refcount of that cred struct. The problem is that this can cause a race with both copy_creds() and exit_creds() as the two counters, whilst they are of atomic_t type, are only atomic with respect to themselves, and not atomic with respect to each other. This means that if creds_are_invalid() can read the values on one CPU whilst they're being modified on another CPU, and so can observe an evolving state in which the subscribers count now is greater than the usage count a moment before. Switching the order in which the counts are read cannot help, so the thing to do is to remove that particular check. I had considered rechecking the values to see if they're in flux if the test fails, but I can't guarantee they won't appear the same, even if they've changed several times in the meantime. Note that this can only happen if CONFIG_DEBUG_CREDENTIALS is enabled. The problem is only likely to occur with multithreaded programs, and can be tested by the tst-eintr1 program from glibc's "make check". The symptoms look like: CRED: Invalid credentials CRED: At include/linux/cred.h:240 CRED: Specified credentials: ffff88003dda5878 [real][eff] CRED: ->magic=43736564, put_addr=(null) CRED: ->usage=766, subscr=766 CRED: ->*uid = { 0,0,0,0 } CRED: ->*gid = { 0,0,0,0 } CRED: ->security is ffff88003d72f538 CRED: ->security {359, 359} ------------[ cut here ]------------ kernel BUG at kernel/cred.c:850! ... RIP: 0010:[<ffffffff81049889>] [<ffffffff81049889>] __invalid_creds+0x4e/0x52 ... Call Trace: [<ffffffff8104a37b>] copy_creds+0x6b/0x23f Note the ->usage=766 and subscr=766. The values appear the same because they've been re-read since the check was made. Reported-by: Roland McGrath <[email protected]> Signed-off-by: David Howells <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-21Merge branch 'for_2.6.34rc_a' of git://git.pwsan.com/linux-2.6 into ↵Tony Lindgren362-2000/+3343
omap-fixes-for-linus
2010-04-21Merge branch 'for-linus' of ↵Linus Torvalds6-6/+12
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: allow 4 coldfire serial ports m68knommu: fix coldfire tcdrain m68knommu: remove a duplicate vector setting line for 68360 Fix m68k-uclinux's rt_sigreturn trampoline m68knommu: correct the CC flags for Coldfire M5272 targets uclinux: error message when FLAT reloc symbol is invalid, v2
2010-04-21Merge branch 'for-linus' of ↵Linus Torvalds2-2/+9
git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6: mc13783-regulator: fix a memory leak in mc13783_regulator_remove regulator: Let drivers know when they use the stub API
2010-04-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfsLinus Torvalds6-55/+91
* git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfs: [LogFS] Split large truncated into smaller chunks [LogFS] Set s_bdi [LogFS] Prevent mempool_destroy NULL pointer dereference [LogFS] Move assertion [LogFS] Plug 8 byte information leak [LogFS] Prevent memory corruption on large deletes [LogFS] Remove unused method Fix trivial conflict with added header includes in fs/logfs/super.c
2010-04-21Merge branch 'for-linus' of ↵Linus Torvalds7-16/+33
git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6: jfs: add jfs specific ->setattr call jfs: fix diAllocExt error in resizing filesystem jfs_dmap.[ch]: trivial typo fix: s/heigth/height/g
2010-04-21Merge branch 'kvm-updates/2.6.34' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds8-67/+79
* 'kvm-updates/2.6.34' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Fix TSS size check for 16-bit tasks KVM: Add missing srcu_read_lock() for kvm_mmu_notifier_release() KVM: Increase NR_IOBUS_DEVS limit to 200 KVM: fix the handling of dirty bitmaps to avoid overflows KVM: MMU: fix kvm_mmu_zap_page() and its calling path KVM: VMX: Save/restore rflags.vm correctly in real mode KVM: allow bit 10 to be cleared in MSR_IA32_MC4_CTL KVM: Don't spam kernel log when injecting exceptions due to bad cr writes KVM: SVM: Fix memory leaks that happen when svm_create_vcpu() fails KVM: take srcu lock before call to complete_pio()
2010-04-21Merge branch 'for-linus' of git://neil.brown.name/mdLinus Torvalds1-12/+7
* 'for-linus' of git://neil.brown.name/md: md/raid5: allow for more than 2^31 chunks.
2010-04-21AFS: Don't pass error value to page_cache_release() in error handlingDavid Howells1-12/+12
In the error handling in afs_mntpt_do_automount(), we pass an error pointer to page_cache_release() if read_mapping_page() failed. Instead, we should extend the gotos around the error handling we don't need. Reported-by: Dan Carpenter <[email protected]> Signed-off-by: David Howells <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-04-21block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timerRichard Kennedy1-7/+5
blk_rq_timed_out_timer() relied on blk_add_timer() never returning a timer value of zero, but commit 7838c15b8dd18e78a523513749e5b54bda07b0cb removed the code that bumped this value when it was zero. Therefore when jiffies is near wrap we could get unlucky & not set the timeout value correctly. This patch uses a flag to indicate that the timeout value was set and so handles jiffies wrap correctly, and it keeps all the logic in one function so should be easier to maintain in the future. Signed-off-by: Richard Kennedy <[email protected]> Cc: [email protected] Signed-off-by: Jens Axboe <[email protected]>
2010-04-21KVM: x86: Fix TSS size check for 16-bit tasksJan Kiszka1-1/+5
A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch. Signed-off-by: Jan Kiszka <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-04-21KVM: Add missing srcu_read_lock() for kvm_mmu_notifier_release()Lai Jiangshan1-0/+4
I got this dmesg due to srcu_read_lock() is missing in kvm_mmu_notifier_release(). =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- arch/x86/kvm/x86.h:72 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by qemu-system-x86/3100: #0: (rcu_read_lock){.+.+..}, at: [<ffffffff810d73dc>] __mmu_notifier_release+0x38/0xdf #1: (&(&kvm->mmu_lock)->rlock){+.+...}, at: [<ffffffffa0130a6a>] kvm_mmu_zap_all+0x21/0x5e [kvm] stack backtrace: Pid: 3100, comm: qemu-system-x86 Not tainted 2.6.34-rc3-22949-gbc8a97a-dirty #2 Call Trace: [<ffffffff8106afd9>] lockdep_rcu_dereference+0xaa/0xb3 [<ffffffffa0123a89>] unalias_gfn+0x56/0xab [kvm] [<ffffffffa0119600>] gfn_to_memslot+0x16/0x25 [kvm] [<ffffffffa012ffca>] gfn_to_rmap+0x17/0x6e [kvm] [<ffffffffa01300c1>] rmap_remove+0xa0/0x19d [kvm] [<ffffffffa0130649>] kvm_mmu_zap_page+0x109/0x34d [kvm] [<ffffffffa0130a7e>] kvm_mmu_zap_all+0x35/0x5e [kvm] [<ffffffffa0122870>] kvm_arch_flush_shadow+0x16/0x22 [kvm] [<ffffffffa01189e0>] kvm_mmu_notifier_release+0x15/0x17 [kvm] [<ffffffff810d742c>] __mmu_notifier_release+0x88/0xdf [<ffffffff810d73dc>] ? __mmu_notifier_release+0x38/0xdf [<ffffffff81040848>] ? exit_mm+0xe0/0x115 [<ffffffff810c2cb0>] exit_mmap+0x2c/0x17e [<ffffffff8103c472>] mmput+0x2d/0xd4 [<ffffffff81040870>] exit_mm+0x108/0x115 [...] Signed-off-by: Lai Jiangshan <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-04-21net: Fix an RCU warning in dev_pick_tx()David Howells1-1/+1
Fix the following RCU warning in dev_pick_tx(): =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- net/core/dev.c:1993 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by swapper/0: #0: (&idev->mc_ifc_timer){+.-...}, at: [<ffffffff81039e65>] run_timer_softirq+0x17b/0x278 #1: (rcu_read_lock_bh){.+....}, at: [<ffffffff812ea3eb>] dev_queue_xmit+0x14e/0x4dc stack backtrace: Pid: 0, comm: swapper Not tainted 2.6.34-rc5-cachefs #4 Call Trace: <IRQ> [<ffffffff810516c4>] lockdep_rcu_dereference+0xaa/0xb2 [<ffffffff812ea4f6>] dev_queue_xmit+0x259/0x4dc [<ffffffff812ea3eb>] ? dev_queue_xmit+0x14e/0x4dc [<ffffffff81052324>] ? trace_hardirqs_on+0xd/0xf [<ffffffff81035362>] ? local_bh_enable_ip+0xbc/0xc1 [<ffffffff812f0954>] neigh_resolve_output+0x24b/0x27c [<ffffffff8134f673>] ip6_output_finish+0x7c/0xb4 [<ffffffff81350c34>] ip6_output2+0x256/0x261 [<ffffffff81052324>] ? trace_hardirqs_on+0xd/0xf [<ffffffff813517fb>] ip6_output+0xbbc/0xbcb [<ffffffff8135bc5d>] ? fib6_force_start_gc+0x2b/0x2d [<ffffffff81368acb>] mld_sendpack+0x273/0x39d [<ffffffff81368858>] ? mld_sendpack+0x0/0x39d [<ffffffff81052099>] ? mark_held_locks+0x52/0x70 [<ffffffff813692fc>] mld_ifc_timer_expire+0x24f/0x288 [<ffffffff81039ed6>] run_timer_softirq+0x1ec/0x278 [<ffffffff81039e65>] ? run_timer_softirq+0x17b/0x278 [<ffffffff813690ad>] ? mld_ifc_timer_expire+0x0/0x288 [<ffffffff81035531>] ? __do_softirq+0x69/0x140 [<ffffffff8103556a>] __do_softirq+0xa2/0x140 [<ffffffff81002e0c>] call_softirq+0x1c/0x28 [<ffffffff81004b54>] do_softirq+0x38/0x80 [<ffffffff81034f06>] irq_exit+0x45/0x47 [<ffffffff810177c3>] smp_apic_timer_interrupt+0x88/0x96 [<ffffffff810028d3>] apic_timer_interrupt+0x13/0x20 <EOI> [<ffffffff810488dd>] ? __atomic_notifier_call_chain+0x0/0x86 [<ffffffff810096bf>] ? mwait_idle+0x6e/0x78 [<ffffffff810096b6>] ? mwait_idle+0x65/0x78 [<ffffffff810011cb>] cpu_idle+0x4d/0x83 [<ffffffff81380b05>] rest_init+0xb9/0xc0 [<ffffffff81380a4c>] ? rest_init+0x0/0xc0 [<ffffffff8168dcf0>] start_kernel+0x392/0x39d [<ffffffff8168d2a3>] x86_64_start_reservations+0xb3/0xb7 [<ffffffff8168d38b>] x86_64_start_kernel+0xe4/0xeb An rcu_dereference() should be an rcu_dereference_bh(). Signed-off-by: David Howells <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-21Merge branch 'master' of /home/davem/src/GIT/linux-2.6/David S. Miller239-2514/+4459
2010-04-21ipv6: Fix tcp_v6_send_response transport header setting.Herbert Xu1-1/+1
My recent patch to remove the open-coded checksum sequence in tcp_v6_send_response broke it as we did not set the transport header pointer on the new packet. Actually, there is code there trying to set the transport header properly, but it sets it for the wrong skb ('skb' instead of 'buff'). This bug was introduced by commit a8fdf2b331b38d61fb5f11f3aec4a4f9fb2dedcb ("ipv6: Fix tcp_v6_send_response(): it didn't set skb transport header") Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-21ARM: fix build error in arch/arm/kernel/process.cRussell King19-86/+86
/tmp/ccJ3ssZW.s: Assembler messages: /tmp/ccJ3ssZW.s:1952: Error: can't resolve `.text' {.text section} - `.LFB1077' This is caused because: .section .data .section .text .section .text .previous does not return us to the .text section, but the .data section; this makes use of .previous dangerous if the ordering of previous sections is not known. Fix up the other users of .previous; .pushsection and .popsection are a safer pairing to use than .section and .previous. Signed-off-by: Russell King <[email protected]>
2010-04-21pcmcia: pcmcia_dev_present bugfixDominik Brodowski3-42/+20
pcmcia_dev_present is in and by itself buggy. Add a note specifying why it is broken, and replace the broken locking -- taking a mutex is a bad idea in IRQ context, from which this function is rarely called -- by an atomic_t. Signed-off-by: Dominik Brodowski <[email protected]>
2010-04-21m68knommu: allow 4 coldfire serial portsPhilippe De Muyter1-1/+1
Fix driver/serial/mcf.c for 4-ports coldfire's (e.g. MCF5484). Signed-off-by: Philippe De Muyter <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-21m68knommu: fix coldfire tcdrainPhilippe De Muyter2-1/+8
Fix tcdrain on coldfire uarts. Currently with coldfire uarts tcdrain returns without waiting for txempty, because (tx)fifosize is 0. Fix that and call uart_update_timeout when setting the baud rate, otherwise tcdrain will wait for an half our :) Also constify mcf_uart_ops. Signed-off-by: Philippe De Muyter <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-21m68knommu: remove a duplicate vector setting line for 68360Greg Ungerer1-1/+0
Remove a duplicate vector setting line for the 68360 interrupt setup. Pointed out by Roel Kluin <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-21Fix m68k-uclinux's rt_sigreturn trampolineMaxim Kuvyrkov1-1/+1
Signed-off-by: Maxim Kuvyrkov <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-21m68knommu: correct the CC flags for Coldfire M5272 targetsPhilip Nye1-1/+1
Signed-off-by: Philip Nye <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-21uclinux: error message when FLAT reloc symbol is invalid, v2Jun Sun1-1/+1
This patch fixes a cosmetic error in printk. Text segment and data/bss segment are allocated from two different areas. It is not meaningful to give the diff between them in the error reporting messages. Signed-off-by: Jun Sun <[email protected]> Signed-off-by: Greg Ungerer <[email protected]>
2010-04-20bridge: add a missing ntohs()Eric Dumazet1-1/+1
grec_nsrcs is in network order, we should convert to host horder in br_multicast_igmp3_report() Signed-off-by: Eric Dumazet <[email protected]> Acked-by: Herbert Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-04-20Merge branch 'master' of ↵David S. Miller9-16/+31
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2010-04-21CRED: Fix double free in prepare_usermodehelper_creds() error handlingDavid Howells1-0/+2
Patch 570b8fb505896e007fd3bb07573ba6640e51851d: Author: Mathieu Desnoyers <[email protected]> Date: Tue Mar 30 00:04:00 2010 +0100 Subject: CRED: Fix memory leak in error handling attempts to fix a memory leak in the error handling by making the offending return statement into a jump down to the bottom of the function where a kfree(tgcred) is inserted. This is, however, incorrect, as it does a kfree() after doing put_cred() if security_prepare_creds() fails. That will result in a double free if 'error' is jumped to as put_cred() will also attempt to free the new tgcred record by virtue of it being pointed to by the new cred record. Signed-off-by: David Howells <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-04-20x86, mrst: Conditionally register cpu hotplug notifier for apbtJacob Pan1-1/+1
APB timer is used on Moorestown platforms but not on a standard PC. If APB timer code is compiled in but not initialized at run-time due to lack of FW reported SFI table, kernel would panic when the non-boot CPUs are offlined and notifier is called. https://bugzilla.kernel.org/show_bug.cgi?id=15786 This patch ensures CPU hotplug notifier for APB timer is only registered when the APBT timer block is initialized. Signed-off-by: Jacob Pan <[email protected]> LKML-Reference: <[email protected]> Signed-off-by: H. Peter Anvin <[email protected]>
2010-04-20ext4: Issue the discard operation *before* releasing the blocks to be reusedTheodore Ts'o1-10/+11
Otherwise, we can end up having data corruption because the blocks could get reused and then discarded! https://bugzilla.kernel.org/show_bug.cgi?id=15579 Signed-off-by: "Theodore Ts'o" <[email protected]>
2010-04-20[LogFS] Split large truncated into smaller chunksJoern Engel1-8/+26
Truncate would do an almost limitless amount of work without invoking the garbage collector in between. Split it up into more manageable, though still large, chunks. Signed-off-by: Joern Engel <[email protected]>
2010-04-20Merge branch 'for_linus' of ↵Linus Torvalds2-9/+15
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6: quota: Convert __DQUOT_PARANOIA symbol to standard config option
2010-04-20quota: Convert __DQUOT_PARANOIA symbol to standard config optionJan Kara2-9/+15
Make __DQUOT_PARANOIA define from the old days a standard config option and turn it off by default. This gets rid of a quota warning about writes before quota is turned on for systems with ext4 root filesystem. Currently there's no way to legally solve this because /etc/mtab has to be written before quota is turned on on most systems. Signed-off-by: Jan Kara <[email protected]>
2010-04-20Merge branch 'urgent' of ↵Linus Torvalds7-23/+55
git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: fix error handling in cm4000_cs.c drivers/pcmcia: Add missing local_irq_restore serial_cs: MD55x support (PCMCIA GPRS/EDGE modem) (kernel 2.6.33) pcmcia: avoid late calls to pccard_validate_cis pcmcia: fix ioport size calculation in rsrc_nonstatic pcmcia: re-start on MFC override pcmcia: fix io_probe due to parent (PCI) resources pcmcia: use previously assigned IRQ for all card functions
2010-04-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6Linus Torvalds7-27/+47
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix hardirq tracing in trap return path. sparc64: Use correct pt_regs in decode_access_size() error paths. sparc64: Fix PREEMPT_ACTIVE value. sparc64: Run NMIs on the hardirq stack. sparc64: Allocate sufficient stack space in ftrace stubs. sparc: Fix forgotten kmemleak headers inclusion
2010-04-20Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds1-2/+6
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf: Fix unsafe frame rewinding with hot regs fetching
2010-04-20Merge branch 'drm-linus' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: delay vblank cleanup until after driver unload
2010-04-20x86: correctly wire up the newuname system callChristoph Hellwig1-1/+1
Before commit e28cbf22933d0c0ccaf3c4c27a1a263b41f73859 ("improve sys_newuname() for compat architectures") 64-bit x86 had a private implementation of sys_uname which was just called sys_uname, which other architectures used for the old uname. Due to some merge issues with the uname refactoring patches we ended up calling the old uname version for both the old and new system call slots, which lead to the domainname filed never be set which caused failures with libnss_nis. Reported-and-tested-by: Andy Isaacson <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-04-20KVM: Increase NR_IOBUS_DEVS limit to 200Sridhar Samudrala1-1/+1
This patch increases the current hardcoded limit of NR_IOBUS_DEVS from 6 to 200. We are hitting this limit when creating a guest with more than 1 virtio-net device using vhost-net backend. Each virtio-net device requires 2 such devices to service notifications from rx/tx queues. Signed-off-by: Sridhar Samudrala <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-04-20KVM: fix the handling of dirty bitmaps to avoid overflowsTakuya Yoshikawa5-13/+24
Int is not long enough to store the size of a dirty bitmap. This patch fixes this problem with the introduction of a wrapper function to calculate the sizes of dirty bitmaps. Note: in mark_page_dirty(), we have to consider the fact that __set_bit() takes the offset as int, not long. Signed-off-by: Takuya Yoshikawa <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-04-20KVM: MMU: fix kvm_mmu_zap_page() and its calling pathXiao Guangrong1-4/+7
This patch fix: - calculate zapped page number properly in mmu_zap_unsync_children() - calculate freeed page number properly kvm_mmu_change_mmu_pages() - if zapped children page it shoud restart hlist walking KVM-Stable-Tag. Signed-off-by: Xiao Guangrong <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-04-20KVM: VMX: Save/restore rflags.vm correctly in real modeAvi Kivity1-9/+15
Currently we set eflags.vm unconditionally when entering real mode emulation through virtual-8086 mode, and clear it unconditionally when we enter protected mode. The means that the following sequence KVM_SET_REGS (rflags.vm=1) KVM_SET_SREGS (cr0.pe=1) Ends up with rflags.vm clear due to KVM_SET_SREGS triggering enter_pmode(). Fix by shadowing rflags.vm (and rflags.iopl) correctly while in real mode: reads and writes to those bits access a shadow register instead of the actual register. Signed-off-by: Avi Kivity <[email protected]> Signed-off-by: Marcelo Tosatti <[email protected]>
2010-04-20KVM: allow bit 10 to be cleared in MSR_IA32_MC4_CTLAndre Przywara1-2/+6
There is a quirk for AMD K8 CPUs in many Linux kernels (see arch/x86/kernel/cpu/mcheck/mce.c:__mcheck_cpu_apply_quirks()) that clears bit 10 in that MCE related MSR. KVM can only cope with all zeros or all ones, so it will inject a #GP into the guest, which will let it panic. So lets add a quirk to the quirk and ignore this single cleared bit. This fixes -cpu kvm64 on all machines and -cpu host on K8 machines with some guest Linux kernels. Signed-off-by: Andre Przywara <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-04-20KVM: Don't spam kernel log when injecting exceptions due to bad cr writesAvi Kivity1-27/+0
These are guest-triggerable. Signed-off-by: Avi Kivity <[email protected]>
2010-04-20KVM: SVM: Fix memory leaks that happen when svm_create_vcpu() failsTakuya Yoshikawa1-10/+15
svm_create_vcpu() does not free the pages allocated during the creation when it fails to complete the allocations. This patch fixes it. Signed-off-by: Takuya Yoshikawa <[email protected]> Signed-off-by: Avi Kivity <[email protected]>
2010-04-20KVM: take srcu lock before call to complete_pio()Gleb Natapov1-0/+2
complete_pio() may use slot table which is protected by srcu. Signed-off-by: Gleb Natapov <[email protected]> Cc: [email protected] Signed-off-by: Avi Kivity <[email protected]>
2010-04-20sparc64: Fix hardirq tracing in trap return path.David S. Miller1-1/+11
We can overflow the hardirq stack if we set the %pil here so early, just let the normal control flow do it. This is fine as we are allowed to do the actual IRQ enable at any point after we call trace_hardirqs_on. Signed-off-by: David S. Miller <[email protected]>
2010-04-20drm: delay vblank cleanup until after driver unloadJesse Barnes1-2/+2
Drivers may use vblank calls now (e.g. drm_vblank_off) in their unload paths, so don't clean up the vblank related structures until after driver unload. Signed-off-by: Jesse Barnes <[email protected]> Reviewed-by: Kristian Høgsberg <[email protected]> Signed-off-by: Dave Airlie <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.