summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-02-15Btrfs: check return value of alloc_extent_map()Tsutomu Itoh4-3/+7
I add the check on the return value of alloc_extent_map() to several places. In addition, alloc_extent_map() returns only the address or NULL. Therefore, check by IS_ERR() is unnecessary. So, I remove IS_ERR() checking. Signed-off-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-15Btrfs - Fix memory leak in btrfs_init_new_device()Ilya Dryomov1-0/+2
Memory allocated by calling kstrdup() should be freed. Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-15btrfs: prevent heap corruption in btrfs_ioctl_space_info()Dan Rosenberg1-2/+8
Commit bf5fc093c5b625e4259203f1cee7ca73488a5620 refactored btrfs_ioctl_space_info() and introduced several security issues. space_args.space_slots is an unsigned 64-bit type controlled by a possibly unprivileged caller. The comparison as a signed int type allows providing values that are treated as negative and cause the subsequent allocation size calculation to wrap, or be truncated to 0. By providing a size that's truncated to 0, kmalloc() will return ZERO_SIZE_PTR. It's also possible to provide a value smaller than the slot count. The subsequent loop ignores the allocation size when copying data in, resulting in a heap overflow or write to ZERO_SIZE_PTR. The fix changes the slot count type and comparison typecast to u64, which prevents truncation or signedness errors, and also ensures that we don't copy more data than we've allocated in the subsequent loop. Note that zero-size allocations are no longer possible since there is already an explicit check for space_args.space_slots being 0 and truncation of this value is no longer an issue. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Josef Bacik <josef@redhat.com> Reviewed-by: Josef Bacik <josef@redhat.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-15Btrfs: Fix balance panicYan, Zheng1-0/+1
Mark the cloned backref_node as checked in clone_backref_node() Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Merge branch 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6Linus Torvalds2-69/+4
* 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6: Revert "dt: add documentation of ARM dt boot interface"
2011-02-14Merge branch 'rtc-for-linus' of ↵Linus Torvalds21-313/+232
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'rtc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: RTC: Fix minor compile warning RTC: Convert rtc drivers to use the alarm_irq_enable method RTC: Fix rtc driver ioctl specific shortcutting
2011-02-14Btrfs: don't release pages when we can't clear the uptodate bitsChris Mason1-1/+9
Btrfs tracks uptodate state in an rbtree as well as in the page bits. This is supposed to enable us to use block sizes other than the page size, but there are a few parts still missing before that completely works. But, our readpage routine trusts this additional range based tracking of uptodateness, much in the same way the buffer head up to date bits are trusted for the other filesystems. The problem is that sometimes we need to allocate memory in order to split records in the rbtree, even when we are just clearing bits. This can be difficult when our clearing function is called GFP_ATOMIC, which can happen in the releasepage path. So, what happens today looks like this: releasepage called with GFP_ATOMIC btrfs_releasepage calls clear_extent_bit clear_extent_bit fails to allocate ram, leaving the up to date bit set btrfs_releasepage returns success The end result is the page being gone, but btrfs thinking the range is up to date. Later on if someone tries to read that same page, the btrfs readpage code will return immediately thinking the page is already up to date. This commit fixes things to fail the releasepage when we can't clear the extent state bits. It covers both data pages and metadata tree blocks. Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Btrfs: fix page->private racesChris Mason2-5/+41
There is a race where btrfs_releasepage can drop the page->private contents just as alloc_extent_buffer is setting up pages for metadata. Because of how the Btrfs page flags work, this results in us skipping the crc on the page during IO. This patch sovles the race by waiting until after the extent buffer is inserted into the radix tree before it sets page private. Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14nfsd: break lease on unlink due to renameJ. Bruce Fields1-0/+7
4795bb37effb7b8fe77e2d2034545d062d3788a8 "nfsd: break lease on unlink, link, and rename", only broke the lease on the file that was being renamed, and didn't handle the case where the target path refers to an already-existing file that will be unlinked by a rename--in that case the target file should have any leases broken as well. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: acquire only one lease per fileJ. Bruce Fields2-42/+58
Instead of acquiring one lease each time another client opens a file, nfsd can acquire just one lease to represent all of them, and reference count it to determine when to release it. This fixes a regression introduced by c45821d263a8a5109d69a9e8942b8d65bcd5f31a "locks: eliminate fl_mylease callback": after that patch, only the struct file * is used to determine who owns a given lease. But since we recently converted the server to share a single struct file per open, if we acquire multiple leases on the same file from nfsd, it then becomes impossible on unlocking a lease to determine which of those leases (all of whom share the same struct file *) we meant to remove. Thanks to Takashi Iwai <tiwai@suse.de> for catching a bug in a previous version of this patch. Tested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: modify fi_delegations under recall_lockJ. Bruce Fields1-4/+4
Modify fi_delegations only under the recall_lock, allowing us to use that list on lease breaks. Also some trivial cleanup to simplify later changes. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: remove unused deleg dprintk's.J. Bruce Fields1-4/+0
These aren't all that useful, and get in the way of the next steps. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: split lease setting into separate functionJ. Bruce Fields1-13/+19
Splitting some code into a separate function which we'll be adding some more to. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: fix leak on allocation errorJ. Bruce Fields1-8/+10
Also share some common exit code. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: add helper function for lease setupJ. Bruce Fields1-12/+21
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd4: split up nfsd_break_deleg_cbJ. Bruce Fields1-18/+16
We'll be adding some more code here soon. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14NFSD: memory corruption due to writing beyond the stat arrayKonstantin Khorenko1-1/+1
If nfsd fails to find an exported via NFS file in the readahead cache, it should increment corresponding nfsdstats counter (ra_depth[10]), but due to a bug it may instead write to ra_depth[11], corrupting the following field. In a kernel with NFSDv4 compiled in the corruption takes the form of an increment of a counter of the number of NFSv4 operation 0's received; since there is no operation 0, this is harmless. In a kernel with NFSDv4 disabled it corrupts whatever happens to be in the memory beyond nfsdstats. Signed-off-by: Konstantin Khorenko <khorenko@openvz.org> Cc: stable@kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14NFSD: use nfserr for status after decode_cb_op_statusBenny Halevy1-4/+2
Bugs introduced in 85a56480191ca9f08fc775c129b9eb5c8c1f2c05 "NFSD: Update XDR decoders in NFSv4 callback client" Cc: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Benny Halevy <bhalevy@panasas.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14nfsd: don't leak dentry count on mnt_want_write failureJ. Bruce Fields1-6/+6
The exit cleanup isn't quite right here. Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2011-02-14Revert "dt: add documentation of ARM dt boot interface"Grant Likely2-69/+4
This reverts commit 9830fcd6f6a4781d8b46d2b35c13b39f30915c63. The ARM dt support has not been merged yet; this documentation update was premature. Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-02-14x86: Fix mwait_usable section mismatchBorislav Petkov2-2/+2
We use it in non __cpuinit code now too so drop marker. Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> LKML-Reference: <20110211171754.GA21047@aftab> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2011-02-14dmaengine: add slave-dma maintainerDan Williams1-0/+1
Slave-dma has become the predominant usage model for dmaengine and needs special attention. Memory-to-memory dma usage cases will continue to be maintained by Dan. Cc: Alan Cox <alan@linux.intel.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-02-14Merge branch 'imx' into dmaengine-fixesDan Williams2-39/+63
2011-02-14dma: ipu_idmac: do not lose valid received data in the irq handlerAnatolij Gustschin1-50/+0
Currently when two or more buffers are queued by the camera driver and so the double buffering is enabled in the idmac, we lose one frame comming from CSI since the reporting of arrival of the first frame is deferred by the DMAIC_7_EOF interrupt handler and reporting of the arrival of the last frame is not done at all. So when requesting N frames from the image sensor we actually receive N - 1 frames in user space. The reason for this behaviour is that the DMAIC_7_EOF interrupt handler misleadingly assumes that the CUR_BUF flag is pointing to the buffer used by the IDMAC. Actually it is not the case since the CUR_BUF flag will be flipped by the FSU when the FSU is sending the <TASK>_NEW_FRM_RDY signal when new frame data is delivered by the CSI. When sending this singal, FSU updates the DMA_CUR_BUF and the DMA_BUFx_RDY flags: the DMA_CUR_BUF is flipped, the DMA_BUFx_RDY is cleared, indicating that the frame data is beeing written by the IDMAC to the pointed buffer. DMA_BUFx_RDY is supposed to be set to the ready state again by the MCU, when it has handled the received data. DMAIC_7_CUR_BUF flag won't be flipped here by the IPU, so waiting for this event in the EOF interrupt handler is wrong. Actually there is no spurious interrupt as described in the comments, this is the valid DMAIC_7_EOF interrupt indicating reception of the frame from CSI. The patch removes code that waits for flipping of the DMAIC_7_CUR_BUF flag in the DMAIC_7_EOF interrupt handler. As the comment in the current code denotes, this waiting doesn't help anyway. As a result of this removal the reporting of the first arrived frame is not deferred to the time of arrival of the next frame and the drivers software flag 'ichan->active_buffer' is in sync with DMAIC_7_CUR_BUF flag, so the reception of all requested frames works. This has been verified on the hardware which is triggering the image sensor by the programmable state machine, allowing to obtain exact number of frames. On this hardware we do not tolerate losing frames. This patch also removes resetting the DMA_BUFx_RDY flags of all channels in ipu_disable_channel() since transfers on other DMA channels might be triggered by other running tasks and the buffers should always be ready for data sending or reception. Signed-off-by: Anatolij Gustschin <agust@denx.de> Reviewed-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Tested-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-02-14Merge branch 'fortglx/2.6.38/tip/timers/rtc' of ↵Thomas Gleixner21-313/+232
git://git.linaro.org/people/jstultz/linux into timers/urgent
2011-02-14klist: Fix object alignment on 64-bit.David Miller1-1/+1
Commit c0e69a5bbc6f ("klist.c: bit 0 in pointer can't be used as flag") intended to make sure that all klist objects were at least pointer size aligned, but used the constant "4" which only works on 32-bit. Use "sizeof(void *)" which is correct in all cases. Signed-off-by: David S. Miller <davem@davemloft.net> Acked-by: Jesper Nilsson <jesper.nilsson@axis.com> Cc: stable <stable@kernel.org> Cc: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-02-14Merge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixesDave Airlie11-99/+229
* 'intel/drm-intel-fixes' of /ssd/git/drm-next: drm/i915: Fix resume regression from 5d1d0cc drm/i915/tv: Use polling rather than interrupt-based hotplug drm/i915: Trigger modesetting if force-audio changes drm/i915/sdvo: If we have an EDID confirm it matches the mode of the connection drm/i915: Disable RC6 on Ironlake drm/i915/lvds: Restore dithering on native modes for gen2/3 drm/i915: Invalidate TLB caches on SNB BLT/BSD rings
2011-02-14drm/radeon/kms: improve 6xx/7xx CS error outputAlex Deucher1-20/+26
Makes debugging CS rejections much easier. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: check AA resolve registers on r300Marek Olšák8-13/+49
This is an important security fix because we allowed arbitrary values to be passed to AARESOLVE_OFFSET. This also puts the right buffer address in the register. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: fix tracking of BLENDCNTL, COLOR_CHANNEL_MASK, and GB_Z on r300Marek Olšák5-12/+5
Also move ZB_DEPTHCLEARVALUE to the list of safe regs. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: use linear aligned for evergreen/ni bo blitsAlex Deucher1-2/+2
Not only is linear aligned supposedly more performant, linear general is only supported by the CB in single slice mode. The texture hardware doesn't support linear general, but I think the hw automatically upgrades it to linear aligned. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: use linear aligned for 6xx/7xx bo blitsAlex Deucher1-2/+2
Not only is linear aligned supposedly more performant, linear general is only supported by the CB in single slice mode. The texture hardware doesn't support linear general, but I think the hw automatically upgrades it to linear aligned. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon: fix race between GPU reset and TTM delayed delete thread.Dave Airlie1-0/+4
My evergreen has been in a remote PC for week and reset has never once saved me from certain doom, I finally relocated to the box with a serial cable and noticed an oops when the GPU resets, and the TTM delayed delete thread tries to remove something from the GTT. This stops the delayed delete thread from executing across the GPU reset handler, and woot I can GPU reset now. Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: evergreen/ni big endian fixes (v2)Alex Deucher4-10/+40
Based on 6xx/7xx endian fixes from Cédric Cano. v2: fix typo in shader Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: 6xx/7xx big endian fixesCédric Cano6-20/+54
agd5f: minor cleanups Signed-off-by: Cédric Cano <ccano@interfaceconcept.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: atombios big endian fixesCédric Cano3-52/+52
agd5f: additional cleanups/fixes Signed-off-by: Cédric Cano <ccano@interfaceconcept.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon: 6xx/7xx non-kms endian fixesCédric Cano3-9/+34
agd5f: minor cleanups Signed-off-by: Cédric Cano <ccano@interfaceconcept.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: optimize CS state checking for r100->r500Marek Olšák4-12/+77
The colorbuffer, zbuffer, and texture states are checked only once when they get changed. This improves performance in the apps which emit lots of draw packets and few state changes. This drops performance in glxgears by a 1% or so, but glxgears is not a benchmark we care about. The time spent in the kernel when running Torcs dropped from 33% to 23% and the frame rate is higher, which is a good thing. r600 might need something like this as well. Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm: do not leak kernel addresses via /proc/dri/*/vmaKees Cook1-4/+5
In the continuing effort to avoid kernel addresses leaking to unprivileged users, this patch switches to %pK for /proc/dri/*/vma. Signed-off-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: add connector table for mac g5 9600Alex Deucher2-0/+48
PPC Mac cards do not provide connector tables in their vbios. Their connector/encoder configurations must be hardcoded in the driver. verified by nyef on #radeon Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14radeon mkregtable: Add missing fclose() callsJesper Juhl1-1/+4
drivers/gpu/drm/radeon/mkregtable.c:parser_auth() almost always remembers to fclose(file) before returning, but it misses two spots. This is not really important since the process will exit shortly after and thus close the file for us, but being explicit prevents static analysis tools from complaining about leaked memory and missing fclose() calls and it also seems to be the prefered style of the existing code to explicitly close the file. So, here's a patch to add the two missing fclose() calls. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon/kms: fix interlaced modes on dce4+Alex Deucher2-22/+20
- set scaler table clears the interleave bit, need to reset it in encoder quirks, this was already done for pre-dce4. - remove the interleave settings from set_base() functions this is now handled in the encoder quirks functions, and isn't technically part of the display base setup. - rename evergreen_do_set_base() to dce4_do_set_base() since it's used on both evergreen and NI asics. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=28182 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14drm/radeon: fix memory debugging since d961db75ce86a84f1f04e91ad1014653ed7d9f46Dave Airlie1-2/+2
The old code dereferenced a value, the new code just needs to pass the ptr. fixes an oops looking at files in debugfs. cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-13Merge branch 'spi/merge' of git://git.secretlab.ca/git/linux-2.6Linus Torvalds63-112/+122
* 'spi/merge' of git://git.secretlab.ca/git/linux-2.6: devicetree-discuss is moderated for non-subscribers MAINTAINERS: Add entry for GPIO subsystem dt: add documentation of ARM dt boot interface dt: Remove obsolete description of powerpc boot interface dt: Move device tree documentation out of powerpc directory spi/spi_sh_msiof: fix wrong address calculation, which leads to an Oops
2011-02-13Merge branch 'for-linus' of ↵Linus Torvalds10-16/+82
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - add quirk for Ordissimo EVE using a realtek ALC662 ALSA: hrtimer: remove superfluous tasklet invocation ALSA: hrtimer: handle delayed timer interrupts ALSA: HDA: Add subwoofer quirk for Acer Aspire 8942G ALSA: hda - Don't handle empty patch files ALSA: hda - Fix missing CA initialization for HDMI/DP ALSA: usbaudio - Enable the E-MU 0204 USB ALSA: hda - switch lfe with side in mixer for 4930g ASoC: Improve WM8994 digital power sequencing ASoC: Create an AIF1ADCDAT signal widget to match AIF2 asoc: davinci: da830/omap-l137: correct cpu_dai_name ASoC: fill in snd_soc_pcm_runtime.card before calling snd_soc_dai_link.init()
2011-02-13Revert "pci: use security_capable() when checking capablities during config ↵Linus Torvalds1-2/+1
space read" This reverts commit 47970b1b2aa64464bc0a9543e86361a622ae7c03. It turns out it breaks several distributions. Looks like the stricter selinux checks fail due to selinux policies not being set to allow the access - breaking X, but also lspci. So while the change was clearly the RightThing(tm) to do in theory, in practice we have backwards compatibility issues making it not work. Reported-by: Dave Young <hidave.darkstar@gmail.com> Acked-by: David Airlie <airlied@linux.ie> Acked-by: Alex Riesen <raa.lkml@gmail.com> Cc: Eric Paris <eparis@redhat.com> Cc: Chris Wright <chrisw@sous-sol.org> Cc: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-02-13Merge branch 'fix/asoc' into for-linusTakashi Iwai3-8/+38
2011-02-13Merge branch 'devicetree/merge' into spi/mergeGrant Likely1002-6868/+7053
2011-02-13devicetree-discuss is moderated for non-subscribersPaul Bolle1-1/+1
Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-02-12[SCSI] mptfusion: Bump version 03.04.18Kashyap, Desai1-2/+2
Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
generated by cgit v1.2.3 (git 2.39.0) at 2025-09-27 07:57:27 +0300