summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2011-02-21eCryptfs: Copy up lower inode attrs in getattrTyler Hicks
The lower filesystem may do some type of inode revalidation during a getattr call. eCryptfs should take advantage of that by copying the lower inode attributes to the eCryptfs inode after a call to vfs_getattr() on the lower inode. I originally wrote this fix while working on eCryptfs on nfsv3 support, but discovered it also fixed an eCryptfs on ext4 nanosecond timestamp bug that was reported. https://bugs.launchpad.net/bugs/613873 Cc: <stable@kernel.org> Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
2011-02-21ecryptfs: read on a directory should return EISDIR if not supportedAndy Whitcroft
read() calls against a file descriptor connected to a directory are incorrectly returning EINVAL rather than EISDIR: [EISDIR] [XSI] [Option Start] The fildes argument refers to a directory and the implementation does not allow the directory to be read using read() or pread(). The readdir() function should be used instead. [Option End] This occurs because we do not have a .read operation defined for ecryptfs directories. Connect this up to generic_read_dir(). BugLink: http://bugs.launchpad.net/bugs/719691 Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
2011-02-21eCryptfs: Handle NULL nameidata pointersTyler Hicks
Allow for NULL nameidata pointers in eCryptfs create, lookup, and d_revalidate functions. Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
2011-02-17eCryptfs: Revert "dont call lookup_one_len to avoid NULL nameidata"Tyler Hicks
This reverts commit 21edad32205e97dc7ccb81a85234c77e760364c8 and commit 93c3fe40c279f002906ad14584c30671097d4394, which fixed a regression by the former. Al Viro pointed out bypassed dcache lookups in ecryptfs_new_lower_dentry(), misuse of vfs_path_lookup() in ecryptfs_lookup_one_lower() and a dislike of passing nameidata to the lower filesystem. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
2011-02-15Linux 2.6.38-rc5v2.6.38-rc5Linus Torvalds
2011-02-15Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: set flow handler for secondary interrupt controller of 5249 m68knommu: remove use of IRQ_FLG_LOCK from 68360 platform support m68knommu: fix dereference of port.tty m68knommu: add missing linker __modver section m68knommu: fix mis-named variable int set_irq_chip loop m68knommu: add optimize memmove() function m68k: remove arch specific non-optimized memcmp() m68knommu: fix use of un-defined _TIF_WORK_MASK m68knommu: Rename m548x_wdt.c to m54xx_wdt.c m68knommu: fix m548x_wdt.c compilation after headers renaming m68knommu: Remove dependencies on nonexistent M68KNOMMU
2011-02-16m68knommu: set flow handler for secondary interrupt controller of 5249Greg Ungerer
The secondary interrupt controller of the ColdFire 5249 code is not setting the edge triggered flow handler. Set it. Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68knommu: remove use of IRQ_FLG_LOCK from 68360 platform supportGreg Ungerer
The m68knommu arch does not define or use IRQ_FLG_LOCK in its irq subsystem. Remove obsolete use of it. Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68knommu: fix dereference of port.ttyGreg Ungerer
The struct_tty associated with a port is now a direct pointer from within the local private driver info struct. So fix all uses of it. Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68knommu: add missing linker __modver sectionGreg Ungerer
Add missing linker section __modver to fix: LD vmlinux /usr/local/bin/../m68k-uclinux/bin/ld.real: error: no memory region specified for loadable section `__modver' Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68knommu: fix mis-named variable int set_irq_chip loopGreg Ungerer
Compiling for 68360 targets gives: CC arch/m68knommu/platform/68360/ints.o arch/m68knommu/platform/68360/ints.c: In function ‘init_IRQ’: arch/m68knommu/platform/68360/ints.c:135:16: error: ‘irq’ undeclared (first use in this function) arch/m68knommu/platform/68360/ints.c:135:16: note: each undeclared identifier is reported only once for each function it appears in Fix variable name used. Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68knommu: add optimize memmove() functionGreg Ungerer
Add an m68k/coldfire optimized memmove() function for the m68knommu arch. This is the same function as used by m68k. Simple speed tests show this is faster once buffers are larger than 4 bytes, and significantly faster on much larger buffers (4 times faster above about 100 bytes). This also goes part of the way to fixing a regression caused by commit ea61bc461d09e8d331a307916530aaae808c72a2 ("m68k/m68knommu: merge MMU and non-MMU string.h"), which breaks non-coldfire non-mmu builds (which is the 68x328 and 68360 families). They currently have no memmove() fucntion defined, since there was none in the m68knommu/lib functions. Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2011-02-16m68k: remove arch specific non-optimized memcmp()Greg Ungerer
The m68k arch implements its own memcmp() function. It is not optimized in any way (it is the most strait forward coding of memcmp you can get). Remove it and use the kernels standard memcmp() implementation. This also goes part of the way to fixing a regression caused by commit ea61bc461d09e8d331a307916530aaae808c72a2 ("m68k/m68knommu: merge MMU and non-MMU string.h"), which breaks non-coldfire non-mmu builds (which is the 68x328 and 68360 families). They currently have no memcmp() function defined, since there is none in the m68knommu/lib functions. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-02-15Merge branch 'drm-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (27 commits) drm/radeon/kms: hopefully fix pll issues for real (v3) drm/radeon/kms: add bounds checking to avivo pll algo drm: fix wrong usages of drm_device in DRM Developer's Guide drm/radeon/kms: fix a few more atombios endian issues drm/radeon/kms: improve 6xx/7xx CS error output drm/radeon/kms: check AA resolve registers on r300 drm/radeon/kms: fix tracking of BLENDCNTL, COLOR_CHANNEL_MASK, and GB_Z on r300 drm/radeon/kms: use linear aligned for evergreen/ni bo blits drm/radeon/kms: use linear aligned for 6xx/7xx bo blits drm/radeon: fix race between GPU reset and TTM delayed delete thread. drm/radeon/kms: evergreen/ni big endian fixes (v2) drm/radeon/kms: 6xx/7xx big endian fixes drm/radeon/kms: atombios big endian fixes drm/radeon: 6xx/7xx non-kms endian fixes drm/radeon/kms: optimize CS state checking for r100->r500 drm: do not leak kernel addresses via /proc/dri/*/vma drm/radeon/kms: add connector table for mac g5 9600 radeon mkregtable: Add missing fclose() calls drm/radeon/kms: fix interlaced modes on dce4+ drm/radeon: fix memory debugging since d961db75ce86a84f1f04e91ad1014653ed7d9f46 ...
2011-02-15Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: pci: use security_capable() when checking capablities during config space read
2011-02-15thp: prevent hugepages during args/env copying into the user stackAndrea Arcangeli
Transparent hugepages can only be created if rmap is fully functional. So we must prevent hugepages to be created while is_vma_temporary_stack() is true. This also optmizes away some harmless but unnecessary setting of khugepaged_scan.address and it switches some BUG_ON to VM_BUG_ON. Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Acked-by: Rik van Riel <riel@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-02-15Merge branch 'release' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI / Video: Probe for output switch method when searching video devices. ACPI / Wakeup: Enable button GPEs unconditionally during initialization ACPI / ACPICA: Avoid crashing if _PRW is defined for the root object ACPI: Fix acpi_os_read_memory() and acpi_os_write_memory() (v2)
2011-02-15Merge branch 'tools-release' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6 * 'tools-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6: tools: turbostat: style updates tools: turbostat: fix bitwise and operand
2011-02-15Merge branch 'iomem' into releaseLen Brown
2011-02-15Merge branch 'fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: (21 commits) dmaengine: add slave-dma maintainer dma: ipu_idmac: do not lose valid received data in the irq handler dmaengine: imx-sdma: fix up param for the last BD in sdma_prep_slave_sg() dmaengine: imx-sdma: correct sdmac->status in sdma_handle_channel_loop() dmaengine: imx-sdma: return sdmac->status in sdma_tx_status() dmaengine: imx-sdma: set sdmac->status to DMA_ERROR in err_out of sdma_prep_slave_sg() dmaengine: imx-sdma: remove IMX_DMA_SG_LOOP handling in sdma_prep_slave_sg() dmaengine i.MX dma: initialize dma capabilities outside channel loop dmaengine i.MX DMA: do not initialize chan_id field dmaengine i.MX dma: check sg entries for valid addresses and lengths dmaengine i.MX dma: set maximum segment size for our device dmaengine i.MX SDMA: reserve channel 0 by not registering it dmaengine i.MX SDMA: initialize dma capabilities outside channel loop dmaengine i.MX SDMA: do not initialize chan_id field dmaengine i.MX sdma: check sg entries for valid addresses and lengths dmaengine i.MX sdma: set maximum segment size for our device DMA: PL08x: fix channel pausing to timeout rather than lockup DMA: PL08x: fix infinite wait when terminating transfers dmaengine: imx-sdma: fix inconsistent naming in sdma_assign_cookie() dmaengine: imx-sdma: propagate error in sdma_probe() instead of returning 0 ...
2011-02-15Merge branch 'for-2.6.38' of git://linux-nfs.org/~bfields/linuxLinus Torvalds
* 'for-2.6.38' of git://linux-nfs.org/~bfields/linux: nfsd: break lease on unlink due to rename nfsd4: acquire only one lease per file nfsd4: modify fi_delegations under recall_lock nfsd4: remove unused deleg dprintk's. nfsd4: split lease setting into separate function nfsd4: fix leak on allocation error nfsd4: add helper function for lease setup nfsd4: split up nfsd_break_deleg_cb NFSD: memory corruption due to writing beyond the stat array NFSD: use nfserr for status after decode_cb_op_status nfsd: don't leak dentry count on mnt_want_write failure
2011-02-15Merge branches 'core-fixes-for-linus' and 'timers-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: Revert "lockdep, timer: Fix del_timer_sync() annotation" * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: timer debug: Hide kernel addresses via %pK in /proc/timer_list
2011-02-15Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Fix text_poke_smp_batch() deadlock perf tools: Fix thread_map event synthesizing in top and record watchdog, nmi: Lower the severity of error messages ARM: oprofile: Fix backtraces in timer mode oprofile: Fix usage of CONFIG_HW_PERF_EVENTS for oprofile_perf_init and friends
2011-02-15Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, dmi, debug: Log board name (when present) in dmesg/oops output x86, ioapic: Don't warn about non-existing IOAPICs if we have none x86: Fix mwait_usable section mismatch x86: Readd missing irq_to_desc() in fixup_irq() x86: Fix section mismatch in LAPIC initialization
2011-02-15Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: matrix_keypad - increase the limit of rows and columns Input: wacom - fix error path in wacom_probe() Input: ads7846 - check proper condition when freeing gpio Revert "Input: do not pass injected events back to the originating handler" Input: sysrq - rework re-inject logic Input: serio - clear pending rescans after sysfs driver rebind Input: rotary_encoder - use proper irqflags Input: wacom_w8001 - report resolution to userland
2011-02-15Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: get rid of nameidata_dentry_drop_rcu() calling nameidata_drop_rcu() drop out of RCU in return_reval split do_revalidate() into RCU and non-RCU cases in do_lookup() split RCU and non-RCU cases of need_revalidate nothing in do_follow_link() is going to see RCU
2011-02-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstableLinus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: check return value of alloc_extent_map() Btrfs - Fix memory leak in btrfs_init_new_device() btrfs: prevent heap corruption in btrfs_ioctl_space_info() Btrfs: Fix balance panic Btrfs: don't release pages when we can't clear the uptodate bits Btrfs: fix page->private races
2011-02-15s390: remove task_show_regsMartin Schwidefsky
task_show_regs used to be a debugging aid in the early bringup days of Linux on s390. /proc/<pid>/status is a world readable file, it is not a good idea to show the registers of a process. The only correct fix is to remove task_show_regs. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-02-15pci: use security_capable() when checking capablities during config space readChris Wright
This reintroduces commit 47970b1b which was subsequently reverted as f00eaeea. The original change was broken and caused X startup failures and generally made privileged processes incapable of reading device dependent config space. The normal capable() interface returns true on success, but the LSM interface returns 0 on success. This thinko is now fixed in this patch, and has been confirmed to work properly. So, once again...Eric Paris noted that commit de139a3 ("pci: check caps from sysfs file open to read device dependent config space") caused the capability check to bypass security modules and potentially auditing. Rectify this by calling security_capable() when checking the open file's capabilities for config space reads. Reported-by: Eric Paris <eparis@redhat.com> Tested-by: Dave Young <hidave.darkstar@gmail.com> Acked-by: James Morris <jmorris@namei.org> Cc: Dave Airlie <airlied@gmail.com> Cc: Alex Riesen <raa.lkml@gmail.com> Cc: Sedat Dilek <sedat.dilek@googlemail.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: James Morris <jmorris@namei.org>
2011-02-15get rid of nameidata_dentry_drop_rcu() calling nameidata_drop_rcu()Al Viro
can't happen anymore and didn't work right anyway Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-02-15drop out of RCU in return_revalAl Viro
... thus killing the need to handle drop-from-RCU in d_revalidate() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-02-15split do_revalidate() into RCU and non-RCU casesAl Viro
fixing oopsen in lookup_one_len() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-02-15in do_lookup() split RCU and non-RCU cases of need_revalidateAl Viro
and use unlikely() instead of gotos, for fsck sake... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-02-15nothing in do_follow_link() is going to see RCUAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-02-15x86, dmi, debug: Log board name (when present) in dmesg/oops outputNaga Chumbalkar
The "Type 2" SMBIOS record that contains Board Name is not strictly required and may be absent in the SMBIOS on some platforms. ( Please note that Type 2 is not listed in Table 3 in Sec 6.2 ("Required Structures and Data") of the SMBIOS v2.7 Specification. ) Use the Manufacturer Name (aka System Vendor) name. Print Board Name only when it is present. Before the fix: (i) dmesg output: DMI: /ProLiant DL380 G6, BIOS P62 01/29/2011 (ii) oops output: Pid: 2170, comm: bash Not tainted 2.6.38-rc4+ #3 /ProLiant DL380 G6 After the fix: (i) dmesg output: DMI: HP ProLiant DL380 G6, BIOS P62 01/29/2011 (ii) oops output: Pid: 2278, comm: bash Not tainted 2.6.38-rc4+ #4 HP ProLiant DL380 G6 Signed-off-by: Naga Chumbalkar <nagananda.chumbalkar@hp.com> Reviewed-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: <stable@kernel.org> # .3x - good for debugging, please apply as far back as it applies cleanly LKML-Reference: <20110214224423.2182.13929.sendpatchset@nchumbalkar.americas.hpqcorp.net> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2011-02-15x86, ioapic: Don't warn about non-existing IOAPICs if we have nonePaul Bolle
mp_find_ioapic() prints errors like: ERROR: Unable to locate IOAPIC for GSI 13 if it can't find the IOAPIC that manages that specific GSI. I see errors like that at every boot of a laptop that apparently doesn't have any IOAPICs. But if there are no IOAPICs it doesn't seem to be an error that none can be found. A solution that gets rid of this message is to directly return if nr_ioapics (still) is zero. (But keep returning -1 in that case, so nothing breaks from this change.) The call chain that generates this error is: pnpacpi_allocated_resource() case ACPI_RESOURCE_TYPE_IRQ: pnpacpi_parse_allocated_irqresource() acpi_get_override_irq() mp_find_ioapic() Signed-off-by: Paul Bolle <pebolle@tiscali.nl> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2011-02-15Merge branch 'urgent' of ↵Ingo Molnar
git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile into perf/urgent
2011-02-15drm/radeon/kms: hopefully fix pll issues for real (v3)Alex Deucher
The problematic boards have a recommended reference divider to be used when spread spectrum is enabled on the laptop panel. Enable the use of the recommended reference divider along with the new pll algo. v2: testing options v3: When using the fixed reference divider with LVDS, prefer min m to max p and use fractional feedback dividers. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=28852 https://bugzilla.kernel.org/show_bug.cgi?id=24462 https://bugzilla.kernel.org/show_bug.cgi?id=26552 MacbookPro issues reported by Justin Mattock <justinmattock@gmail.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-15drm/radeon/kms: add bounds checking to avivo pll algoAlex Deucher
Prevent divider overflow. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=28932 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-15drm: fix wrong usages of drm_device in DRM Developer's GuideXiao Jiang
A few wrong usages of drm_device, which should be drm_driver. Signed-off-by: Xiao Jiang <jgq516@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-15drm/radeon/kms: fix a few more atombios endian issuesAlex Deucher
Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-02-14Merge branch 'fixes' of master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds
* 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm: ARM: 6657/1: hw_breakpoint: fix ptrace breakpoint advertising on unsupported arch ARM: 6656/1: hw_breakpoint: avoid UNPREDICTABLE behaviour when reading DBGDSCR ARM: 6658/1: collie: do actually pass locomo_info to locomo driver ARM: 6659/1: Thumb-2: Make CONFIG_OABI_COMPAT depend on !CONFIG_THUMB2_KERNEL ARM: 6654/1: perf/oprofile: fix off-by-one in stack check ARM: fixup SMP alternatives in modules ARM: make SWP emulation explicit on !CPU_USE_DOMAINS ARM: Avoid building unsafe kernels on OMAP2 and MX3 ARM: pxa: Properly configure PWM period for palm27x ARM: pxa: only save/restore registers when pm functions are defined ARM: pxa/colibri: use correct SD detect pin ARM: pxa: fix mfpr_sync to read from valid offset
2011-02-14Btrfs: check return value of alloc_extent_map()Tsutomu Itoh
I add the check on the return value of alloc_extent_map() to several places. In addition, alloc_extent_map() returns only the address or NULL. Therefore, check by IS_ERR() is unnecessary. So, I remove IS_ERR() checking. Signed-off-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Btrfs - Fix memory leak in btrfs_init_new_device()Ilya Dryomov
Memory allocated by calling kstrdup() should be freed. Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14btrfs: prevent heap corruption in btrfs_ioctl_space_info()Dan Rosenberg
Commit bf5fc093c5b625e4259203f1cee7ca73488a5620 refactored btrfs_ioctl_space_info() and introduced several security issues. space_args.space_slots is an unsigned 64-bit type controlled by a possibly unprivileged caller. The comparison as a signed int type allows providing values that are treated as negative and cause the subsequent allocation size calculation to wrap, or be truncated to 0. By providing a size that's truncated to 0, kmalloc() will return ZERO_SIZE_PTR. It's also possible to provide a value smaller than the slot count. The subsequent loop ignores the allocation size when copying data in, resulting in a heap overflow or write to ZERO_SIZE_PTR. The fix changes the slot count type and comparison typecast to u64, which prevents truncation or signedness errors, and also ensures that we don't copy more data than we've allocated in the subsequent loop. Note that zero-size allocations are no longer possible since there is already an explicit check for space_args.space_slots being 0 and truncation of this value is no longer an issue. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Josef Bacik <josef@redhat.com> Reviewed-by: Josef Bacik <josef@redhat.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Btrfs: Fix balance panicYan, Zheng
Mark the cloned backref_node as checked in clone_backref_node() Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Merge branch 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6Linus Torvalds
* 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6: Revert "dt: add documentation of ARM dt boot interface"
2011-02-14Merge branch 'rtc-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'rtc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: RTC: Fix minor compile warning RTC: Convert rtc drivers to use the alarm_irq_enable method RTC: Fix rtc driver ioctl specific shortcutting
2011-02-14Btrfs: don't release pages when we can't clear the uptodate bitsChris Mason
Btrfs tracks uptodate state in an rbtree as well as in the page bits. This is supposed to enable us to use block sizes other than the page size, but there are a few parts still missing before that completely works. But, our readpage routine trusts this additional range based tracking of uptodateness, much in the same way the buffer head up to date bits are trusted for the other filesystems. The problem is that sometimes we need to allocate memory in order to split records in the rbtree, even when we are just clearing bits. This can be difficult when our clearing function is called GFP_ATOMIC, which can happen in the releasepage path. So, what happens today looks like this: releasepage called with GFP_ATOMIC btrfs_releasepage calls clear_extent_bit clear_extent_bit fails to allocate ram, leaving the up to date bit set btrfs_releasepage returns success The end result is the page being gone, but btrfs thinking the range is up to date. Later on if someone tries to read that same page, the btrfs readpage code will return immediately thinking the page is already up to date. This commit fixes things to fail the releasepage when we can't clear the extent state bits. It covers both data pages and metadata tree blocks. Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-02-14Btrfs: fix page->private racesChris Mason
There is a race where btrfs_releasepage can drop the page->private contents just as alloc_extent_buffer is setting up pages for metadata. Because of how the Btrfs page flags work, this results in us skipping the crc on the page during IO. This patch sovles the race by waiting until after the extent buffer is inserted into the radix tree before it sets page private. Signed-off-by: Chris Mason <chris.mason@oracle.com>
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-27 00:07:07 +0000