1. 07 Jan, 2011 12 commits
    • NeilBrown's avatar
      sunrpc: prevent use-after-free on clearing XPT_BUSY · 7df3fe5e
      NeilBrown authored
      commit ed2849d3 upstream.
      
      When an xprt is created, it has a refcount of 1, and XPT_BUSY is set.
      The refcount is *not* owned by the thread that created the xprt
      (as is clear from the fact that creators never put the reference).
      Rather, it is owned by the absence of XPT_DEAD.  Once XPT_DEAD is set,
      (And XPT_BUSY is clear) that initial reference is dropped and the xprt
      can be freed.
      
      So when a creator clears XPT_BUSY it is dropping its only reference and
      so must not touch the xprt again.
      
      However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY
      reference on a new xprt), calls svc_xprt_recieved.  This clears
      XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference.
      This is dangerous and has been seen to leave svc_xprt_enqueue working
      with an xprt containing garbage.
      
      So we need to hold an extra counted reference over that call to
      svc_xprt_received.
      
      For safety, any time we clear XPT_BUSY and then use the xprt again, we
      first get a reference, and the put it again afterwards.
      
      Note that svc_close_all does not need this extra protection as there are
      no threads running, and the final free can only be called asynchronously
      from such a thread.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      7df3fe5e
    • Sergey Vlasov's avatar
      NFS: Fix fcntl F_GETLK not reporting some conflicts · dd143426
      Sergey Vlasov authored
      commit 21ac19d4 upstream.
      
      The commit 129a84de (locks: fix F_GETLK
      regression (failure to find conflicts)) fixed the posix_test_lock()
      function by itself, however, its usage in NFS changed by the commit
      9d6a8c5c (locks: give posix_test_lock
      same interface as ->lock) remained broken - subsequent NFS-specific
      locking code received F_UNLCK instead of the user-specified lock type.
      To fix the problem, fl->fl_type needs to be saved before the
      posix_test_lock() call and restored if no local conflicts were reported.
      
      Reference: https://bugzilla.kernel.org/show_bug.cgi?id=23892Tested-by: default avatarAlexander Morozov <amorozov@etersoft.ru>
      Signed-off-by: default avatarSergey Vlasov <vsu@altlinux.ru>
      Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      dd143426
    • Neil Brown's avatar
      nfsd: Fix possible BUG_ON firing in set_change_info · 54cc1ed3
      Neil Brown authored
      commit c1ac3ffc upstream.
      
      If vfs_getattr in fill_post_wcc returns an error, we don't
      set fh_post_change.
      For NFSv4, this can result in set_change_info triggering a BUG_ON.
      i.e. fh_post_saved being zero isn't really a bug.
      
      So:
       - instead of BUGging when fh_post_saved is zero, just clear ->atomic.
       - if vfs_getattr fails in fill_post_wcc, take a copy of i_ctime anyway.
         This will be used i seg_change_info, but not overly trusted.
       - While we are there, remove the pointless 'if' statements in set_change_info.
         There is no harm setting all the values.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      54cc1ed3
    • Chuck Lever's avatar
      NFS: Fix panic after nfs_umount() · 22e20005
      Chuck Lever authored
      commit 5b362ac3 upstream.
      
      After a few unsuccessful NFS mount attempts in which the client and
      server cannot agree on an authentication flavor both support, the
      client panics.  nfs_umount() is invoked in the kernel in this case.
      
      Turns out nfs_umount()'s UMNT RPC invocation causes the RPC client to
      write off the end of the rpc_clnt's iostat array.  This is because the
      mount client's nrprocs field is initialized with the count of defined
      procedures (two: MNT and UMNT), rather than the size of the client's
      proc array (four).
      
      The fix is to use the same initialization technique used by most other
      upper layer clients in the kernel.
      
      Introduced by commit 0b524123, which failed to update nrprocs when
      support was added for UMNT in the kernel.
      
      BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=24302
      BugLink: http://bugs.launchpad.net/bugs/683938Reported-by: default avatarStefan Bader <stefan.bader@canonical.com>
      Tested-by: default avatarStefan Bader <stefan.bader@canonical.com>
      Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      22e20005
    • Heiko Carstens's avatar
      nohz: Fix get_next_timer_interrupt() vs cpu hotplug · 4c3c5519
      Heiko Carstens authored
      commit dbd87b5a upstream.
      
      This fixes a bug as seen on 2.6.32 based kernels where timers got
      enqueued on offline cpus.
      
      If a cpu goes offline it might still have pending timers. These will
      be migrated during CPU_DEAD handling after the cpu is offline.
      However while the cpu is going offline it will schedule the idle task
      which will then call tick_nohz_stop_sched_tick().
      
      That function in turn will call get_next_timer_intterupt() to figure
      out if the tick of the cpu can be stopped or not. If it turns out that
      the next tick is just one jiffy off (delta_jiffies == 1)
      tick_nohz_stop_sched_tick() incorrectly assumes that the tick should
      not stop and takes an early exit and thus it won't update the load
      balancer cpu.
      
      Just afterwards the cpu will be killed and the load balancer cpu could
      be the offline cpu.
      
      On 2.6.32 based kernel get_nohz_load_balancer() gets called to decide
      on which cpu a timer should be enqueued (see __mod_timer()). Which
      leads to the possibility that timers get enqueued on an offline cpu.
      These will never expire and can cause a system hang.
      
      This has been observed 2.6.32 kernels. On current kernels
      __mod_timer() uses get_nohz_timer_target() which doesn't have that
      problem. However there might be other problems because of the too
      early exit tick_nohz_stop_sched_tick() in case a cpu goes offline.
      
      The easiest and probably safest fix seems to be to let
      get_next_timer_interrupt() just lie and let it say there isn't any
      pending timer if the current cpu is offline.
      
      I also thought of moving migrate_[hr]timers() from CPU_DEAD to
      CPU_DYING, but seeing that there already have been fixes at least in
      the hrtimer code in this area I'm afraid that this could add new
      subtle bugs.
      Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
      LKML-Reference: <20101201091109.GA8984@osiris.boeblingen.de.ibm.com>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      4c3c5519
    • Heiko Carstens's avatar
      nohz: Fix printk_needs_cpu() return value on offline cpus · 0a8eea52
      Heiko Carstens authored
      commit 61ab2544 upstream.
      
      This patch fixes a hang observed with 2.6.32 kernels where timers got enqueued
      on offline cpus.
      
      printk_needs_cpu() may return 1 if called on offline cpus. When a cpu gets
      offlined it schedules the idle process which, before killing its own cpu, will
      call tick_nohz_stop_sched_tick(). That function in turn will call
      printk_needs_cpu() in order to check if the local tick can be disabled. On
      offline cpus this function should naturally return 0 since regardless if the
      tick gets disabled or not the cpu will be dead short after. That is besides the
      fact that __cpu_disable() should already have made sure that no interrupts on
      the offlined cpu will be delivered anyway.
      
      In this case it prevents tick_nohz_stop_sched_tick() to call
      select_nohz_load_balancer(). No idea if that really is a problem. However what
      made me debug this is that on 2.6.32 the function get_nohz_load_balancer() is
      used within __mod_timer() to select a cpu on which a timer gets enqueued. If
      printk_needs_cpu() returns 1 then the nohz_load_balancer cpu doesn't get
      updated when a cpu gets offlined. It may contain the cpu number of an offline
      cpu. In turn timers get enqueued on an offline cpu and not very surprisingly
      they never expire and cause system hangs.
      
      This has been observed 2.6.32 kernels. On current kernels __mod_timer() uses
      get_nohz_timer_target() which doesn't have that problem. However there might be
      other problems because of the too early exit tick_nohz_stop_sched_tick() in
      case a cpu goes offline.
      
      Easiest way to fix this is just to test if the current cpu is offline and call
      printk_tick() directly which clears the condition.
      
      Alternatively I tried a cpu hotplug notifier which would clear the condition,
      however between calling the notifier function and printk_needs_cpu() something
      could have called printk() again and the problem is back again. This seems to
      be the safest fix.
      Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
      LKML-Reference: <20101126120235.406766476@de.ibm.com>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      0a8eea52
    • Alex Deucher's avatar
      drm/kms: remove spaces from connector names (v2) · b17b3ee9
      Alex Deucher authored
      commit e76116ca upstream.
      
      Grub doesn't parse spaces in parameters correctly, so
      this makes it impossible to force video= parameters
      for kms on the grub kernel command line.
      
      v2: shorten the names to make them easier to type.
      Reported-by: default avatarSergej Pupykin <ml@sergej.pp.ru>
      
      Cc: Sergej Pupykin <ml@sergej.pp.ru>
      Signed-off-by: default avatarAlex Deucher <alexdeucher@gmail.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      b17b3ee9
    • Daniel T Chen's avatar
      ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture · f6ac0a1f
      Daniel T Chen authored
      commit 77c4d5cd upstream.
      
      BugLink: https://launchpad.net/bugs/595482
      
      The original reporter states that audible playback from the internal
      speaker is inaudible despite the hardware being properly detected.  To
      work around this symptom, he uses the model=lg quirk to properly enable
      both playback, capture, and jack sense.  Another user corroborates this
      workaround on separate hardware.  Add this PCI SSID to the quirk table
      to enable it for further LG P1 Expresses.
      Reported-and-tested-by: default avatarPhilip Peitsch <philip.peitsch@gmail.com>
      Tested-by: nikhov
      Signed-off-by: default avatarDaniel T Chen <crimsun@ubuntu.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      f6ac0a1f
    • Miklos Szeredi's avatar
      fuse: fix ioctl when server is 32bit · 9f68de59
      Miklos Szeredi authored
      commit d9d318d3 upstream.
      
      If a 32bit CUSE server is run on 64bit this results in EIO being
      returned to the caller.
      
      The reason is that FUSE_IOCTL_RETRY reply was defined to use 'struct
      iovec', which is different on 32bit and 64bit archs.
      
      Work around this by looking at the size of the reply to determine
      which struct was used.  This is only needed if CONFIG_COMPAT is
      defined.
      
      A more permanent fix for the interface will be to use the same struct
      on both 32bit and 64bit.
      Reported-by: default avatar"ccmail111" <ccmail111@yahoo.com>
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
      CC: Tejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      9f68de59
    • Miklos Szeredi's avatar
      fuse: verify ioctl retries · 326aa620
      Miklos Szeredi authored
      commit 7572777e upstream.
      
      Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY
      doesn't overflow iov_length().
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
      CC: Tejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      326aa620
    • H. Peter Anvin's avatar
      x86, hotplug: Use mwait to offline a processor, fix the legacy case · 226917b0
      H. Peter Anvin authored
      upstream ea530692
      x86, hotplug: Use mwait to offline a processor, fix the legacy case
      
      Here included also some small follow-on patches to the same code:
      
      upstream a68e5c94
      x86, hotplug: Move WBINVD back outside the play_dead loop
      
      upstream ce5f6824
      x86, hotplug: In the MWAIT case of play_dead, CLFLUSH the cache line
      
      https://bugzilla.kernel.org/show_bug.cgi?id=5471Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
      Signed-off-by: default avatarLen Brown <len.brown@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      226917b0
    • Ben Hutchings's avatar
      TTY: Fix error return from tty_ldisc_open() · 6db0ed15
      Ben Hutchings authored
      The backported version of "TTY: ldisc, fix open flag handling" in
      2.6.32.27 causes tty_ldisc_open() to return 0 on error.  Fix that.
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Cc: Jiri Slaby <jslaby@suse.cz>
      Cc: Alan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      6db0ed15
  2. 09 Dec, 2010 28 commits