1. 13 Feb, 2012 13 commits
  2. 09 Feb, 2012 3 commits
  3. 07 Feb, 2012 1 commit
    • Dave Airlie's avatar
      Merge branch 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel into drm-core-next · 198ceac0
      Dave Airlie authored
      * 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel:
        drm/i915: add a LLC feature flag in device description
        drm/i915: kill i915_mem.c
        drm/i915: Use kcalloc instead of kzalloc to allocate array
        drm/i915/dp: Check for AUXCH error before checking for success
        drm/i915/dp: Use auxch precharge value of 5 everywhere
        drm/i915/dp: Tweak auxch clock divider for PCH
        drm/i915: Remove a comment about PCH from the non-PCH path
        drm/i915: Fix assert_pch_hdmi_disabled to mention HDMI (not DP)
        drm/i915: Implement plane-disabled assertion for PCH too
        drivers: i915: Fix BLC PWM register setup
        drm/i915: Check that plane/pipe is disabled before removing the fb
        drm/i915: fix typo in function name
        drm/i915: split out pll divider code
        drm/i915: split 9xx refclk & sdvo tv code out
        agp/intel: Add pci id for hostbridge from has/qemu
        drm/i915: there is no pipe CxSR on ironlake
        drm/i915: Only look for matching clocks for LVDS downclock
        drm/i915: Silence _DSM errors
      198ceac0
  4. 03 Feb, 2012 20 commits
  5. 02 Feb, 2012 3 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 6c073a7e
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        rbd: fix safety of rbd_put_client()
        rbd: fix a memory leak in rbd_get_client()
        ceph: create a new session lock to avoid lock inversion
        ceph: fix length validation in parse_reply_info()
        ceph: initialize client debugfs outside of monc->mutex
        ceph: change "ceph.layout" xattr to be "ceph.file.layout"
      6c073a7e
    • Josh Triplett's avatar
    • Alex Elder's avatar
      rbd: fix safety of rbd_put_client() · d23a4b3f
      Alex Elder authored
      The rbd_client structure uses a kref to arrange for cleaning up and
      freeing an instance when its last reference is dropped.  The cleanup
      routine is rbd_client_release(), and one of the things it does is
      delete the rbd_client from rbd_client_list.  It acquires node_lock
      to do so, but the way it is done is still not safe.
      
      The problem is that when attempting to reuse an existing rbd_client,
      the structure found might already be in the process of getting
      destroyed and cleaned up.
      
      Here's the scenario, with "CLIENT" representing an existing
      rbd_client that's involved in the race:
      
       Thread on CPU A                | Thread on CPU B
       ---------------                | ---------------
       rbd_put_client(CLIENT)         | rbd_get_client()
         kref_put()                   |   (acquires node_lock)
           kref->refcount becomes 0   |   __rbd_client_find() returns CLIENT
           calls rbd_client_release() |   kref_get(&CLIENT->kref);
                                      |   (releases node_lock)
             (acquires node_lock)     |
             deletes CLIENT from list | ...and starts using CLIENT...
             (releases node_lock)     |
             and frees CLIENT         | <-- but CLIENT gets freed here
      
      Fix this by having rbd_put_client() acquire node_lock.  The result
      could still be improved, but at least it avoids this problem.
      Signed-off-by: default avatarAlex Elder <elder@dreamhost.com>
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      d23a4b3f