1. 07 Jul, 2011 2 commits
    • Steven Rostedt's avatar
      tracing: Have "enable" file use refcounts like the "filter" file · 40ee4dff
      Steven Rostedt authored
      
      
      The "enable" file for the event system can be removed when a module
      is unloaded and the event system only has events from that module.
      As the event system nr_events count goes to zero, it may be freed
      if its ref_count is also set to zero.
      
      Like the "filter" file, the "enable" file may be opened by a task and
      referenced later, after a module has been unloaded and the events for
      that event system have been removed.
      
      Although the "filter" file referenced the event system structure,
      the "enable" file only references a pointer to the event system
      name. Since the name is freed when the event system is removed,
      it is possible that an access to the "enable" file may reference
      a freed pointer.
      
      Update the "enable" file to use the subsystem_open() routine that
      the "filter" file uses, to keep a reference to the event system
      structure while the "enable" file is opened.
      
      Cc: <stable@kernel.org>
      Reported-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      40ee4dff
    • Steven Rostedt's avatar
      tracing: Fix bug when reading system filters on module removal · e9dbfae5
      Steven Rostedt authored
      
      
      The event system is freed when its nr_events is set to zero. This happens
      when a module created an event system and then later the module is
      removed. Modules may share systems, so the system is allocated when
      it is created and freed when the modules are unloaded and all the
      events under the system are removed (nr_events set to zero).
      
      The problem arises when a task opened the "filter" file for the
      system. If the module is unloaded and it removed the last event for
      that system, the system structure is freed. If the task that opened
      the filter file accesses the "filter" file after the system has
      been freed, the system will access an invalid pointer.
      
      By adding a ref_count, and using it to keep track of what
      is using the event system, we can free it after all users
      are finished with the event system.
      
      Cc: <stable@kernel.org>
      Reported-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      e9dbfae5
  2. 29 Jun, 2011 1 commit
  3. 22 Jun, 2011 1 commit
  4. 21 Jun, 2011 9 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband · e08f6d41
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
        IB/qib: Ensure that LOS and DFE are being turned off
        RDMA/cxgb4: Couple of abort fixes
        RDMA/cxgb4: Don't truncate MR lengths
        RDMA/cxgb4: Don't exceed hw IQ depth limit for user CQs
      e08f6d41
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 890879cf
      Linus Torvalds authored
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        jbd2: Fix oops in jbd2_journal_remove_journal_head()
        jbd2: Remove obsolete parameters in the comments for some jbd2 functions
        ext4: fixed tracepoints cleanup
        ext4: use FIEMAP_EXTENT_LAST flag for last extent in fiemap
        ext4: Fix max file size and logical block counting of extent format file
        ext4: correct comments for ext4_free_blocks()
      890879cf
    • Linus Torvalds's avatar
      Linux 3.0-rc4 · 56299378
      Linus Torvalds authored
      56299378
    • Linus Torvalds's avatar
      vfs: i_state needs to be 'unsigned long' for now · 79568f5b
      Linus Torvalds authored
      Commit 13e12d14
      
       ("vfs: reorganize 'struct inode' layout a bit")
      moved things around a bit changed i_state to be unsigned int instead of
      unsigned long.  That was to help structure layout for the 64-bit case,
      and shrink 'struct inode' a bit (admittedly that only happened when
      spinlock debugging was on and i_flags didn't pack with i_lock).
      
      However, Meelis Roos reports that this results in unaligned exceptions
      on sprc, and it turns out that the bit-locking primitives that we use
      for the I_NEW bit want to use the bitops.  Which want 'unsigned long',
      not 'unsigned int'.
      
      We really should fix the bit locking code to not have that kind of
      requirement, but that's a much bigger change.  So for now, revert that
      field back to 'unsigned long' (but keep the other re-ordering changes
      from the commit that caused this).
      
      Andi points out that we have played games with this in 'struct page', so
      it's solvable with other hacks too, but since right now the struct inode
      size advantage only happens with some rare config options, it's not
      worth fighting.
      
      It _would_ be worth fixing the bitlocking code, though.  Especially
      since there is no type safety in the bitlocking code (this never caused
      any warnings, and worked fine on x86-64, because the bitlocks take a
      'void *' and x86-64 doesn't care that deeply about alignment).  So it's
      currently a very easy problem to trigger by mistake and never notice.
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: David Miller <davem@davemloft.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      79568f5b
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 · f5fc5567
      Linus Torvalds authored
      * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
        drm/radeon/kms/r6xx+: voltage fixes
        drm/nouveau: drop leftover debugging
        drm/radeon: avoid warnings from r600/eg irq handlers on powered off card.
        drm/radeon/kms: add missing param for dce3.2 DP transmitter setup
        drm/radeon/kms/atom: fix duallink on some early DCE3.2 cards
        drm/nouveau: fix assumption that semaphore dmaobj is valid in x-chan sync
        drm/nv50/disp: fix gamma with page flipping overlay turned on
        drm/nouveau/pm: Prevent overflow in nouveau_perf_init()
        drm/nouveau: fix big-endian switch
      f5fc5567
    • Linus Torvalds's avatar
      Merge branch 'msm-fix' of git://codeaurora.org/quic/kernel/davidb/linux-msm · 85d45ade
      Linus Torvalds authored
      * 'msm-fix' of git://codeaurora.org/quic/kernel/davidb/linux-msm:
        msm: timer: Fix DGT rate on 8960 and 8660
        msm: timer: compensate for timer shift in msm_read_timer_count
        msm: timer: Fix SMP build error
      85d45ade
    • Linus Torvalds's avatar
      Merge branch 'for-2.6.40' of git://linux-nfs.org/~bfields/linux · eda08410
      Linus Torvalds authored
      * 'for-2.6.40' of git://linux-nfs.org/~bfields/linux:
        nfsd4: fix break_lease flags on nfsd open
        nfsd: link returns nfserr_delay when breaking lease
        nfsd: v4 support requires CRYPTO
        nfsd: fix dependency of nfsd on auth_rpcgss
      eda08410
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 · 6e158d21
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (40 commits)
        pxa168_eth: fix race in transmit path.
        ipv4, ping: Remove duplicate icmp.h include
        netxen: fix race in skb->len access
        sgi-xp: fix a use after free
        hp100: fix an skb->len race
        netpoll: copy dev name of slaves to struct netpoll
        ipv4: fix multicast losses
        r8169: fix static initializers.
        inet_diag: fix inet_diag_bc_audit()
        gigaset: call module_put before restart of if_open()
        farsync: add module_put to error path in fst_open()
        net: rfs: enable RFS before first data packet is received
        fs_enet: fix freescale FCC ethernet dp buffer alignment
        netdev: bfin_mac: fix memory leak when freeing dma descriptors
        vlan: don't call ndo_vlan_rx_register on hardware that doesn't have vlan support
        caif: Bugfix - XOFF removed channel from caif-mux
        tun: teach the tun/tap driver to support netpoll
        dp83640: drop PHY status frames in the driver.
        dp83640: fix phy status frame event parsing
        phylib: Allow BCM63XX PHY to be selected only on BCM63XX.
        ...
      6e158d21
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 · 36698206
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
        devcgroup_inode_permission: take "is it a device node" checks to inlined wrapper
        fix comment in generic_permission()
        kill obsolete comment for follow_down()
        proc_sys_permission() is OK in RCU mode
        reiserfs_permission() doesn't need to bail out in RCU mode
        proc_fd_permission() is doesn't need to bail out in RCU mode
        nilfs2_permission() doesn't need to bail out in RCU mode
        logfs doesn't need ->permission() at all
        coda_ioctl_permission() is safe in RCU mode
        cifs_permission() doesn't need to bail out in RCU mode
        bad_inode_permission() is safe from RCU mode
        ubifs: dereferencing an ERR_PTR in ubifs_mount()
      36698206
  5. 20 Jun, 2011 25 commits
  6. 19 Jun, 2011 2 commits