summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-02-01usb: ch9.h: usb_endpoint_maxp() uses __le16_to_cpu()Kuninori Morimoto
The usb/ch9.h will be installed to /usr/include/linux, and be used from user space. But le16_to_cpu() is only defined for kernel code. Without this patch, user space compile will be broken. Special thanks to Stefan Becker Reported-by: Stefan Becker <chemobejk@gmail.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-02-01USB: qcserial: don't enable autosuspendThomas Tuttle
We've found that qcserial devices will not always wake up reliably from autosuspend, so disable it. Signed-off-by: Thomas Tuttle <ttuttle@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-02-01USB: qcserial: add several new serial devicesThomas Tuttle
Signed-off-by: Thomas Tuttle <ttuttle@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-02-01ASoC: wm_hubs: Correct line input to line output 2 pathsMark Brown
The second line output mixer has the controls for the line input bypasses in the opposite order. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: stable@vger.kernel.org
2012-02-02lib: Fix 32-bit sparc udiv_qrnnd() definition in mpilib's longlong.hDavid Miller
This copy of longlong.h is extremely dated and results in compile errors on sparc32 when MPILIB is enabled, copy over the more uptodate implementation from arch/sparc/math/sfp-util_32.h Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib: Fix multiple definitions of clz_tabDavid Miller
Both sparc 32-bit's software divide assembler and MPILIB provide clz_tab[] with identical contents. Break it out into a seperate object file and select it when SPARC32 or MPILIB is set. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-01Merge tag 'rdma-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband InfiniBand/RDMA fixes for 3.3: - Fix a crash due to a regression (uninitialized refcnt) introduced in 3.2 with XRC support. - Close race in how ucma reports events when connect fails. - Process vendor-specific MADs in mlx4 so that eg FDR-10 data rate works. - Fix regression in qib caused by over-aggressive PCIe tuning. - Other small fixes for hardware drivers (ipath, nes, qib). * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: RDMA/nes: Copyright update IB/mlx4: pass SMP vendor-specific attribute MADs to firmware RDMA/nes: Fix fast memory registration opcode RDMA/nes: Fix fast memory registration length RDMA/ucma: Discard all events for new connections until accepted IB/qib: Roll back PCIe tuning change IB/qib: Use GFP_ATOMIC when locks are held RDMA/nes: Add missing rcu_read_unlock() in nes_addr_resolve_neigh() RDMA/nes: Fix for sending MPA reject frame IB/ipath: Calling PTR_ERR() on right variable in create_file() RDMA/core: Fix kernel panic by always initializing qp->usecnt
2012-02-01proc: make sure mem_open() doesn't pin the target's memoryOleg Nesterov
Once /proc/pid/mem is opened, the memory can't be released until mem_release() even if its owner exits. Change mem_open() to do atomic_inc(mm_count) + mmput(), this only pins mm_struct. Change mem_rw() to do atomic_inc_not_zero(mm_count) before access_remote_vm(), this verifies that this mm is still alive. I am not sure what should mem_rw() return if atomic_inc_not_zero() fails. With this patch it returns zero to match the "mm == NULL" case, may be it should return -EINVAL like it did before e268337d. Perhaps it makes sense to add the additional fatal_signal_pending() check into the main loop, to ensure we do not hold this memory if the target task was oom-killed. Cc: stable@kernel.org Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-01proc: unify mem_read() and mem_write()Oleg Nesterov
No functional changes, cleanup and preparation. mem_read() and mem_write() are very similar. Move this code into the new common helper, mem_rw(), which takes the additional "int write" argument. Cc: stable@kernel.org Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-01proc: mem_release() should check mm != NULLOleg Nesterov
mem_release() can hit mm == NULL, add the necessary check. Cc: stable@kernel.org Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-01PM / Hibernate: Thaw kernel threads in SNAPSHOT_CREATE_IMAGE ioctl pathSrivatsa S. Bhat
In the SNAPSHOT_CREATE_IMAGE ioctl, if the call to hibernation_snapshot() fails, the frozen tasks are not thawed. And in the case of success, if we happen to exit due to a successful freezer test, all tasks (including those of userspace) are thawed, whereas actually we should have thawed only the kernel threads at that point. Fix both these issues. Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com> Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Cc: stable@vger.kernel.org
2012-02-01mac80211: timeout a single frame in the rx reorder bufferEliad Peller
The current code checks for stored_mpdu_num > 1, causing the reorder_timer to be triggered indefinitely, but the frame is never timed-out (until the next packet is received) Signed-off-by: Eliad Peller <eliad@wizery.com> Cc: <stable@vger.kernel.org> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01iwlwifi: don't mess up QoS counters with non-QoS framesEmmanuel Grumbach
In my AMPDU rework, I rely on the sequence numbers of frames. But I didn't check that the frame has a valid tid before updating the tracking counters. As a result, the Tx queues were stalled. People who hit this bug saw that we simply didn't let any data out. This bug was introduced in 3.3. This patch fixes that and checks that the frame is a QoS frame before looking at its tid and changing the counters. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01ssb: fix cardbus slot in hostmodeHauke Mehrtens
ssb supports one extra device on the cardbus. This results in two devices in total, one beeing the host controller itself and the other the external device connected to the hostcontroller over cardbus. This makes the cardbus slot work on the Linksys WRT150N. Reported-by: Aaron Z <aaronz@pls-net.org> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01iwlwifi: make "Tx aggregation enabled on ra =" be at DEBUG levelJohn W. Linville
Average users either don't care or they think that message indicates a problem... Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01rt2800lib: fix wrong -128dBm when signal is stronger than -12dBmLuigi Tarenga
This patch correct the type of variables containing the rssi values read from the rxwi. In function rt2800_agc_to_rssi() 3 variables (rssi0, rssi1, rss2) defined as int was assigned a 16bit signed values as unsigned. From a test with a hi-gain antenna I verified that the rxwi contains signed rssi values in the range -13/+81 (inclusive) with 0 as an error condition. In case of negative values a condition is triggered and the function return -128dBm while the signal is at its maximum. This patch correct the cast so negative values are not treated as very high positive values (ex. -13 does not become 243). Signed-off-by: Luigi Tarenga <luigi.tarenga@gmail.com> Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01bcma: Fix mem leak in bcma_bus_scan()Jesper Juhl
bcma_bus_scan() leaks 'struct bcma_device' bytes if bcma_get_next_core() returns error. Restructure the code so we always kfree() the memory we allocate to the variable 'core' before it goes out of scope. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-02-01ethtool: Null-terminate filename passed to ethtool_ops::flash_deviceBen Hutchings
The parameters for ETHTOOL_FLASHDEV include a filename, which ought to be null-terminated. Currently the only driver that implements ethtool_ops::flash_device attempts to add a null terminator if necessary, but does it wrongly. Do it in the ethtool core instead. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-01net: Disambiguate kernel messageArun Sharma
Some of our machines were reporting: TCP: too many of orphaned sockets even when the number of orphaned sockets was well below the limit. We print a different message depending on whether we're out of TCP memory or there are too many orphaned sockets. Also move the check out of line and cleanup the messages that were printed. Signed-off-by: Arun Sharma <asharma@fb.com> Suggested-by: Mohan Srinivasan <mohan@fb.com> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: David Miller <davem@davemloft.net> Cc: Glauber Costa <glommer@parallels.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-01net/hyperv: rx_bytes should account the ether header sizeWei Yongjun
skb->len after call eth_type_trans() does not include the ether header size, but rx_bytes should account it. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-02-01MAINTAINERS: Greg's suse email address is deadGreg KH
My email address has changed, the suse.de one is now dead, so update all of my MAINTAINER entries with the correct one so that patches don't get lost. Also change the status of some of my entries as I'm supposed to be doing this stuff now for real. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-01mtd: fix merge conflict resolution breakageArtem Bityutskiy
This patch fixes merge conflict resolution breakage introduced by merge d3712b9dfcf4 ("Merge tag 'for-linus' of git://github.com/prasad-joshi/logfs_upstream"). The commit changed 'mtd_can_have_bb()' function and made it always return zero, which is incorrect. Instead, we need it to return whether the underlying flash device can have bad eraseblocks or not. UBI needs this information because it affects how it handles the underlying flash. E.g., if the underlying flash is NOR, it cannot have bad blocks and any write or erase error is fatal, and all we can do is to switch to R/O mode. We do not need to reserve a pool of good eraseblocks for bad eraseblocks handling, and so on. This patch also removes 'mtd_can_have_bb()' invocations from Logfs to ensure correct Logfs behavior. I've tested that with this patch UBI works on top of NOR and NAND flashes emulated by mtdram and nandsim correspondingly. This patch is based on patch from Linus Torvalds. Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Acked-by: Jörn Engel <joern@logfs.org> Acked-by: Prasad Joshi <prasadjoshi.linux@gmail.com> Acked-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-02-01Input: serio_raw - return proper result when serio_raw_read failsChe-Liang Chiou
serio_raw_read now returns (sometimes partially) successful number of bytes transferred to the caller, and only returns error code to the caller on completely failed transfers. Signed-off-by: Che-Liang Chiou <clchiou@chromium.org> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2012-02-01Input: document device propertiesHenrik Rydberg
Add a section which defines the input device properties and provides guidelines on how to use them. Signed-off-by: Henrik Rydberg <rydberg@euromail.se> Reviewed-by: Chase Douglas <chase.douglas@canonical.com> Reviewed-by: Jussi Pakkanen <jussi.pakkanen@canonical.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2012-02-01Input: twl4030_keypad - fix comment (trivial)Felipe Contreras
And trivial whitespace fixes. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2012-02-01Input: gpio_keys - fix struct device declared inside parameter listHeiko Stübner
A struct device parameter is used in the enable and disable callbacks to distinguish between different gpio_keys devices. Platforms that don't use these callbacks may not include struct device at all, as seen on arch/arm/mach-s3c2410/mach-n30.c Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2012-02-01Input: evdev - fix variable initialisationHeiko Stübner
Commit 509f87c5f564 (evdev - do not block waiting for an event if fd is nonblock) created a code path were it was possible to use retval uninitialized. This could lead to the xorg evdev input driver getting corrupt data and refusing to work with log messages like AUO-Pixcir touchscreen: Read error: Success sg060_keys: Read error: Success AUO-Pixcir touchscreen: Read error: Success sg060_keys: Read error: Success (for drivers auo-pixcir-ts and gpio-keys). Signed-off-by: Heiko Stuebner <heiko@sntech.de> Acked-by: Dima Zavin <dima@android.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2012-02-01ARM: mach-shmobile: both USB DMAC instances on sh7372 are slave-onlyGuennadi Liakhovetski
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
2012-02-01dma: sh_dma: not all SH DMAC implementations support MEMCPYGuennadi Liakhovetski
Add a flag to allow platforms to specify, whether a DMAC instance supports the MEMCPY operation. To avoid regressions, preserve the current default. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
2012-02-01drm/radeon/kms: Fix device tree linkage of DP i2c buses tooJean Delvare
Properly set the parent device of DP i2c buses before registering them too. Signed-off-by: Jean Delvare <jdelvare@suse.de> Reviewed-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-02-01drm/radeon: Set DESKTOP_HEIGHT register to the framebuffer (not mode) height.Michel Dänzer
The value of this register is transferred to the V_COUNTER register at the beginning of vertical blank. V_COUNTER is the reference for VLINE waits and goes from VIEWPORT_Y_START to VIEWPORT_Y_START+VIEWPORT_HEIGHT during scanout, so if VIEWPORT_Y_START is not 0, V_COUNTER actually went backwards at the beginning of vertical blank, and VLINE waits excluding the whole scanout area could never finish (possibly only if VIEWPORT_Y_START is larger than the length of vertical blank in scanlines). Setting DESKTOP_HEIGHT to the framebuffer height should prevent this for any kind of VLINE wait. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=45329 . CC: stable@vger.kernel.org Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-02-01drm/radeon/kms: disable output polling when suspendedSeth Forshee
Polling the outputs when the device is suspended can result in erroneous status updates. Disable output polling during suspend to prevent this from happening. Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2012-02-02lib/digsig: checks for NULL return valueDmitry Kasatkin
mpi_read_from_buffer() return value must not be NULL. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: added missing NULL checkDmitry Kasatkin
Added missing NULL check after mpi_alloc_limb_space(). Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: added comment on divide by 0 caseDmitry Kasatkin
Comment explains that existing clients do not call this function with dsize == 0, which means that 1/0 should not happen. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: check for possible zero lengthDmitry Kasatkin
Buggy client might pass zero nlimbs which is meaningless. Added check for zero length. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/digsig: pkcs_1_v1_5_decode_emsa cleanupDmitry Kasatkin
Removed useless 'is_valid' variable in pkcs_1_v1_5_decode_emsa(), which was inhereted from original code. Client now uses return value to check for an error. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/digsig: additional sanity checks against badly formated key payloadDmitry Kasatkin
Added sanity checks for possible wrongly formatted key payload data: - minimum key payload size - zero modulus length - corrected upper key payload boundary. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: removed unused functionsDmitry Kasatkin
do_encode_md() and mpi_get_keyid() are not parts of mpi library. They were used early versions of gnupg and in digsig project, but they are not used neither here nor there anymore. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: checks for zero divisor lengthDmitry Kasatkin
Divisor length should not be 0. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: return error code on dividing by zeroDmitry Kasatkin
Definitely better to return error code than to divide by zero. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: replaced MPI_NULL with normal NULLDmitry Kasatkin
MPI_NULL is replaced with normal NULL. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-02lib/mpi: added missing NULL checkDmitry Kasatkin
Added missing NULL check after mpi_alloc(). Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Reviewed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <jmorris@namei.org>
2012-02-01ALSA: HDA: Fix duplicated output to more than one codecDavid Henningsson
This typo caused the wrong codec's nid to be checked for wcaps type. As a result, sometimes speakers would duplicate the output sent to HDMI output. Cc: stable@kernel.org BugLink: https://bugs.launchpad.net/bugs/924320 Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-02-01ASoC: cs42l73: Fix Output [X|A|V]SP_SCLK Sourcing Mode setting for master modeAxel Lin
For master mode, set Output [X|A|V]SP_SCLK Sourcing Mode to MCLK Mode. Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Brian Austin <brian.austin@cirrus.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-02-01ASoC: wm8962: Fix word length configurationSusan Gao
Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: stable@vger.kernel.org
2012-02-01KVM: do not #GP on perf MSR writes when vPMU is disabledGleb Natapov
Return to behaviour perf MSR had before introducing vPMU in case vPMU is disabled. Some guests access those registers unconditionally and do not expect it to fail. Signed-off-by: Gleb Natapov <gleb@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2012-02-01KVM: x86: fix missing checks in syscall emulationStephan Bärwolf
On hosts without this patch, 32bit guests will crash (and 64bit guests may behave in a wrong way) for example by simply executing following nasm-demo-application: [bits 32] global _start SECTION .text _start: syscall (I tested it with winxp and linux - both always crashed) Disassembly of section .text: 00000000 <_start>: 0: 0f 05 syscall The reason seems a missing "invalid opcode"-trap (int6) for the syscall opcode "0f05", which is not available on Intel CPUs within non-longmodes, as also on some AMD CPUs within legacy-mode. (depending on CPU vendor, MSR_EFER and cpuid) Because previous mentioned OSs may not engage corresponding syscall target-registers (STAR, LSTAR, CSTAR), they remain NULL and (non trapping) syscalls are leading to multiple faults and finally crashs. Depending on the architecture (AMD or Intel) pretended by guests, various checks according to vendor's documentation are implemented to overcome the current issue and behave like the CPUs physical counterparts. [mtosatti: cleanup/beautify code] Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2012-02-01KVM: x86: extend "struct x86_emulate_ops" with "get_cpuid"Stephan Bärwolf
In order to be able to proceed checks on CPU-specific properties within the emulator, function "get_cpuid" is introduced. With "get_cpuid" it is possible to virtually call the guests "cpuid"-opcode without changing the VM's context. [mtosatti: cleanup/beautify code] Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2012-02-01KVM: Fix __set_bit() race in mark_page_dirty() during dirty loggingTakuya Yoshikawa
It is possible that the __set_bit() in mark_page_dirty() is called simultaneously on the same region of memory, which may result in only one bit being set, because some callers do not take mmu_lock before mark_page_dirty(). This problem is hard to produce because when we reach mark_page_dirty() beginning from, e.g., tdp_page_fault(), mmu_lock is being held during __direct_map(): making kvm-unit-tests' dirty log api test write to two pages concurrently was not useful for this reason. So we have confirmed that there can actually be race condition by checking if some callers really reach there without holding mmu_lock using spin_is_locked(): probably they were from kvm_write_guest_page(). To fix this race, this patch changes the bit operation to the atomic version: note that nr_dirty_pages also suffers from the race but we do not need exactly correct numbers for now. Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>