summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-02-06ACPI: disable ACPI cleanly when bad RSDP foundLen Brown
When ACPI is disabled in the BIOS of this VIA C3 box, it invalidates the RSDP, which Linux notices: ACPI Error (tbxfroot-0218): A valid RSDP was not found [20080926] Bug Linux neglected to disable ACPI at that stage, and later scribbled on smp_found_config: ACPI: No APIC-table, disabling MPS But this box doesn't run well in legacy PIC mode, it needed IOAPIC mode to perform correctly: http://lkml.org/lkml/2009/2/5/39 So exit ACPI mode cleanly when we first detect that it is hopeless. Signed-off-by: Len Brown <len.brown@intel.com>
2009-02-06ACPI: delete CPU_IDLE=n codeLen Brown
CPU_IDLE=y has been default for ACPI=y since Nov-2007, and has shipped in many distributions since then. Here we delete the CPU_IDLE=n ACPI idle code, since nobody should be using it, and we don't want to maintain two versions. Signed-off-by: Len Brown <len.brown@intel.com>
2009-02-06Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: ieee1394: dv1394: move deprecation message from module init to file open firewire: core: Remove card from list of cards when enable fails
2009-02-06Add Sascha Hauer to .mailmapUwe Kleine-König
This fixes the shortlog attribution e.g. for 106757b38fff Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Acked-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-06add another mailmap entry for Uwe Kleine-KönigUwe Kleine-König
I created commit 7971db5a4b4176ad5df590fce07a962c643a2740 on a machine where I forgot to set user.name and user.email before. The default values were not optimal. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-06arch/powerpc: Eliminate double sizeofJulia Lawall
Taking sizeof the result of sizeof is quite strange and does not seem to be what is wanted here. This was fixed using the following semantic patch. (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ expression E; @@ - sizeof ( sizeof (E) - ) @@ type T; @@ - sizeof ( sizeof (T) - ) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2009-02-06powerpc/cpm2: Fix set interrupt typepaulfax
This is a simple change to correct problems when using set_irq_type on platforms using CPM2. This code corrects the problem on most platform but may have issues on 8272 derived platforms for some interrupts. On 8272 PC2 & 3 are missing and PC 23 & 29 are added, which this patch does not address. Signed-off-by: Paul Bilke <paul@conspiracy.net> Reviewed-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2009-02-06fork.c: fix NULL pointer dereference when nr_threads == threads-maxLi Zefan
I happened to forked lots of processes, and hit NULL pointer dereference. It is because in copy_process() after checking max_threads, 0 is returned but not -EAGAIN. The bug is introduced by "CRED: Detach the credentials from task_struct" (commit f1752eec6145c97163dbce62d17cf5d928e28a27). Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-06powerpc/83xx: Fix TSEC0 workability on MPC8313E-RDB boardsAnton Vorontsov
TSEC0 is connected to Vitesse 7385 5-port switch. The switch isn't connected to any mdio bus, the link to the switch is fixed to Full-duplex 1000 Mb/s (no pause). This patch fixes following failure during bootup: mdio@24520:01 not found eth0: Could not attach to PHY IP-Config: Failed to open eth0 Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2009-02-06powerpc/83xx: Fix missing #{address,size}-cells in mpc8313erdb.dtsAnton Vorontsov
commit b31a1d8b41513b96e9c7ec2f68c5734cef0b26a4 ("gianfar: Convert gianfar to an of_platform_driver") introduced a child node for the ethernet@25000 controller, but no address and size cells specifiers were added, and that makes dtc unhappy: DTC: dts->dtb on file "arch/powerpc/boot/dts/mpc8313erdb.dts" Warning (reg_format): "reg" property in /soc8313@e0000000/ethernet@25000/mdio@25520 has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) Warning (avoid_default_addr_size): Relying on default #address-cells value for /soc8313@e0000000/ethernet@25000/mdio@25520 Warning (avoid_default_addr_size): Relying on default #size-cells value for /soc8313@e0000000/ethernet@25000/mdio@25520 Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2009-02-06powerpc/83xx: Build breakage for CONFIG_PM but no CONFIG_SUSPENDMichael Neuling
I noticed this doing some randconfig testing (.config below). I have CONFIG_PM but no CONFIG_SUSPEND. Bug is against mainline. arch/powerpc/sysdev/built-in.o: In function `ipic_suspend': ipic.c:(.text+0x6b34): undefined reference to `fsl_deep_sleep' make[1]: *** [.tmp_vmlinux1] Error 1 make: *** [sub-make] Error 2 Looks like #ifdef CONFIG_PM in arch/powerpc/sysdev/ipic.c should be CONFIG_SUSPEND. d49747bdfb2ddebea24d1580da55b79d093d48a9 introduced this. Fix build when we have CONFIG_PM but no CONFIG_SUSPEND. Signed-off-by: Michael Neuling <mikey@neuling.org> Acked-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2009-02-06Btrfs: Make sure dir is non-null before doing S_ISGID checksChris Mason
The S_ISGID check in btrfs_new_inode caused an oops during subvol creation because sometimes the dir is null. Signed-off-by: Chris Mason <chris.mason@oracle.com>
2009-02-06Merge branch 'for-linus' of git://neil.brown.name/mdLinus Torvalds
* 'for-linus' of git://neil.brown.name/md: md: Ensure an md array never has too many devices. md: Fix a bug in linear.c causing which_dev() to return the wrong device. md: Allow read error in a single drive raid1 to be passed up.
2009-02-06ieee1394: dv1394: move deprecation message from module init to file openStefan Richter
On many Linux installations, the dv1394 driver will be auto-loaded whenever an AV/C device (e.g. camcorder or audio device) is plugged in. An irritating message would then appear in the kernel log. Defer this message to until a dv1394 character device file is actually used by a program. Also include the program name in the message and update the message slightly. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2009-02-06x86: clean up hpet timer reinitPavel Emelyanov
Implement Linus's suggestion: introduce the hpet_cnt_ahead() helper function to compare hpet time values - like other wrapping counter comparisons are abstracted away elsewhere. (jiffies, ktime_t, etc.) Reported-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-06timers: split process wide cpu clocks/timers, remove spurious warningIngo Molnar
Mike Galbraith reported that the new warning in thread_group_cputimer() triggers en masse with Amarok running. Oleg Nesterov observed: Can't fastpath_timer_check()->thread_group_cputimer() have the false warning too? Suppose we had the timer, then posix_cpu_timer_del() removes this timer, but task_cputime_zero(&sig->cputime_expires) still not true. Remove the spurious debug warning. Reported-by: Mike Galbraith <efault@gmx.de> Explained-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-06Merge branch 'fix/usb-audio' into for-linusTakashi Iwai
2009-02-06Merge branch 'fix/hda' into for-linusTakashi Iwai
2009-02-06ALSA: hda - Add missing COEF initialization for ALC887Takashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-02-06ALSA: hda - Add missing initialization for ALC272Takashi Iwai
ALC272 needs EAPD for speaker outputs as well as other similar ALC codecs. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-02-06ASoC: WM8990: Fix kcontrol's private value use in put callbackJarkko Nikula
Function wm899x_outpga_put_volsw_vu misuses the kcontrol's private value by still accessing it as bitfields even SOC_SINGLE_VALUE constructs it as a pointer into struct soc_mixer_control after the commit 4eaa9819dc08d7bfd1065ce530e31b18a119dcaf. This is very similar fix than fix to TLV320AIC3X codec made by Eero Nurkkala <ext-eero.nurkkala@nokia.com>. This fix is compile tested only. Signed-off-by: Jarkko Nikula <jarkko.nikula@nokia.com> Cc: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2009-02-06ASoC: TLV320AIC3X: Fix kcontrol's private value use in put callbackEero Nurkkala
Function snd_soc_dapm_put_volsw_aic3x misuses the kcontrol's private value by still accessing it as bitfields even SOC_SINGLE_VALUE constructs it as a pointer into struct soc_mixer_control after the commit 4eaa9819dc08d7bfd1065ce530e31b18a119dcaf. This was causing arbitrary register writes when touching the controls defined with SOC_DAPM_SINGLE_AIC3X. Signed-off-by: Eero Nurkkala <ext-eero.nurkkala@nokia.com> Acked-by: Jarkko Nikula <jarkko.nikula@nokia.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2009-02-06udp: Fix potential wrong ip_hdr(skb) pointersJesper Dangaard Brouer
Like the UDP header fix, pskb_may_pull() can potentially alter the SKB buffer. Thus the saddr and daddr, pointers may point to the old skb->data buffer. I haven't seen corruptions, as its only seen if the old skb->data buffer were reallocated by another user and written into very quickly (or poison'd by SLAB debugging). Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-06neigh: some entries can be skipped during dumpingGautam Kachroo
neightbl_dump_info and neigh_dump_table can skip entries if the *fill*info functions return an error. This results in an incomplete dump ((invoked by netlink requests for RTM_GETNEIGHTBL or RTM_GETNEIGH) nidx and idx should not be incremented if the current entry was not placed in the output buffer Signed-off-by: Gautam Kachroo <gk@aristanetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-06ipv6: Disallow rediculious flowlabel option sizes.David S. Miller
Just like PKTINFO, limit the options area to 64K. Based upon report by Eric Sesterhenn and analysis by Roland Dreier. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-06sound: usb-audio: handle wMaxPacketSize for FIXED_ENDPOINT devicesClemens Ladisch
For audio devices that do not have proper audio descriptors (e.g., Edirol UA-20), we use hardcoded parameters from our quirks list. However, we must still read the maximum packet size from the standard endpoint descriptor; otherwise, we might use packets that are too big and therefore rejected by the USB core. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-02-05sparc64: Don't hook up pcr_ops on spitfire chips.David S. Miller
They can't be used for profiling and NMI watchdog currently since they lack the counter overflow interrupt. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-06md: Ensure an md array never has too many devices.NeilBrown
Each different metadata format supported by md supports a different maximum number of devices. We really should be enforcing this maximum in the kernel, but we aren't quite doing that properly. We currently only enforce it at the 'hot_add' point, which is an older interface which is not used by current userspace. We need to also enforce it at 'add_new_disk' time for active arrays and at 'do_md_run' time when starting a new array. So move the test from 'hot_add' into 'bind_rdev_to_array' which is called from both 'hot_add' and 'add_new_disk, and add a new test in 'analyse_sbs' which is called from 'do_md_run'. This bug (or missing feature) has been around "forever" and so the patch is suitable for any -stable that is currently maintained. Cc: stable@kernel.org Signed-off-by: NeilBrown <neilb@suse.de>
2009-02-06md: Fix a bug in linear.c causing which_dev() to return the wrong device.Andre Noll
ab5bd5cbc8d4b868378d062eed3d4240930fbb86 introduced the following bug in linear software raid for large arrays on 32 bit machines: which_dev() computes the device holding a given sector by shifting down the sector number to a 32 bit range, dividing by the array spacing and looking up the resulting index in the hash table of the array. Because the computed index might be slightly too small, a loop at the end of which_dev() increases the index until the given sector actually falls into the range of the device associated with that index. The changes of the above mentioned commit caused this loop to check whether the _index_ rather than the sector number is small enough, effectively bypassing the loop and thus possibly returning the wrong device. As reported by Simon Kirby, this leads to errors such as linear_make_request: Sector 2340486136 out of bounds on dev sdi: 156301312 sectors, offset 2109870464 Fix this bug by introducing a local variable for the index so that the variable containing the passed sector is left unchanged. Cc: stable@kernel.org Signed-off-by: Andre Noll <maan@systemlinux.org> Signed-off-by: NeilBrown <neilb@suse.de>
2009-02-06md: Allow read error in a single drive raid1 to be passed up.NeilBrown
If a raid1 only has a single working device and gets a read error, we choose to simply return that error up to the filesystem (or whatever) rather than failing the whole array. However the codes doesn't quite do that. We attempt a readbalance which allocates the same drive, so we retry the read - indefinitely. Instead: If read_balance in the error case chooses the same drive that just failed, treat it as a failure and don't retry. Signed-off-by: NeilBrown <neilb@suse.de>
2009-02-05prevent kprobes from catching spurious page faultsMasami Hiramatsu
Prevent kprobes from catching spurious faults which will cause infinite recursive page-fault and memory corruption by stack overflow. Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com> Cc: <stable@kernel.org> [2.6.28.x] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05braino in sg_ioctl_trans()Al Viro
... and yes, gcc is insane enough to eat that without complaint. We probably want sparse to scream on those... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05Merge branch 'upstream-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2: Revert "configfs: Silence lockdep on mkdir(), rmdir() and configfs_depend_item()"
2009-02-05Merge branch 'sh/for-2.6.29' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.29' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: Fix up T-bit error handling in SH-4A mutex fastpath. sh: Fix up spurious syscall restarting. sh: fcnvds fix with denormalized numbers on SH-4 FPU. sh: Only reserve memory under CONFIG_ZERO_PAGE_OFFSET when it != 0. sh: Handle calling csum_partial with misaligned data sh: ap325rxa: Enable ov772x in defconfig. sh: ap325rxa: Add ov772x support. sh: ap325rxa: control camera power toggling. sh: mach-migor: Enable ov772x and tw9910 in defconfig.
2009-02-05Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: Revert "tcp: Always set urgent pointer if it's beyond snd_nxt" ipv6: Copy cork options in ip6_append_data udp: Fix UDP short packet false positive gianfar: Fix potential soft reset race gianfar: Fix BD_LENGTH_MASK definition cxgb3: Fix lro switch iwlwifi: save PCI state before suspend, restore after resume iwlwifi: clean key table in iwl_clear_stations_table
2009-02-05Revert "tcp: Always set urgent pointer if it's beyond snd_nxt"David S. Miller
This reverts commit 64ff3b938ec6782e6585a83d5459b98b0c3f6eb8. Jeff Chua reports that it breaks rlogin for him. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-05ipv6: Copy cork options in ip6_append_dataHerbert Xu
As the options passed to ip6_append_data may be ephemeral, we need to duplicate it for corking. This patch applies the simplest fix which is to memdup all the relevant bits. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-05Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-02-05udp: Fix UDP short packet false positiveJesper Dangaard Brouer
The UDP header pointer assignment must happen after calling pskb_may_pull(). As pskb_may_pull() can potentially alter the SKB buffer. This was exposted by running multicast traffic through the NIU driver, as it won't prepull the protocol headers into the linear area on receive. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-02-05seq_file: fix big-enough lseek() + read()Alexey Dobriyan
lseek() further than length of the file will leave stale ->index (second-to-last during iteration). Next seq_read() will not notice that ->f_pos is big enough to return 0, but will print last item as if ->f_pos is pointing to it. Introduced in commit cb510b8172602a66467f3551b4be1911f5a7c8c2 aka "seq_file: more atomicity in traverse()". Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05seq_file: move traverse so it can be used from seq_readEric Biederman
In 2.6.25 some /proc files were converted to use the seq_file infrastructure. But seq_files do not correctly support pread(), which broke some usersapce applications. To handle pread correctly we can't assume that f_pos is where we left it in seq_read. So move traverse() so that we can eventually use it in seq_read and do thus some day support pread(). Signed-off-by: Eric Biederman <ebiederm@xmission.com> Cc: Paul Turner <pjt@google.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05sgi-xp: fix writing past the end of kzalloc()'d spaceDean Nelson
A missing type cast results in writing way beyond the end of a kzalloc()'d memory segment resulting in slab corruption. But it seems like the better solution is to define ->recv_msg_slots as a 'void *' rather than a 'struct xpc_notify_mq_msg_uv *' and add the type cast. Signed-off-by: Dean Nelson <dcn@sgi.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05alpha: fixup BUG macroAlexey Dobriyan
Do usual do {} while (0) dance, otherwise fs/gfs2/util.c:99: error: expected expression before 'else' drivers/scsi/lpfc/lpfc_sli.c:363: error: expected expression before 'else' Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Acked-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05sx.c: fix missed unlock_kernel() on error path in sx_fw_ioctl()Dan Carpenter
If we return directly with -EPERM then lock_kernel() is still held. This was found with a code checker (http://repo.or.cz/w/smatch.git/). [akpm@linux-foundation.org: fix another such path - missed func_exit()] Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: <R.E.Wolff@BitWizard.nl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05atyfb: fix CONFIG_ namespace violationsRandy Dunlap
Fix namespace violations by changing non-kconfig CONFIG_ names to CNFG_*. Fixes breakage in staging/, which adds a real CONFIG_PANEL. Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05rtc-ds1390: fix compilation warnings in drivers/rtc/rtc-ds1390.cManish Katiyar
drivers/rtc/rtc-ds1390.c:125: warning: unused variable 'rtc' Signed-off-by: Manish Katiyar <mkatiyar@gmail.com> Signed-off-by: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05drivers/video/backlight: rename da903x to da903x_blMike Rapoport
Currently both da903x backlight and voltage reulator drivers have the same name. Rename the backlight driver to allow use of both drivers as modules. Signed-off-by: Mike Rapoport <mike@compulab.co.il> Acked-by: Eric Miao <eric.miao@marvell.com> Cc: Richard Purdie <rpurdie@rpsys.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05atmel-ssc: fix misuse of dev_dbg when requested ssc instance is not foundHans-Christian Egtvedt
The ssc pointer is not valid when the id is not found in the list. Convert the message from a debug one into an error message and avoid dereferencing the bad pointer. Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com> Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Huang Weiyi <weiyi.huang@gmail.com> Acked-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05do_wp_page: fix regression with execute in placeCarsten Otte
Fix do_wp_page for VM_MIXEDMAP mappings. In the case where pfn_valid returns 0 for a pfn at the beginning of do_wp_page and the mapping is not shared writable, the code branches to label `gotten:' with old_page == NULL. In case the vma is locked (vma->vm_flags & VM_LOCKED), lock_page, clear_page_mlock, and unlock_page try to access the old_page. This patch checks whether old_page is valid before it is dereferenced. The regression was introduced by "mlock: mlocked pages are unevictable" (commit b291f000393f5a0b679012b39d79fbc85c018233). Signed-off-by: Carsten Otte <cotte@de.ibm.com> Cc: Nick Piggin <npiggin@suse.de> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: <stable@kernel.org> [2.6.28.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-05wait: prevent exclusive waiter starvationJohannes Weiner
With exclusive waiters, every process woken up through the wait queue must ensure that the next waiter down the line is woken when it has finished. Interruptible waiters don't do that when aborting due to a signal. And if an aborting waiter is concurrently woken up through the waitqueue, noone will ever wake up the next waiter. This has been observed with __wait_on_bit_lock() used by lock_page_killable(): the first contender on the queue was aborting when the actual lock holder woke it up concurrently. The aborted contender didn't acquire the lock and therefor never did an unlock followed by waking up the next waiter. Add abort_exclusive_wait() which removes the process' wait descriptor from the waitqueue, iff still queued, or wakes up the next waiter otherwise. It does so under the waitqueue lock. Racing with a wake up means the aborting process is either already woken (removed from the queue) and will wake up the next waiter, or it will remove itself from the queue and the concurrent wake up will apply to the next waiter after it. Use abort_exclusive_wait() in __wait_event_interruptible_exclusive() and __wait_on_bit_lock() when they were interrupted by other means than a wake up through the queue. [akpm@linux-foundation.org: coding-style fixes] Reported-by: Chris Mason <chris.mason@oracle.com> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Mentored-by: Oleg Nesterov <oleg@redhat.com> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Matthew Wilcox <matthew@wil.cx> Cc: Chuck Lever <cel@citi.umich.edu> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Cc: Ingo Molnar <mingo@elte.hu> Cc: <stable@kernel.org> ["after some testing"] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit (git 2.34.1) at 2025-09-13 13:27:52 +0000