summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2011-01-11hwmon: nct1008: delete driver codeVarun Wadekar
nct1008 driver will now reside in drivers/misc Bug 742230 Change-Id: I774c920cf96ded96ae440a99935f6cb9f1f63323 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Reviewed-on: http://git-master/r/15496 Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2011-01-10[tegra alsa] Add routing supportSumit Bhattacharya
Add three alsa controls to expose selection of playback device, capture device and call mode.Alsa kernel will route pcm data to the selected output/input port. bug 771510 Change-Id: Ibdeebbd799b2ae36046a77327ec8b6a3b01553a9 Reviewed-on: http://git-master/r/14729 Tested-by: Sumit Bhattacharya <sumitb@nvidia.com> Reviewed-by: Sachin Nikam <snikam@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2011-01-10merging android-tegra-2.6.36 into git-master/linux-2.6/android-tegra-2.6.36Nitin Kumbhar
Conflicts: arch/arm/mach-tegra/fuse.c drivers/misc/Makefile Change-Id: I300b925d78b31efe00c342190d8dbd50e2e81230
2011-01-08Merge branch 'linux-tegra-2.6.36' into android-tegra-2.6.36Colin Cross
Conflicts: drivers/misc/Kconfig drivers/misc/Makefile Change-Id: I826244513f799fdd2fb0269abad3271c96661293
2011-01-07NCT1008 temperature sensor driverTodd Poynor
Replace the PM-only driver for NCT1008 with a new version written by Varun Wadekar and Dmitriy Gruzman. Add a callback to an alarm function specified in the board platform data. Change-Id: Ib429533930ee75af3402d24b0bc286da9f6ee67b Signed-off-by: Todd Poynor <toddpoynor@google.com>
2011-01-07misc: Initial NCT1008 driverGreg Meiste
Initial version of the NCT1008 driver to turn off the sensor when the device is suspended. This improves standby current drain. Change-Id: Ia64613c33c0052434d5e304c434605611e5ef789 Signed-off-by: Greg Meiste <w30289@motorola.com>
2011-01-07Merge branch 'linux-tegra-2.6.36' into android-tegra-2.6.36Colin Cross
Conflicts: arch/arm/mm/cache-v6.S Change-Id: I1a2063218dd705a762a40f4a9dfe504ce1a1d491
2011-01-07Merge branch 'android-2.6.36' into android-tegra-2.6.36Colin Cross
2011-01-07Merge commit 'v2.6.36.3' into linux-tegra-2.6.36Colin Cross
2011-01-07input: keyreset: Allow reset function to be overridenColin Cross
Change-Id: Ibb3dda05772b2e89d7b2646689944d309cb1f74e Signed-off-by: Colin Cross <ccross@android.com>
2011-01-07Don't export format_by_forcc on two different driversMauro Carvalho Chehab
commit a757ee2216211278680dd8ac869aabe7b4a9970d upstream. Drivers should append their name on exported symbols, to avoid conflicts with allyesconfig: drivers/staging/built-in.o: In function `format_by_fourcc': /home/v4l/work_trees/linus/drivers/staging/cx25821/cx25821-video.c:96: multiple definition of `format_by_fourcc' drivers/media/built-in.o:/home/v4l/work_trees/linus/drivers/media/common/saa7146_video.c:88: first defined here Let's rename both occurences with a small shellscript: for i in drivers/staging/cx25821/*.[ch]; do sed s,format_by_fourcc,cx25821_format_by_fourcc,g <$i >a && mv a $i; done for i in drivers/media/common/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done for i in include/media/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits insteadMartin K. Petersen
commit e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 upstream. When stacking devices, a request_queue is not always available. This forced us to have a no_cluster flag in the queue_limits that could be used as a carrier until the request_queue had been set up for a metadevice. There were several problems with that approach. First of all it was up to the stacking device to remember to set queue flag after stacking had completed. Also, the queue flag and the queue limits had to be kept in sync at all times. We got that wrong, which could lead to us issuing commands that went beyond the max scatterlist limit set by the driver. The proper fix is to avoid having two flags for tracking the same thing. We deprecate QUEUE_FLAG_CLUSTER and use the queue limit directly in the block layer merging functions. The queue_limit 'no_cluster' is turned into 'cluster' to avoid double negatives and to ease stacking. Clustering defaults to being enabled as before. The queue flag logic is removed from the stacking function, and explicitly setting the cluster flag is no longer necessary in DM and MD. Reported-by: Ed Lin <ed.lin@promise.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Acked-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07PM / Runtime: Fix pm_runtime_suspended()Rafael J. Wysocki
commit f08f5a0add20834d3f3d876dfe08005a5df656db upstream. There are some situations (e.g. in __pm_generic_call()), where pm_runtime_suspended() is used to decide whether or not to execute a device's (system) ->suspend() callback. The callback is not executed if pm_runtime_suspended() returns true, but it does so for devices that don't even support runtime PM, because the power.disable_depth device field is ignored by it. This leads to problems (i.e. devices are not suspened when they should), so rework pm_runtime_suspended() so that it returns false if the device's power.disable_depth field is different from zero. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07sched: Cure more NO_HZ load average woesPeter Zijlstra
commit 0f004f5a696a9434b7214d0d3cbd0525ee77d428 upstream. There's a long-running regression that proved difficult to fix and which is hitting certain people and is rather annoying in its effects. Damien reported that after 74f5187ac8 (sched: Cure load average vs NO_HZ woes) his load average is unnaturally high, he also noted that even with that patch reverted the load avgerage numbers are not correct. The problem is that the previous patch only solved half the NO_HZ problem, it addressed the part of going into NO_HZ mode, not of comming out of NO_HZ mode. This patch implements that missing half. When comming out of NO_HZ mode there are two important things to take care of: - Folding the pending idle delta into the global active count. - Correctly aging the averages for the idle-duration. So with this patch the NO_HZ interaction should be complete and behaviour between CONFIG_NO_HZ=[yn] should be equivalent. Furthermore, this patch slightly changes the load average computation by adding a rounding term to the fixed point multiplication. Reported-by: Damien Wyart <damien.wyart@free.fr> Reported-by: Tim McGrath <tmhikaru@gmail.com> Tested-by: Damien Wyart <damien.wyart@free.fr> Tested-by: Orion Poplawski <orion@cora.nwra.com> Tested-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Chase Douglas <chase.douglas@canonical.com> LKML-Reference: <1291129145.32004.874.camel@laptop> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07xen: Provide a variant of __RING_SIZE() that is an integer constant expressionJeremy Fitzhardinge
commit 667c78afaec0ac500908e191e8f236e9578d7b1f upstream. Without this, gcc 4.5 won't compile xen-netfront and xen-blkfront, where this is being used to specify array sizes. Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: David Miller <davem@davemloft.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07filter: fix sk_filter rcu handlingEric Dumazet
[ Upstream commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 ] Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and sk_clone() in commit 47e958eac280c263397 Problem is we can have several clones sharing a common sk_filter, and these clones might want to sk_filter_attach() their own filters at the same time, and can overwrite old_filter->rcu, corrupting RCU queues. We can not use filter->rcu without being sure no other thread could do the same thing. Switch code to a more conventional ref-counting technique : Do the atomic decrement immediately and queue one rcu call back when last reference is released. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07af_unix: limit recursion levelEric Dumazet
[ Upstream commit 25888e30319f8896fc656fc68643e6a078263060 ] Its easy to eat all kernel memory and trigger NMI watchdog, using an exploit program that queues unix sockets on top of others. lkml ref : http://lkml.org/lkml/2010/11/25/8 This mechanism is used in applications, one choice we have is to have a recursion limit. Other limits might be needed as well (if we queue other types of files), since the passfd mechanism is currently limited by socket receive queue sizes only. Add a recursion_level to unix socket, allowing up to 4 levels. Each time we send an unix socket through sendfd mechanism, we copy its recursion level (plus one) to receiver. This recursion level is cleared when socket receive queue is emptied. Reported-by: Марк Коренберг <socketpair@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07bootmem: Add alloc_bootmem_align()Suresh Siddha
commit 53dde5f385bc56e312f78b7cb25ffaf8efd4735d upstream. Add an alloc_bootmem_align() interface to allocate bootmem with specified alignment. This is necessary to be able to allocate the xsave area in a subsequent patch. Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com> LKML-Reference: <20101116212441.977574826@sbsiddha-MOBL3.sc.intel.com> Acked-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07ASoC: Fix off by one error in WM8994 EQ register bank sizeUk Kim
commit 3fcc0afbb9c93f3599ba03273e59915670b6c2c2 upstream. Signed-off-by: Uk Kim <w0806.kim@samsung.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-05[ARM] tegra: hdmi nvhdcp driverJon Mayo
Device /dev/nvhdcpX is used to manage NVHDCP on framebuffer /dev/fbX. These devices are created on hdmi driver initialition when it is attached to dc. An ioctl interface is in video/nvhdcp.h Hooks into edid.c and hdmi.c were added to take control of I2C bus. use TEGRA_DC_OUT_NVHDCP_POLICY_ON_DEMAND in tegra_dc_out.flags in board panel configuration to select a different default policy at probe. Change-Id: I0db66fc86096b98d2604544061721d291523de75 Reviewed-on: http://git-master/r/14466 Reviewed-by: Jonathan Mayo <jmayo@nvidia.com> Tested-by: Jonathan Mayo <jmayo@nvidia.com> Reviewed-by: Phillip Smith <psmith@nvidia.com> Reviewed-by: Yu-Huan Hsu <yhsu@nvidia.com>
2011-01-05tegra: otg: Don't use global functions in board filesDan Willemsen
Releasing the platform_data in unregister. Change-Id: Iba1c6e7ad42b0886f8ce9dadf9664bcc266398d4 Reviewed-on: http://git-master/r/14963 Reviewed-by: Sachin Nikam <snikam@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
2011-01-03HDMI stereo support - kernel code changeschzhang
Signed-off-by: Chong Zhang <chzhang@nvidia.com> Change-Id: I53eea3b14852aecd589dfbd0461258e064835cc9 Reviewed-on: http://git-master/r/11405 Reviewed-by: Daniel Willemsen <dwillemsen@nvidia.com>
2010-12-28[ARM] tegra: gpio based scrollwheel driverSachin Nikam
Reports Scroll keys: - Press - Scrollup - Scrolldown Change-Id: I47f6ca3d7b5bed4aa7441634850881df7066fce7 Reviewed-on: http://git-master/r/13618 Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-24hwmon: nct1008: platform data to set offset registerVarun Wadekar
Bug 769337 Change-Id: I61b958bbb33e548aa975844bf67e9e18ed640668 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Reviewed-on: http://git-master/r/14224 Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-23merging android-tegra-2.6.36 into git-master/linux-2.6/android-tegra-2.6.36Nitin Kumbhar
Conflicts: arch/arm/mach-tegra/board-ventana-power.c drivers/mfd/tps6586x.c Change-Id: Ic8c46d4251d6e71fa2900b7e876f87e256299bc4
2010-12-23Revert "Revert "sched: Add a generic notifier when a task struct is about to ↵Nitin Kumbhar
be freed"" This reverts commit d534322cb6066ae0db4790ceacba3e1a95b1ee7c.
2010-12-21Merge branch 'linux-tegra-2.6.36' into android-tegra-2.6.36Colin Cross
Conflicts: drivers/usb/gadget/composite.c Change-Id: I1a332ec21da62aea98912df9a01cf0282ed50ee1
2010-12-21Merge commit 'v2.6.36.2' into linux-tegra-2.6.36Colin Cross
2010-12-17Merge branch 'android-2.6.36' into android-tegra-2.6.36Colin Cross
2010-12-17cgroup: Remove call to synchronize_rcu in cgroup_attach_taskColin Cross
synchronize_rcu can be very expensive, averaging 100 ms in some cases. In cgroup_attach_task, it is used to prevent a task->cgroups pointer dereferenced in an RCU read side critical section from being invalidated, by delaying the call to put_css_set until after an RCU grace period. To avoid the call to synchronize_rcu, make the put_css_set call rcu-safe by moving the deletion of the css_set links into free_css_set_work, scheduled by the rcu callback free_css_set_rcu. The decrement of the cgroup refcount is no longer synchronous with the call to put_css_set, which can result in the cgroup refcount staying positive after the last call to cgroup_attach_task returns. To allow the cgroup to be deleted with cgroup_rmdir synchronously after cgroup_attach_task, have rmdir check the refcount of all associated css_sets. If cgroup_rmdir is called on a cgroup for which the css_sets all have refcount zero but the cgroup refcount is nonzero, reuse the rmdir waitqueue to block the rmdir until free_css_set_work is called. Signed-off-by: Colin Cross <ccross@android.com>
2010-12-17cgroup: Set CGRP_RELEASABLE when adding to a cgroupColin Cross
Changes the meaning of CGRP_RELEASABLE to be set on any cgroup that has ever had a task or cgroup in it, or had css_get called on it. The bit is set in cgroup_attach_task, cgroup_create, and __css_get. It is not necessary to set the bit in cgroup_fork, as the task is either in the root cgroup, in which can never be released, or the task it was forked from already set the bit in croup_attach_task. Signed-off-by: Colin Cross <ccross@android.com>
2010-12-17USB: ehci: tegra: Align DMA transfers to 32 bytesRobert Morell
The Tegra2 USB controller doesn't properly deal with misaligned DMA buffers, causing corruption. This is especially prevalent with USB network adapters, where skbuff alignment is often in the middle of a 4-byte dword. To avoid this, allocate a temporary buffer for the DMA if the provided buffer isn't sufficiently aligned. Change-Id: Ica56c52c3b2152e3ba2b96506cf15105462a0602 Signed-off-by: Robert Morell <rmorell@nvidia.com> Reviewed-on: http://git-master/r/13382 Reviewed-by: Scott Williams <scwilliams@nvidia.com> Reviewed-by: Janne Hellsten <jhellsten@nvidia.com>
2010-12-17mfd: tps6586x: add api to power off tps6586xNitin Kumbhar
when tps6586x is put into sleep mode, it powers off ldos. Add an api to put tps6586x in sleep mode by resetting EXITSLREQ and setting SLEEP_MODE in SUPPLYENE register. Change-Id: I80fe35d541e85014bd7b5544d212573fe35d67e5 Reviewed-on: http://git-master/r/13589 Tested-by: Nitin Kumbhar <nkumbhar@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-16Regulators: Add max8907c and max8952Jin Park
Add max8907c regulator and mfd driver. Add max8952 regulator driver. Change-Id: If63b724647d887a8088da0f2deb8af91e4fe3cfa Signed-off-by: Jin Park <jinyoungp@nvidia.com> Reviewed-on: http://git-master/r/9902 Reviewed-by: Thomas Cherry <tcherry@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-16USB: Add driver hooks for (un)?map_urb_for_dmaRobert Morell
These are useful in case your device has quirks involving what memory is and is not DMAable. Signed-off-by: Robert Morell <rmorell@nvidia.com> Change-Id: I60b48ef8efd9f7f78eaba70d708d25b231f23d82 Reviewed-on: http://git-master/r/13381 Reviewed-by: Scott Williams <scwilliams@nvidia.com> Reviewed-by: Janne Hellsten <jhellsten@nvidia.com>
2010-12-15merging android-tegra-2.6.36 into git-master/linux-2.6/android-tegra-2.6.36Nitin Kumbhar
Change-Id: I84ac6254ede2e88e8141e6ffd630eb753d9b1d91
2010-12-14[misc] cancel executable permission on source filesChao Jiang
Source files should not be with executable permission. Change-Id: I70b6be4cf88fea4be9b092ca2f5dd08e40ee7cbd Reviewed-on: http://git-master/r/12081 Reviewed-by: Chao Jiang <chaoj@nvidia.com> Tested-by: Chao Jiang <chaoj@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-14Merge remote branch android-2.6.36 into android-tegra-2.6.36Erik Gilling
Change-Id: Ice30bc601132f829abd664c68ddc61cbcdb8668c
2010-12-14USB: gadget: composite: Use separate switches for connected and config stateMike Lockwood
Also remove disconnect debouncing, which didn't actually work on some platforms Signed-off-by: Mike Lockwood <lockwood@android.com>
2010-12-13[ARM/tegra] Touchscreen : Added Atmel Max-Touch driverRobert Collins
Change-Id: I87de64e2c1a87c8e4da89489b4c5c18860abb0f6 Reviewed-on: http://git-master/r/11491 Reviewed-by: Robert R Collins <rcollins@nvidia.com> Tested-by: Robert R Collins <rcollins@nvidia.com> Reviewed-by: Maria Gutowski <mgutowski@nvidia.com>
2010-12-10[ARM/tegra] Integrate Accelerometer source code files.Robert Collins
Inegrate MPL libraries and the following sensors: Accelerometers: kxtf9 Compi: ak8975 Change-Id: I450b5b7ff018249a19bb23b78e722e9a355b7bd8 Reviewed-on: http://git-master/r/11803 Tested-by: Robert R Collins <rcollins@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
2010-12-10merging android-tegra-2.6.36 into git-master/linux-2.6/android-tegra-2.6.36Nitin Kumbhar
Change-Id: I1312ec33ba8bac38dc395d7d1a2f485b13d74c14
2010-12-09Un-inline get_pipe_info() helper functionLinus Torvalds
commit 72083646528d4887b920deb71b37e09bc7d227bb upstream. This avoids some include-file hell, and the function isn't really important enough to be inlined anyway. Reported-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09Export 'get_pipe_info()' to other usersLinus Torvalds
commit c66fb347946ebdd5b10908866ecc9fa05ee2cf3d upstream. And in particular, use it in 'pipe_fcntl()'. The other pipe functions do not need to use the 'careful' version, since they are only ever called for things that are already known to be pipes. The normal read/write/ioctl functions are called through the file operations structures, so if a file isn't a pipe, they'd never get called. But pipe_fcntl() is special, and called directly from the generic fcntl code, and needs to use the same careful function that the splice code is using. Cc: Jens Axboe <jaxboe@fusionio.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Dave Jones <davej@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09net: Limit socket I/O iovec total length to INT_MAX.David S. Miller
commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream. This helps protect us from overflow issues down in the individual protocol sendmsg/recvmsg handlers. Once we hit INT_MAX we truncate out the rest of the iovec by setting the iov_len members to zero. This works because: 1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial writes are allowed and the application will just continue with another write to send the rest of the data. 2) For datagram oriented sockets, where there must be a one-to-one correspondance between write() calls and packets on the wire, INT_MAX is going to be far larger than the packet size limit the protocol is going to check for and signal with -EMSGSIZE. Based upon a patch by Linus Torvalds. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09PM / Hibernate: Fix memory corruption related to swapRafael J. Wysocki
commit c9e664f1fdf34aa8cede047b206deaa8f1945af0 upstream. There is a problem that swap pages allocated before the creation of a hibernation image can be released and used for storing the contents of different memory pages while the image is being saved. Since the kernel stored in the image doesn't know of that, it causes memory corruption to occur after resume from hibernation, especially on systems with relatively small RAM that need to swap often. This issue can be addressed by keeping the GFP_IOFS bits clear in gfp_allowed_mask during the entire hibernation, including the saving of the image, until the system is finally turned off or the hibernation is aborted. Unfortunately, for this purpose it's necessary to rework the way in which the hibernate and suspend code manipulates gfp_allowed_mask. This change is based on an earlier patch from Hugh Dickins. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Reported-by: Ondrej Zary <linux@rainbow-software.org> Acked-by: Hugh Dickins <hughd@google.com> Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09perf: Fix inherit vs. context rotation bugThomas Gleixner
commit dddd3379a619a4cb8247bfd3c94ca9ae3797aa2e upstream. It was found that sometimes children of tasks with inherited events had one extra event. Eventually it turned out to be due to the list rotation no being exclusive with the list iteration in the inheritance code. Cure this by temporarily disabling the rotation while we inherit the events. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> LKML-Reference: <new-submission> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09exec: copy-and-paste the fixes into compat_do_execve() pathsOleg Nesterov
commit 114279be2120a916e8a04feeb2ac976a10016f2f upstream. Note: this patch targets 2.6.37 and tries to be as simple as possible. That is why it adds more copy-and-paste horror into fs/compat.c and uglifies fs/exec.c, this will be cleanuped later. compat_copy_strings() plays with bprm->vma/mm directly and thus has two problems: it lacks the RLIMIT_STACK check and argv/envp memory is not visible to oom killer. Export acct_arg_size() and get_arg_page(), change compat_copy_strings() to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0) as do_execve() does. Add the fatal_signal_pending/cond_resched checks into compat_count() and compat_copy_strings(), this matches the code in fs/exec.c and certainly makes sense. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09exec: make argv/envp memory visible to oom-killerOleg Nesterov
commit 3c77f845722158206a7209c45ccddc264d19319c upstream. Brad Spengler published a local memory-allocation DoS that evades the OOM-killer (though not the virtual memory RLIMIT): http://www.grsecurity.net/~spender/64bit_dos.c execve()->copy_strings() can allocate a lot of memory, but this is not visible to oom-killer, nobody can see the nascent bprm->mm and take it into account. With this patch get_arg_page() increments current's MM_ANONPAGES counter every time we allocate the new page for argv/envp. When do_execve() succeds or fails, we change this counter back. Technically this is not 100% correct, we can't know if the new page is swapped out and turn MM_ANONPAGES into MM_SWAPENTS, but I don't think this really matters and everything becomes correct once exec changes ->mm or fails. Reported-by: Brad Spengler <spender@grsecurity.net> Reviewed-and-discussed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09radix-tree: fix RCU bugNick Piggin
commit 27d20fddc8af539464fc3ba499d6a830054c3bd6 upstream. Salman Qazi describes the following radix-tree bug: In the following case, we get can get a deadlock: 0. The radix tree contains two items, one has the index 0. 1. The reader (in this case find_get_pages) takes the rcu_read_lock. 2. The reader acquires slot(s) for item(s) including the index 0 item. 3. The non-zero index item is deleted, and as a consequence the other item is moved to the root of the tree. The place where it used to be is queued for deletion after the readers finish. 3b. The zero item is deleted, removing it from the direct slot, it remains in the rcu-delayed indirect node. 4. The reader looks at the index 0 slot, and finds that the page has 0 ref count 5. The reader looks at it again, hoping that the item will either be freed or the ref count will increase. This never happens, as the slot it is looking at will never be updated. Also, this slot can never be reclaimed because the reader is holding rcu_read_lock and is in an infinite loop. The fix is to re-use the same "indirect" pointer case that requires a slot lookup retry into a general "retry the lookup" bit. Signed-off-by: Nick Piggin <npiggin@kernel.dk> Reported-by: Salman Qazi <sqazi@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-11 18:19:53 +0000