Commit Graph

26822 Commits

Author SHA1 Message Date
KaiGai Kohei
20a92fc74c Merge git://git.infradead.org/mtd-2.6 2006-05-19 00:43:53 +09:00
David Woodhouse
f6a673b3f4 [MTD] Fix printk format error in gen_probe.c
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 22:03:10 +01:00
David Woodhouse
fd0e518745 [MTD] Fix mtdconcat build. We didn't introduce mtd->writesize yet.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 21:53:58 +01:00
Alexander Belyakov
e8d32937d9 MTD: mtdconcat NAND/Sibley support (rev.2)
There is a second revision of "mtdconcat NAND/Sibley" patch. I hope
the patch will not get damaged as I'm posting it from gmail account,
thanks to Jorn.

The patch adds previously missing concat_writev(),
concat_writev_ecc(), concat_block_isbad(), concat_block_markbad()
functions to make concatenation layer compatible with Sibley and NAND
chips.

Patch has been cleared from whitespaces, fixed some lines of code as
requested. Also I have added code for alignment check that should
support Jorn's "writesize" patch.

Signed-off-by: Alexander Belyakov <alexander.belyakov@intel.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 16:31:31 +01:00
Martin Michlmayr
ceb31db11f LASAT depends on MTD_CFI
The following difference was found between the mainline and linux-mips
kernel.  LASAT depends on MTD_CFI.

Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 16:20:57 +01:00
Martin Michlmayr
be21ce1197 Re-add module description for ms02-nv to Kconfig
In an unrelated MTD commit, a description about the ms02-nv module
got removed from Kconfig.  While I personally agree with this
removal, the module maintainer (Maciej W. Rozycki) would like to
see it added back.  In the absense of any consistency regarding
Kconfig descriptions his wish should be followed.

Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Acked-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 16:20:37 +01:00
Sean Young
683b30c8e7 [MTD] RFD FTL: Be noisier, and don't assume block without RFD magic are erased
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 12:45:34 +01:00
Vitaly Wool
ae282d497d [MTD] generic: propagate oobavail to MTD partitions
'oobavail' parameter of mtd_info structure is now propagated to the MTD
partitions

Signed-off-by: Vitaly Wool <vwool@ru.mvista.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 12:34:27 +01:00
Sean Young
599fb3298b [PCMCIA MTD] Fix leak and crash on reboot
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 11:47:48 +01:00
Nicolas Pitre
c172471b78 cfi_cmdset_0001: factorize code to wait for flash status
This allows for much better abstraction and separation of the XIP and
non-XIP cases with their own specific implementations.  This fixes the
case where a timeout was tripped on in the XIP case by the code that
was meant for the non-XIP case only.

This also makes for a nice code reduction.

Signed-off-by: Nicolas Pitre <nico@cam.org>
CC: "Alexey, Korolev" <alexey.korolev@intel.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 01:25:37 +01:00
Nicolas Pitre
6e7a6809c5 cfi-cmdset-0001: always update the chip status
... otherwise xip_enable() won't do the right thing.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 01:22:23 +01:00
Josh Boyer
df54b52c41 CHIPS: Fix potential starvation in cfi_cmdset_0001
The patch below fixes a potential starvation issue that can arise when
there is contention on a chip during a period when a process is
currently writing to it.  The starvation is avoided by conditionally
rescheduling when the chip is left in a state usable by other processes.

Signed-off-by: Josh Boyer <jdub@us.ibm.com>
Signed-off-by: Tom Gall <tom_gall@vnet.ibm.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-17 01:11:17 +01:00
David Woodhouse
ba9627b85f [JFFS2] Repack some on-medium structures. ARM is weirder than I thought.
We have to pack at least the jint16_t structure, because otherwise it'll
be four bytes in size. Thankfully, we can do that and _not_ pack the
actual node structures, and the compiler still doesn't emit stupid code.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 23:03:08 +01:00
Sergei Shtylyov
35af68b53a NAND: Fix NAND ECC errors on AMD Au1550
On AMD Au1550 the static bus controller fails to keep -CE asserted during
chip ready delay on read commands and the NAND chip being used requires this.
So, the current driver allows nand_base.c to drive -CE manually during the
entire sector read. When the PCMCIA driver is enabled however, occasionally
the ECC errors occur on NAND reads. This happens because the PCMCIA driver
polls sockets periodically and reads one of the board's control/status regs
(BCSRs) which are on the same static bus as the NAND flash, and just use
another chip select (and the NOR flash also resides on that bus), so as the
NAND driver forces NAND chip select asserted and the -RE signal is shared, a
contention occurs on the static bus when BCSR or NOR flash is read while we're
reading from NAND.
    So, we either can't keep interrupts enabled during the whole NAND sector
read (which is hardly acceptable), or have to implement some interlocking
scheme between multiple drivers (which is painful, and makes me shudder :-).
    There's a third way which has proven to work: to force -CE asserted only
while we're waiting for a NAND chip to become ready after a read command,
disabling interrupts for a maximum of 25 microseconds (according to Toshiba
TC58DVM92A1FT00 datasheet -- this chip is mentioned in the board schematics);
for Samsung NAND chip which seems to be actually used this delay is even less,
12 us.

Signed-off-by: Konstantin Baydarov <kbaidarov@ru.mvista.com>
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 18:03:18 +01:00
Ben Dooks
b020bb7d3b [MTD] Fix build warnings in RedBoot MTD partition parser.
Fix build warnings from drivers/mtd/redboot.c due to
use of `unsigned long` in `struct fis_image_desc` for
fields being passed to swab32s() which expects __u32 *

Change the entries to uint32_t to make them compatible
with the swab32s() function

Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 17:31:15 +01:00
Sergei Shtylyov
155285c477 NAND: AMD Au1550 driver reads write-only register
During the last cleanup of the AMD Au1550 NAND driver the old buglet was
reintroduced: as the MEM_STNDCTL register is write-only and seem to always
read as 0x31, read-modify-write to it done in au1xxx_nand_init() will have the
side effect of enabling -RCS0/1 pin override (via bits 4/5 of this reg.), thus
possibly causing a contention on the static bus when the NOR flash (using
-RCS0) or board control status registers (using -RCS2) are read. Luckily, this
goes away with a first NAND access, since au1550_hwcontrol() doesn't try to
read this register before writing anymore.

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 17:25:19 +01:00
David Woodhouse
c41ff6e5f3 [JFFS2] Fix printk format in jffs2_sum_write_data() error message.
fs/jffs2/summary.c: In function ‘jffs2_sum_write_data’:
fs/jffs2/summary.c:658: warning: format ‘%zd’ expects type ‘signed size_t’, but argument 4 has type ‘uint32_t’

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 17:05:33 +01:00
David Brownell
7d2beb1359 [JFFS2] Fix section mismatch warnings in JFFS2.
Mark certain functions with __init and __exit appropriately.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 16:08:10 +01:00
David Woodhouse
cead4dbc03 [MTD NAND] Make various initfuncs static, remove #ifdef MODULE from exitfuncs
We all inherited the same error from the original NAND board driver which
got copied and changed. Fix them all at once...

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 13:54:50 +01:00
Adrian Bunk
ce589a0328 drivers/mtd/devices/docprobe.c: correct #if's
On Mon, May 15, 2006 at 12:56:37AM -0700, Andrew Morton wrote:
>...
> Changes since 2.6.17-rc3-mm1:
>...
>  git-mtd.patch
>...
>  git trees
>...

If we correct the names of the config options, the code might actually
work as intended...

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 13:12:12 +01:00
David Woodhouse
f41a5f804a [MTD] Add help text for MTD_NAND_CS553X option.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 13:11:47 +01:00
David Woodhouse
18594822fc Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-16 01:19:52 +01:00
Florin Malita
5b5ffbc1e6 [PATCH] jffs2: memory leak in jffs2_scan_medium()
If jffs2_scan_eraseblock() fails and the exit path is taken, 's' is not
being deallocated.

Reported by Coverity, CID: 1258.

Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
2006-05-15 23:42:31 +01:00
Andrew Morton
c4694c76ce [PATCH] dl2k needs dma-mapping.h
On alpha:

drivers/net/dl2k.c: In function `rio_free_tx':
drivers/net/dl2k.c:768: error: `DMA_48BIT_MASK' undeclared (first use in this function)
drivers/net/dl2k.c:768: error: (Each undeclared identifier is reported only once
drivers/net/dl2k.c:768: error: for each function it appears in.)
drivers/net/dl2k.c: In function `receive_packet':
drivers/net/dl2k.c:896: error: `DMA_48BIT_MASK' undeclared (first use in this function)
drivers/net/dl2k.c: In function `rio_close':
drivers/net/dl2k.c:1803: error: `DMA_48BIT_MASK' undeclared (first use in this function)

Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:58 -07:00
Andrew Morton
194a61b8e0 [PATCH] jffs2 warning fixes
fs/jffs2/nodelist.c: In function `check_node_data':
fs/jffs2/nodelist.c:441: warning: unsigned int format, different type arg (arg 4)
fs/jffs2/nodelist.c:464: warning: int format, different type arg (arg 5)

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:58 -07:00
Peter Osterlund
d3779e7989 [PATCH] devices.txt: remove pktcdvd entry
Changing the driver to use dynamic device numbers was one of the many
changes that were made in order to have the driver accepted into the
mainline kernel.  Therefore I would say that the entry in devices.txt is
obsolete.  This patch removes it.

Signed-off-by: Peter Osterlund <petero2@telia.com>
Cc: Torben Mathiasen <device@lanana.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:58 -07:00
Thomas Kleffel
264a341231 [PATCH] ide_cs: Add IBM microdrive to known IDs
Add the IBM microdrive to the known PCMCIA IDs for ide_cs.

Signed-off-by: Thomas Kleffel <tk@maintech.de>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:58 -07:00
Aneesh Kumar
79afecfaab [PATCH] Fix typos in Documentation/memory-barriers.txt
Fix some typos in Documentation/memory-barriers.txt

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:58 -07:00
Alexey Dobriyan
bfe2e9349f [PATCH] gigaset: endian fix
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Hansjoerg Lipp <hjlipp@web.de>
Cc: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Pavel Machek
b2d596d8e0 [PATCH] fix hotplug kconfig help
HOTPLUG_CPU entry says "Say Y..." then "Say N.".  Slightly ugly, so I fixed
it up, and added remark about suspend on SMP as a bonus.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Carl-Daniel Hailfinger
ce007ea597 [PATCH] smbus unhiding kills thermal management
Do not enable the SMBus device on Asus boards if suspend is used.  We do
not reenable the device on resume, leading to all sorts of undesirable
effects, the worst being a total fan failure after resume on Samsung P35
laptop.

Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Signed-off-by: Pavel Machek <pavel@suse.cz>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Andrew Morton
eee391a66d [PATCH] revert "vfs: propagate mnt_flags into do_loopback/vfsmount"
Revert commit f6422f17d3, due to

Valdis.Kletnieks@vt.edu wrote:
>
> There seems to have been a bug introduced in this changeset:
>
> Am running 2.6.17-rc3-mm1.  When this changeset is applied, 'mount --bind'
> misbehaves:
>
> > # mkdir /foo
> > # mount -t tmpfs -o rw,nosuid,nodev,noexec,noatime,nodiratime none /foo
> > # mkdir /foo/bar
> > # mount --bind /foo/bar /foo
> > # tail -2 /proc/mounts
> > none /foo tmpfs rw,nosuid,nodev,noexec,noatime,nodiratime 0 0
> > none /foo tmpfs rw 0 0
>
> Reverting this changeset causes both mounts to have the same options.
>
> (Thanks to Stephen Smalley for tracking down the changeset...)
>

Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: <Valdis.Kletnieks@vt.edu>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Andy Whitcroft
be6e028b64 [PATCH] root mount failure: emit filesystems attempted
When we fail to mount from a valid root device list out the filesystems we
have tried to mount it with.  This gives the user vital diagnostics as to
what is missing from their kernel.

For example in the fragment below the kernel does not have CRAMFS compiled
into the kernel and yet appears to recognise it at the RAMDISK detect
stage.  Later the mount fails as we don't have the filesystem.

  RAMDISK: cramfs filesystem found at block 0
  RAMDISK: Loading 1604KiB [1 disk] into ram disk... done.
  XFS: bad magic number
  XFS: SB validate failed
  No filesystem could mount root, tried: reiserfs ext3 ext2 msdos vfat
    iso9660 jfs xfs
  Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,1)

Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Alexey Dobriyan
3835a9bd07 [PATCH] fs/compat.c: fix 'if (a |= b )' typo
Mentioned by Mark Armbrust somewhere on Usenet.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Daniel Walker
bb53a76116 [PATCH] tpm_register_hardware gcc 4.1 warning fix
drivers/char/tpm/tpm.c: In function 'tpm_register_hardware':
drivers/char/tpm/tpm.c:1157: warning: assignment from incompatible pointer type

Signed-off-by: Daniel Walker <dwalker@mvista.com>
Acked-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Alan Cox
655fdeab80 [PATCH] Final rio polish
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Kylene Jo Hall
2a7362f52a [PATCH] tpm: fix constant
Fix the constant used for the base address when it cannot be determined
from ACPI.  It was off by one order of magnitude.

Signed-off-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:57 -07:00
Benjamin LaHaise
64471ebe53 [PATCH] Add Core Solo and Core Duo support to oprofile
Add support to oprofile for the Intel Core Solo and Core Duo processors.
See also the patch to add support to oprofile-0.9.1-8.1.1 at
http://www.kvack.org/~bcrl/patches/oprofile/oprofile-core-0.9.1.diff .

Signed-off-by: Benjamin LaHaise <benjamin.c.lahaise@intel.com>
Cc: Philippe Elie <phil.el@wanadoo.fr>
Cc: John Levon <levon@movementarian.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Hua Zhong
e6333fd4dd [PATCH] fix can_share_swap_page() when !CONFIG_SWAP
can_share_swap_page() is used to check if the page has the last reference.
This avoids allocating a new page for COW if it's the last page.

However, if CONFIG_SWAP is not set, can_share_swap_page() is defined as 0,
thus always causes a copy for the last COW page.  The below simple patch
fixes it.

Signed-off-by: Hua Zhong <hzhong@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Latchesar Ionkov
41e5a6ac80 [PATCH] v9fs: signal handling fixes
Multiple races can happen when v9fs is interrupted by a signal and Tflush
message is sent to the server.  After v9fs sends Tflush it doesn't wait
until it receives Rflush, and possibly the response of the original
message.  This behavior may confuse v9fs what fids are allocated by the
file server.

This patch fixes the races and the fid allocation.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@hera.kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Latchesar Ionkov
343f1fe6f2 [PATCH] v9fs: Twalk memory leak
v9fs leaks memory if the file server responds with Rerror to a Twalk
message.  The patch fixes the leak.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@hera.kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Richard Purdie
3dc7b82ea7 [PATCH] LED: Fix sysfs store function error handling
Fix the error handling of some LED _store functions.  This corrects them to
return -EINVAL if the value is not numeric with an optional byte of trailing
whitespace.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Richard Purdie
263de9b582 [PATCH] LED: Add maintainer entry for the LED subsystem
Add a MAINTAINERS entry for the LED subsystem.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Richard Purdie
68673afd44 [PATCH] Backlight/LCD Class: Fix sysfs _store error handling
The backlight and LCD class _store functions currently accept values like "34
some random strings" without error.  This corrects them to return -EINVAL if
the value is not numeric with an optional byte of trailing whitespace.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Richard Purdie
a8d2e7d952 [PATCH] LED: Improve Kconfig information
Improve the NEW_LEDS Kconfig information to say what it does as well as what
it doesn't.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Mike Kravetz
39d24e6426 [PATCH] add slab_is_available() routine for boot code
slab_is_available() indicates slab based allocators are available for use.
SPARSEMEM code needs to know this as it can be called at various times
during the boot process.

Signed-off-by: Mike Kravetz <kravetz@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Jan Niehusmann
48564e628b [PATCH] smbfs: Fix slab corruption in samba error path
Yesterday, I got the following error with 2.6.16.13 during a file copy from
a smb filesystem over a wireless link.  I guess there was some error on the
wireless link, which in turn caused an error condition for the smb
filesystem.

In the log, smb_file_read reports error=4294966784 (0xfffffe00), which also
shows up in the slab dumps, and also is -ERESTARTSYS.  Error code 27499
corresponds to 0x6b6b, so the rq_errno field seems to be the only one being
set after freeing the slab.

In smb_add_request (which is the only place in smbfs where I found
ERESTARTSYS), I found the following:

        if (!timeleft || signal_pending(current)) {
                /*
                 * On timeout or on interrupt we want to try and remove the
                 * request from the recvq/xmitq.
                 */
                smb_lock_server(server);
                if (!(req->rq_flags & SMB_REQ_RECEIVED)) {
                        list_del_init(&req->rq_queue);
                        smb_rput(req);
                }
                smb_unlock_server(server);
        }
	[...]
        if (signal_pending(current))
                req->rq_errno = -ERESTARTSYS;

I guess that some codepath like smbiod_flush() caused the request to be
removed from the queue, and smb_rput(req) be called, without
SMB_REQ_RECEIVED being set.  This violates an asumption made by the quoted
code.

Then, the above code calls smb_rput(req) again, the req gets freed, and
req->rq_errno = -ERESTARTSYS writes into the already freed slab.  As
list_del_init doesn't cause an error if called multiple times, that does
cause the observed behaviour (freed slab with rq_errno=-ERESTARTSYS).

If this observation is correct, the following patch should fix it.

I wonder why the smb code uses list_del_init everywhere - using list_del
instead would catch such situations by poisoning the next and prev
pointers.

May  4 23:29:21 knautsch kernel: [17180085.456000] ipw2200: Firmware error detected.  Restarting.
May  4 23:29:21 knautsch kernel: [17180085.456000] ipw2200: Sysfs 'error' log captured.
May  4 23:33:02 knautsch kernel: [17180306.316000] ipw2200: Firmware error detected.  Restarting.
May  4 23:33:02 knautsch kernel: [17180306.316000] ipw2200: Sysfs 'error' log already exists.
May  4 23:33:02 knautsch kernel: [17180306.968000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:34:18 knautsch kernel: [17180383.256000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:34:18 knautsch kernel: [17180383.284000] SMB connection re-established (-5)
May  4 23:37:19 knautsch kernel: [17180563.956000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:40:09 knautsch kernel: [17180733.636000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:40:26 knautsch kernel: [17180750.700000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:02 knautsch kernel: [17180907.304000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:08 knautsch kernel: [17180912.324000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:34 knautsch kernel: [17180938.416000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:43:34 knautsch kernel: [17180938.416000] Slab corruption: start=c4ebe09c, len=244
May  4 23:43:34 knautsch kernel: [17180938.416000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:43:34 knautsch kernel: [17180938.416000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:43:34 knautsch kernel: [17180938.416000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.416000] 0f0: 00 fe ff ff
May  4 23:43:34 knautsch kernel: [17180938.416000] Next obj: start=c4ebe19c, len=244
May  4 23:43:34 knautsch kernel: [17180938.416000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:43:34 knautsch kernel: [17180938.416000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:43:34 knautsch kernel: [17180938.416000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.416000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.460000] SMB connection re-established (-5)
May  4 23:43:42 knautsch kernel: [17180946.292000] ipw2200: Firmware error detected.  Restarting.
May  4 23:43:42 knautsch kernel: [17180946.292000] ipw2200: Sysfs 'error' log already exists.
May  4 23:45:04 knautsch kernel: [17181028.752000] ipw2200: Firmware error detected.  Restarting.
May  4 23:45:04 knautsch kernel: [17181028.752000] ipw2200: Sysfs 'error' log already exists.
May  4 23:45:05 knautsch kernel: [17181029.868000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:45:36 knautsch kernel: [17181060.984000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:45:36 knautsch kernel: [17181060.984000] Slab corruption: start=c4ebe09c, len=244
May  4 23:45:36 knautsch kernel: [17181060.984000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:45:36 knautsch kernel: [17181060.984000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:45:36 knautsch kernel: [17181060.984000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181060.984000] 0f0: 00 fe ff ff
May  4 23:45:36 knautsch kernel: [17181060.984000] Next obj: start=c4ebe19c, len=244
May  4 23:45:36 knautsch kernel: [17181060.984000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:45:36 knautsch kernel: [17181060.984000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:45:36 knautsch kernel: [17181060.984000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181060.984000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181061.024000] SMB connection re-established (-5)
May  4 23:46:17 knautsch kernel: [17181102.132000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:47:46 knautsch kernel: [17181190.468000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:47:46 knautsch kernel: [17181190.468000] Slab corruption: start=c4ebe09c, len=244
May  4 23:47:46 knautsch kernel: [17181190.468000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:47:46 knautsch kernel: [17181190.468000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:47:46 knautsch kernel: [17181190.468000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.468000] 0f0: 00 fe ff ff
May  4 23:47:46 knautsch kernel: [17181190.468000] Next obj: start=c4ebe19c, len=244
May  4 23:47:46 knautsch kernel: [17181190.468000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:47:46 knautsch kernel: [17181190.468000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:47:46 knautsch kernel: [17181190.468000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.468000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.492000] SMB connection re-established (-5)
May  4 23:49:20 knautsch kernel: [17181284.828000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:49:39 knautsch kernel: [17181303.896000] smb_file_read: //some_file validation failed, error=4294966784

Signed-off-by: Jan Niehusmann <jan@gondor.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:56 -07:00
Marcelo Tosatti
2e367a82fc [PATCH] Marcelo has moved
Signed-off-by: Marcelo Tosatti <marcelo@kvack.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:55 -07:00
Trent Piepho
5e37661389 [PATCH] symbol_put_addr() locks kernel
Even since a previous patch:

Fix race between CONFIG_DEBUG_SLABALLOC and modules
Sun, 27 Jun 2004 17:55:19 +0000 (17:55 +0000)
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/old-2.6-bkcvs.git;a=commit;h=92b3db26d31cf21b70e3c1eadc56c179506d8fbe

The function symbol_put_addr() will deadlock the kernel.

symbol_put_addr() would acquire modlist_lock, then while holding the lock call
two functions kernel_text_address() and module_text_address() which also try
to acquire the same lock.  This deadlocks the kernel of course.

This patch changes symbol_put_addr() to not acquire the modlist_lock, it
doesn't need it since it never looks at the module list directly.  Also, it
now uses core_kernel_text() instead of kernel_text_address().  The latter has
an additional check for addr inside a module, but we don't need to do that
since we call module_text_address() (the same function kernel_text_address
uses) ourselves.

Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Cc: Zwane Mwaikambo <zwane@fsmlabs.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:55 -07:00
Martin Schwidefsky
0159677857 [PATCH] s390: add vmsplice system call
Add new vmsplice system call and add missing __NR_xxx defines for
sys_set_robust_list, sys_get_robust_list, sys_splice, sys_sync_file_range
and sys_tee.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-15 11:20:55 -07:00