linux-toradex.git, branch v2.6.38.3

Linux 2.6.38.3

2011-04-14T20:03:56+00:00

nfsd4: fix oops on lock failure

2011-04-14T20:02:40+00:00

commit 23fcf2ec93fb8573a653408316af599939ff9a8e upstream.

Lock stateid's can have access_bmap 0 if they were only partially
initialized (due to a failed lock request); handle that case in
free_generic_stateid.

------------[ cut here ]------------
kernel BUG at fs/nfsd/nfs4state.c:380!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/kernel/mm/ksm/run
Modules linked in: nfs fscache md4 nls_utf8 cifs ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat bridge stp llc nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 ppdev parport_pc parport pcnet32 mii pcspkr microcode i2c_piix4 BusLogic floppy [last unloaded: mperf]

Pid: 1468, comm: nfsd Not tainted 2.6.38+ #120 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
EIP: 0060:[] EFLAGS: 00010297 CPU: 0
EIP is at nfs4_access_to_omode+0x1c/0x29 [nfsd]
EAX: ffffffff EBX: dd758120 ECX: 00000000 EDX: 00000004
ESI: dd758120 EDI: ddfe657c EBP: dd54dde0 ESP: dd54dde0
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process nfsd (pid: 1468, ti=dd54c000 task=ddc92580 task.ti=dd54c000)
Stack:
 dd54ddf0 e24f19ca 00000000 ddfe6560 dd54de08 e24f1a5d dd758130 deee3a20
 ddfe6560 31270000 dd54df1c e24f52fd 0000000f dd758090 e2505dd0 0be304cf
 dbb51d68 0000000e ddfe657c ddcd8020 dd758130 dd758128 dd7580d8 dd54de68
Call Trace:
 [] free_generic_stateid+0x1c/0x3e [nfsd]
 [] release_lockowner+0x71/0x8a [nfsd]
 [] nfsd4_lock+0x617/0x66c [nfsd]
 [] ? nfsd_setuser+0x199/0x1bb [nfsd]
 [] ? nfsd_setuser_and_check_port+0x65/0x81 [nfsd]
 [] ? _cond_resched+0x8/0x1c
 [] ? slab_pre_alloc_hook.clone.33+0x23/0x27
 [] ? kmem_cache_alloc+0x1a/0xd2
 [] ? __call_rcu+0xd7/0xdd
 [] ? fh_verify+0x401/0x452 [nfsd]
 [] ? nfsd4_encode_operation+0x52/0x117 [nfsd]
 [] ? nfsd4_putfh+0x33/0x3b [nfsd]
 [] ? nfsd4_delegreturn+0xd4/0xd4 [nfsd]
 [] nfsd4_proc_compound+0x1ea/0x33e [nfsd]
 [] nfsd_dispatch+0xd1/0x1a5 [nfsd]
 [] svc_process_common+0x282/0x46f [sunrpc]
 [] svc_process+0xdc/0xfa [sunrpc]
 [] nfsd+0xd6/0x115 [nfsd]
 [] ? nfsd_shutdown+0x24/0x24 [nfsd]
 [] kthread+0x62/0x67
 [] ? kthread_worker_fn+0x114/0x114
 [] kernel_thread_helper+0x6/0x10
Code: eb 05 b8 00 00 27 4f 8d 65 f4 5b 5e 5f 5d c3 83 e0 03 55 83 f8 02 89 e5 74 17 83 f8 03 74 05 48 75 09 eb 09 b8 02 00 00 00 eb 0b <0f> 0b 31 c0 eb 05 b8 01 00 00 00 5d c3 55 89 e5 57 56 89 d6 8d
EIP: [] nfs4_access_to_omode+0x1c/0x29 [nfsd] SS:ESP 0068:dd54dde0
---[ end trace 2b0bf6c6557cb284 ]---

The trace route is:

 -> nfsd4_lock()
   -> if (lock->lk_is_new) {
     -> alloc_init_lock_stateid()

        3739: stp->st_access_bmap = 0;

   ->if (status && lock->lk_is_new && lock_sop)
     -> release_lockowner()
      -> free_generic_stateid()
       -> nfs4_access_bmap_to_omode()
          -> nfs4_access_to_omode()

        380: BUG();   *****

This problem was introduced by 0997b173609b9229ece28941c118a2a9b278796e.

Reported-by: Mi Jinlong 
Tested-by: Mi Jinlong 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

nfsd: fix auth_domain reference leak on nlm operations

2011-04-14T20:02:40+00:00

commit 954032d2527f2fce7355ba70709b5e143d6b686f upstream.

This was noticed by users who performed more than 2^32 lock operations
and hence made this counter overflow (eventually leading to
use-after-free's).  Setting rq_client to NULL here means that it won't
later get auth_domain_put() when it should be.

Appears to have been introduced in 2.5.42 by "[PATCH] kNFSd: Move auth
domain lookup into svcauth" which moved most of the rq_client handling
to common svcauth code, but left behind this one line.

Cc: Neil Brown 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

ext4: fix credits computing for indirect mapped files

2011-04-14T20:02:40+00:00

commit 5b41395fcc0265fc9f193aef9df39ce49d64677c upstream.

When writing a contiguous set of blocks, two indirect blocks could be
needed depending on how the blocks are aligned, so we need to increase
the number of credits needed by one.

[ Also fixed a another bug which could further underestimate the
  number of journal credits needed by 1; the code was using integer
  division instead of DIV_ROUND_UP() -- tytso]

Signed-off-by: Yongqiang Yang 
Signed-off-by: "Theodore Ts'o" 
Signed-off-by: Greg Kroah-Hartman

ext4: fix a double free in ext4_register_li_request

2011-04-14T20:02:40+00:00

commit 46e4690bbd9a4f8d9e7c4f34e34b48f703ad47e0 upstream.

In ext4_register_li_request, we malloc a ext4_li_request and
inserts it into ext4_li_info->li_request_list. In case of any
error later, we free it in the end.  But if we have some error
in ext4_run_lazyinit_thread, the whole li_request_list will be
dropped and freed in it. So we will double free this ext4_li_request.

This patch just sets elr to NULL after it is inserted to the list
so that the latter kfree won't double free it.

Signed-off-by: Tao Ma 
Reviewed-by: Lukas Czerner 
Signed-off-by: "Theodore Ts'o" 
Signed-off-by: Greg Kroah-Hartman

atm/solos-pci: Don't flap VCs when carrier state changes

2011-04-14T20:02:39+00:00

commit c031235b395433350f25943b7580a5e343c7b7b2 upstream.

Don't flap VCs when carrier state changes; higher-level protocols
can detect loss of connectivity and act accordingly. This is more
consistent with how other network interfaces work.

We no longer use release_vccs() so we can delete it.

release_vccs() was duplicated from net/atm/common.c; make the
corresponding function exported, since other code duplicates it
and could leverage it if it were public.

Signed-off-by: Philip A. Prindeville 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump

2011-04-14T20:02:39+00:00

commit 18b429e74eeafe42e947b1b0f9a760c7153a0b5c upstream.

Omit pkt_hdr preamble when dumping transmitted packet as hex-dump;
we can pull this up because the frame has already been sent, and
dumping it is the last thing we do with it before freeing it.

Also include the size, vpi, and vci in the debug as is done on
receive.

Use "port" consistently instead of "device" intermittently.

Signed-off-by: Philip Prindeville 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Squashfs: handle corruption of directory structure

2011-04-14T20:02:39+00:00

commit 44cff8a9ee8a974f9e931df910688e7fc1f0b0f9 upstream.

Handle the rare case where a directory metadata block is uncompressed and
corrupted, leading to a kernel oops in directory scanning (memcpy).
Normally corruption is detected at the decompression stage and dealt with
then, however, this will not happen if:

- metadata isn't compressed (users can optionally request no metadata
  compression), or
- the compressed metadata block was larger than the original, in which
  case the uncompressed version was used, or
- the data was corrupt after decompression

This patch fixes this by adding some sanity checks against known maximum
values.

Signed-off-by: Phillip Lougher 
Signed-off-by: Greg Kroah-Hartman

Squashfs: Use vmalloc rather than kmalloc for zlib workspace

2011-04-14T20:02:38+00:00

commit 117a91e0f25fd7698e20ac3dfa62086be3dc82a3 upstream.

Bugzilla bug 31422 reports occasional "page allocation failure. order:4"
at Squashfs mount time.  Fix this by making zlib workspace allocation
use vmalloc rather than kmalloc.

Reported-by: Mehmet Giritli 
Signed-off-by: Phillip Lougher 
Signed-off-by: Greg Kroah-Hartman

Revert "x86: Cleanup highmap after brk is concluded"

2011-04-14T20:02:38+00:00

This reverts upstream commit e5f15b45ddf3afa2bbbb10c7ea34fb32b6de0a0e

It caused problems in the stable tree and should not have been there.

Cc: Yinghai Lu 
Cc: Stefano Stabellini 
Cc: H. Peter Anvin 
Cc: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman