linux-toradex.git/fs, branch v2.6.20.2

gfs2: fix locking mistake

2007-03-09T18:50:32+00:00

Fix a locking mistake in the quota code, we do a mutex_lock instead of a
mutex_unlock.

Signed-off-by: Josef Whiter 
Cc: Steven Whitehouse 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

buffer: memorder fix

2007-03-09T18:50:30+00:00

unlock_buffer(), like unlock_page(), must not clear the lock without
ensuring that the critical section is closed.


Mingming later sent the same patch, saying:

We are running SDET benchmark and saw double free issue for ext3 extended
attributes block, which complains the same xattr block already being freed (in
ext3_xattr_release_block()).  The problem could also been triggered by
multiple threads loop untar/rm a kernel tree.

The race is caused by missing a memory barrier at unlock_buffer() before the
lock bit being cleared, resulting in possible concurrent h_refcounter update. 
That causes a reference counter leak, then later leads to the double free that
we have seen.

Inside unlock_buffer(), there is a memory barrier is placed *after* the lock
bit is being cleared, however, there is no memory barrier *before* the bit is
cleared.  On some arch the h_refcount update instruction and the clear bit
instruction could be reordered, thus leave the critical section re-entered.

The race is like this: For example, if the h_refcount is initialized as 1,

cpu 0:                                   cpu1

hugetlb: preserve hugetlb pte dirty state

2007-03-09T18:50:30+00:00

__unmap_hugepage_range() is buggy that it does not preserve dirty state of
huge_pte when unmapping hugepage range.  It causes data corruption in the
event of dop_caches being used by sys admin.  For example, an application
creates a hugetlb file, modify pages, then unmap it.  While leaving the
hugetlb file alive, comes along sys admin doing a "echo 3 >
/proc/sys/vm/drop_caches".

drop_pagecache_sb() will happily free all pages that aren't marked dirty if
there are no active mapping.  Later when application remaps the hugetlb
file back and all data are gone, triggering catastrophic flip over on
application.

Not only that, the internal resv_huge_pages count will also get all messed
up.  Fix it up by marking page dirty appropriately.

Signed-off-by: Ken Chen 
Cc: "Nish Aravamudan" 
Cc: Adam Litke 
Cc: David Gibson 
Acked-by: William Irwin 
Cc: Hugh Dickins 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

v9fs_vfs_mkdir(): fix a double free

2007-03-09T18:50:29+00:00

Fix a double free of "dfid" introduced by commit
da977b2c7eb4d6312f063a7b486f2aad99809710 and spotted by the Coverity
checker.

Signed-off-by: Adrian Bunk 
Cc: Eric Van Hensbergen 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

ufs: restore back support of openstep

2007-03-09T18:50:29+00:00

This is a fix of regression, which triggered by ~2.6.16.

Patch with name ufs-directory-and-page-cache-from-blocks-to-pages.patch: in
additional to conversation from block to page cache mechanism added new
checks of directory integrity, one of them that directory entry do not
across directory chunks.

But some kinds of UFS: OpenStep UFS and Apple UFS (looks like these are the
same filesystems) have different directory chunk size, then common
UFSes(BSD and Solaris UFS).

So this patch adds ability to works with variable size of directory chunks,
and set it for ufstype=openstep to right size.

Tested on darwin ufs.

Signed-off-by: Evgeniy Dushistov 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

NLM: Fix double free in __nlm_async_call

2007-03-09T18:50:29+00:00

rpc_call_async() will always call rpc_release_calldata(), so it is an
error for __nlm_async_call() to do so as well.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=7923

Signed-off-by: Trond Myklebust 
Cc: Jan "Yenya" Kasprzak 
Cc: Neil Brown 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

fix umask when noACL kernel meets extN tuned for ACLs

2007-03-09T18:50:24+00:00

Fix insecure default behaviour reported by Tigran Aivazian: if an ext2
or ext3 or ext4 filesystem is tuned to mount with "acl", but mounted by
a kernel built without ACL support, then umask was ignored when creating
inodes - though root or user has umask 022, touch creates files as 0666,
and mkdir creates directories as 0777.

This appears to have worked right until 2.6.11, when a fix to the default
mode on symlinks (always 0777) assumed VFS applies umask: which it does,
unless the mount is marked for ACLs; but ext[234] set MS_POSIXACL in
s_flags according to s_mount_opt set according to def_mount_opts.

We could revert to the 2.6.10 ext[234]_init_acl (adding an S_ISLNK test);
but other filesystems only set MS_POSIXACL when ACLs are configured.  We
could fix this at another level; but it seems most robust to avoid setting
the s_mount_opt flag in the first place (at the expense of more ifdefs).

Likewise don't set the XATTR_USER flag when built without XATTR support.

Signed-off-by: Hugh Dickins 
Acked-by: Andreas Gruenbacher 
Cc: Tigran Aivazian 
Signed-off-by: Greg Kroah-Hartman

x86: Don't require the vDSO for handling a.out signals

2007-03-09T18:50:22+00:00

x86: Don't require the vDSO for handling a.out signals

and in other strange binfmts. vDSO is not necessarily mapped there.

This fixes signals in a.out programs

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

ocfs2: ocfs2_link() journal credits update

2007-03-09T18:50:16+00:00

Commit 592282cf2eaa33409c6511ddd3f3ecaa57daeaaa fixed some missing directory
c/mtime updates in part by introducing a dinode update in ocfs2_add_entry().
Unfortunately, ocfs2_link() (which didn't update the directory inode before)
is now missing a single journal credit. Fix this by doubling the number of
inode updates expected during hard link creation.

Signed-off-by: Mark Fasheh 
Signed-off-by: Chris Wright

[PATCH] Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)

2007-02-20T06:33:33+00:00

Due to type confusion, when an nfsacl verison 2 'ACCESS' request
finishes and tries to clean up, it calls fh_put on entiredly the
wrong thing and this can cause an oops.

Signed-off-by: Neil Brown 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman