linux-toradex.git/fs, branch v2.6.22.6

signalfd: make it group-wide, fix posix-timers scheduling

2007-08-31T06:01:01+00:00

With this patch any thread can dequeue its own private signals via signalfd,
even if it was created by another sub-thread.

To do so, we pass "current" to dequeue_signal() if the caller is from the same
thread group. This also fixes the scheduling of posix timers broken by the
previous patch.

If the caller doesn't belong to this thread group, we can't handle __SI_TIMER
case properly anyway. Perhaps we should forbid the cross-process signalfd usage
and convert ctx->tsk to ctx->sighand.

Signed-off-by: Oleg Nesterov 
Cc: Benjamin Herrenschmidt 
Cc: Davide Libenzi 
Cc: Ingo Molnar 
Cc: Michael Kerrisk 
Cc: Roland McGrath 
Cc: Thomas Gleixner 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

ocfs2: Fix bad source start calculation during kernel writes

2007-08-31T06:01:00+00:00

[PATCH] ocfs2: Fix bad source start calculation during kernel writes

For in-kernel writes ocfs2_get_write_source() should be starting the buffer
at a page boundary as the math in ocfs2_map_and_write_user_data() will pad
it back out to the correct write offset. Instead, we were passing the raw
offset, which caused ocfs2_map_and_write_user_data() start too far into the
buffer, resulting in corruptions from nfs client writes.

Signed-off-by: Mark Fasheh 
Signed-off-by: Greg Kroah-Hartman

JFFS2 locking regression fix.

2007-08-22T23:23:27+00:00

Commit a491486a2087ac3dfc00efb4f838c8d684afaf54 introduced a locking
problem in JFFS2 -- we up() the alloc_sem when we weren't previously
holding it. This leads to all kinds of fun behaviour later.

There was a _reason_ for the
	if (1 /* alternative path needs testing */ ||
which the above-mentioned commit removed :)

Discovered and debugged by Giulio Fedel 

Signed-off-by: David Woodhouse 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Reset current->pdeath_signal on SUID binary execution (CVE-2007-3848)

2007-08-21T04:32:42+00:00

This fixes a vulnerability in the "parent process death signal"
implementation discoverd by Wojciech Purczynski of COSEINC PTE Ltd.
and iSEC Security Research.

http://marc.info/?l=bugtraq&m=118711306802632&w=2

Signed-off-by: Marcel Holtmann 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

direct-io: fix error-path crashes

2007-08-15T16:25:10+00:00

Need to initialize map_bh.b_state to zero.  Otherwise, in case of a faulty
user-buffer its possible to go into dio_zero_block() and submit a page by
mistake - since it checks for buffer_new().

http://marc.info/?l=linux-kernel&m=118551339032528&w=2

akpm: Linus had a (better) patch to just do a kzalloc() in there, but it got
lost.  Probably this version is better for -stable anwyay.

Signed-off-by: Badari Pulavarty 
Acked-by: Joe Jin 
Acked-by: Zach Brown 
Cc: gurudas pai 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

sysfs: release mutex when kmalloc() failed in sysfs_open_file().

2007-08-09T21:27:46+00:00

Signed-off-by: Greg Kroah-Hartman

jbd2 commit: fix transaction dropping

2007-08-09T21:27:40+00:00

We have to check that also the second checkpoint list is non-empty before
dropping the transaction.

Signed-off-by: Jan Kara 
Cc: Chuck Ebbert 
Cc: Kirill Korotaev 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

jbd commit: fix transaction dropping

2007-08-09T21:27:40+00:00

We have to check that also the second checkpoint list is non-empty before
dropping the transaction.

Signed-off-by: Jan Kara 
Cc: Chuck Ebbert 
Cc: Kirill Korotaev 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

fs: 9p/conv.c error path fix

2007-08-09T21:27:39+00:00

When buf_check_overflow() returns != 0 we will hit kfree(ERR_PTR(err))
and it will not be happy about it.

Signed-off-by: Mariusz Kozlowski 
Cc: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

nfsd: fix possible read-ahead cache and export table corruption

2007-08-09T21:27:39+00:00

The value of nperbucket calculated here is too small--we should be rounding up
instead of down--with the result that the index j in the following loop can
overflow the raparm_hash array.  At least in my case, the next thing in memory
turns out to be export_table, so the symptoms I see are crashes caused by the
appearance of four zeroed-out export entries in the first bucket of the hash
table of exports (which were actually entries in the readahead cache, a
pointer to which had been written to the export table in this initialization
code).

It looks like the bug was probably introduced with commit
fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params
cache SMP-friendly").

Cc: Greg Banks 
Signed-off-by: "J. Bruce Fields" 
Acked-by: NeilBrown 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman