pm24.git, branch v3.3-rc7

Linux 3.3-rc7

2012-03-10T21:49:52Z

aio: fix the "too late munmap()" race

2012-03-10T02:59:59Z

Current code has put_ioctx() called asynchronously from aio_fput_routine(); that's done *after* we have killed the request that used to pin ioctx, so there's nothing to stop io_destroy() waiting in wait_for_all_aios() from progressing. As the result, we can end up with async call of put_ioctx() being the last one and possibly happening during exit_mmap() or elf_core_dump(), neither of which expects stray munmap() being done to them... We do need to prevent _freeing_ ioctx until aio_fput_routine() is done with that, but that's all we care about - neither io_destroy() nor exit_aio() will progress past wait_for_all_aios() until aio_fput_routine() does really_put_req(), so the ioctx teardown won't be done until then and we don't care about the contents of ioctx past that point. Since actual freeing of these suckers is RCU-delayed, we don't need to bump ioctx refcount when request goes into list for async removal. All we need is rcu_read_lock held just over the ->ctx_lock-protected area in aio_fput_routine(). Signed-off-by: Al Viro Reviewed-by: Jeff Moyer Acked-by: Benjamin LaHaise Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds

aio: fix io_setup/io_destroy race

2012-03-10T02:59:59Z

Have ioctx_alloc() return an extra reference, so that caller would drop it on success and not bother with re-grabbing it on failure exit. The current code is obviously broken - io_destroy() from another thread that managed to guess the address io_setup() would've returned would free ioctx right under us; gets especially interesting if aio_context_t * we pass to io_setup() points to PROT_READ mapping, so put_user() fails and we end up doing io_destroy() on kioctx another thread has just got freed... Signed-off-by: Al Viro Acked-by: Benjamin LaHaise Reviewed-by: Jeff Moyer Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

2012-03-10T02:09:18Z

Pull btrfs updates from Chris Mason: "I have two additional and btrfs fixes in my for-linus branch. One is a casting error that leads to memory corruption on i386 during scrub, and the other fixes a corner case in the backref walking code (also triggered by scrub)." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: fix casting error in scrub reada code btrfs: fix locking issues in find_parent_nodes()

memcg: revert fix to mapcount check for this release

2012-03-09T23:32:20Z

Respectfully revert commit e6ca7b89dc76 "memcg: fix mapcount check in move charge code for anonymous page" for the 3.3 release, so that it behaves exactly like releases 2.6.35 through 3.2 in this respect. Horiguchi-san's commit is correct in itself, 1 makes much more sense than 2 in that check; but it does not go far enough - swapcount should be considered too - if we really want such a check at all. We appear to have reached agreement now, and expect that 3.4 will remove the mapcount check, but had better not make 3.3 different. Signed-off-by: Hugh Dickins Reviewed-by: Naoya Horiguchi Signed-off-by: Linus Torvalds

x86: Derandom delay_tsc for 64 bit

2012-03-09T20:43:27Z

Commit f0fbf0abc093 ("x86: integrate delay functions") converted delay_tsc() into a random delay generator for 64 bit. The reason is that it merged the mostly identical versions of delay_32.c and delay_64.c. Though the subtle difference of the result was: static void delay_tsc(unsigned long loops) { - unsigned bclock, now; + unsigned long bclock, now; Now the function uses rdtscl() which returns the lower 32bit of the TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64 bit this fails when the lower 32bit are close to wrap around when bclock is read, because the following check if ((now - bclock) >= loops) break; evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0 because the unsigned long (now - bclock) of these values results in 0xffffffff00000001 which is definitely larger than the loops value. That explains Tvortkos observation: "Because I am seeing udelay(500) (_occasionally_) being short, and that by delaying for some duration between 0us (yep) and 491us." Make those variables explicitely u32 again, so this works for both 32 and 64 bit. Reported-by: Tvrtko Ursulin Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org # >= 2.6.27 Signed-off-by: Linus Torvalds

Merge tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2012-03-09T20:14:23Z

Pull sound fixes from Takashi Iwai: "Nothing exciting here: just a few regression fixes for HD-audio and ASoC, also the support of missing 32bit compat ioctl for HDSPM." * tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hdspm - Provide ioctl_compat ALSA: hda/realtek - Apply the coef-setup only to ALC269VB ALSA: hda - add quirk to detect CD input on Gigabyte EP45-DS3 ASoC: neo1973: fix neo1973 wm8753 initialization

MAINTAINERS: new git entry for arm/mach-msm

2012-03-09T20:13:36Z

The msm git tree moved to git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git Signed-off-by: David Brown Signed-off-by: Linus Torvalds

Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming

2012-03-09T15:27:38Z

Pull C6X fix from Mark Salter: "Fix for C6X KSTK_EIP and KSTK_ESP macros." * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming: C6X: fix KSTK_EIP and KSTK_ESP macros

Merge tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

2012-03-09T15:26:25Z

Pull two IOMMU fixes from Joerg Roedel: "The first is an additional fix for the OMAP initialization order issue and the second patch fixes a possible section mismatch which can lead to a kernel crash in the AMD IOMMU driver when suspend/resume is used and the compiler has not inlined the iommu_set_device_table function." * tag 'iommu-fixes-v3.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: x86/amd: iommu_set_device_table() must not be __init ARM: OMAP: fix iommu, not mailbox