pm24.git/kernel, branch v2.6.22-rc5

swsusp: Fix userland interface

2007-06-16T20:16:15Z

Fix oops caused by 'cat /dev/snapshot', reported by Arkadiusz Miskiewicz, and make it impossible to thaw tasks with the help of the swsusp userland interface while there is a snapshot image ready to save. Signed-off-by: Rafael J. Wysocki Acked-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

cpuset: zero malloc - fix for old cpusets

2007-06-16T20:16:15Z

The cpuset code to present a list of tasks using a cpuset to user space could write to an array that it had kmalloc'd, after a kmalloc request of zero size. The problem was that the code didn't check for writes past the allocated end of the array until -after- the first write. This is a race condition that is likely rare -- it would only show up if a cpuset went from being empty to having a task in it, during the brief time between the allocation and the first write. Prior to roughly 2.6.22 kernels, this was also a benign problem, because a zero kmalloc returned a few usable bytes anyway, and no harm was done with the bogus write. With the 2.6.22 kernel changes to make issue a warning if code tries to write to the location returned from a zero size allocation, this problem is no longer benign. This cpuset code would occassionally trigger that warning. The fix is trivial -- check before storing into the array, not after, whether the array is big enough to hold the store. Cc: "Eric W. Biederman" Cc: "Serge E. Hallyn" Cc: Balbir Singh Cc: Dave Hansen Cc: Herbert Poetzl Cc: Kirill Korotaev Cc: Paul Menage Cc: Srivatsa Vaddagiri Cc: Christoph Lameter Signed-off-by: Paul Jackson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

pi-futex: fix exit races and locking problems

2007-06-09T00:23:34Z

1. New entries can be added to tsk->pi_state_list after task completed exit_pi_state_list(). The result is memory leakage and deadlocks. 2. handle_mm_fault() is called under spinlock. The result is obvious. 3. results in self-inflicted deadlock inside glibc. Sometimes futex_lock_pi returns -ESRCH, when it is not expected and glibc enters to for(;;) sleep() to simulate deadlock. This problem is quite obvious and I think the patch is right. Though it looks like each "if" in futex_lock_pi() got some stupid special case "else if". :-) 4. sometimes futex_lock_pi() returns -EDEADLK, when nobody has the lock. The reason is also obvious (see comment in the patch), but correct fix is far beyond my comprehension. I guess someone already saw this, the chunk: if (rt_mutex_trylock(&q.pi_state->pi_mutex)) ret = 0; is obviously from the same opera. But it does not work, because the rtmutex is really taken at this point: wake_futex_pi() of previous owner reassigned it to us. My fix works. But it looks very stupid. I would think about removal of shift of ownership in wake_futex_pi() and making all the work in context of process taking lock. From: Thomas Gleixner Fix 1) Avoid the tasklist lock variant of the exit race fix by adding an additional state transition to the exit code. This fixes also the issue, when a task with recursive segfaults is not able to release the futexes. Fix 2) Cleanup the lookup_pi_state() failure path and solve the -ESRCH problem finally. Fix 3) Solve the fixup_pi_state_owner() problem which needs to do the fixup in the lock protected section by using the in_atomic userspace access functions. This removes also the ugly lock drop / unqueue inside of fixup_pi_state() Fix 4) Fix a stale lock in the error path of futex_wake_pi() Added some error checks for verification. The -EDEADLK problem is solved by the rtmutex fixups. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Steven Rostedt Cc: Ulrich Drepper Cc: Eric Dumazet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

rt-mutex: fix chain walk early wakeup bug

2007-06-09T00:23:34Z

Alexey Kuznetsov found some problems in the pi-futex code. One of the root causes is: When a wakeup happens, we do not to stop the chain walk so we follow a not longer relevant locking chain. Drop out when this happens. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Steven Rostedt Cc: Alexey Kuznetsov Cc: Ulrich Drepper Cc: Eric Dumazet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

rt-mutex: fix stale return value

2007-06-09T00:23:34Z

Alexey Kuznetsov found some problems in the pi-futex code. The major problem is a stale return value in rt_mutex_slowlock(): When the pi chain walk returns -EDEADLK, but the waiter was woken up during the phases where the locks were dropped, the rtmutex could be acquired, but due to the stale return value -EDEADLK returned to the caller. Reset the return value in the retry path. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Steven Rostedt Cc: Alexey Kuznetsov Cc: Ulrich Drepper Cc: Eric Dumazet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Restrict clearing TIF_SIGPENDING

2007-06-07T15:52:15Z

This patch should get a few birds. It prevents sigaction calls from clearing TIF_SIGPENDING in other threads, which could leak -ERESTART*. And It fixes ptrace_stop not to clear it, which done at the syscall exit stop could leak -ERESTART*. It probably removes the harm from signalfd, at least assuming it never calls dequeue_signal on kernel threads that might have used block_all_signals. Signed-off-by: Roland McGrath Cc: Andrew Morton Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Satoru Takeuchi Signed-off-by: Linus Torvalds

timer stats: speedups

2007-06-01T15:18:30Z

Make timer-stats have almost zero overhead when enabled in the config but not used. (this way distros can enable it more easily) Also update the documentation about overhead of timer_stats - it was written for the first version which had a global lock and a linear list walk based lookup ;-) Signed-off-by: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

timer statistics: fix race

2007-06-01T15:18:30Z

Fix two races in the timer stats lookup code. One by ensuring that the initialization of a new entry is finished upon insertion of that entry. The other by cleaning up the hash table when the entries array is cleared, so that we don't have any "pre-inserted" entries. Thanks to Eric Dumazet for reminding me of the memory barriers. Signed-off-by: Bjorn Steinbrink Signed-off-by: Ian Kumlien Acked-by: Ingo Molnar Cc: Eric Dumazet Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

fix compat futex code for private futexes

2007-06-01T15:18:28Z

When the private futex support was added the compat code wasn't changed. The result is that code using compat code which fail, e.g., because the timeout values are not correctly passed. The following patch should fix that. Signed-off-by: Ulrich Drepper Cc: Eric Dumazet Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

fix possible null ptr deref in kallsyms_lookup

2007-05-30T17:51:38Z

ugh, this function gets called by our unwinder. recursive backtrace for the win... bisection to find this one was "fun." Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds