linux/drivers/block, branch v2.6.36

ps3disk: passing wrong variable to bvec_kunmap_irq()

2010-10-12T16:56:33Z

This should pass "buf" to bvec_kunmap_irq() instead of "bv". The api is like kmap_atomic() instead of kmap(). Signed-off-by: Dan Carpenter Acked-by: Geoff Levand Signed-off-by: Jens Axboe

virtio-blk: fix request leak.

2010-10-09T18:42:37Z

Must drop reference taken by blk_make_request(). Signed-off-by: Mike Snitzer Signed-off-by: Rusty Russell Cc: stable@kernel.org # .35.x Signed-off-by: Linus Torvalds

Fix pktcdvd ioctl dev_minor range check

2010-09-27T23:29:06Z

The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds

cciss: freeing uninitialized data on error path

2010-09-21T09:49:17Z

The "h->scatter_list" is allocated inside a for loop. If any of those allocations fail, then the rest of the list is uninitialized data. When we free it we should start from the top and free backwards so that we don't call kfree() on uninitialized pointers. Also if the allocation for "h->scatter_list" fails then we would get an Oops here. I should have noticed this when I send: 4ee69851c "cciss: handle allocation failure." but I didn't. Sorry about that. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe

Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block

2010-09-10T14:26:27Z

* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: Range check cpu in blk_cpu_to_group scatterlist: prevent invalid free when alloc fails writeback: Fix lost wake-up shutting down writeback thread writeback: do not lose wakeup events when forking bdi threads cciss: fix reporting of max queue depth since init block: switch s390 tape_block and mg_disk to elevator_change() block: add function call to switch the IO scheduler from a driver fs/bio-integrity.c: return -ENOMEM on kmalloc failure bio-integrity.c: remove dependency on __GFP_NOFAIL BLOCK: fix bio.bi_rw handling block: put dev->kobj in blk_register_queue fail path cciss: handle allocation failure cfq-iosched: Documentation help for new tunables cfq-iosched: blktrace print per slice sector stats cfq-iosched: Implement tunable group_idle cfq-iosched: Do group share accounting in IOPS when slice_idle=0 cfq-iosched: Do not idle if slice_idle=0 cciss: disable doorbell reset on reset_devices blkio: Fix return code for mkdir calls

cciss: fix reporting of max queue depth since init

2010-08-25T17:58:53Z

The ioctl path and the scsi tape path were not accounting for their additions to the queue depth. Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe

Merge branch 'for-upstream/pvhvm' of git://xenbits.xensource.com/people/ianc/linux-2.6

2010-08-24T01:29:18Z

* 'for-upstream/pvhvm' of git://xenbits.xensource.com/people/ianc/linux-2.6: xen: pvhvm: make it clearer that XEN_UNPLUG_* define bits in a bitfield xen: pvhvm: rename xen_emul_unplug=ignore to =unnnecessary xen: pvhvm: allow user to request no emulated device unplug

block: switch s390 tape_block and mg_disk to elevator_change()

2010-08-23T12:02:44Z

Now that we have this API, switch the two in-kernel users to it. Resolves an oops introduced by commit 1abec4fdbb142e3ccb6ce99832fae42129134a96. Signed-off-by: Jens Axboe

xen: pvhvm: rename xen_emul_unplug=ignore to =unnnecessary

2010-08-23T10:59:29Z

It is not immediately clear what this option causes to become ignored. The actual meaning is that it is not necessary to unplug the emulated devices to safely use the PV ones, even if the platform does not support the unplug protocol. (pressumably the user will only add this option if they have ensured that their domain configuration is safe). I think xen_emul_unplug=unnecessary better captures this. Signed-off-by: Ian Campbell Acked-by: Jeremy Fitzhardinge Acked-by: Stefano Stabellini

BLOCK: fix bio.bi_rw handling

2010-08-23T10:33:10Z

Return of the bi_rw tests is no longer bool after commit 74450be1. But results of such tests are stored in bools. This doesn't fit in there for some compilers (gcc 4.5 here), so either use !! magic to get real bools or use ulong where the result is assigned somewhere. Signed-off-by: Jiri Slaby Cc: Christoph Hellwig Reviewed-by: Jeff Moyer Signed-off-by: Jens Axboe