summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* USB: fix warning caused by autosuspend counter going negativeAlan Stern2007-08-091-4/+6
| | | | | | | | | | | | | | This patch (as937) fixes a minor bug in the autosuspend usage-counting code. Each hub's usage counter keeps track of the number of unsuspended children. However the current driver increments the counter after registering a new child, by which time the child may already have been suspended and caused the counter to go negative. The obvious solution is to increment the counter before registering the child. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* KVM: SVM: Reliably detect if SVM was disabled by BIOSJoerg Roedel2007-08-092-0/+9
| | | | | | | | | | | | This patch adds an implementation to the svm is_disabled function to detect reliably if the BIOS disabled the SVM feature in the CPU. This fixes the issues with kernel panics when loading the kvm-amd module on machines where SVM is available but disabled. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@qumranet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix TCP IPV6 MD5 bug.YOSHIFUJI Hideaki2007-08-091-0/+1
| | | | | | | | | | | | | | | [TCPv6] MD5SIG: Ensure to reset allocation count to avoid panic. After clearing all passwords for IPv6 peers, we need to set allocation count to zero as well as we free the storage. Otherwise, we panic when a user trys to (re)add a password. Discovered and fixed by MIYAJIMA Mitsuharu <miyajima.mitsuharu@anchor.jp>. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix sparc32 udelay() rounding errors.Mark Fortescue2007-08-091-4/+10
| | | | | | | | | | | | | | | | | | | | [SPARC32]: Fix rounding errors in ndelay/udelay implementation. __ndelay and __udelay have not been delayung >= specified time. The problem with __ndelay has been tacked down to the rounding of the multiplier constant. By changing this, delays > app 18us are correctly calculated. The problem with __udelay has also been tracked down to rounding issues. Changing the multiplier constant (to match that used in sparc64) corrects for large delays and adding in a rounding constant corrects for trunctaion errors in the claculations. Many short delays will return without looping. This is not an error as there is the fixed delay of doing all the maths to calculate the loop count. Signed-off-by: Mark Fortescue <mark@mtfhpc.demon.co.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix sparc32 memset()Alexander Shmelev2007-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [SPARC32]: Fix bug in sparc optimized memset. Sparc optimized memset (arch/sparc/lib/memset.S) does not fill last byte of the memory area, if area size is less than 8 bytes and start address is not word (4-bytes) aligned. Here is code chunk where bug located: /* %o0 - memory address, %o1 - size, %g3 - value */ 8: add %o0, 1, %o0 subcc %o1, 1, %o1 bne,a 8b stb %g3, [%o0 - 1] This code should write byte every loop iteration, but last time delay instruction stb is not executed because branch instruction sets "annul" bit. Patch replaces bne,a by bne instruction. Error can be reproduced by simple kernel module: -------------------- #include <linux/module.h> #include <linux/config.h> #include <linux/kernel.h> #include <linux/errno.h> #include <string.h> static void do_memset(void **p, int size) { memset(p, 0x00, size); } static int __init memset_test_init(void) { char fooc[8]; int *fooi; memset(fooc, 0xba, sizeof(fooc)); do_memset((void**)(fooc + 3), 1); fooi = (int*) fooc; printk("%08X %08X\n", fooi[0], fooi[1]); return -1; } static void __exit memset_test_cleanup(void) { return; } module_init(memset_test_init); module_exit(memset_test_cleanup); MODULE_LICENSE("GPL"); EXPORT_NO_SYMBOLS; ------------------------ Signed-off-by: Alexander Shmelev <ashmelev@task.sun.mcst.ru> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix ipv6 tunnel endianness bug.Al Viro2007-08-091-2/+2
| | | | | | | | | [IPV6]: endianness bug in ip6_tunnel Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Sparc64 bootup assembler bugDavid S. Miller2007-08-091-1/+0
| | | | | | | | | | | | | [SPARC64]: Fix two year old bug in early bootup asm. We try to fetch the CIF entry pointer from %o4, but that can get clobbered by the early OBP calls. It is saved in %l7 already, so actually this "mov %o4, %l7" can just be completely removed with no other changes. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Netpoll leakSatyam Sharma2007-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | [NETPOLL]: Fix a leak-n-bug in netpoll_cleanup() 93ec2c723e3f8a216dde2899aeb85c648672bc6b applied excessive duct tape to the netpoll beast's netpoll_cleanup(), thus substituting one leak with another, and opening up a little buglet :-) net_device->npinfo (netpoll_info) is a shared and refcounted object and cannot simply be set NULL the first time netpoll_cleanup() is called. Otherwise, further netpoll_cleanup()'s see np->dev->npinfo == NULL and become no-ops, thus leaking. And it's a bug too: the first call to netpoll_cleanup() would thus (annoyingly) "disable" other (still alive) netpolls too. Maybe nobody noticed this because netconsole (only user of netpoll) never supported multiple netpoll objects earlier. This is a trivial and obvious one-line fixlet. Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix ipv6 link down handling.Vlad Yasevich2007-08-091-0/+1
| | | | | | | | | | | | | | [IPV6]: Call inet6addr_chain notifiers on link down Currently if the link is brought down via ip link or ifconfig down, the inet6addr_chain notifiers are not called even though all the addresses are removed from the interface. This caused SCTP to add duplicate addresses to it's list. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix error queue socket lookup in ipv6Dmitry Butskoy2007-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [IPV6]: MSG_ERRQUEUE messages do not pass to connected raw sockets From: Dmitry Butskoy <dmitry@butskoy.name> Taken from http://bugzilla.kernel.org/show_bug.cgi?id=8747 Problem Description: It is related to the possibility to obtain MSG_ERRQUEUE messages from the udp and raw sockets, both connected and unconnected. There is a little typo in net/ipv6/icmp.c code, which prevents such messages to be delivered to the errqueue of the correspond raw socket, when the socket is CONNECTED. The typo is due to swap of local/remote addresses. Consider __raw_v6_lookup() function from net/ipv6/raw.c. When a raw socket is looked up usual way, it is something like: sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif); where "daddr" is a destination address of the incoming packet (IOW our local address), "saddr" is a source address of the incoming packet (the remote end). But when the raw socket is looked up for some icmp error report, in net/ipv6/icmp.c:icmpv6_notify() , daddr/saddr are obtained from the echoed fragment of the "bad" packet, i.e. "daddr" is the original destination address of that packet, "saddr" is our local address. Hence, for icmpv6_notify() must use "saddr, daddr" in its arguments, not "daddr, saddr" ... Steps to reproduce: Create some raw socket, connect it to an address, and cause some error situation: f.e. set ttl=1 where the remote address is more than 1 hop to reach. Set IPV6_RECVERR . Then send something and wait for the error (f.e. poll() with POLLERR|POLLIN). You should receive "time exceeded" icmp message (because of "ttl=1"), but the socket do not receive it. If you do not connect your raw socket, you will receive MSG_ERRQUEUE successfully. (The reason is that for unconnected socket there are no actual checks for local/remote addresses). Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* gen estimator deadlock fixRanko Zivojnovic2007-08-091-32/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | [NET]: gen_estimator deadlock fix -Fixes ABBA deadlock noted by Patrick McHardy <kaber@trash.net>: > There is at least one ABBA deadlock, est_timer() does: > read_lock(&est_lock) > spin_lock(e->stats_lock) (which is dev->queue_lock) > > and qdisc_destroy calls htb_destroy under dev->queue_lock, which > calls htb_destroy_class, then gen_kill_estimator and this > write_locks est_lock. To fix the ABBA deadlock the rate estimators are now kept on an rcu list. -The est_lock changes the use from protecting the list to protecting the update to the 'bstat' pointer in order to avoid NULL dereferencing. -The 'interval' member of the gen_estimator structure removed as it is not needed. Signed-off-by: Ranko Zivojnovic <ranko@spidernet.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* gen estimator timer unload racePatrick McHardy2007-08-091-1/+2
| | | | | | | | | | | | | | | | [NET]: Fix gen_estimator timer removal race As noticed by Jarek Poplawski <jarkao2@o2.pl>, the timer removal in gen_kill_estimator races with the timer function rearming the timer. Check whether the timer list is empty before rearming the timer in the timer function to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Jarek Poplawski <jarkao2@o2.pl> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix rfkill IRQ flags.Ingo Molnar2007-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [RFKILL]: fix net/rfkill/rfkill-input.c bug on 64-bit systems Subject: [patch] net/input: fix net/rfkill/rfkill-input.c bug on 64-bit systems this recent commit: commit cf4328cd949c2086091c62c5685f1580fe9b55e4 Author: Ivo van Doorn <IvDoorn@gmail.com> Date: Mon May 7 00:34:20 2007 -0700 [NET]: rfkill: add support for input key to control wireless radio added this 64-bit bug: .... unsigned int flags; spin_lock_irqsave(&task->lock, flags); .... irq 'flags' must be unsigned long, not unsigned int. The -rt tree has strict checks about this on 64-bit so this triggered a build failure. Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* SCTP scope_id handling fixVlad Yasevich2007-08-091-0/+4
| | | | | | | | | | | | | SCTP: Add scope_id validation for link-local binds SCTP currently permits users to bind to link-local addresses, but doesn't verify that the scope id specified at bind matches the interface that the address is configured on. It was report that this can hang a system. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Missing header include in ipt_iprange.hAdrian Bunk2007-08-091-0/+2
| | | | | | | | | | | | | [NETFILTER]: ipt_iprange.h must #include <linux/types.h> ipt_iprange.h must #include <linux/types.h> since it uses __be32. This patch fixes kernel Bugzilla #7604. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Add a PCI ID for santa rosa's PATA controller.Christian Lamparter2007-08-091-0/+2
| | | | | | | | | | | This is commit c1e6f28cc5de37dcd113b9668a185c0b9334ba8a which is merged during 23-rc1 window. Considering the popularity of these chips, I think including it in -stable release would be good idea. Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix console write locking in sparc drivers.David S. Miller2007-08-094-12/+68
| | | | | | | | | Mirror the logic in 8250 for proper console write locking when SYSRQ is triggered or an OOPS is in progress. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix IPCOMP crashes.Patrick McHardy2007-08-092-2/+1
| | | | | | | | | | | | | | | [XFRM]: Fix crash introduced by struct dst_entry reordering XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which was broken by the dst_entry reordering in commit 1e19e02c~, causing an oops in xfrm_bundle_ok when walking the bundle upwards. Kill xfrm_dst->u.next and change the only user to use dst->next instead. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Fix TC deadlock.Patrick McHardy2007-08-091-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [NET_SCHED]: Revert "avoid transmit softirq on watchdog wakeup" optimization As noticed by Ranko Zivojnovic <ranko@spidernet.net>, calling qdisc_run from the timer handler can result in deadlock: > CPU#0 > > qdisc_watchdog() fires and gets dev->queue_lock > qdisc_run()...qdisc_restart()... > -> releases dev->queue_lock and enters dev_hard_start_xmit() > > CPU#1 > > tc del qdisc dev ... > qdisc_graft()...dev_graft_qdisc()...dev_deactivate()... > -> grabs dev->queue_lock ... > > qdisc_reset()...{cbq,hfsc,htb,netem,tbf}_reset()...qdisc_watchdog_cancel()... > -> hrtimer_cancel() - waiting for the qdisc_watchdog() to exit, while still > holding dev->queue_lock > > CPU#0 > > dev_hard_start_xmit() returns ... > -> wants to get dev->queue_lock(!) > > DEADLOCK! The entire optimization is a bit questionable IMO, it moves potentially large parts of NET_TX_SOFTIRQ work to TIMER_SOFTIRQ/HRTIMER_SOFTIRQ, which kind of defeats the separation of them. Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Ranko Zivojnovic <ranko@spidernet.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* TCP FRTO retransmit bug fixIlpo Järvinen2007-08-091-1/+3
| | | | | | | | | | | | [TCP]: Verify the presence of RETRANS bit when leaving FRTO For yet unknown reason, something cleared SACKED_RETRANS bit underneath FRTO. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: cdc-acm: fix sysfs attribute registration bugAlan Stern2007-08-091-3/+9
| | | | | | | | | | | | | | This patch (as950) fixes a bug in the cdc-acm driver. It doesn't keep track of which interface (control or data) the sysfs attributes get registered for, and as a result, during disconnect it will sometimes attempt to remove the attributes from the wrong interface. The left-over attributes can cause a crash later on, particularly if the driver module has been unloaded. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: Oliver Neukum <oliver@neukum.name> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Linux 2.6.22.1v2.6.22.1Greg Kroah-Hartman2007-07-101-1/+1
| | | | | | | Ok, so it was more than just 5 minutes for the first exploit to be found, nothing to be ashamed about :) Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* NETFILTER: {ip, nf}_conntrack_sctp: fix remotely triggerable NULL ptr ↵Patrick McHardy2007-07-101-1/+2
| | | | | | | | | | | | | | | | | | dereference (CVE-2007-2876) When creating a new connection by sending an unknown chunk type, we don't transition to a valid state, causing a NULL pointer dereference in sctp_packet when accessing sctp_timeouts[SCTP_CONNTRACK_NONE]. Fix by don't creating new conntrack entry if initial state is invalid. Noticed by Vilmos Nebehaj <vilmos.nebehaj@ramsys.hu> CC: Kiran Kumar Immidi <immidi_kiran@yahoo.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
* Linux 2.6.22v2.6.22Linus Torvalds2007-07-081-1/+1
| | | | | | | | Woo-hoo. I'm sure somebody will report a "this doesn't compile, and I have a new root exploit" five minutes after release, but it still feels good ;) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6Linus Torvalds2007-07-083-2/+3
|\ | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6: qd65xx: fix PIO mode selection sis5513: adding PCI-ID
| * qd65xx: fix PIO mode selectionBartlomiej Zolnierkiewicz2007-07-081-2/+1
| | | | | | | | | | | | | | | | | | | | PIO4 is a maximum PIO mode supported by a driver. Using "255" as a max_mode argument to ide_get_best_pio_mode() could result in wrong timings being used by a driver (for "pio" equal to 5) or OOPS (for "pio" values > 5 && < 255). Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> Reviewed-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
| * sis5513: adding PCI-IDUwe Koziolek2007-07-082-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SiS966 has one additional PCI-ID 1180. If the chipset is using this PCI-ID, the primary channel is connected to the first PATA-port. The secondary channel is connected to SATA-ports in IDE emulation mode. The legacy IO-ports are used. The including of the PCI-ID into pata_sis is not sufficient, because the legacy driver in drivers/ide is initialized before pata_sis. Signed-off-by: Uwe Koziolek <uwe.koziolek@gmx.net> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* | Fix permission checking for the new utimensat() system callLinus Torvalds2007-07-081-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 1c710c896eb461895d3c399e15bb5f20b39c9073 added the utimensat() system call, but didn't handle the case of checking for the writability of the target right, when the target was a file descriptor, not a filename. We cannot use vfs_permission(MAY_WRITE) for that case, and need to simply check whether the file descriptor is writable. The oops from using the wrong function was noticed and narrowed down by Markus Trippelsdorf. Cc: Ulrich Drepper <drepper@redhat.com> Cc: Markus Trippelsdorf <markus@trippelsdorf.de> Cc: Andrew Morton <akpm@linux-foundation.org> Acked-by: Al Viro <viro@ftp.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | mm: double mark_page_accessed() in read_cache_page_async()Peter Zijlstra2007-07-081-1/+0
|/ | | | | | | | | | | | | | | Fix a post-2.6.21 regression. read_cache_page_async() has two invocations of mark_page_accessed() which will launch pages right onto the active list. Remove the first one, keeping the latter one. This avoids marking unwanted pages active (in the retry loop). Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* DLM must depend on SYSFSAdrian Bunk2007-07-071-1/+1
| | | | | | | | | | | | | | | | | | | | | The dependency of DLM on SYSFS got lost in commit 6ed7257b46709e87d79ac2b6b819b7e0c9184998 resulting in the following compile error with CONFIG_DLM=y, CONFIG_SYSFS=n: <-- snip --> ... LD .tmp_vmlinux1 fs/built-in.o: In function `dlm_lockspace_init': /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/fs/dlm/lockspace.c:231: undefined reference to `kernel_subsys' fs/built-in.o: In function `configfs_init': /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/fs/configfs/mount.c:143: undefined reference to `kernel_subsys' make[1]: *** [.tmp_vmlinux1] Error 1 <-- snip --> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Clean up E7520/7320/7525 quirk printk.Dave Jones2007-07-071-3/+2
| | | | | | | | | | | | | | | The printk level in this printk is bogus, as the previous printk didn't have a terminating \n resulting in .. Intel E7520/7320/7525 detected.<6>Disabling irq balancing and affinity It also never printed a \n at all in the case where we didn't do the quirk. Change it to only make noise if it actually does something useful. Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* include/linux/kallsyms.h must #include <linux/errno.h>Adrian Bunk2007-07-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | This patch fixes the following 2.6.22 regression with CONFIG_KALLSYMS=n: <-- snip --> ... CC arch/m32r/kernel/traps.o In file included from /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/arch/m32r/kernel/traps.c:14: /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h: In function 'lookup_symbol_name': /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h:66: error: 'ERANGE' undeclared (first use in this function) /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h:66: error: (Each undeclared identifier is reported only once /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h:66: error: for each function it appears in.) /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h: In function 'lookup_symbol_attrs': /home/bunk/linux/kernel-2.6/linux-2.6.22-rc6-mm1/include/linux/kallsyms.h:71: error: 'ERANGE' undeclared (first use in this function) make[2]: *** [arch/m32r/kernel/traps.o] Error 1 <-- snip --> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Fix use-after-free oops in Bluetooth HID.David Woodhouse2007-07-071-9/+9
| | | | | | | | | | | | | | | | When cleaning up HIDP sessions, we currently close the ACL connection before deregistering the input device. Closing the ACL connection schedules a workqueue to remove the associated objects from sysfs, but the input device still refers to them -- and if the workqueue happens to run before the input device removal, the kernel will oops when trying to look up PHYSDEVPATH for the removed input device. Fix this by deregistering the input device before closing the connections. Signed-off-by: David Woodhouse <dwmw2@infradead.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* slub: remove useless EXPORT_SYMBOLChristoph Lameter2007-07-061-1/+0
| | | | | | | | | | | | | | kmem_cache_open is static. EXPORT_SYMBOL was leftover from some earlier time period where kmem_cache_open was usable outside of slub. (Fixes powerpc build error) Signed-off-by: Chrsitoph Lameter <clameter@sgi.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* MAINTAINERS new kernel janitors mlmaximilian attems2007-07-061-1/+1
| | | | | | | | | | davem kindly moved the list from osdl to vger. Signed-of-by: maximilian attems <max@stro.at> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* GEODE: reboot fixup for geode machines with CS5536 boardsAndres Salomon2007-07-062-2/+15
| | | | | | | | | | | | Writing to MSR 0x51400017 forces a hard reset on CS5536-based machines, this has the reboot fixup do just that if such a board is detected. Acked-by: Jordan Crouse <jordan.crouse@amd.com> Signed-off-by: Andres Salomon <dilinger@debian.org> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge branch 'master' of ↵Linus Torvalds2007-07-066-8/+20
|\ | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 * 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [NETPOLL]: Fixups for 'fix soft lockup when removing module' [NET]: net/core/netevent.c should #include <net/netevent.h> [NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' index values [NET] skbuff: remove export of static symbol SCTP: Add scope_id validation for link-local binds SCTP: Check to make sure file is valid before setting timeout SCTP: Fix thinko in sctp_copy_laddrs()
| * [NETPOLL]: Fixups for 'fix soft lockup when removing module'Jarek Poplawski2007-07-051-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | >From my recent patch: > > #1 > > Until kernel ver. 2.6.21 (including) cancel_rearming_delayed_work() > > required a work function should always (unconditionally) rearm with > > delay > 0 - otherwise it would endlessly loop. This patch replaces > > this function with cancel_delayed_work(). Later kernel versions don't > > require this, so here it's only for uniformity. But Oleg Nesterov <oleg@tv-sign.ru> found: > But 2.6.22 doesn't need this change, why it was merged? > > In fact, I suspect this change adds a race, ... His description was right (thanks), so this patch reverts #1. Signed-off-by: Jarek Poplawski <jarkao2@o2.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET]: net/core/netevent.c should #include <net/netevent.h>Adrian Bunk2007-07-051-0/+1
| | | | | | | | | | | | | | | | Every file should include the headers containing the prototypes for its global functions. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' ↵Jing Min Zhao2007-07-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | index values Choices' index values may be out of range while still encoded in the fixed length bit-field. This bug may cause access to undefined types (NULL pointers) and thus crashes (Reported by Zhongling Wen). This patch also adds checking of decode flag when decoding SEQUENCEs. Signed-off-by: Jing Min Zhao <zhaojingmin@vivecode.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * [NET] skbuff: remove export of static symbolJohannes Berg2007-07-051-1/+0
| | | | | | | | | | | | | | skb_clone_fraglist is static so it shouldn't be exported. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * SCTP: Add scope_id validation for link-local bindsVlad Yasevich2007-07-051-0/+4
| | | | | | | | | | | | | | | | | | | | SCTP currently permits users to bind to link-local addresses, but doesn't verify that the scope id specified at bind matches the interface that the address is configured on. It was report that this can hang a system. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * SCTP: Check to make sure file is valid before setting timeoutVlad Yasevich2007-07-051-1/+9
| | | | | | | | | | | | | | | | | | | | In-kernel sockets created with sock_create_kern don't usually have a file and file descriptor allocated to them. As a result, when SCTP tries to check the non-blocking flag, we Oops when dereferencing a NULL file pointer. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * SCTP: Fix thinko in sctp_copy_laddrs()Vlad Yasevich2007-07-051-1/+1
| | | | | | | | | | | | | | | | Correctly dereference bytes_copied in sctp_copy_laddrs(). I totally must have spaced when doing this. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds2007-07-069-19/+44
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Fix scheduling latency issue on 24K, 34K and 74K cores [MIPS] Add macros to encode processor revisions. [MIPS] RM7000: Enable ICACHE_REFILLS_WORKAROUND_WAR. [MIPS] SMTC: Fix cut'n'paste bug in Kconfig.debug [MIPS] Change libgcc-style functions from lib-y to obj-y [MIPS] Fix timer/performance interrupt detection [MIPS] AP/SP: Avoid triggering the 34K E125 performance issue [MIPS] 64-bit TO_PHYS_MASK macro for RM9000 processors
| * | [MIPS] Fix scheduling latency issue on 24K, 34K and 74K coresRalf Baechle2007-07-062-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The idle loop goes to sleep using the WAIT instruction if !need_resched(). This has is suffering from from a race condition that if if just after need_resched has returned 0 an interrupt might set TIF_NEED_RESCHED but we've just completed the test so go to sleep anyway. This would be trivial to fix by just disabling interrupts during that sequence as in: local_irq_disable(); if (!need_resched()) __asm__("wait"); local_irq_enable(); but the processor architecture leaves it undefined if a processor calling WAIT with interrupts disabled will ever restart its pipeline and indeed some processors have made use of the freedom provided by the architecture definition. This has been resolved and the Config7.WII bit indicates that the use of WAIT is safe on 24K, 24KE and 34K cores. It also is safe on 74K starting revision 2.1.0 so enable the use of WAIT with interrupts disabled for 74K based on a c0_prid of at least that. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | [MIPS] Add macros to encode processor revisions.Ralf Baechle2007-07-061-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Older processors used to encode processor version and revision in two 4-bit bitfields, the 4K seems to simply count up and even newer MTI cores have switched to use the 8-bits as 3:3:2 bitfield with the last field as the patch number. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | [MIPS] RM7000: Enable ICACHE_REFILLS_WORKAROUND_WAR.Ralf Baechle2007-07-061-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RM7000 processors and the E9000 cores have a bug (though PMC-Sierra opposes it being called that) where invalid instructions in the same I-cache line worth of instructions being fetched may case spurious exceptions. The workaround for this was only enabled for E9000 cores; enable it also for all RM7000-based platforms. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | [MIPS] SMTC: Fix cut'n'paste bug in Kconfig.debugRalf Baechle2007-07-061-1/+1
| | | | | | | | | | | | | | | | | | This effectivly turned the SMTC_IDLE_HOOK_DEBUG debug option into a no-op. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | [MIPS] Change libgcc-style functions from lib-y to obj-yRalf Baechle2007-07-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Reported by Eugene Surovegin <ebs@ebshome.net>. If only modules were users of these functions they did not get linked into the kernel proper, so later module loads would fail as well. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
generated by cgit v1.2.3 (git 2.46.0) at 2025-04-23 13:39:52 +0000