summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [TR]: Preserve RIF flag even for 2 byte RIF fields.Jochen Friedrich2005-10-251-2/+3
| | | | | Signed-off-by: Jochen Friedrich <jochen@scram.de> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
* [IPV6]: Fix refcnt of struct ip6_flowlabelYan Zheng2005-10-251-1/+1
| | | | | | Signed-off-by: Yan Zheng <yanzheng@21cn.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
* [PATCH] qlogic lockup fixAndrew Morton2005-10-251-1/+2
| | | | | | | | | | | | | | | If qla2x00_probe_one()'s call to qla2x00_iospace_config() fails, we call qla2x00_free_device() to clean up. But because ha->dpc_pid hasn't been set yet, qla2x00_free_device() tries to stop a kernel thread which hasn't started yet. It does wait_for_completion() against an uninitialised completion struct and the kernel hangs up. Fix it by initialising ha->dpc_pid a bit earlier. Cc: Andrew Vasquez <andrew.vasquez@qlogic.com> Cc: James Bottomley <James.Bottomley@steeleye.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] alpha: atomic dependency fixAndrew Morton2005-10-253-30/+37
| | | | | | | | | | | | | My alpha build is exploding because asm/atomic.h now needs smb_mb(), which is over in the (not included) system.h. I fear what will happen if I include system.h into atomic.h, so let's put the barriers into their own header file. Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] Return the line length via sysfs for fbdevJames Simmons2005-10-241-0/+8
| | | | | | | | This small patch returns the stride/line length of the framebuffer via sysfs. Signed-off-by: James Simmons <jsimmons@infradead.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] ALSA: Fix Oops of suspend/resume with generic driversTakashi Iwai2005-10-241-2/+4
| | | | | | | | The patch fixes Oops from sound drivers using generic platform device but have no suspend/resume callbacks. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] uml: fix compile failure for TT modeMiklos Szeredi2005-10-242-2/+2
| | | | | | | | | | | | | Without this patch, uml compile fails with: LD .tmp_vmlinux1 arch/um/kernel/built-in.o: In function `config_gdb_cb': arch/um/kernel/tt/gdb.c:129: undefined reference to `TASK_EXTERN_PID' Tested on i386, but fix needed on x86_64 too AFAICS. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() raceOleg Nesterov2005-10-241-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This might be harmless, but looks like a race from code inspection (I was unable to trigger it). I must admit, I don't understand why we can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)' without doing bump_cpu_timer(), but this is what original code does. posix_cpu_timer_set: read_lock(&tasklist_lock); spin_lock(&p->sighand->siglock); list_del_init(&timer->it.cpu.entry); spin_unlock(&p->sighand->siglock); We are probaly deleting the timer from run_posix_cpu_timers's 'firing' local list_head while run_posix_cpu_timers() does list_for_each_safe. Various bad things can happen, for example we can just delete this timer so that list_for_each() will not notice it and run_posix_cpu_timers() will not reset '->firing' flag. In that case, .... if (timer->it.cpu.firing) { read_unlock(&tasklist_lock); timer->it.cpu.firing = -1; return TIMER_RETRY; } sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again, it returns TIMER_RETRY ... Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] posix-timers: exit path cleanupOleg Nesterov2005-10-241-0/+6
| | | | | | | No need to rebalance when task exited Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] posix-timers: remove false BUG_ON() from run_posix_cpu_timers()Oleg Nesterov2005-10-242-26/+18
| | | | | | | | | | | | | | | | | do_exit() clears ->it_##clock##_expires, but nothing prevents another cpu to attach the timer to exiting process after that. After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and before do_exit() calls 'schedule() local timer interrupt can find tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu does sys_wait4) interrupted task has ->signal == NULL. At this moment exiting task has no pending cpu timers, they were cleaned up in __exit_signal()->posix_cpu_timers_exit{,_group}(), so we can just return from irq. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() racesOleg Nesterov2005-10-241-19/+10
| | | | | | | | | | | | | | | | | | | | | | 1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks. That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set() lock_timer(timer); if (timer->task == NULL) return; read_lock(tasklist); put_task_struct(timer->task) is racy. With this patch timer->task modified and accounted only under timer->it_lock. Sadly, this means that dead task_struct won't be freed until timer deleted or armed. 2. run_posix_cpu_timers() collects expired timers into local list under tasklist + ->sighand again. That means that posix_cpu_timer_del() should check timer->it.cpu.firing under these locks too. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-for-linus-2.6Linus Torvalds2005-10-235-8/+17
|\
| * [SCSI] scsi_error thread exits in TASK_INTERRUPTIBLE state.Steven Rostedt2005-10-191-0/+2
| | | | | | | | | | | | | | | | Found in the -rt patch set. The scsi_error thread likely will be in the TASK_INTERRUPTIBLE state upon exit. This patch fixes this bug. Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] mptsas: fix phy identifiersChristoph Hellwig2005-10-171-4/+8
| | | | | | | | | | | | | | | | | | | | This patch from Eric fixes handling of the phy identifiers in mptsas. I've split it up from his bigger patch as it should go into 2.6.14 still. Signed-off-by: Eric Moore <Eric.Moore@lsil.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] 2.6.13.3; add Pioneer DRM-624x to drivers/scsi/scsi_devinfo.cKarl Magnus Kolstoe2005-10-171-0/+1
| | | | | | | | | | | | | | | | The patch below should make the Pioneer DRM-624X automatically be set up with all 6 "drives". (6 slot SCSI CD changer) Signed-off-by: Karl Magnus Kolstø <karl.kolsto@uib.no> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] Fix leak of Scsi_CmndsAlan Stern2005-10-161-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | When a request is deferred in scsi_init_io because the sg table could not be allocated, the associated scsi_cmnd is not released and the request is not marked with REQ_DONTPREP. When the command is retried, if scsi_prep_fn decides to kill it then the scsi_cmnd will never be released. This patch (as573) changes scsi_init_io so that it calls scsi_put_command before deferring a request. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] FW: [PATCH] for Deadlock in transport_fcJames.Smart@Emulex.Com2005-10-161-3/+10
| | | | | | | | | | | | | | Cannot call fc_rport_terminate() under the host lock, so drop the lock. Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] Fix aacraid regressionSalyzyn, Mark2005-10-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Juan was kind enough to linger on site, and work on a production machine, to try the parameter to make the system stable. He discovered that reducing the maximum transfer size issued to the adapter to 128KB stabilized his system. This is related to an earlier change for the 2.6.13 tree resulting from Martin Drab's testing where the transfer size was reduced from 4G to 256KB; we needed to go still further in scaling back the request size. Here is the patch that tames this regression. Signed-off-by: Mark Salyzyn <aacraid@adaptec.com> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
| * [SCSI] NCR5380: fix undefined preprocessor identifierRandy Dunlap2005-10-161-1/+1
| | | | | | | | | | | | | | | | | | Fix 12 undefined preprocessor identifier warnings (4 each in 3 driver builds): drivers/scsi/NCR5380.c:2744:16: warning: undefined preprocessor identifier 'NDEBUG_ABORT' drivers/scsi/NCR5380.c:2744:16: warning: "NDEBUG_ABORT" is not defined Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
* | [PATCH] ib: mthca: Always re-arm EQs in mthca_tavor_interrupt()Roland Dreier2005-10-231-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | We should always re-arm an event queue's interrupt in mthca_tavor_interrupt() if the corresponding bit is set in the event cause register (ECR), even if we didn't find any entries in the EQ. If we don't, then there's a window where we miss an EQ entry and then get stuck because we don't get another EQ event. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] inotify/idr leak fixAndrew Morton2005-10-233-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug which was reported and diagnosed by Stefan Jones <stefan.jones@churchillrandoms.co.uk> IDR trees include a cache of idr_layer objects. There's no way to destroy this cache, so when we discard an overall idr tree we end up leaking some memory. Add and use idr_destroy() for this. v9fs and infiniband also need to use idr_destroy() to avoid leaks. Or, we make the cache global, like radix_tree_preload(). Which is probably better. Later. Cc: Eric Van Hensbergen <ericvh@ericvh.myip.org> Cc: Roland Dreier <rolandd@cisco.com> Cc: Robert Love <rml@novell.com> Cc: John McCutchan <ttb@tentacle.dhs.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] Kconfig: saa7134-dvb should not select cx22702Mike Krufky2005-10-231-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On 2005-05-01, Gerd Knorr sent in a patch to add cx22702 to cx88-dvb: [PATCH] dvb: cx22702 frontend driver update http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9990d744bea7d28e83c420e2c9d524c7a8a2d136 ...but as we can see, the Kconfig portion of his patch was incorrectly applied to saa7134-dvb instead of cx88-dvb. On 2005-06-24, Adrian bunk fixed cx88-dvb: [PATCH] VIDEO_CX88_DVB must select DVB_CX22702 http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d6988588e13616587aa879c2e0bd7cd811705e5d ...but we never removed the original patch from Gerd. This patch sets things straight: saa7134-dvb should not select cx22702 Signed-off-by: Michael Krufky <mkrufky@m1k.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] SELinux: handle sel_make_bools() failure in selinuxfsDavi Arnaut2005-10-231-1/+3
| | | | | | | | | | | | | | | | | | | | | | This patch fixes error handling in sel_make_bools(), where currently we'd get a memory leak via security_get_bools() and try to kfree() the wrong pointer if called again. Signed-off-by: James Morris <jmorris@namei.org> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] selinux: Fix NULL deref in policydb_destroyStephen Smalley2005-10-231-2/+4
| | | | | | | | | | | | | | | | | | | | | | This patch fixes a possible NULL dereference in policydb_destroy, where p->type_attr_map can be NULL if policydb_destroy is called to clean up a partially loaded policy upon an error during policy load. Please apply. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] aio syscalls are not checked by lsmKostik Belousov2005-10-231-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Another case of missing call to security_file_permission: aio functions (namely, io_submit) does not check credentials with security modules. Below is the simple patch to the problem. It seems that it is enough to check for rights at the request submission time. Signed-off-by: Kostik Belousov <kostikbel@gmail.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] kernel-parameters cleanupRandy Dunlap2005-10-231-236/+260
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix typos & trailing whitespace. Add blank lines in a few places. Remove "AM53C974=" option: driver does not exist. Restrict to < 80 columns in most places (but don't split formatted command-line arguments). Add a few option arguments for completeness. Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | cardbus: limit IO windows to 256 bytesLinus Torvalds2005-10-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | That's what we've always historically done, and bigger windows seem to confuse some cardbus bridges. Or something. Alan reports that this makes the ThinkPad 600x series work properly again: the 4kB IO window for some reason made IDE DMA not work, which makes IDE painfully slow even if it works after DMA timeouts. Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | Merge master.kernel.org:/pub/scm/linux/kernel/git/acme/net-2.6Linus Torvalds2005-10-231-32/+16
|\ \
| * | [NEIGH] Fix timer leak in neigh_changeaddrHerbert Xu2005-10-231-30/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | neigh_changeaddr attempts to delete neighbour timers without setting nud_state. This doesn't work because the timer may have already fired when we acquire the write lock in neigh_changeaddr. The result is that the timer may keep firing for quite a while until the entry reaches NEIGH_FAILED. It should be setting the nud_state straight away so that if the timer has already fired it can simply exit once we relinquish the lock. In fact, this whole function is simply duplicating the logic in neigh_ifdown which in turn is already doing the right thing when it comes to deleting timers and setting nud_state. So all we have to do is take that code out and put it into a common function and make both neigh_changeaddr and neigh_ifdown call it. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| * | [NEIGH] Fix add_timer race in neigh_add_timerHerbert Xu2005-10-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | neigh_add_timer cannot use add_timer unconditionally. The reason is that by the time it has obtained the write lock someone else (e.g., neigh_update) could have already added a new timer. So it should only use mod_timer and deal with its return value accordingly. This bug would have led to rare neighbour cache entry leaks. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| * | [NEIGH] Print stack trace in neigh_add_timerHerbert Xu2005-10-231-0/+1
| | | | | | | | | | | | | | | | | | | | | Stack traces are very helpful in determining the exact nature of a bug. So let's print a stack trace when the timer is added twice. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | Posix timers: limit number of timers firing at onceLinus Torvalds2005-10-231-6/+14
|/ / | | | | | | | | | | | | | | | | | | | | Bursty timers aren't good for anybody, very much including latency for other programs when we trigger lots of timers in interrupt context. So set a random limit, after which we'll handle the rest on the next timer tick. Noted by Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] alpha: additional smp barriersIvan Kokshaysky2005-10-221-4/+8
| | | | | | | | | | | | | | | | | | | | | | As stated in Documentation/atomic_ops.txt, atomic functions returning values must have the memory barriers both before and after the operation. Thanks to DaveM for pointing that out. Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [AX.25]: Fix signed char bugRalf Baechle2005-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | On architectures where the char type defaults to unsigned some of the arithmetic in the AX.25 stack to fail, resulting in some packets being dropped on receive. Credits for tracking this down and the original patch to Bob Brose N0QBJ <linuxhams@n0qbj-11.ampr.org>. Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
* | [SK_BUFF]: ipvs_property field must be copiedJulian Anastasov2005-10-222-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | IPVS used flag NFC_IPVS_PROPERTY in nfcache but as now nfcache was removed the new flag 'ipvs_property' still needs to be copied. This patch should be included in 2.6.14. Further comments from Harald Welte: Sorry, seems like the bug was introduced by me. Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
* | [PATCH] typo fix in last cpufreq powernow patchChris Wright2005-10-211-1/+1
| | | | | | | | | | | | | | | | Not sure how it slipped by, but here's a trivial typo fix for powernow. Signed-off-by: Chris Wright <chrisw@osdl.org> [ It's "nurter" backwards.. Maybe we have a hillbilly The Shining fan? ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] Call exit_itimers from do_exit, not __exit_signalRoland McGrath2005-10-213-14/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When I originally moved exit_itimers into __exit_signal, that was the only place where we could reliably know it was the last thread in the group dying, without races. Since then we've gotten the signal_struct.live counter, and do_exit can reliably do group-wide cleanup work. This patch moves the call to do_exit, where it's made without locks. This avoids the deadlock issues that the old __exit_signal code's comment talks about, and the one that Oleg found recently with process CPU timers. [ This replaces e03d13e985d48ac4885382c9e3b1510c78bd047f, which is why it was just reverted. ] Signed-off-by: Roland McGrath <roland@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | Revert "Fix cpu timers exit deadlock and races"Linus Torvalds2005-10-211-11/+17
| | | | | | | | | | Revert commit e03d13e985d48ac4885382c9e3b1510c78bd047f, to be replaced by a much nicer fix from Roland.
* | [PATCH] cpufreq: fix pending powernow timer stuck conditionDave Jones2005-10-211-11/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AMD recently discovered that on some hardware, there is a race condition possible when a C-state change request goes onto the bus at the same time as a P-state change request. Both requests happen, but the southbridge hardware only acknowledges the C-state change. The PowerNow! driver is then stuck in a loop, waiting for the P-state change acknowledgement. The driver eventually times out, but can no longer perform P-state changes. It turns out the solution is to resend the P-state change, which the southbridge will acknowledge normally. Thanks to Johannes Winkelmann for reporting this and testing the fix. Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com> Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] ppc64: Fix typo bug in iSeries hash codeDavid Gibson2005-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes a stupid typo bug in the iSeries hash table code. When we place a hash PTE in the secondary bucket, instead of setting the SECONDARY flag bit, as we should, we (redundantly) set the VALID flag. This was introduced with the patch abolishing bitfields from the hash table code. Mea culpa, oops. It hasn't been noticed until now because in practice we don't hit the secondary bucket terribly often. Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds2005-10-214-14/+48
|\ \
| * | [ARM] Fix Integrator IM/PD-1 supportRussell King2005-10-211-7/+8
| | | | | | | | | | | | Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] 3028/1: S3C2410 - add DCLK mask definitionsBen Dooks2005-10-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Ben Dooks From: Guillaume Gourat <guillaume.gourat@nexvision.fr> Add MASK definitions for DCLK0 and DCLK1 Signed-off-by: Guillaume Gourat <guillaume.gourat@nexvision.fr> Signed-off-by: Ben Dooks <ben-linux@fluff.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] 3027/1: BAST - reduce NAND timings slightlyBen Dooks2005-10-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Ben Dooks The current Simtec BAST nand area timings are a little too slow to be obtained by a 2410 running at 266MHz, so reduce the timings slightly to bring them into the acceptable range. Signed-off-by: Ben Dooks <ben-linux@fluff.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] 3026/1: S3C2410 - avoid possible overflow in pll calculationsBen Dooks2005-10-201-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Ben Dooks Avoid the possiblity that if the board is using a 16.9334 or higher crystal with a high PLL multiplier, then the pll value could overflow the capability of an int. Also fix the value types of the intermediate variables to unsigned int. Rewrite of patch from Guillaume Gourat Signed-off-by: Ben Dooks <ben-linux@fluff.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] 3025/1: Add I2S platform device for PXAMatt Reimer2005-10-201-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Matt Reimer Adds an I2S platform_device for PXA. I2S is used to interface with sound chips on systems like iPAQ h1910/h2200/hx4700 and Asus 716. Signed-off-by: mreimer@vpop.net Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* | | Merge master.kernel.org:/pub/scm/linux/kernel/git/acme/net-2.6Linus Torvalds2005-10-214-18/+8
|\ \ \
| * | | [TCP] Allow len == skb->len in tcp_fragmentHerbert Xu2005-10-201-11/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is legitimate to call tcp_fragment with len == skb->len since that is done for FIN packets and the FIN flag counts as one byte. So we should only check for the len > skb->len case. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
| * | | [DCCP]: Clear the IPCB areaHerbert Xu2005-10-202-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the problem has nothing to do with use-after-free or double-free. It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB format that's incompatible with IP. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Ian McDonald <imcdnzl@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
| * | | [DCCP]: Make dccp_write_xmit always free the packetHerbert Xu2005-10-202-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | icmp_send doesn't use skb->sk at all so even if skb->sk has already been freed it can't cause crash there (it would've crashed somewhere else first, e.g., ip_queue_xmit). I found a double-free on an skb that could explain this though. dccp_sendmsg and dccp_write_xmit are a little confused as to what should free the packet when something goes wrong. Sometimes they both go for the ball and end up in each other's way. This patch makes dccp_write_xmit always free the packet no matter what. This makes sense since dccp_transmit_skb which in turn comes from the fact that ip_queue_xmit always frees the packet. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 09:39:18 +0000