aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* [MTD] Make init_tqm_mtd function staticDmitri Vorobiev2008-12-10
| | | | | | | | The init_tqm_mtd function does not need to be defined globally in drivers/mtd/maps/tqm8xxl.c. Make it static. Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@movial.fi> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* [MTD] Make uclinux_mtd_cleanup and uclinux_mtd_init staticDmitri Vorobiev2008-12-10
| | | | | | | | | The functions uclinux_mtd_cleanup and uclinux_mtd_init do not heed to be global. Add the needed keyword to the file drivers/mtd/maps/uclinux.c to make these functions static. Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@movial.fi> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* [MTD] Make lart_flash_init, lart_flash_exit staticDmitri Vorobiev2008-12-10
| | | | | | | | | The symbols lart_flash_init, lart_flash_exit are needlessly defined global in drivers/mtd/devices/lart.c, so make them static. Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@movial.fi> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* [MTD] Make init_sbc8240_mtd function staticDmitri Vorobiev2008-12-10
| | | | | | | | | The function init_sbc8240_mtd is not called from outside the module drivers/mtd/maps/sbc8240.c where it is defined, so it can become static. Add the needed keyword. Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@movial.fi> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* [MTD] Make init_sharpsl symbol staticDmitri Vorobiev2008-12-10
| | | | | | | | | | The function init_sharpsl is needlessly defined global. Make it static by adding the needed keyword to the file drivers/mtd/maps/sharpsl-flash.c, where the function is defined. Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@movial.fi> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* Merge git://git.infradead.org/mtd-2.6Linus Torvalds2008-12-09
|\ | | | | | | | | | | | | | | | | | | | | | | | | * git://git.infradead.org/mtd-2.6: [MTD] [NAND] fix OOPS accessing flash operations over STM flash on PXA [MTD] [NAND] drivers/mtd/nand/pasemi_nand.c: Add missing pci_dev_put [MTD] [NAND] fsl_upm: fix build problem with 2.6.28-rc2 [MTD] physmap: fix memory leak on physmap_flash_remove by using devres [MTD] m25p80: chip erase != block erase != sector erase [MTD] m25p80: fix detection of m25p16 flashes [MTD] m25p80: fix detection of SPI parts [MTD] [NAND] OMAP: OneNAND: header file relocation (part 2) [MTD] [NAND] OMAP: OneNAND: header file relocation
| * [MTD] [NAND] fix OOPS accessing flash operations over STM flash on PXADenis V. Lunev2008-12-03
| | | | | | | | | | | | | | | | | | | | | | STM 2Gb flash is a large-page NAND flash. Set operations accordingly. This field is dereferenced without a check in several places resulting in OOPS. Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Eric Miao <ymiao3@marvell.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] [NAND] drivers/mtd/nand/pasemi_nand.c: Add missing pci_dev_putJulia Lawall2008-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pci_get_device increments a reference count that should be decremented using pci_dev_put. The semantic patch that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @r exists@ local idexpression x; statement S,S1; position p1,p2,p3; expression E,E1; type T,T1; expression *ptr != NULL; @@ ( if ((x@p1 = pci_get_device(...)) == NULL) S | x@p1 = pci_get_device(...); ) ... when != pci_dev_put(...,(T)x,...) when != if (...) { <+... pci_dev_put(...,(T)x,...) ...+> } when != true x == NULL || ... when != x = E when != E = (T)x when any ( if (x == NULL || ...) S1 | if@p2 (...) { ... when != pci_dev_put(...,(T1)x,...) when != if (...) { <+... pci_dev_put(...,(T1)x,...) ...+> } when != x = E1 when != E1 = (T1)x ( return \(0\|<+...x...+>\|ptr\); | return@p3 ...; ) } ) @ script:python @ p1 << r.p1; p3 << r.p3; @@ print "* file: %s pci_get_device: %s return: %s" % (p1[0].file,p1[0].line,p3[0].line) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] [NAND] fsl_upm: fix build problem with 2.6.28-rc2Wolfgang Grandegger2008-11-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch fixes following build error: CC drivers/mtd/nand/fsl_upm.o drivers/mtd/nand/fsl_upm.c: In function 'fun_chip_init': drivers/mtd/nand/fsl_upm.c:168: warning: passing argument 2 of 'of_mtd_parse_partitions' from incompatible pointer type drivers/mtd/nand/fsl_upm.c:168: warning: passing argument 3 of 'of_mtd_parse_partitions' from incompatible pointer type drivers/mtd/nand/fsl_upm.c:168: error: too many arguments to function 'of_mtd_parse_partitions' make[1]: *** [drivers/mtd/nand/fsl_upm.o] Error 1 The breakage was introduced in 69fd3a8d098faf41a04930afa83757c0555ee360 ("[MTD] remove unused mtd parameter in of_mtd_parse_partitions()"). While at it, also add a check for the of_mtd_parse_partitions() return value. Signed-off-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] physmap: fix memory leak on physmap_flash_remove by using devresAtsushi Nemoto2008-11-26
| | | | | | | | | | | | | | | | | | | | | | physmap_flash_remove releases only last memory region. This causes memory leak if multiple resources were provided. This patch fixes this leakage by using devm_ functions. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] m25p80: chip erase != block erase != sector eraseChen Gong2008-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes broken terminology added in the "m25p80.c erase enhance" patch, which added a chip erase command but called it "block erase". There are already two block erase commands; blocks are 4KiB or 32KiB. There's also a sector erase (usually 64 KiB). Chip erase typically covers Megabytes. OPCODE_BE ==> OPCODE_CHIP_ERASE erase_block ==> erase_chip [dbrownell@users.sourceforge.net: update sector erase comments too ] Signed-off-by: Chen Gong <clumsycg@gmail.com> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] m25p80: fix detection of m25p16 flashesMike Frysinger2008-11-26
| | | | | | | | | | | | | | | | | | | | | | | | Commit d0e8c47c58575b9131e786edb488fd029eba443e ("m25p80.c extended jedec support") added support for extended ids but seems to break on flashes which don't have an extended id defined. If the table does not have an extid defined, then we should ignore it. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Michael Hennerich <Michael.Hennerich@analog.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] m25p80: fix detection of SPI partsMike Frysinger2008-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit d0e8c47c58575b9131e786edb488fd029eba443e ("m25p80.c extended jedec support") added support for extended ids but in the process managed to break detection of all flashes. The ext jedec id check was inserted into an if statement that lacked braces, and it did not add the required braces. As such, the detection routine always returns the first entry in the SPI flash list. Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] [NAND] OMAP: OneNAND: header file relocation (part 2)Adrian Hunter2008-11-26
| | | | | | | | | | | | | | Include <linux/dma-mapping.h> and <linux/io.h>, not files from <asm/*> Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
| * [MTD] [NAND] OMAP: OneNAND: header file relocationAdrian Hunter2008-11-24
| | | | | | | | | | Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
* | Merge branch 'audit.b59' of ↵Linus Torvalds2008-12-09
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current * 'audit.b59' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] fix broken timestamps in AVC generated by kernel threads [patch 1/1] audit: remove excess kernel-doc [PATCH] asm/generic: fix bug - kernel fails to build when enable some common audit code on Blackfin [PATCH] return records for fork() both to child and parent [PATCH] Audit: make audit=0 actually turn off audit
| * | [PATCH] fix broken timestamps in AVC generated by kernel threadsAl Viro2008-12-09
| | | | | | | | | | | | | | | | | | Timestamp in audit_context is valid only if ->in_syscall is set. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | [patch 1/1] audit: remove excess kernel-docRandy Dunlap2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Delete excess kernel-doc notation in kernel/auditsc.c: Warning(linux-2.6.27-git10//kernel/auditsc.c:1481): Excess function parameter or struct member 'tsk' description in 'audit_syscall_entry' Warning(linux-2.6.27-git10//kernel/auditsc.c:1564): Excess function parameter or struct member 'tsk' description in 'audit_syscall_exit' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Eric Paris <eparis@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | [PATCH] asm/generic: fix bug - kernel fails to build when enable some common ↵Mike Frysinger2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | audit code on Blackfin If you enable some common audit code, the kernel fails to build. In file included from lib/audit.c:17: include/asm-generic/audit_write.h:3: error: '__NR_swapon' undeclared here (not in a function) make[1]: *** [lib/audit.o] Error 1 make: *** [lib] Error 2 So do not use __NR_swapon if it isnt defined for a port. Signed-off-by: Mike Frysinger <vapier.adi@gmail.com> Signed-off-by: Bryan Wu <cooloney@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | [PATCH] return records for fork() both to child and parentAl Viro2008-12-09
| | | | | | | | | | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | [PATCH] Audit: make audit=0 actually turn off auditEric Paris2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently audit=0 on the kernel command line does absolutely nothing. Audit always loads and always uses its resources such as creating the kernel netlink socket. This patch causes audit=0 to actually disable audit. Audit will use no resources and starting the userspace auditd daemon will not cause the kernel audit system to activate. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | | Merge branch 'upstream-linus' of ↵Linus Torvalds2008-12-09
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ata: Fix experimental tags pata_ninja32: update ID table pata_sis: Remove bogus cable match ATA: piix, fix pointer deref on suspend pata_hpt366: fix clock detection
| * | | ata: Fix experimental tagsAlan Cox2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | Various tags are now way out of date Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * | | pata_ninja32: update ID tableAlan Cox2008-12-09
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * | | pata_sis: Remove bogus cable matchAlan Cox2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some systems report SIS 5513 as both vendor/id and subvendor/id string. In that case we can't distinguish the system by the id svid/sdid and in fact the entry here breaks some boxes. At some point we need to find another way to detect the Targa Visionary 1000, until then this trades a hang for some users with lower performance for others. Closes: #12092 Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * | | ATA: piix, fix pointer deref on suspendJiri Slaby2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hi, I've found this issue in the mmotm 2008-12-02-17-08. -- Commit ata_piix: add borked Tecra M4 to broken suspend list introduced DMI variables checking, but they can be null, so that we possibly dereference null. Check if they are null and avoid checks in that case. Solves: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 IP: [<ffffffff8043da97>] piix_pci_device_suspend+0x117/0x230 Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: Jeff Garzik <jgarzik@redhat.com> Cc: Alexandru Romanescu <a_romanescu@yahoo.co.uk> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * | | pata_hpt366: fix clock detectionTejun Heo2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pata_hpt366 had its clock detection wrong and detected 25Mhz as 40Mhz and vice-versa. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
* | | | Merge branch 'drm-fixes' of ↵Linus Torvalds2008-12-09
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: Disable the GM965 MSI errata workaround. drm/i915: Don't return error in evict_everything when we get to the end. drm/radeon: don't actually enable the IRQ regs until irq is enabled
| * | | | drm/i915: Disable the GM965 MSI errata workaround.Keith Packard2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since applying the fix suggested by the errata (disabling MSI), we've had issues with interrupts being stuck on despite IIR being 0 on GM965 hardware. Most reporters of the issue have confirmed that turning MSI back on fixes things, and given the difficulties experienced in getting reliable MSI working on Linux, it's believable that the errata was about software issues and not actual hardware issues. Signed-off-by: Dave Airlie <airlied@redhat.com>
| * | | | drm/i915: Don't return error in evict_everything when we get to the end.Owain Ainsworth2008-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Returning -ENOMEM errored all the way out of execbuf, so the rendering never occurred. Signed-off-by: Dave Airlie <airlied@redhat.com>
| * | | | drm/radeon: don't actually enable the IRQ regs until irq is enabledDave Airlie2008-12-09
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | vblank can try and enable the IRQ registers before we've set the interrupt handler up. Signed-off-by: Dave Airlie <airlied@redhat.com>
* | | | Merge branch 'merge' of ↵Linus Torvalds2008-12-09
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: powerpc/virtex5: Fix Virtex5 machine check handling
| * \ \ \ Merge branch 'merge' of ↵Paul Mackerras2008-12-08
| |\ \ \ \ | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/galak/powerpc into merge
| * | | | | powerpc/virtex5: Fix Virtex5 machine check handlingGrant Likely2008-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 440x5 core in the Virtex5 uses the 440A type machine check (ie, they have MCSRR0/MCSRR1). They thus need to call the appropriate fixup function to hook the right variant of the exception. Without this, all machine checks become fatal due to loss of context when entering the exception handler. Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
* | | | | | radeonfb: Disable new color expand acceleration unless explicitely enabledBenjamin Herrenschmidt2008-12-09
| |_|_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new color expansion acceleration for radeonfb appears to trigger problems with X on VT switch and suspend/resume on some machines. It might be a problem in the VT layer or in X, but I haven't quite found it yet, so in the meantime, this disables the acceleration by default, reverting to 2.6.27 state. It can be enabled using the "accel_cexp" module parameter or fbdev argument. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds2008-12-08
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tproxy: fixe a possible read from an invalid location in the socket match zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr() mac80211: use unaligned safe memcmp() in-place of compare_ether_addr() ipw2200: fix netif_*_queue() removal regression iwlwifi: clean key table in iwl_clear_stations_table function tcp: tcp_vegas ssthresh bug fix can: omit received RTR frames for single ID filter lists ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table netx-eth: initialize per device spinlock tcp: make urg+gso work for real this time enc28j60: Fix sporadic packet loss (corrected again) hysdn: fix writing outside the field on 64 bits b1isa: fix b1isa_exit() to really remove registered capi controllers can: Fix CAN_(EFF|RTR)_FLAG handling in can_filter Phonet: do not dump addresses from other namespaces netlabel: Fix a potential NULL pointer dereference bnx2: Add workaround to handle missed MSI. xfrm: Fix kernel panic when flush and dump SPD entries
| * | | | | tproxy: fixe a possible read from an invalid location in the socket matchBalazs Scheidler2008-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TIME_WAIT sockets need to be handled specially, and the socket match casted inet_timewait_sock instances to inet_sock, which are not compatible. Handle this special case by checking sk->sk_state. Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | Merge branch 'master' of ↵David S. Miller2008-12-06
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
| | * | | | | zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr()Shaddy Baddah2008-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Under my 2.6.28-rc6 sparc64, when associating to an AP through my zd1211rw device, I was seeing kernel log messages like (not exact output): Kernel unaligned access at TPC[10129b68] zd_mac_rx+0x144/0x32c [zd1211rw] For the zd1211rw module, on RX, the 80211 packet will be located after the PLCP header in the skb data buffer. The PLCP header being 5 bytes long, the 80211 header will start unaligned from an aligned skb buffer. As per Documentation/unaligned-memory-access.txt, we must replace the not unaligned() safe compare_ether_addr() with memcmp() to protect architectures that require alignment. Signed-off-by: Shaddy Baddah <shaddy_baddah@hotmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | mac80211: use unaligned safe memcmp() in-place of compare_ether_addr()Shaddy Baddah2008-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After fixing zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr(), I started to see kernel log messages detailing unaligned access: Kernel unaligned access at TPC[100f7f44] sta_info_get+0x24/0x68 [mac80211] As with the aforementioned patch, the unaligned access was eminating from a compare_ether_addr() call. Concerned that whilst it was safe to assume that unalignment was the norm for the zd1211rw, and take preventative measures, it may not be the case or acceptable to use the easy fix of changing the call to memcmp(). My research however indicated that it was OK to do this, as there are a few instances where memcmp() is the preferred mechanism for doing mac address comparisons throughout the module. Signed-off-by: Shaddy Baddah <shaddy_baddah@hotmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | ipw2200: fix netif_*_queue() removal regressionZhu Yi2008-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In "ipw2200: Call netif_*_queue() interfaces properly", netif_stop_queue() and netif_wake_queue() were removed with the reason "netif_carrier_{on,off}() handles starting and stopping packet flow into the driver". The patch also removes a valid condition check that ipw_tx_skb() cannot be called if device is not in STATUS_ASSOCIATED state. But netif_carrier_off() doesn't guarantee netdev->hard_start_xmit won't be called because linkwatch event is handled in a delayed workqueue. This caused a kernel oops reported by Frank Seidel: https://bugzilla.novell.com/show_bug.cgi?id=397390 This patch fixes the problem by moving the STATUS_ASSOCIATED check back to ipw_tx_skb(). It also adds a missing netif_carrier_off() call to ipw_disassociate(). Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: Chatre, Reinette <reinette.chatre@intel.com> Tested-by: Frank Seidel <fseidel@suse.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | iwlwifi: clean key table in iwl_clear_stations_table functionTomas Winkler2008-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch cleans uCode key table bit map iwl_clear_stations_table since all stations are cleared also the key table must be. Since the keys are not removed properly on suspend by mac80211 this may result in exhausting key table on resume leading to memory corruption during removal This patch also fixes a memory corruption problem reported in http://marc.info/?l=linux-wireless&m=122641417231586&w=2 and tracked in http://bugzilla.kernel.org/show_bug.cgi?id=12040. When the key is removed a second time the offset is set to 255 - this index is not valid for the ucode_key_table and corrupts the eeprom pointer (which is 255 bits from ucode_key_table). Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Reported-by: Carlos R. Mafra <crmafra2@gmail.com> Reported-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | | | | | tcp: tcp_vegas ssthresh bug fixDoug Leith2008-12-04
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a bug in tcp_vegas.c. At the moment this code leaves ssthresh untouched. However, this means that the vegas congestion control algorithm is effectively unable to reduce cwnd below the ssthresh value (if the vegas update lowers the cwnd below ssthresh, then slow start is activated to raise it back up). One example where this matters is when during slow start cwnd overshoots the link capacity and a flow then exits slow start with ssthresh set to a value above where congestion avoidance would like to adjust it. Signed-off-by: Doug Leith <doug.leith@nuim.ie> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | can: omit received RTR frames for single ID filter listsOliver Hartkopp2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit d253eee20195b25e298bf162a6e72f14bf4803e5 the single CAN identifier filter lists handle only non-RTR CAN frames. So we need to omit the check of these filter lists when receiving RTR CAN frames. Signed-off-by: Oliver Hartkopp <oliver@hartkopp.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc tableChas Williams2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As reported by Hugo Dias that it is possible to cause a local denial of service attack by calling the svc_listen function twice on the same socket and reading /proc/net/atm/*vc Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | netx-eth: initialize per device spinlockUwe Kleine-König2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The spinlock used in the netx-eth driver was never properly initialized. This was noticed using CONFIG_DEBUG_SPINLOCK=y Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | tcp: make urg+gso work for real this timeIlpo Järvinen2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I should have noticed this earlier... :-) The previous solution to URG+GSO/TSO will cause SACK block tcp_fragment to do zig-zig patterns, or even worse, a steep downward slope into packet counting because each skb pcount would be truncated to pcount of 2 and then the following fragments of the later portion would restore the window again. Basically this reverts "tcp: Do not use TSO/GSO when there is urgent data" (33cf71cee1). It also removes some unnecessary code from tcp_current_mss that didn't work as intented either (could be that something was changed down the road, or it might have been broken since the dawn of time) because it only works once urg is already written while this bug shows up starting from ~64k before the urg point. The retransmissions already are split to mss sized chunks, so only new data sending paths need splitting in case they have a segment otherwise suitable for gso/tso. The actually check can be improved to be more narrow but since this is late -rc already, I'll postpone thinking the more fine-grained things. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | enc28j60: Fix sporadic packet loss (corrected again)Baruch Siach2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Packet data read from the RX buffer the when the RSV is at the end of the RX buffer does not warp around. This causes packet loss, as the actual data is never read. Fix this by calculating the right packet data location. Thanks to Shachar Shemesh for suggesting the fix. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Acked-by: Claudio Lanconelli <lanconelli.claudio@eptar.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | hysdn: fix writing outside the field on 64 bitsPascal Terjan2008-12-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ifa_local is assumed to be unsigned long which lead to writing the address at dev->dev_addr-2 instead of +2 noticed thanks to gcc: drivers/isdn/hysdn/hysdn_net.c: In function `net_open': drivers/isdn/hysdn/hysdn_net.c:91: warning: array subscript is below array bounds Signed-off-by: Pascal Terjan <pterjan@mandriva.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | | b1isa: fix b1isa_exit() to really remove registered capi controllersWilfried Klaebe2008-12-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On "/etc/init.d/capiutils stop", this oops happened. The oops happens on reading /proc/capi/controllers because capi_ctrl->procinfo is called for the wrongly not unregistered controller, which points to b1isa_procinfo(), which was removed on module unload. b1isa_exit() did not call b1isa_remove() for its controllers because io[0] == 0 on module unload despite having been 0x340 on module load. Besides, just removing the controllers that where added on module load time and not those that were added later via b1isa_add_card() is wrong too - the place where all added cards are found is isa_dev[]. relevant dmesg lines: [ 0.000000] Linux version 2.6.27.4 (w@shubashi) (gcc version 4.3.2 (Debian 4.3.2-1) ) #3 Thu Oct 30 16:49:03 CET 2008 [ 67.403555] CAPI Subsystem Rev 1.1.2.8 [ 68.529154] capifs: Rev 1.1.2.3 [ 68.563292] capi20: Rev 1.1.2.7: started up with major 68 (middleware+capifs) [ 77.026936] b1: revision 1.1.2.2 [ 77.049992] b1isa: revision 1.1.2.3 [ 77.722655] kcapi: Controller [001]: b1isa-340 attached [ 77.722671] b1isa: AVM B1 ISA at i/o 0x340, irq 5, revision 255 [ 81.272669] b1isa-340: card 1 "B1" ready. [ 81.272683] b1isa-340: card 1 Protocol: DSS1 [ 81.272689] b1isa-340: card 1 Linetype: point to multipoint [ 81.272695] b1isa-340: B1-card (3.11-03) now active [ 81.272702] kcapi: card [001] "b1isa-340" ready. [ 153.721281] kcapi: card [001] down. [ 154.151889] BUG: unable to handle kernel paging request at e87af000 [ 154.152081] IP: [<e87af000>] [ 154.153292] *pde = 2655b067 *pte = 00000000 [ 154.153307] Oops: 0000 [#1] [ 154.153360] Modules linked in: rfcomm l2cap ppdev lp ipt_MASQUERADE tun capi capifs kernelcapi ac battery nfsd exportfs nfs lockd nfs_acl sunrpc sit tunnel4 bridge stp llc ipt_REJECT ipt_LOG xt_tcpudp xt_state iptable_filter iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack ip_tables x_tables nls_utf8 isofs nls_base zlib_inflate loop ipv6 netconsole snd_via82xx dvb_usb_dib0700 gameport dib7000p dib7000m dvb_usb snd_ac97_codec ac97_bus dvb_core mt2266 snd_pcm tuner_xc2028 dib3000mc dibx000_common mt2060 dib0070 snd_page_alloc snd_mpu401_uart snd_seq_midi snd_seq_midi_event btusb snd_rawmidi bluetooth snd_seq snd_timer snd_seq_device snd via686a i2c_viapro soundcore i2c_core parport_pc parport button dm_mirror dm_log dm_snapshot floppy sg ohci1394 uhci_hcd ehci_hcd 8139too mii ieee1394 usbcore sr_mod cdrom sd_mod thermal processor fan [last unloaded: b1] [ 154.153360] [ 154.153360] Pid: 4132, comm: capiinit Not tainted (2.6.27.4 #3) [ 154.153360] EIP: 0060:[<e87af000>] EFLAGS: 00010286 CPU: 0 [ 154.153360] EIP is at 0xe87af000 [ 154.153360] EAX: e6b9ccc8 EBX: e6b9ccc8 ECX: e87a0c67 EDX: e87af000 [ 154.153360] ESI: e142bbc0 EDI: e87a56e0 EBP: e0505f0c ESP: e0505ee4 [ 154.153360] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [ 154.153360] Process capiinit (pid: 4132, ti=e0504000 task=d1196cf0 task.ti=e0504000) [ 154.153360] Stack: e879f650 00000246 e0505ef4 c01472eb e0505f0c 00000246 e7001780 fffffff4 [ 154.153360] fffffff4 e142bbc0 e0505f48 c01a56c6 00000400 b805e000 d102dc80 e142bbe0 [ 154.153360] 00000000 e87a56e0 00000246 e12617ac 00000000 00000000 e1261760 fffffffb [ 154.153360] Call Trace: [ 154.153360] [<e879f650>] ? controller_show+0x20/0x90 [kernelcapi] [ 154.153360] [<c01472eb>] ? trace_hardirqs_on+0xb/0x10 [ 154.153360] [<c01a56c6>] ? seq_read+0x126/0x2f0 [ 154.153360] [<c01a55a0>] ? seq_read+0x0/0x2f0 [ 154.153360] [<c01c033c>] ? proc_reg_read+0x5c/0x90 [ 154.153360] [<c0189919>] ? vfs_read+0x99/0x140 [ 154.153360] [<c01c02e0>] ? proc_reg_read+0x0/0x90 [ 154.153360] [<c0189a7d>] ? sys_read+0x3d/0x70 [ 154.153360] [<c0103c3d>] ? sysenter_do_call+0x12/0x35 [ 154.153360] ======================= [ 154.153360] Code: Bad EIP value. [ 154.153360] EIP: [<e87af000>] 0xe87af000 SS:ESP 0068:e0505ee4 [ 154.153360] ---[ end trace 23750b6c2862de94 ]--- Signed-off-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Karsten Keil <kkeil@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-21 04:46:37 -0500