aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
| * | [ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return valueAmit Choudhary2006-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Check the return value of kmalloc() in function snd_card_opti9xx_pnp(), in file sound/isa/opti9xx/opti92x-ad1848.c. Signed-off-by: Amit Choudhary <amit2030@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
| * | [ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return valueAmit Choudhary2006-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Check the return value of kmalloc() in function snd_card_ad1816a_pnp(), in file sound/isa/ad1816a/ad1816a.c. Signed-off-by: Amit Choudhary <amit2030@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
| * | [ALSA] sound/isa/cmi8330.c: check kmalloc() return valueAmit Choudhary2006-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Check the return value of kmalloc() in function snd_cmi8330_pnp(), in file sound/isa/cmi8330.c. Signed-off-by: Amit Choudhary <amit2030@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
| * | [ALSA] sound/isa/gus/interwave.c: check kmalloc() return valueAmit Choudhary2006-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | Check the return value of kmalloc() in function snd_interwave_pnp(), in file sound/isa/gus/interwave.c. Signed-off-by: Amit Choudhary <amit2030@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* | | Merge branch 'for-linus' of ↵Linus Torvalds2006-10-23
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6: JFS: pageno needs to be long
| * | | JFS: pageno needs to be longDave Kleikamp2006-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | diRead and diWrite are representing the page number as an unsigned int. This causes file system corruption on volumes larger than 16TB. Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
* | | | Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds2006-10-23
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [PKT_SCHED] netem: Orphan SKB when adding to queue. [NET]: kernel-doc fix for sock.h [NET]: Reduce sizeof(struct flowi) by 20 bytes. [IPv6] fib: initialize tb6_lock in common place to give lockdep a key [ATM] nicstar: Fix a bogus casting warning [ATM] firestream: handle thrown error [ATM]: No need to return void [ATM]: handle sysfs errors [DCCP] ipv6: Fix opt_skb leak. [DCCP]: Fix Oops in DCCPv6
| * | | | [PKT_SCHED] netem: Orphan SKB when adding to queue.David S. Miller2006-10-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The networking emulator can queue SKBs for a very long time, so if you're using netem on the sender side for large bandwidth/delay product testing, the SKB socket send queue sizes become artificially larger. Correct this by calling skb_orphan() in netem_enqueue(). Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [NET]: kernel-doc fix for sock.hRandy Dunlap2006-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix kernel-doc warning in include/net/sock.h: Warning(/var/linsrc/linux-2619-rc1-pv//include/net/sock.h:894): No description found for parameter 'rcu' Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [NET]: Reduce sizeof(struct flowi) by 20 bytes.Eric Dumazet2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested by David, just kill off some unused fields in dnports to reduce sizef(struct flowi). If they come back, they should be moved to nl_u.dn_u in order not to enlarge again struct flowi [ Modified to really delete this stuff instead of using #if 0. -DaveM ] Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [IPv6] fib: initialize tb6_lock in common place to give lockdep a keyThomas Graf2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [ATM] nicstar: Fix a bogus casting warningAlan Cox2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Not enough to make Nicstar 64bit friendly but got squashed in passing so might as well be applied Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [ATM] firestream: handle thrown errorJeff Garzik2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc emits the following warning: drivers/atm/firestream.c: In function ‘fs_open’: drivers/atm/firestream.c:870: warning: ‘tmc0’ may be used uninitialized in this function This indicates a real bug. We should check make_rate() return value for potential errors. Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [ATM]: No need to return voidTobias Klauser2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The module_exit function has return-type void and pci_unregister_driver() returns void anyway. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [ATM]: handle sysfs errorsJeff Garzik2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [DCCP] ipv6: Fix opt_skb leak.David S. Miller2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based upon a patch from Jesper Juhl. Try to match the TCP IPv6 code this was copied from as much as possible, so that it's easy to see where to add the ipv6 pktoptions support code. Signed-off-by: David S. Miller <davem@davemloft.net>
| * | | | [DCCP]: Fix Oops in DCCPv6Gerrit Renker2006-10-21
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I think I got the cause for the Oops observed in http://www.mail-archive.com/dccp@vger.kernel.org/msg00578.html The problem is always with applications listening on PF_INET6 sockets. Apart from the mentioned oops, I observed another one one, triggered at irregular intervals via timer interrupt: run_timer_softirq -> dccp_keepalive_timer -> inet_csk_reqsk_queue_prune -> reqsk_free -> dccp_v6_reqsk_destructor The latter function is the problem and is also the last function to be called in said kernel panic. In any case, there is a real problem with allocating the right request_sock which is what this patch tackles. It fixes the following problem: - application listens on PF_INET6 - DCCPv4 packet comes in, is handed over to dccp_v4_do_rcv, from there to dccp_v4_conn_request Now: socket is PF_INET6, packet is IPv4. The following code then furnishes the connection with IPv6 - request_sock operations: req = reqsk_alloc(sk->sk_prot->rsk_prot); The first problem is that all further incoming packets will get a Reset since the connection can not be looked up. The second problem is worse: --> reqsk_alloc is called instead of inet6_reqsk_alloc --> consequently inet6_rsk_offset is never set (dangling pointer) --> the request_sock_ops are nevertheless still dccp6_request_ops --> destructor is called via reqsk_free --> dccp_v6_reqsk_destructor tries to free random memory location (inet6_rsk_offset not set) --> panic I have tested this for a while, DCCP sockets are now handled correctly in all three scenarios (v4/v6 only/v4-mapped). Commiter note: I've added the dccp_request_sock_ops forward declaration to keep the tree building and to reduce the size of the patch for 2.6.19, later I'll move the functions to the top of the affected source code to match what we have in the TCP counterpart, where this problem hasn't existed in the first place, dumb me not to have done the same thing on DCCP land 8) Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
* | | | Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6Linus Torvalds2006-10-23
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6: [SPARC64]: 8-byte align return value from compat_alloc_user_space()
| * | | | [SPARC64]: 8-byte align return value from compat_alloc_user_space()David S. Miller2006-10-23
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise we get a ton of unaligned exceptions, for cases such as compat_sys_msgrcv() which go: p = compat_alloc_user_space(second + sizeof(struct msgbuf)); and here 'second' can for example be an arbitrary odd value. Based upon a bug report from Jurij Smakov. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | Merge master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6Linus Torvalds2006-10-23
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: Convert INTC2 to IRQ table registration. sh: Updates for irq-flow-type naming changes. sh: Add some missing board headers. sh: Fix exception_handling_table alignment. sh: Cleanup board header directories. sh: Remove board-specific ide.h headers. sh: Proper show_stack/show_trace() implementation.
| * | | sh: Convert INTC2 to IRQ table registration.Paul Mundt2006-10-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the INTC2 code contains a fixed IRQ table that it iterates through to set the handler type, we move this in to the CPU subtype setup code instead and allow for submitting the table that way. This drops the ST40 tables, as nothing has been happening with those processors, while converting the only existing users to use the new table directly (SH7760 and SH7780). Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Updates for irq-flow-type naming changes.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | handle_irq_name() and set_irq_chip_and_handler() disappeared, update for desc->name and set_irq_chip_and_handler_name() use. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Add some missing board headers.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some of these were dropped in the header directory rework, add the few missing ones back in. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Fix exception_handling_table alignment.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the recent change ripping out interrupt_table, explicit padding of the table was missing, causing bad things to happen when manually inserting handlers in to the table. This problem particularly showed up in relation to do_fpu_state_restore() which was inserted quite deeply in to the table and ended up scribbling over a slab object. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Cleanup board header directories.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now with the ide.h mess sorted out, most of these boards don't need their own directory. Move the headers out, and update the driver paths. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Remove board-specific ide.h headers.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver that these were using never made it in to drivers/ide, so kill off the rest of the cruft. These will have to be reworked for board-specific platform devices through libata when they're added back through the setup code. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
| * | | sh: Proper show_stack/show_trace() implementation.Paul Mundt2006-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This splits out some of the previous show_stack() implementation which was mostly doing the show_trace() work without actually dumping any of the stack contents. This now gets split in to two sections, where we do the fetching of the stack pointer and subsequent stack dumping in show_stack(), while moving the call trace in to show_trace(). Signed-off-by: Paul Mundt <lethal@linux-sh.org>
* | | | Merge branch 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6Linus Torvalds2006-10-21
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | * 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6: [PATCH] x86-64: increase PHB1 split transaction timeout [PATCH] x86-64: Fix C3 timer test
| * | | | [PATCH] x86-64: increase PHB1 split transaction timeoutMuli Ben-Yehuda2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch increases the timeout for PCI split transactions on PHB1 on the first Calgary to work around an issue with the aic94xx adapter. Fixes kernel.org bugzilla #7180 (http://bugzilla.kernel.org/show_bug.cgi?id=7180) Based on excellent debugging and a patch by Darrick J. Wong <djwong@us.ibm.com> Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com> Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Andi Kleen <ak@suse.de> Acked-by: Darrick J. Wong <djwong@us.ibm.com>
| * | | | [PATCH] x86-64: Fix C3 timer testAndi Kleen2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was a typo in the C3 latency test to decide of the TSC should be used or not. It used the C2 latency threshold, not the C3 one. Fix that. This should fix the time on various dual core laptops. Signed-off-by: Andi Kleen <ak@suse.de>
* | | | | [MIPS] Fix aliasing bug in copy_to_user_page / copy_from_user_pageRalf Baechle2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current implementation uses a sequence of a cacheflush and a copy. This is racy in case of a multithreaded debuggee and renders GDB virtually unusable. Aside this fixes a performance hog rendering access to /proc/cmdline very slow and resulting in a enough cache stalls for the 34K AP/SP programming model to make the bare metal code on the non-Linux VPE miss RT deadlines. The main part of this patch was originally written by Ralf Baechle; Atushi Nemoto did the the debugging. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
* | | | | [MIPS] Cleanup remaining references to mips_counter_frequency.Ralf Baechle2006-10-21
|/ / / / | | | | | | | | | | | | | | | | | | | | Noticed by Samium Gromoff but his patch got stale in flight ... Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
* | | | Merge branch 'upstream-linus' of ↵Linus Torvalds2006-10-21
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev: [PATCH] libata-sff: Allow for wacky systems [PATCH] ahci: readability tweak [PATCH] libata: typo fix [PATCH] ATA must depend on BLOCK [PATCH] libata: use correct map_db values for ICH8
| * | | | [PATCH] libata-sff: Allow for wacky systemsAlan Cox2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some Linux supported platforms that simply cannot hit the low I/O addresses used by ATA legacy mode PCI mappings. These platforms have a window for PCI space that is fixed by the board logic and doesn't include the neccessary locations. Provide a config option so that such platforms faced with a controller that they cannot support simply error it and punt Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] ahci: readability tweakAlan Cox2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] libata: typo fixTejun Heo2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Typo fix in commment. Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] ATA must depend on BLOCKAdrian Bunk2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following compile error with CONFIG_ATA=y, CONFIG_BLOCK=n: ... CC drivers/ata/libata-scsi.o /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c: In function ‘ata_scsi_dev_config’: /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:791: warning: implicit declaration of function ‘blk_queue_max_sectors’ /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:799: error: ‘request_queue_t’ undeclared (first use in this function) /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:799: error: (Each undeclared identifier is reported only once /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:799: error: for each function it appears in.) /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:799: error: ‘q’ undeclared (first use in this function) /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:800: warning: implicit declaration of function ‘blk_queue_max_hw_segments’ /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c: In function ‘ata_scsi_slave_config’: /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ata/libata-scsi.c:831: warning: implicit declaration of function ‘blk_queue_max_phys_segments’ make[3]: *** [drivers/ata/libata-scsi.o] Error 1 Bug report by Jesper Juhl. Signed-off-by: Adrian Bunk <bunk@stusta.de> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] libata: use correct map_db values for ICH8Kristen Carlson Accardi2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use valid values for ICH8 map_db. With the old values, when the controller was in Native mode, and SCC was 1 (drives configured for IDE), any drive plugged into a slave port was not recognized. For Combined Mode (and SCC is still 1), 2 is a value value for MAP.map_value, and needs to be recognized. Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | | | Merge branch 'upstream-linus' of ↵Linus Torvalds2006-10-21
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (22 commits) [PATCH] ibmveth: Fix index increment calculation [PATCH] Fix timer race [PATCH] Remove useless comment from sb1250 [PATCH] ucc_geth: changes to ucc_geth driver as a result of qe_lib changes and bugfixes [PATCH] sky2: 88E803X transmit lockup [PATCH] e1000: Reset all functions after a PCI error [PATCH] WAN/pc300: handle, propagate minor errors [PATCH] Update smc91x driver with ARM Versatile board info [PATCH] wireless: WE-20 compatibility for ESSID and NICKN ioctls [PATCH] zd1211rw: fix build-break caused by association race fix [PATCH] sotftmac: fix a slab corruption in WEP restricted key association [PATCH] airo: check if need to freeze [PATCH] wireless: More WE-21 potential overflows... [PATCH] zd1201: Possible NULL dereference [PATCH] orinoco: fix WE-21 buffer overflow [PATCH] airo.c: check returned values [PATCH] bcm43xx-softmac: Fix system hang for x86-64 with >1GB RAM [PATCH] bcm43xx-softmac: check returned value from pci_enable_device [PATCH] softmac: Fix WX and association related races [PATCH] bcm43xx: fix race condition in periodic work handler ...
| * | | | | [PATCH] ibmveth: Fix index increment calculationDavid Gibson2006-10-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On Thu, Oct 12, 2006 at 06:22:14PM +1000, David Gibson wrote: > Your recent ibmveth commit, 751ae21c6cd1493e3d0a4935b08fb298b9d89773 > ("fix int rollover panic"), causes a rapid oops on my test machine > (POWER5 LPAR). > > I've bisected it down to that commit, but am still investigating the > cause of the crash itself. Found the problem, I believe: an object lesson in the need for great caution using ++. [...] @@ -213,6 +213,7 @@ static void ibmveth_replenish_buffer_poo } free_index = pool->consumer_index++ % pool->size; + pool->consumer_index = free_index; index = pool->free_map[free_index]; ibmveth_assert(index != IBM_VETH_INVALID_MAP); Since the ++ is used as post-increment, the increment is not included in free_index, and so the added line effectively reverts the increment. The produced_index side has an analagous bug. The following change corrects this: The recent commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773 introduced a bug in the producer/consumer index calculation in the ibmveth driver - incautious use of the post-increment ++ operator resulted in an increment being immediately reverted. This patch corrects the logic. Without this patch, the driver oopses almost immediately after activation on at least some machines. Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | | Merge branch 'upstream-fixes' of ↵Jeff Garzik2006-10-21
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes
| | * | | | | [PATCH] zd1211rw: fix build-break caused by association race fixJohn W. Linville2006-10-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The break was caused by 7c28ad2d83ecc637237fe684659a6afbce0bb2a8. Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] sotftmac: fix a slab corruption in WEP restricted key associationLaurent Riffard2006-10-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a slab corruption in ieee80211softmac_auth(). The size of a buffer was miscomputed. see http://bugzilla.kernel.org/show_bug.cgi?id=7245 Acked-by: Daniel Drake <dsd@gentoo.org> Signed-off-by: Laurent Riffard <laurent.riffard@free.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] airo: check if need to freezeDave Kleikamp2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The airo driver used to break out of while loop if there were any signals pending. Since it no longer checks for signals, it at least needs to check if it needs to be frozen. Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com> Cc: Jean Tourrilhes <jt@hpl.hp.com> Cc: Sukadev Bhattiprolu <sukadev@us.ibm.com> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] wireless: More WE-21 potential overflows...Jean Tourrilhes2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After the Orinoco issue, I did an audit of other drivers for the same issue. Three drivers were NULL terminating the ESSID, which could cause an overflow in WE-21 when the ESSID has maximum size. Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] zd1201: Possible NULL dereferenceEric Sesterhenn2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we enter the if(!zd) and set free to 1, we dereference zd in the exit code. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] orinoco: fix WE-21 buffer overflowJean Tourrilhes2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the Orinoco driver overflow issue with WE-21. Cc: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Cc: Pavel Roskin <proski@gnu.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] airo.c: check returned valuesFlorin Malita2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | create_proc_entry() can fail and return NULL in setup_proc_entry(), the result must be checked before dereferencing. (Coverity ID 1443) init_wifidev() & setup_proc_entry() can also fail in _init_airo_card(). This adds the checks & cleanup code and removes some whitespace. Signed-off-by: Florin Malita <fmalita@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] bcm43xx-softmac: Fix system hang for x86-64 with >1GB RAMLarry Finger2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bcm43xx-softmac software currently fails when running on x86_64 systems with more than 1GB RAM and one of the card variants with 30-bit DMA addressing. This patch uses the address extension bits in the hardware to set the correct DMA mask for the specific card in use. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | | [PATCH] bcm43xx-softmac: check returned value from pci_enable_deviceLarry Finger2006-10-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linus's tree now has a configuration option that prints a warning whenever the returned value of any routine is ignored. This patch fixes the only such warning for bcm43xx. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.2 (git 2.25.0) at 2024-10-20 01:38:07 -0400