aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* powerpc: Add missing reference to coherent_dma_maskVitaly Bordug2008-07-09
| | | | | | | | | | There is dma_mask in of_device upon of_platform_device_create() but we don't actually set coherent_dma_mask. This may cause weird behavior of USB subsystem using of_device USB host drivers. Signed-off-by: Vitaly Bordug <vitb@kernel.crashing.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds2008-07-08
|\ | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: tcrypt - Fix memory leak in test_cipher
| * crypto: tcrypt - Fix memory leak in test_cipherDarren Jenkins2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity CID: 2306 & 2307 RESOURCE_LEAK In the second for loop in test_cipher(), data is allocated space with kzalloc() and is only ever freed in an error case. Looking at this loop, data is written to this memory but nothing seems to read from it. So here is a patch removing the allocation, I think this is the right fix. Only compile tested. Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | kernel/printk.c: Made printk_recursion_bug_msg static.Daniel Guilak2008-07-08
| | | | | | | | | | | | Signed-off-by: Daniel Guilak <daniel@danielguilak.com> Acked-by: Josh Triplett <josh@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | Fix broken fix for fsl-diu-dbTakashi Iwai2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | On 2.6.26-rc9, the commit 05946bce839b4fed5442dbfab77060fb75e051f3 ("fsl_diu_fb: fix build with CONFIG_PM=y, plus fix some warnings") breaks its previous fix f969c5672b16b857e5231ad3c78f08d8ef3305aa ("fsl-diu-db: compile fix") This patch reverts the broken part. Signed-off-by: Takashi Iwai <tiwai@suse.de> Acked-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | Merge branch 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6Linus Torvalds2008-07-08
|\ \ | | | | | | | | | | | | | | | | | | * 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups SUNRPC: Fix a double-free in rpcbind NFS: Fix readdir cache invalidation
| * | SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookupsTrond Myklebust2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that rpcb_next_version has been split into an IPv4 version and an IPv6 version, we Oops when rpcb_call_async attempts to look up the IPv6-specific RPC procedure in rpcb_next_version. Fix the Oops simply by having rpcb_getport_async pass the correct RPC procedure as an argument. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
| * | SUNRPC: Fix a double-free in rpcbindTrond Myklebust2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | It is wrong to be freeing up the rpcbind arguments if the call to rpcb_call_async() fails, since they should already have been freed up by rpcb_map_release(). Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
| * | NFS: Fix readdir cache invalidationTrond Myklebust2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | invalidate_inode_pages2_range() takes page offset arguments, not byte ranges. Another thought is that individual pages might perhaps get evicted by VM pressure, in which case we might perhaps want to re-read not only the evicted page, but all subsequent pages too (in case the server returns more/less data per page so that the alignment of the next entry changes). We should therefore remove the condition that we only do this on page->index==0. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
* | | Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds2008-07-08
|\ \ \ | | | | | | | | | | | | | | | | | | | | * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Fix 32bit kernels on R4k with 128 byte cache line size [MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs
| * | | [MIPS] Fix 32bit kernels on R4k with 128 byte cache line sizeThomas Bogendoerfer2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The generated copy_page for R4k CPU with a 128 byte cache line size used Create Dirty Exclusive cache line operations even if only part of the cache line was filled. This change avoids generating cache operations, if only part of the cache line size is copied in one loop. It also increases the maxmimum loop size, because the generated code even fits into the available space for r4k CPUs with 128 byte cache line size. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
| * | | [MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigsShane McDonald2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolve these mismatches by defining affected functions with the __cpuinit attribute, rather than __init. Signed-off-by: Shane McDonald <mcdonald.shane@gmail.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
* | | | reiserfs: discard prealloc in reiserfs_delete_inodeJeff Mahoney2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the removal of struct file from the xattr code, reiserfs_file_release() isn't used anymore, so the prealloc isn't discarded. This causes hangs later down the line. This patch adds it to reiserfs_delete_inode. In most cases it will be a no-op due to it already having been called, but will avoid hangs with xattrs. Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | | Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6Linus Torvalds2008-07-08
|\ \ \ \ | |_|/ / |/| | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: it8213: fix return value in it8213_init_one() palm_bk3710: fix IDECLK period calculation ide: add __ide_default_irq() inline helper
| * | | it8213: fix return value in it8213_init_one()Bartlomiej Zolnierkiewicz2008-07-08
| | | | | | | | | | | | | | | | Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
| * | | palm_bk3710: fix IDECLK period calculationSergei Shtylyov2008-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver uses completely bogus rounding formula for calculating period from the IDECLK frequency which gives one-off period values (e.g. 11 ns with 100 MHz IDECLK) which in turn can lead to overclocked IDE transfer timings. Actually, rounding is just wrong in this case, so use a mere division for a safe result. While at it, also: - give 'ide_palm_clk' variable a more suitable name; - get rid of the useless 'ideclkp' variable; - drop the LISP stype 'p' postfix from the 'clkp' variable's name. :-) Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> Cc: mcherkashin@ru.mvista.com Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
| * | | ide: add __ide_default_irq() inline helperBartlomiej Zolnierkiewicz2008-07-08
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add __ide_default_irq() inline helper and use it instead of ide_default_irq() in ide-probe.c and ns87415.c (all host drivers except IDE PCI ones always setup hwif->irq so it is enough to check only for I/O bases 0x1f0 and 0x170). This fixes post-2.6.25 regression since ide_default_irq() define could shadow ide_default_irq() inline. Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* | | Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6Linus Torvalds2008-07-08
|\ \ \ | |/ / |/| | | | | | | | * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] protect _PAGE_SPECIAL bit against mprotect
| * | [S390] protect _PAGE_SPECIAL bit against mprotectNick Piggin2008-07-08
| |/ | | | | | | | | | | | | | | | | | | | | Stop mprotect's pte_modify from wiping out the s390 pte_special bit, which caused oops thereafter when vm_normal_page thought X's abnormal was normal. Debugged-by: Ryan Hope <rmh3093@gmail.com> Debugged-by: Zan Lynx <zlynx@acm.org> Acked-by: Hugh Dickins <hugh@veritas.com> Signed-off-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
* / Correct hash flushing from huge_ptep_set_wrprotect()David Gibson2008-07-08
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As Andy Whitcroft recently pointed out, the current powerpc version of huge_ptep_set_wrprotect() has a bug. It just calls ptep_set_wrprotect() which in turn calls pte_update() then hpte_need_flush() with the 'huge' argument set to 0. This will cause hpte_need_flush() to flush the wrong hash entries (of any). Andy's fix for this is already in the powerpc tree as commit 016b33c4958681c24056abed8ec95844a0da80a3. I have confirmed this is a real bug, not masked by some other synchronization, with a new testcase for libhugetlbfs. A process write a (MAP_PRIVATE) hugepage mapping, fork(), then alter the mapping and have the child incorrectly see the second write. Therefore, this should be fixed for 2.6.26, and for the stable tree. Here is a suitable patch for 2.6.26, which I think will also be suitable for the stable tree (neither of the headers in question has been changed much recently). It is cut down slighlty from Andy's original version, in that it does not include a 32-bit version of huge_ptep_set_wrprotect(). Currently, hugepages are not supported on any 32-bit powerpc platform. When they are, a suitable 32-bit version can be added - the only 32-bit hardware which supports hugepages does not use the conventional hashtable MMU and so will have different needs anyway. Signed-off-by: Andy Whitcroft <apw@shadowen.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge branch 'for-linus' of ↵Linus Torvalds2008-07-07
|\ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: Revert "PCI: Correct last two HP entries in the bfsort whitelist"
| * Revert "PCI: Correct last two HP entries in the bfsort whitelist"Jesse Barnes2008-07-07
| | | | | | | | | | | | | | | | | | | | | | This reverts commit a1676072558854b95336c8f7db76b0504e909a0a. It duplicates the change from 8d64c781f0c5fbfdf8016bd1634506ff2ad1376a and only one should be applied, otherwise some of the Dell quirks are lost. Thanks to Tony Camuso for catching this. Acked-by: Tony Camuso <tcamuso@redhat.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
* | [UML] fix gcc ICEs and unresolved externsJeff Dike2008-07-07
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are various constraints on the use of unit-at-a-time: - i386 uses no-unit-at-a-time for pre-4.0 (not 4.3) - x86_64 uses unit-at-a-time always Uli reported a crash on x86_64 with gcc 4.1.2 with unit-at-a-time, resulting in commit c0a18111e571138747a98af18b3a2124df56a0d1 Ingo reported a gcc internal error with gcc 4.3 with no-unit-at-a-timem, resulting in 22eecde2f9034764a3fd095eecfa3adfb8ec9a98 Benny Halevy is seeing extern inlines not resolved with gcc 4.3 with no-unit-at-a-time This patch reintroduces unit-at-a-time for gcc >= 4.0, bringing back the possibility of Uli's crash. If that happens, we'll debug it. I started seeing both the internal compiler errors and unresolved inlines on Fedora 9. This patch fixes both problems, without so far reintroducing the crash reported by Uli. Signed-off-by: Jeff Dike <jdike@linux.intel.com> Cc: Benny Halevy <bhalevy@panasas.com> Cc: Adrian Bunk <bunk@kernel.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Ulrich Drepper <drepper@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds2008-07-07
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: can: add sanity checks fs_enet: restore promiscuous and multicast settings in restart() ibm_newemac: Fixes entry of short packets ibm_newemac: Fixes kernel crashes when speed of cable connected changes pasemi_mac: Access iph->tot_len with correct endianness ehea: Access iph->tot_len with correct endianness ehea: fix race condition ehea: add MODULE_DEVICE_TABLE ehea: fix might sleep problem forcedeth: fix lockdep warning on ethtool -s Add missing skb->dev assignment in Frame Relay RX code bridge: fix use-after-free in br_cleanup_bridges() tcp: fix a size_t < 0 comparison in tcp_read_sock tcp: net/ipv4/tcp.c needs linux/scatterlist.h libertas: support USB persistence on suspend/resume (resend) iwlwifi: drop skb silently for Tx request in monitor mode iwlwifi: fix incorrect 5GHz rates reported in monitor mode
| * can: add sanity checksOliver Hartkopp2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Even though the CAN netlayer only deals with CAN netdevices, the netlayer interface to the userspace and to the device layer should perform some sanity checks. This patch adds several sanity checks that mainly prevent userspace apps to send broken content into the system that may be misinterpreted by some other userspace application. Signed-off-by: Oliver Hartkopp <oliver.hartkopp@volkswagen.de> Signed-off-by: Urs Thuermann <urs.thuermann@volkswagen.de> Acked-by: Andre Naujoks <nautsch@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * fs_enet: restore promiscuous and multicast settings in restart()Laurent Pinchart2008-07-04
| | | | | | | | | | | | | | | | | | The restart() function is called when the link state changes and resets multicast and promiscuous settings. This patch restores those settings at the end of restart(). Signed-off-by: Laurent Pinchart <laurentp@cse-semaphore.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ibm_newemac: Fixes entry of short packetsSathya Narayanan2008-07-04
| | | | | | | | | | | | | | | | | | | | Short packets has to be discarded by the driver. So this patch addresses the issue of discarding the short packets of size lesser then ethernet header size. Signed-off-by: Sathya Narayanan <sathyan@teamf1.com> Signed-off-by: Stefan Roese <sr@denx.de> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ibm_newemac: Fixes kernel crashes when speed of cable connected changesSathya Narayanan2008-07-04
| | | | | | | | | | | | | | | | | | | | | | The descriptor pointers were not initialized to NIL values, so it was poiniting to some random addresses which was completely invalid. This fix takes care of initializing the descriptor to NIL values and clearing the valid descriptors on clean ring operation. Signed-off-by: Sathya Narayanan <sathyan@teamf1.com> Signed-off-by: Stefan Roese <sr@denx.de> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * pasemi_mac: Access iph->tot_len with correct endiannessRoland Dreier2008-07-04
| | | | | | | | | | | | | | | | | | | | | | iph->tot_len is stored in network byte order, so access it using ntohs(). This doesn't have any real world impact on pasemi_mac, since the device only exists as part of a big-endian system-on-chip, but fixing this gets rid of a sparse warning and avoids having a bad example in the tree. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ehea: Access iph->tot_len with correct endiannessRoland Dreier2008-07-04
| | | | | | | | | | | | | | | | | | | | | | iph->tot_len is stored in network byte order, so access it using ntohs(). This doesn't have any real world impact on ehea, since ehea only exists for big-endian platfroms (at the moment at least) but fixing this gets rid of a sparse warning and avoids having a bad example in the tree. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ehea: fix race conditionJan-Bernd Themann2008-07-04
| | | | | | | | | | | | | | | | | | | | | | When ehea_stop is called the function cancel_work_sync(&port->reset_task) is used to ensure that the reset task is not running anymore. We need an additional flag to ensure that it can not be scheduled after this call again for a certain time. Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ehea: add MODULE_DEVICE_TABLEJan-Bernd Themann2008-07-04
| | | | | | | | | | | | | | | | Required to allow distros to easily detect when ehea module needs to be loaded Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * ehea: fix might sleep problemJan-Bernd Themann2008-07-04
| | | | | | | | | | | | | | | | | | | | A mutex has to be replaced by spinlocks as it can be called from a context which does not allow sleeping. The kzalloc flag GFP_KERNEL has to be replaced by GFP_ATOMIC for the same reason. Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * forcedeth: fix lockdep warning on ethtool -sTobias Diedrich2008-07-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After enabling CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING I get the following warning when ethtool -s is first called on one of the forcedeth ports: ================================= [ INFO: inconsistent lock state ] 2.6.26-rc4 #28 --------------------------------- inconsistent {in-hardirq-W} -> {hardirq-on-W} usage. ethtool/1985 [HC0[0]:SC0[1]:HE1:SE0] takes: (&np->lock){++..}, at: [<ffffffffa000c5fd>] nv_set_settings+0xc8/0x3de [forcedeth] {in-hardirq-W} state was registered at: [<ffffffffffffffff>] 0xffffffffffffffff irq event stamp: 3606 hardirqs last enabled at (3605): [<ffffffff8068106f>] _spin_unlock_irqrestore+0x3f/0x68 hardirqs last disabled at (3604): [<ffffffff80680d38>] _spin_lock_irqsave+0x13/0x46 softirqs last enabled at (3534): [<ffffffff80246ba5>] __do_softirq+0xbc/0xc5 softirqs last disabled at (3606): [<ffffffff80680b33>] _spin_lock_bh+0x11/0x41 other info that might help us debug this: 2 locks held by ethtool/1985: #0: (rtnl_mutex){--..}, at: [<ffffffff80596072>] rtnl_lock+0x12/0x14 #1: (_xmit_ETHER){-+..}, at: [<ffffffffa000c5e8>] nv_set_settings+0xb3/0x3de [forcedeth] stack backtrace: Pid: 1985, comm: ethtool Not tainted 2.6.26-rc4 #28 Call Trace: [<ffffffff8025f190>] print_usage_bug+0x162/0x173 [<ffffffff8025fa8b>] mark_lock+0x231/0x41f [<ffffffff802607cf>] __lock_acquire+0x4e7/0xcac [<ffffffff8025fe64>] ? trace_hardirqs_on+0xf1/0x115 [<ffffffff80272c3a>] ? disable_irq_nosync+0x6f/0x7b [<ffffffff80261375>] lock_acquire+0x55/0x6e [<ffffffffa000c5fd>] ? :forcedeth:nv_set_settings+0xc8/0x3de [<ffffffff80680b15>] _spin_lock+0x2f/0x3c [<ffffffffa000c5fd>] :forcedeth:nv_set_settings+0xc8/0x3de [<ffffffff8058f8bb>] dev_ethtool+0x186/0xea3 [<ffffffff8067f446>] ? mutex_lock_nested+0x243/0x275 [<ffffffff8025df2b>] ? debug_mutex_free_waiter+0x46/0x4a [<ffffffff8067f469>] ? mutex_lock_nested+0x266/0x275 [<ffffffff8058e1ce>] dev_ioctl+0x4eb/0x600 [<ffffffff8068106f>] ? _spin_unlock_irqrestore+0x3f/0x68 [<ffffffff80580f91>] sock_ioctl+0x1f5/0x202 [<ffffffff802a322e>] vfs_ioctl+0x2a/0x77 [<ffffffff802a34d6>] do_vfs_ioctl+0x25b/0x270 [<ffffffff806807b6>] ? trace_hardirqs_on_thunk+0x35/0x3a [<ffffffff802a352d>] sys_ioctl+0x42/0x65 [<ffffffff8021fffb>] system_call_after_swapgs+0x7b/0x80 This is caused by the following snippet in nv_set_settings: netif_carrier_off(dev); if (netif_running(dev)) { nv_disable_irq(dev); netif_tx_lock_bh(dev); spin_lock(&np->lock); /* stop engines */ nv_stop_rxtx(dev); spin_unlock(&np->lock); netif_tx_unlock_bh(dev); } Because of nv_disable_irq this is probably not really a problem though (I guess) and replacing the spin_lock with spin_lock_irqsave could keep interrupts disabled for a longer period of time because of delays in nv_stop_rx and nv_stop_tx. Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de> Cc: Ayaz Abdulla <aabdulla@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * Add missing skb->dev assignment in Frame Relay RX codeKrzysztof Halasa2008-07-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 ([ETH]: Make eth_type_trans set skb->dev like the other *_type_trans) removed skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also needed for cases other than eth_type_trans(). Adding it back. It's quite serious and may be a security risk as it causes a wrong input interface indication (the physical hdlcX instead of logical pvcX). Probably -stable class fix. Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * bridge: fix use-after-free in br_cleanup_bridges()Patrick McHardy2008-07-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unregistering a bridge device may cause virtual devices stacked on the bridge, like vlan or macvlan devices, to be unregistered as well. br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all devices during cleanup. This is not enough however, if one of the additionally unregistered devices is next in the list to the bridge device, it will get freed as well and the iteration continues on the freed element. Restart iteration after each bridge device removal from the beginning to fix this, similar to what rtnl_link_unregister() does. Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * tcp: fix a size_t < 0 comparison in tcp_read_sockOctavian Purdila2008-07-03
| | | | | | | | | | | | | | | | <used> should be of type int (not size_t) since recv_actor can return negative values and it is also used in a < 0 comparison. Signed-off-by: Octavian Purdila <opurdila@ixiacom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * tcp: net/ipv4/tcp.c needs linux/scatterlist.hAndrew Morton2008-07-03
| | | | | | | | | | | | | | | | | | | | | | alpha: net/ipv4/tcp.c: In function 'tcp_calc_md5_hash': net/ipv4/tcp.c:2479: error: implicit declaration of function 'sg_init_table' net/ipv4/tcp.c:2482: error: implicit declaration of function 'sg_set_buf' net/ipv4/tcp.c:2507: error: implicit declaration of function 'sg_mark_end' Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * Merge branch 'master' of ↵David S. Miller2008-07-03
| |\ | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6
| | * libertas: support USB persistence on suspend/resume (resend)andrey@cozybit.com2008-07-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Handle .reset_resume() so that libertas can survive suspend/resume without reloading the firmware. Signed-off-by: Andrey Yurovsky <andrey@cozybit.com> Acked-by: Deepak Saxena <dsaxena@laptop.org> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * iwlwifi: drop skb silently for Tx request in monitor modeZhu Yi2008-07-02
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the problem to keep mac80211 resubmitting SKBs when Tx request cannot be met in monitor mode. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * iwlwifi: fix incorrect 5GHz rates reported in monitor modeRick Farrington2008-07-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the rates reported in monitor mode operation (Wireshark) for iwlwifi. Previously, packets with rates of 6M..24M would be reported incorrectly and packets with rates of 36M..54M would not passed up the stack. Signed-off-by: Rick Farrington <rickdic@hotmail.com> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* | | powerpc: Fix unterminated of_device_id array in legacy_serial.cBenjamin Herrenschmidt2008-07-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent patch to legacy_serial.c factored out some code by using the of_match_node() facility to match a node against an array of possible matches. However, the patch didn't properly terminate the array causing potential crashes in cases where no match is found. In addition, the name of the array was poorly chosen for a static symbol making debugging harder. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | vsprintf: add support for '%pS' and '%pF' pointer formatsLinus Torvalds2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They print out a pointer in symbolic format, if possible (ie using symbolic KALLSYMS information). The '%pS' format is for regular direct pointers (which can point to data or code and that you find on the stack during backtraces etc), while '%pF' is for C function pointer types. On most architectures, the two mean exactly the same thing, but some architectures use an indirect pointer for C function pointers, where the function pointer points to a function descriptor (which in turn contains the actual pointer to the code). The '%pF' code automatically does the appropriate function descriptor dereference on such architectures. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | vsprintf: add infrastructure support for extended '%p' specifiersLinus Torvalds2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This expands the kernel '%p' handling with an arbitrary alphanumberic specifier extension string immediately following the '%p'. Right now it's just being ignored, but the next commit will start adding some specific pointer type extensions. NOTE! The reason the extension is appended to the '%p' is to allow minimal gcc type checking: gcc will still see the '%p' and will check that the argument passed in is indeed a pointer, and yet will not complain about the extended information that gcc doesn't understand about (on the other hand, it also won't actually check that the pointer type and the extension are compatible). Alphanumeric characters were chosen because there is no sane existing use for a string format with a hex pointer representation immediately followed by alphanumerics (which is what such a format string would have traditionally resulted in). Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | vsprintf: split out '%p' handling logicLinus Torvalds2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | The actual code is the same, just split out into a helper function. This makes it easier to read, and allows for simple future extension of %p handling. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | vsprintf: split out '%s' handling logicLinus Torvalds2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | The actual code is the same, just split out into a helper function. This makes it easier to read, and allows for future sharing of the string code. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | Merge branch 'kvm-updates-2.6.26' of ↵Linus Torvalds2008-07-06
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm * 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm: KVM: IOAPIC: Fix level-triggered irq injection hang x86: KVM guest: Add memory clobber to hypercalls
| * | | KVM: IOAPIC: Fix level-triggered irq injection hangMark McLoughlin2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "remote_irr" variable is used to indicate an interrupt which has been received by the LAPIC, but not acked. In our EOI handler, we unset remote_irr and re-inject the interrupt if the interrupt line is still asserted. However, we do not set remote_irr here, leading to a situation where if kvm_ioapic_set_irq() is called, then we go ahead and call ioapic_service(). This means that IRR is re-asserted even though the interrupt is currently in service (i.e. LAPIC IRR is cleared and ISR/TMR set) The issue with this is that when the currently executing interrupt handler finishes and writes LAPIC EOI, then TMR is unset and EOI sent to the IOAPIC. Since IRR is now asserted, but TMR is not, then when the second interrupt is handled, no EOI is sent and if there is any pending interrupt, it is not re-injected. This fixes a hang only seen while running mke2fs -j on an 8Gb virtio disk backed by a fully sparse raw file, with aliguori "avoid fragmented virtio-blk transfers by copying" changes. Signed-off-by: Mark McLoughlin <markmc@redhat.com> Acked-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Avi Kivity <avi@qumranet.com>
| * | | x86: KVM guest: Add memory clobber to hypercallsAnthony Liguori2008-07-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hypercalls can modify arbitrary regions of memory. Make sure to indicate this in the clobber list. This fixes a hang when using KVM_GUEST kernel built with GCC 4.3.0. This was originally spotted and analyzed by Marcelo. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Avi Kivity <avi@qumranet.com>
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-26 21:19:44 -0500