aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge branch 'for-linus' of ↵Linus Torvalds2006-05-26
|\ | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband: IB/mthca: Fix posting lists of 256 receive requests to SRQ for Tavor
| * IB/mthca: Fix posting lists of 256 receive requests to SRQ for TavorMichael S. Tsirkin2006-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | If we post a list of length exactly a multiple of 256, nreq in doorbell gets set to 256 which is wrong: it should be encoded by 0. This is because we only zero it out on the next WR, which may not be there. The solution is to ring the doorbell after posting a WQE, not before posting the next one. This is the same bug that we just fixed for QPs with non-shared RQ. Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
* | [PATCH] s390: fix typo in stop_hz_timer.Martin Schwidefsky2006-05-25
| | | | | | | | | | | | | | | | Add missing parentheses for type cast to u64. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Dave Jones <davej@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | Linux 2.6.17-rc5v2.6.17-rc5Linus Torvalds2006-05-24
| |
* | [PATCH] V4L/DVB (4045): Fixes recursive dependency for I2CJean Delvare2006-05-24
|/ | | | | | | | | | | | Mixing "depends on I2C" and "select I2C" within the media subsystem leads to the following problem: Warning! Found recursive dependency: I2C DVB_BUDGET DVB_BUDGET_PATCH DVB_AV7110 VIDEO_SAA7146_VV VIDEO_SAA7146 I2C Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Manu Abraham <manu@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* Merge branch 'for-linus' of ↵Linus Torvalds2006-05-24
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband: IB/ipath: deref correct pointer when using kernel SMA IB/ipath: fix null deref during rdma ops IB/ipath: register as IB device owner IB/ipath: enable PE800 receive interrupts on user ports IB/ipath: enable GPIO interrupt on HT-460 IB/ipath: fix NULL dereference during cleanup IB/ipath: replace uses of LIST_POISON IB/ipath: fix reporting of driver version to userspace IB/ipath: don't modify QP if changes fail IB/ipath: fix spinlock recursion bug
| * IB/ipath: deref correct pointer when using kernel SMABryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | | | At this point, the core QP structure hasn't been initialized, so what's in there isn't valid. Get the same information elsewhere. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: fix null deref during rdma opsBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The problem was that node A's sending thread, which handles sending RDMA read response data, would write the trigger word, the last packet would be sent, node B would send a new RDMA read request, node A's interrupt handler would initialize s_rdma_sge, then node A's sending thread would update s_rdma_sge. This didn't happen very often naturally but was more frequent with 1 byte RDMA reads. Rather than adding more locking or increasing the QP structure size and copying sge data, I modified the copy routine to update the pointers before writing the trigger word to avoid the update race. Signed-off-by: Ralph Campbell <ralphc@pathscale.com> Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: register as IB device ownerBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | This fixes an oops. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: enable PE800 receive interrupts on user portsBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | | | Fixed so it works on the PE-800. It had not previously been updated to match PE-800 receive interrupt differences from HT-400. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: enable GPIO interrupt on HT-460Bryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | This is required for even semi-decent performance on OpenIB. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: fix NULL dereference during cleanupBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | | | Fix NULL deref due to pcidev being clobbered before dd->ipath_f_cleanup() was called. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: replace uses of LIST_POISONBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | Per Andrew's request. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: fix reporting of driver version to userspaceBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | Fix the interface version that gets exported to userspace. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: don't modify QP if changes failBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | Make sure modify_qp won't modify the QP if any of the changes failed. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
| * IB/ipath: fix spinlock recursion bugBryan O'Sullivan2006-05-23
| | | | | | | | | | | | | | | | | | The local loopback path for RC can lock the rkey table lock without blocking interrupts. The receive interrupt path can then call ipath_rkey_ok() and deadlock. Remove the redundant lock. Signed-off-by: Bryan O'Sullivan <bos@pathscale.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
* | Merge branch 'for-linus' of ↵Linus Torvalds2006-05-24
|\ \ | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6: JFS: Fix multiple errors in metapage_releasepage
| * | JFS: Fix multiple errors in metapage_releasepageDave Kleikamp2006-05-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like metapage_releasepage was making in invalid assumption that the releasepage method would not be called on a dirty page. Instead of issuing a warning and releasing the metapage, it should return 0, indicating that the private data for the page cannot be released. I also realized that metapage_releasepage had the return code all wrong. If it is successful in releasing the private data, it should return 1, otherwise it needs to return 0. Lastly, there is no need to call wait_on_page_writeback, since try_to_release_page will not call us with a page in writback state. Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
* | | Merge branch 'upstream-linus' of ↵Linus Torvalds2006-05-24
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev: [PATCH] libata: add pio flush for via atapi (was: Re: TR: ASUS A8V Deluxe, x86_64)
| * | | [PATCH] libata: add pio flush for via atapi (was: Re: TR: ASUS A8V Deluxe, ↵Albert Lee2006-05-24
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | x86_64) Backport the "pio flush" from the libata major update to 2.6.17 for via atapi. Signed-off-by: Albert Lee <albertcc@tw.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | Merge branch 'upstream-linus' of ↵Linus Torvalds2006-05-24
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: [PATCH] sky2: fix jumbo packet support
| * | | [PATCH] sky2: fix jumbo packet supportStephen Hemminger2006-05-24
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | The truncate threshold calculation to prevent receiver from getting stuck was incorrect, and it didn't take into account the upper limit on bits in the register so the jumbo packet support was broken. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* / / [MMC] Fix premature use of md->diskPierre Ossman2006-05-24
|/ / | | | | | | | | | | | | md->disk was being used in a debug message before it was allocated. Signed-off-by: Pierre Ossman <drzeus@drzeus.cx> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [BRIDGE]: need to ref count the LLC sapStephen Hemminger2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | Bridge will OOPS on removal if other application has the SAP open. The bridge SAP might be shared with other usages, so need to do reference counting on module removal rather than explicit close/delete. Since packet might arrive after or during removal, need to clear the receive function handle, so LLC only hands it to user (if any). Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NETFILTER]: SNMP NAT: fix memleak in snmp_object_decodeChris Wright2006-05-23
| | | | | | | | | | | | | | | | If kmalloc fails, error path leaks data allocated from asn1_oid_decode(). Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NETFILTER]: H.323 helper: fix sequence extension parsingPatrick McHardy2006-05-23
| | | | | | | | | | | | | | | | When parsing unknown sequence extensions the "son"-pointer points behind the last known extension for this type, don't try to interpret it. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [NETFILTER]: H.323 helper: fix parser error propagationPatrick McHardy2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The condition "> H323_ERROR_STOP" can never be true since H323_ERROR_STOP is positive and is the highest possible return code, while real errors are negative, fix the checks. Also only abort on real errors in some spots that were just interpreting any return value != 0 as error. Fixes crashes caused by use of stale data after a parsing error occured: BUG: unable to handle kernel paging request at virtual address bfffffff printing eip: c01aa0f8 *pde = 1a801067 *pte = 00000000 Oops: 0000 [#1] PREEMPT Modules linked in: ip_nat_h323 ip_conntrack_h323 nfsd exportfs sch_sfq sch_red cls_fw sch_hfsc xt_length ipt_owner xt_MARK iptable_mangle nfs lockd sunrpc pppoe pppoxx CPU: 0 EIP: 0060:[<c01aa0f8>] Not tainted VLI EFLAGS: 00210646 (2.6.17-rc4 #8) EIP is at memmove+0x19/0x22 eax: d77264e9 ebx: d77264e9 ecx: e88d9b17 edx: d77264e9 esi: bfffffff edi: bfffffff ebp: de6a7680 esp: c0349db8 ds: 007b es: 007b ss: 0068 Process asterisk (pid: 3765, threadinfo=c0349000 task=da068540) Stack: <0>00000006 c0349e5e d77264e3 e09a2b4e e09a38a0 d7726052 d7726124 00000491 00000006 00000006 00000006 00000491 de6a7680 d772601e d7726032 c0349f74 e09a2dc2 00000006 c0349e5e 00000006 00000000 d76dda28 00000491 c0349f74 Call Trace: [<e09a2b4e>] mangle_contents+0x62/0xfe [ip_nat] [<e09a2dc2>] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat] [<e0a2712d>] set_addr+0x74/0x14c [ip_nat_h323] [<e0ad531e>] process_setup+0x11b/0x29e [ip_conntrack_h323] [<e0ad534f>] process_setup+0x14c/0x29e [ip_conntrack_h323] [<e0ad57bd>] process_q931+0x3c/0x142 [ip_conntrack_h323] [<e0ad5dff>] q931_help+0xe0/0x144 [ip_conntrack_h323] ... Found by the PROTOS c07-h2250v4 testsuite. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | V4L/DVB (4041): Fix compilation on PPC 64Mauro Carvalho Chehab2006-05-23
| | | | | | | | | | | | Those functions don't exist on PPC64 architecture. Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
* | V4L/DVB (4040a): Fix the following section warnings:Jean Delvare2006-05-23
| | | | | | | | | | | | | | | | | | | | reference to .init.text: from .text between 'dvb_bt8xx_probe' (at offset 0x122c) and 'dvb_bt8xx_remove' reference to .init.text: from .text between 'dvb_bt8xx_probe' (at offset 0x1267) and 'dvb_bt8xx_remove' Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
* | V4L/DVB (4037): Make the bridge devices that depend on I2C dependant on I2CManu Abraham2006-05-23
| | | | | | | | | | | | | | Ref: Bugzilla 6179, 6589 Signed-off-by: Manu Abraham <manu@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
* | V4L/DVB (3927): Fix VIDEO_DEV=m, VIDEO_V4L1_COMPAT=yAdrian Bunk2006-05-23
|/ | | | | | | | | If CONFIG_VIDEO_DEV=m and CONFIG_VIDEO_V4L1_COMPAT=y, v4l1-compat should be built as a module (currently, it isn't built at all leading to problems with modules using it). Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
* Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6Linus Torvalds2006-05-23
|\ | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6: [SPARC64]: Respect gfp_t argument to dma_alloc_coherent().
| * [SPARC64]: Respect gfp_t argument to dma_alloc_coherent().David S. Miller2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using asm-generic/dma-mapping.h does not work because pushing the call down to pci_alloc_coherent() causes the gfp_t argument of dma_alloc_coherent() to be ignored. Fix this by implementing things directly, and adding a gfp_t argument we can use in the internal call down to the PCI DMA implementation of pci_alloc_coherent(). This fixes massive memory corruption when using the sound driver layer, which passes things like __GFP_COMP down into these routines and (correctly) expects that to work. Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds2006-05-23
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [NETFILTER]: SNMP NAT: fix memory corruption [IRDA]: fixup type of ->lsap_state [IRDA]: fix 16/32 bit confusion [NET]: Fix "ntohl(ntohs" bugs [BNX2]: Use kmalloc instead of array [BNX2]: Fix bug in bnx2_nvram_write() [TG3]: Add some missing rx error counters
| * | [NETFILTER]: SNMP NAT: fix memory corruptionPatrick McHardy2006-05-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix memory corruption caused by snmp_trap_decode: - When snmp_trap_decode fails before the id and address are allocated, the pointers contain random memory, but are freed by the caller (snmp_parse_mangle). - When snmp_trap_decode fails after allocating just the ID, it tries to free both address and ID, but the address pointer still contains random memory. The caller frees both ID and random memory again. - When snmp_trap_decode fails after allocating both, it frees both, and the callers frees both again. The corruption can be triggered remotely when the ip_nat_snmp_basic module is loaded and traffic on port 161 or 162 is NATed. Found by multiple testcases of the trap-app and trap-enc groups of the PROTOS c06-snmpv1 testsuite. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [IRDA]: fixup type of ->lsap_stateAlexey Dobriyan2006-05-22
| | | | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [IRDA]: fix 16/32 bit confusionAlexey Dobriyan2006-05-22
| | | | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [NET]: Fix "ntohl(ntohs" bugsAlexey Dobriyan2006-05-22
| | | | | | | | | | | | Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [BNX2]: Use kmalloc instead of arrayMichael Chan2006-05-22
| | | | | | | | | | | | | | | | | | | | | | | | Use kmalloc() instead of a local array in bnx2_nvram_write(). Update version to 1.4.40. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [BNX2]: Fix bug in bnx2_nvram_write()Michael Chan2006-05-22
| | | | | | | | | | | | | | | | | | | | | Fix a bug in bnx2_nvram_write() caused by a counter variable not correctly incremented by 4. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | [TG3]: Add some missing rx error countersMichael Chan2006-05-22
| |/ | | | | | | | | | | | | | | | | Add some missing rx error counters for 5705 and newer chips. Update version to 3.58. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | [PATCH] blk: fix gendisk->in_flight accounting during barrier sequenceJens Axboe2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | While executing barrrier sequence, the bar_rq which carries actual write was accounted as normal IO on completion, while it wasn't on queueing. This caused gendisk->in_flight to be decremented by 1 after each barrier thus messed up statistics. This patch makes bar_rq not accounted as normal IO. As the containing barrier request as a whole is accounted, part of it shouldn't be. Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jens Axboe <axboe@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] powerpc: wire up sys_[gs]et_robust_listDavid Woodhouse2006-05-23
| | | | | | | | | | | | | | | | | | Signed-off-by: David Woodhouse <dwmw2@infradead.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Paul Mackerras <paulus@samba.org> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] powerpc: check Cell SPU syscall number range _before_ using itDavid Woodhouse2006-05-23
| | | | | | | | | | | | | | | | | | Signed-off-by: David Woodhouse <dwmw2@infradead.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Paul Mackerras <paulus@samba.org> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] powerpc: fill hole in Cell SPU syscall tableDavid Woodhouse2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | Syscall number 224 was absent from the table, which I believe means that the SPU can cause an oops by attempting to use it. Signed-off-by: David Woodhouse <dwmw2@infradead.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Paul Mackerras <paulus@samba.org> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] orinoco: possible null pointer dereference in orinoco_rx_monitor()Florin Malita2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | If the skb allocation fails, the current error path calls dev_kfree_skb_irq() with a NULL argument. Also, 'err' is not being used. Coverity CID: 275. Signed-off-by: Florin Malita <fmalita@gmail.com> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] swsusp: fix typo in cr0 handlingPavel Machek2006-05-23
| | | | | | | | | | | | | | | | | | | | Writing cr0 to cr2 register can't be right. This fixes the typo. I wonder how it could survive so long. Signed-off-by: Pavel Machek <pavel@suse.cz> Cc: Zachary Amsden <zach@vmware.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] tty_insert_flip_string_flags() license fixTobias Powalowski2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | We still don't have the tty layer licensing compatibility quite right. tty_insert_flip_char() used to be inlined in include/linux/tty_flip.h. It is now out-of-lined and hence needs EXPORT_SYMBOL() to be back-compatible. One known offender is the Intel Modem driver. Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] md: Make sure bi_max_vecs is set properly in bio_splitNeilBrown2006-05-23
| | | | | | | | | | | | | | | | | | | | Else a subsequent bio_clone might make a mess. Signed-off-by: Neil Brown <neilb@suse.de> Cc: "Don Dupuis" <dondster@gmail.com> Acked-by: Jens Axboe <axboe@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | [PATCH] md: fix possible oops when starting a raid0 arrayNeilBrown2006-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This loop that sets up the hash_table has problems. Careful examination will show that the last time through, everything but the first line is pointless. This is because all it does is change 'cur' and 'size' and neither of these are used after the loop. This should ring warning bells... That last time through the loop, size += conf->strip_zone[cur].size can index off the end of the strip_zone array. Depending on what it finds there, it might exit the loop cleanly, or it might spin going further and further beyond the array until it hits an unmapped address. This patch rearranges the code so that the last, pointless, iteration of the loop never happens. i.e. the one statement of the last loop that is needed is moved the the end of the previous loop - or to before the loop starts - and the loop counter starts from 1 instead of 0. Cc: "Don Dupuis" <dondster@gmail.com> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-22 00:05:10 -0500