Commit Graph

21528 Commits

Author SHA1 Message Date
James Bottomley 7e5cdf9cd6 [SCSI] hptiop: don't use cmnd->bufflen
use cmnd->request_bufflen instead.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:35:42 +01:00
HighPoint Linux Team 9f7887935b [SCSI] hptiop: HighPoint RocketRAID 3xxx controller driver
Updates:
- don't bypass SYNCHRONIZE_CACHE command
- return SCSI_MLQUEUE_HOST_BUSY when no free request slots
- move scsi_remove_host() to the begin of hpt_remove(), or it will
  not work after resources being released.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:34:52 +01:00
HighPoint Linux Team 3bd2533830 [SCSI] hptiop: HighPoint RocketRAID 3xxx controller driver
HighPoint RocketRAID 3220/3320 series 8 channel PCI-X SATA RAID Host
Adapters.

Fixes from original submission:

Merge Andrew Morton's patches:
- Provide locking for global list
- Fix debug printks
- uninline function with multiple callsites
- coding style fixups
- remove unneeded casts of void*
- kfree(NULL) is legal
- Don't "succeed" if register_chrdev() failed - otherwise we'll later
  unregister a not-registered chrdev.
- Don't return from hptiop_do_ioctl() with the spinlock held.
- uninline __hpt_do_ioctl()

Update for Arjan van de Ven's comments:
- put all asm/ includes after the linux/ ones
- replace mdelay with msleep
- add pci posting flush
- do not set pci command reqister in map_pci_bar
- do not try merging sg elements in hptiop_buildsgl()
- remove unused outstandingcommands member from hba structure
- remove unimplemented hptiop_abort() handler
- remove typedef u32 hpt_id_t

Other updates:
- fix endianess

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:34:03 +01:00
Adrian Bunk 0e10e6db6b update the OBSOLETE_OSS_DRIVER help text
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 03:27:09 +01:00
Hidetoshi Seto a2a17a0f15 sysfs: remove duplicated dput in sysfs_update_file
Following function can drops d_count twice against one reference
by lookup_one_len.

<SOURCE>
/**
 * sysfs_update_file - update the modified timestamp on an object attribute.
 * @kobj: object we're acting for.
 * @attr: attribute descriptor.
 */
int sysfs_update_file(struct kobject * kobj, const struct attribute * attr)
{
        struct dentry * dir = kobj->dentry;
        struct dentry * victim;
        int res = -ENOENT;

        mutex_lock(&dir->d_inode->i_mutex);
        victim = lookup_one_len(attr->name, dir, strlen(attr->name));
        if (!IS_ERR(victim)) {
                /* make sure dentry is really there */
                if (victim->d_inode &&
                    (victim->d_parent->d_inode == dir->d_inode)) {
                        victim->d_inode->i_mtime = CURRENT_TIME;
                        fsnotify_modify(victim);

                        /**
                         * Drop reference from initial sysfs_get_dentry().
                         */
                        dput(victim);
                        res = 0;
                } else
                        d_drop(victim);

                /**
                 * Drop the reference acquired from sysfs_get_dentry() above.
                 */
                dput(victim);
        }
        mutex_unlock(&dir->d_inode->i_mutex);

        return res;
}
</SOURCE>

PCI-hotplug (drivers/pci/hotplug/pci_hotplug_core.c) is only user of
this function. I confirmed that dentry of /sys/bus/pci/slots/XXX/*
have negative d_count value.

This patch removes unnecessary dput().

Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 03:11:19 +01:00
Kirill Korotaev 7eeeab0403 fix sys_getppid oopses on debug kernel
sys_getppid() optimization can access a freed memory.  On kernels with
DEBUG_SLAB turned ON, this results in Oops.  As Dave Hansen noted, this
optimization is also unsafe for memory hotplug.

So this patch always takes the lock to be safe.

Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 03:08:27 +01:00
Al Viro d6042b2ec9 [IPX]: Annotate and fix IPX checksum
Calculation of IPX checksum got buggered about 2.4.0.  The old variant
mangled the packet; that got fixed, but calculation itself got buggered.
Restored the correct logics, fixed a subtle breakage we used to have even
back then: if the sum is 0 mod 0xffff, we want to return 0, not 0xffff.
The latter has special meaning for IPX (cheksum disabled).  Observation
(and obvious fix) nicked from history of FreeBSD ipx_cksum.c...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 03:03:34 +01:00
David S. Miller 635cc29c54 [IPX]: Fix typo, ipxhdr() --> ipx_hdr()
Noticed by Dave Jones.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 03:01:09 +01:00
Stephen Hemminger a43a6210ce [IPX]: Another nonlinear receive fix
Need to check some more cases in IPX receive.  If the skb is purely
fragments, the IPX header needs to be extracted. The function
pskb_may_pull() may in theory invalidate all the pointers in the skb,
so references to ipx header must be refreshed.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 02:59:07 +01:00
Stephen Hemminger 20e121b945 [IPX]: Header length validation needed
This patch will linearize and check there is enough data.
It handles the pprop case as well as avoiding a whole audit of
the routing code.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 02:57:28 +01:00
Alexey Dobriyan a06ee75aa0 [IPX]: Correct return type of ipx_map_frame_type().
Casting BE16 to int and back may or may not work. Correct, to be sure.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 02:56:20 +01:00
Jean Delvare c0235754cd Fix i2c-ixp4xx compilation breakage
Fix recent i2c-ixp4xx compilation breakage. Sorry for overlooking it.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 02:53:16 +01:00
Adrian Bunk 5ab53cfeaf [SCSI] advansys pci tweaks.
Remove a lot of duplicate #defines from the advansys driver,
and make them look like PCI IDs as defined elsewhere in the kernel.
Also add a module table so that it automatically gets picked up
by tools relying on modinfo output (like say, distro installers).

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-23 02:11:07 +01:00
Randy Dunlap bc1061baec advansys section fixes
Priority: not critical.
Mark 3 functions __init.  Saves a little memory.
This makes these functions' calls to AdvWaitEEPCmd() (which is __init)
be clean (i.e., eliminates text -> init -> text call chain).

Fix multiple section mismatch warnings:
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet3550EEPConfig' (at offset 0x7a22) and 'AdvSet38C0800EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet3550EEPConfig' (at offset 0x7a4e) and 'AdvSet38C0800EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet3550EEPConfig' (at offset 0x7a79) and 'AdvSet38C0800EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet3550EEPConfig' (at offset 0x7aa2) and 'AdvSet38C0800EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet3550EEPConfig' (at offset 0x7abb) and 'AdvSet38C0800EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C0800EEPConfig' (at offset 0x7ae0) and 'AdvSet38C1600EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C0800EEPConfig' (at offset 0x7b0c) and 'AdvSet38C1600EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C0800EEPConfig' (at offset 0x7b37) and 'AdvSet38C1600EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C0800EEPConfig' (at offset 0x7b60) and 'AdvSet38C1600EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C0800EEPConfig' (at offset 0x7b79) and 'AdvSet38C1600EEPConfig'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C1600EEPConfig' (at offset 0x7b9e) and 'AdvExeScsiQueue'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C1600EEPConfig' (at offset 0x7bca) and 'AdvExeScsiQueue'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C1600EEPConfig' (at offset 0x7bf5) and 'AdvExeScsiQueue'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C1600EEPConfig' (at offset 0x7c1e) and 'AdvExeScsiQueue'
WARNING: drivers/scsi/advansys.o - Section mismatch: reference to .init.text: from .text between 'AdvSet38C1600EEPConfig' (at offset 0x7c37) and 'AdvExeScsiQueue'

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-23 02:09:36 +01:00
Linus Torvalds 3e7fbd085f [SCSI] advansys driver: limp along on x86
Let people enable the advansys driver on x86-32, even though it's broken
on other architectures due to missing DMA mapping infrastructure.

It's used by Jeffrey Phillips Freeman <jeffreyfreeman@syncleus.com> and
possibly others.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-23 02:01:01 +01:00
Alexey Dobriyan 5e8721dcb5 i2c-ixp4xx: fix ") != 0))" typo
i2c_bit_add_bus() returns -E;
-E != 0             =>      err = 1
probe fails with positive error code

Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-23 01:33:16 +01:00
Adrian Bunk 72be3fc830 Linux 2.6.16.33 v2.6.16.33 2006-11-22 19:06:31 +01:00
Adrian Bunk 6d44d60a6b Linux 2.6.16.33-rc1 v2.6.16.33-rc1 2006-11-20 22:51:17 +01:00
Benjamin Herrenschmidt 371899a77a POWERPC: Make alignment exception always check exception table
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 22:45:49 +01:00
Daniele Venzano 70c505610f Add new PHY to sis900 supported list
This patch adds support for a new PHY to the sis900 driver.
See also Bugzilla 6919.

Signed-off-by: Daniele Venzano <venza@brownhat.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 22:43:31 +01:00
Artur Skawina 0379a9a1d4 sis900 adm7001 PHY support
this patch is required to get a SIS964 based motherboard ethernet working
(FSC D1875) (picking the #1 transceiver, instead of the last one, in case
no known ones were found might be a better default, and would have worked
in this case too)

Signed-off-by: Artur Skawina <art_k@o2.pl>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 22:32:56 +01:00
Michael-Luke Jones c61120c340 Old IDE, fix SATA detection for cabling
This patch is identical to that introduced in
1a1276e7b6 to the Linus' 2.6 development tree
by Alan Cox.

'This is based on the proposed patches flying around but also checks that
the device in question is new enough to have word 93 rather thanb blindly
assuming word 93 == 0 means SATA (see ATA-5, ATA-7)' -- Alan Cox

Required for my SATA drive on an Asus Pundit-R to operate above 33MBps.

Signed-off-by: Michael-Luke Jones <mlj28@cam.ac.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 22:30:21 +01:00
Diego Calleja 2c8e2c9fe5 Fix BeFS slab corruption
In bugzilla #6941, Jens Kilian reported:

"The function befs_utf2nls (in fs/befs/linuxvfs.c) writes a 0 byte past the
end of a block of memory allocated via kmalloc(), leading to memory
corruption.  This happens only for filenames which are pure ASCII and a
multiple of 4 bytes in length.  [...]

Without DEBUG_SLAB, this leads to further corruption and hard lockups; I
believe this is the bug which has made kernels later than 2.6.8 unusable
for me.  (This must be due to changes in memory management, the bug has
been in the BeFS driver since the time it was introduced (AFAICT).)

Steps to reproduce:
Create a directory (in BeOS, naturally :-) with files named, e.g.,
"1", "22", "333", "4444", ...  Mount it in Linux and do an "ls" or "find""

This patch implements the suggested fix. Credits to Jens Kilian for
debugging the problem and finding the right fix.

Signed-off-by: Diego Calleja <diegocg@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 22:25:17 +01:00
Adrian Bunk facabd6146 V4L/DVB: Saa7134: rename dmasound_{init,exit}
Two different exports with the same name are not a good idea:

$ grep -r EXPORT_SYMBOL\(dmasound_init\) *
drivers/media/video/saa7134/saa7134-core.c:EXPORT_SYMBOL(dmasound_init);
sound/oss/dmasound/dmasound_core.c:EXPORT_SYMBOL(dmasound_init);
$

This patch renames the saa7134 dmasound_{init,exit} to
saa7134_dmasound_{init,exit}.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 04:56:03 +01:00
David Miller 705cb93548 [RTNETLINK]: Fix IFLA_ADDRESS handling.
The ->set_mac_address handlers expect a pointer to a
sockaddr which contains the MAC address, whereas
IFLA_ADDRESS provides just the MAC address itself.

So whip up a sockaddr to wrap around the netlink
attribute for the ->set_mac_address call.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 00:21:04 +01:00
Adrian Bunk 02db407979 drivers/scsi/psi240i.c: fix an array overrun
This patch fixes an array overrun spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 00:15:06 +01:00
Michael Chan 9d41b6ad66 [TG3]: Fix array overrun in tg3_read_partno().
Use proper upper limits for the loops and check for all error
conditions.

The problem was noticed by Adrian Bunk.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 00:12:55 +01:00
Andrew Morton de6c0ccfa9 disable debugging version of write_lock()
We've confirmed that the debug version of write_lock() can get stuck for long
enough to cause NMI watchdog timeouts and hence a crash.

We don't know why, yet.   Disable it for now.

Also disable the similar read_lock() code.  Just in case.

Thanks to Dave Olson <olson@unixfolk.com> for reporting and testing.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20 00:11:42 +01:00
Dmitry Mishin 9e9c714703 Fix timer race in dst GC code
Replace add_timer() by mod_timer() in dst_run_gc
in order to avoid BUG message.

   CPU1                            CPU2
dst_run_gc()  entered           dst_run_gc() entered
spin_lock(&dst_lock)                   .....
del_timer(&dst_gc_timer)         fail to get lock
   ....                         mod_timer() <--- puts
                                             timer back
                                             to the list
add_timer(&dst_gc_timer) <--- BUG because timer is in list already.

Found during OpenVZ internal testing.

At first we thought that it is OpenVZ specific as we
added dst_run_gc(0) call in dst_dev_event(),
but as Alexey pointed to me it is possible to trigger
this condition in mainstream kernel.

F.e. timer has fired on CPU2, but the handler was preeempted
by an irq before dst_lock is tried.
Meanwhile, someone on CPU1 adds an entry to gc list and
starts the timer.
If CPU2 was preempted long enough, this timer can expire
simultaneously with resuming timer handler on CPU1, arriving
exactly to the situation described.

Signed-off-by: Dmitry Mishin <dim@openvz.org>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17 17:53:07 +01:00
Badari Pulavarty 770af3b42a ext3 -nobh option causes oops
For files other than IFREG, nobh option doesn't make sense.  Modifications
to them are journalled and needs buffer heads to do that.  Without this
patch, we get kernel oops in page_buffers().

Signed-off-by: Badari Pulavarty <pbadari@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17 17:47:22 +01:00
Alexey Dobriyan 39a2b41be7 ipmi_si_intf.c: fix "&& 0xff" typos
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17 17:44:46 +01:00
Adrian Bunk e6169b5398 security/seclvl.c: fix time wrap (CVE-2005-4352)
initlvl=2 in seclvl gives the guarantee
"Cannot decrement the system time".

But it was possible to set the time to the maximum unixtime value
(19 Jan 2038) resulting in a wrap to the minimum value.

This patch fixes this by disallowing setting the time to any date
after 2030 with initlvl=2.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17 17:42:43 +01:00
Paul Fulghum 6e16bd44c3 synclink_gt fix receive tty error handling
Fix receive tty error handling in synclink_gt driver.
Adrian reported compiler warning for incorrect bit test
against char variable. I determined these and other
device specific error bits were incorrectly defined.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17 00:13:41 +01:00
Daniel Ritz 9ca0bc2cee fix via586 irq routing for pirq 5
fix interrput routing for via 586 bridges. pirq can be 5 which needs to be
mapped to INTD. but currently the access functions can handle only pirq 1-4.
this is similar to the other via chipsets where pirq 4 and 5 are both mapped
to INTD. fixes bugzilla #7490

Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15 17:07:33 +01:00
Daniel Drake 891bdfcddd sata_promise: Support FastTrak TX4300/TX4310
This patch adds support for the Promise FastTrak TX4300/TX4310 4-port PCI SATA
controllers based on the PDC40719 chip.

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15 16:26:16 +01:00
Bob Moore 1b1469021a Reduce ACPI verbosity on null handle condition
As detailed at http://bugs.gentoo.org/131534 :

2.6.16 converted many ACPI debug messages into error or warning
messages. One extraneous message was incorrectly converted, resulting in
logs being flooded by "Handle is NULL and Pathname is relative" messages
on some systems.

This patch (part of a larger ACPICA commit) converts the message back to
debug level.

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15 16:20:37 +01:00
Adrian Bunk f908b08a54 Linux 2.6.16.32 v2.6.16.32 2006-11-15 11:38:39 +01:00
Adrian Bunk ae92a0d031 Linux 2.6.16.32-rc1 v2.6.16.32-rc1 2006-11-11 12:16:36 +01:00
Christoph Lameter ef147950be Fix longstanding load balancing bug in the scheduler
The scheduler will stop load balancing if the most busy processor contains
processes pinned via processor affinity.

The scheduler currently only does one search for busiest cpu.  If it cannot
pull any tasks away from the busiest cpu because they were pinned then the
scheduler goes into a corner and sulks leaving the idle processors idle.

F.e.  If you have processor 0 busy running four tasks pinned via taskset,
there are none on processor 1 and one just started two processes on
processor 2 then the scheduler will not move one of the two processes away
from processor 2.

This patch fixes that issue by forcing the scheduler to come out of its
corner and retrying the load balancing by considering other processors for
load balancing.

This patch was originally developed by John Hawkes and discussed at

    http://marc.theaimsgroup.com/?l=linux-kernel&m=113901368523205&w=2.

I have removed extraneous material and gone back to equipping struct rq
with the cpu the queue is associated with since this makes the patch much
easier and it is likely that others in the future will have the same
difficulty of figuring out which processor owns which runqueue.

The overhead added through these patches is a single word on the stack if
the kernel is configured to support 32 cpus or less (32 bit).  For 32 bit
environments the maximum number of cpus that can be configued is 255 which
would result in the use of 32 bytes additional on the stack.  On IA64 up to
1k cpus can be configured which will result in the use of 128 additional
bytes on the stack.  The maximum additional cache footprint is one
cacheline.  Typically memory use will be much less than a cacheline and the
additional cpumask will be placed on the stack in a cacheline that already
contains other local variable.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 12:13:53 +01:00
Tejun Heo f9a198cc96 sata_sil24: add a new PCI ID for SiI 3124
Add a new PCI ID for SiI 3124.  Reported by Silicon Image.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 11:34:49 +01:00
Kirill Korotaev 05c19c4369 ia64/sparc: fix local DoS with corrupted ELFs (CVE-2006-4538)
This patch prevents cross-region mappings
on IA64 and SPARC which could lead to system crash.

Adrian Bunk:
Adapted to 2.6.16.

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 01:08:49 +01:00
Paul Mackerras 567e0e320d nvidia fbdev: fix powerpc xmon scribbles
xmon writes garbage on the screen because the nvidia console driver has
changed the line pitch from what the firmware set it to.  Fix it by making
the nvidia driver inform the btext engine (which xmon uses if the screen is
its output device) about changes to display resolution.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 00:28:30 +01:00
Paul Mackerras 582b119914 [POWERPC] Fix return value from memcpy
As pointed out by Herbert Xu <herbert@gondor.apana.org.au>, our
memcpy implementation didn't return the destination pointer as its
return value, and there is code in the kernel that expects that.
This fixes it.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 00:17:57 +01:00
Herbert Xu e1dc7abb24 [NET]: Update frag_list in pskb_trim
When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of
the packet, the frag_list is not updated to reflect the trimming.  This
will usually work fine until you hit something that uses the packet length
or tail from the frag_list.

Examples include esp_output and ip_fragment.

Another problem caused by this is that you can end up with a linear packet
with a frag_list attached.

It is possible to get away with this if we audit everything to make sure
that they always consult skb->len before going down onto frag_list.  In
fact we can do the samething for the paged part as well to avoid copying
the data area of the skb.  For now though, let's do the conservative fix
and update frag_list.

Many thanks to Marco Berizzi for helping me to track down this bug.

This 4-year old bug took 3 months to track down.  Marco was very patient
indeed :)

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 00:15:10 +01:00
Jean Delvare c04f8dca8e scx200_acb: Fix the block transactions
The scx200_acb i2c bus driver pretends to support SMBus block
transactions, but in fact it implements the more simple I2C block
transactions. Additionally, it lacks sanity checks on the length
of the block transactions, which could lead to a buffer overrun.

This fixes an oops reported by Alexander Atanasov:
http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094

Thanks to Ben Gardner for fixing my bugs :)

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 00:13:32 +01:00
Thomas Andrews b88acf65ab Fix the scx200_acb state machine:
* Nack was sent one byte too late on reads >= 2 bytes.
* Stop bit was set one byte too late on reads.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11 00:09:25 +01:00
Pavel Roskin b235e28325 drivers/video/nvidia/nvidia.c: Add ID for Quadro NVS280
Quadro NVS280 is a dual-head PCIe card with PCI ID 10de:00fd and subsystem I
10de:0215.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09 12:00:26 +01:00
Jeff Mahoney d2b85a5a40 [DISKLABEL] SUN: Fix signed int usage for sector count
The current sun disklabel code uses a signed int for the sector count.
When partitions larger than 1 TB are used, the cast to a sector_t causes
the partition sizes to be invalid:

 # cat /proc/paritions | grep sdan
   66   112 2146435072 sdan
   66   115 9223372036853660736 sdan3
   66   120 9223372036853660736 sdan8

This patch switches the sector count to an unsigned int to fix this.

Eric Sandeen also submitted the same patch.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09 11:31:23 +01:00
Larry Woodman 4504530e9f [NET]: __alloc_pages() failures reported due to fragmentation
We have seen a couple of __alloc_pages() failures due to
fragmentation, there is plenty of free memory but no large order pages
available.  I think the problem is in sock_alloc_send_pskb(), the
gfp_mask includes __GFP_REPEAT but its never used/passed to the page
allocator.  Shouldnt the gfp_mask be passed to alloc_skb() ?

Signed-off-by: Larry Woodman <lwoodman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09 11:05:38 +01:00
Herbert Xu 5f61e927c7 [NET]: Set truesize in pskb_copy
Since pskb_copy tacks on the non-linear bits from the original
skb, it needs to count them in the truesize field of the new skb.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09 11:03:56 +01:00