Commit Graph

21576 Commits

Author SHA1 Message Date
Adrian Bunk 0c95cdfaff Linux 2.6.16.35 v2.6.16.35 2006-12-06 18:38:58 +01:00
Adrian Bunk 5c60e8012f Linux 2.6.16.35-rc1 v2.6.16.35-rc1 2006-12-04 19:45:53 +01:00
Chris Wright e0d34fea66 bridge: fix possible overflow in get_fdb_entries (CVE-2006-5751)
Make sure to properly clamp maxnum to avoid overflow (CVE-2006-5751).

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Acked-by: Stephen Hemminger <shemminger@osdl.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 19:44:59 +01:00
Trond Myklebust 25e1dd8a73 fcntl(F_SETSIG) fix
fcntl(F_SETSIG) no longer works on leases because
lease_release_private_callback() gets called as the lease is copied in
order to initialise it.

The problem is that lease_alloc() performs an unnecessary initialisation,
which sets the lease_manager_ops.  Avoid the problem by allocating the
target lease structure using locks_alloc_lock().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 19:43:11 +01:00
Jens Axboe ba6c35f888 cciss: fix iostat
cciss needs to call disk_stat_add() for iostat to work.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:30:27 +01:00
Jens Axboe f131f70efa cpqarray: fix iostat
cpqarray needs to call disk_stat_add() for iostat to work.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:29:45 +01:00
Michael De Backer 6d46c48302 alim15x3.c: M5229 (rev c8) support for DMA cd-writer
Configuration bits are not set properly for DMA on some chipset revisions.
It has already been corrected for M5229 (rev c7) but not for M5229 (rev
c8).  This leads to the bug described at
http://bugzilla.kernel.org/show_bug.cgi?id=5786 (lost interrupt + ide bus
hangs).

Signed-off-by: Michael De Backer <micdb@skynet.be>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:24:41 +01:00
Fernando J. Pereda c375b5b95d alpha: Fix ALPHA_EV56 dependencies typo
There appears to be a typo in the EV56 config option. NORITAKE and PRIMO are
be able to set a variation of either.

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:21:29 +01:00
Jiri Slaby 407e973fcc Char: isicom, fix close bug
port is dereferenced even if it is NULL.  Dereference it _after_ the
check if (!port)...  Thanks Eric <ef87@yahoo.com> for reporting this.

This fixes

        http://bugzilla.kernel.org/show_bug.cgi?id=7527

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:06:36 +01:00
Roberto Castagnola 2491185f7a Input: logips2pp - fix button mapping for MX300
MX300 does not have an EXTRA_BTN - it is a simple wheel mouse with
an additional task-switcher button, which is reported as side button
(and not task button).

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:02:47 +01:00
Zbigniew Luszpinski 7ac0b0a2cb Input: psmouse - add detection of Logitech TrackMan Wheel trackball
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 14:01:50 +01:00
Zhou Yingchao 4c3b882b6e Remove redundant up() in stop_machine()
An up() is called in kernel/stop_machine.c on failure, and also in the
caller (unconditionally).

Signed-off-by: Zhou Yingchao <yingchao.zhou@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 13:58:06 +01:00
Al Viro dbb4a0ecfe [EBTABLES]: Prevent wraparounds in checks for entry components' sizes.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 13:13:23 +01:00
Al Viro e4a7da4a76 [EBTABLES]: Deal with the worst-case behaviour in loop checks.
No need to revisit a chain we'd already finished with during
the check for current hook.  It's either instant loop (which
we'd just detected) or a duplicate work.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 13:12:43 +01:00
Al Viro f1f7d270d4 [EBTABLES]: Verify that ebt_entries have zero ->distinguisher.
We need that for iterator to work; existing check had been too weak.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 13:12:06 +01:00
Al Viro d559dd79b5 [EBTABLES]: Fix wraparounds in ebt_entries verification.
We need to verify that
    a) we are not too close to the end of buffer to dereference
    b) next entry we'll be checking won't be _before_ our

While we are at it, don't subtract unrelated pointers...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 13:11:24 +01:00
Patrick McHardy b00b3fe3f0 [NET_SCHED]: policer: restore compatibility with old iproute binaries
The tc actions increased the size of struct tc_police, which broke
compatibility with old iproute binaries since both the act_police
and the old NET_CLS_POLICE code check for an exact size match.

Since the new members are not even used, the simple fix is to also
accept the size of the old structure. Dumping is not affected since
old userspace will receive a bigger structure, which is handled fine.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 12:46:48 +01:00
Kim Nordlund e6e129777f [PKT_SCHED] act_gact: division by zero
Not returning -EINVAL, because someone might want to use the value
zero in some future gact_prob algorithm?

Signed-off-by: Kim Nordlund <kim.nordlund@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 12:44:22 +01:00
Dave Kleikamp a7c850eb81 JFS: pageno needs to be long
diRead and diWrite are representing the page number as an unsigned int.
This causes file system corruption on volumes larger than 16TB.

Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 12:40:56 +01:00
YOSHIFUJI Hideaki b3d413d405 [IPV6]: Fix address/interface handling in UDP and DCCP, according to the scoping architecture.
TCP and RAW do not have this issue.  Closes Bug #7432.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 12:20:41 +01:00
Adrian Bunk 8cf6005296 remove garbage the sneaked into the ext3 fix
Spotted by Thomas Voegtle.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-12-04 12:18:43 +01:00
Josh Triplett 8e0a9377e5 freevxfs: Add missing lock_kernel() to vxfs_readdir
Commit 7b2fd697427e73c81d5fa659efd91bd07d303b0e in the historical GIT tree
stopped calling the readdir member of a file_operations struct with the big
kernel lock held, and fixed up all the readdir functions to do their own
locking.  However, that change added calls to unlock_kernel() in
vxfs_readdir, but no call to lock_kernel().  Fix this by adding a call to
lock_kernel().

Signed-off-by: Josh Triplett <josh@freedesktop.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:26:18 +01:00
Kyle McMartin e2d1cbdc70 Fix incorrent type of flags in <asm/semaphore.h>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:24:16 +01:00
Jeremy Higdon 190492c8f8 sgiioc4: Disable module unload
This patch removes a module_exit function that sgiioc4 should not have had.

It seems that the IDE layer doesn't support submodule unloading. sgiioc4
was the only driver in drivers/ide/pci that had an exit function.
After an unload, the devices would stay around and the next attempt to
reference would crash...

Signed-off-by: Jeremy Higdon <jeremy@sgi.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:22:11 +01:00
Alexey Dobriyan 82ae0fbafe proper flags type of spin_lock_irqsave()
Convert various spin_lock_irqsave() callers to correctly use `unsigned long'

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:17:58 +01:00
Adrian Bunk 15c47f32ea drivers/usb/input/ati_remote.c: fix cut'n'paste error
Backported from a patch by Mariusz Kozlowski <m.kozlowski@tuxland.pl>
in 2.6.19.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:15:25 +01:00
Vasily Tarasov b46d1f7bcd block layer: elv_iosched_show should get elv_list_lock
elv_iosched_show function iterates other elv_list,
hence elv_list_lock should be got.

Also the question is: in elv_iosched_show, elv_iosched_store
q->elevator->elevator_type construction is used without locking q->queue_lock.
Is it expected?..

Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
Acked-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:04:14 +01:00
Jens Axboe 18ff15828e block: Fix bad data direction in SG_IO
Contrary to what the name misleads you to believe, SG_DXFER_TO_FROM_DEV
is really just a normal read seen from the device side.

This patch fixes http://lkml.org/lkml/2006/10/13/100

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 14:01:40 +01:00
Oliver Neukum feeddb339e USB: failure in usblp's error path
if urb submission fails due to a transient error here eg. ENOMEM,
the driver is dead. This fixes it.

Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 12:45:29 +01:00
Nathan Lynch 193d2e39e1 nvidiafb: fix unreachable code in nv10GetConfig
Fix binary/logical operator typo which leads to unreachable code.  Noticed
while looking at other issues; I don't have the relevant hardware to test
this.

Signed-off-by: Nathan Lynch <ntl@pobox.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 12:17:37 +01:00
Wink Saville f6cbbf0f53 Fix divide by zero error for nvidia 7600 pci-express card
The following patch resolves the divide by zero error I encountered on my
system:

        http://marc.10east.com/?l=linux-fbdev-devel&m=116058257024413&w=2

I accomplished this by merging what I thought was appropriate from:

        http://webcvs.freedesktop.org/xorg/driver/xf86-video-nv/src/

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 12:15:49 +01:00
Pierre Ossman e5b30aebbf MMC: Always use a sector size of 512 bytes
Both MMC and SD specifications specify (although a bit unclearly in the MMC
case) that a sector size of 512 bytes must always be supported by the card.

Cards can report larger "native" size than this, and cards >= 2 GB even
must do so. Most other readers use 512 bytes even for these cards. We should
do the same to be compatible.

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 12:10:52 +01:00
Herbert Xu 540218dd28 SCTP: Always linearise packet on input
I was looking at a RHEL5 bug report involving Xen and SCTP
(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550).
It turns out that SCTP wasn't written to handle skb fragments at
all.  The absence of any calls to skb_may_pull is testament to
that.

It just so happens that Xen creates fragmented packets more often
than other scenarios (header & data split when going from domU to
dom0).  That's what caused this bug to show up.

Until someone has the time sits down and audits the entire net/sctp
directory, here is a conservative and safe solution that simply
linearises all packets on input.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 12:06:04 +01:00
Al Viro 82182ed2ce add forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable)
sbi->s_group_desc is an array of pointers to buffer_head.  memcpy() of
buffer size from address of buffer_head is a bad idea - it will generate
junk in any case, may oops if buffer_head is close to the end of slab
page and next page is not mapped and isn't what was intended there.
IOW, ->b_data is missing in that call.  Fortunately, result doesn't go
into the primary on-disk data structures, so only backup ones get crap
written to them; that had allowed this bug to remain unnoticed until
now.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 11:40:22 +01:00
Jean Delvare cf76a4a8bd Fix a masking bug in the 6pack driver.
Looks like a broken masking to me, binary not is used where bitwise
not was intended.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 11:00:25 +01:00
Olaf Kirch 08d93ba55b [UDP]: Make udp_encap_rcv use pskb_may_pull
Make udp_encap_rcv use pskb_may_pull

IPsec with NAT-T breaks on some notebooks using the latest e1000 chipset,
when header split is enabled. When receiving sufficiently large packets, the
driver puts everything up to and including the UDP header into the header
portion of the skb, and the rest goes into the paged part. udp_encap_rcv
forgets to use pskb_may_pull, and fails to decapsulate it. Instead, it
passes it up it to the IKE daemon.

Signed-off-by: Olaf Kirch <okir@suse.de>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-29 10:59:22 +01:00
Adrian Bunk 72713a4528 Linux 2.6.16.34 v2.6.16.34 2006-11-29 06:47:00 +01:00
Adrian Bunk 8a775d0370 Linux 2.6.16.34-rc1 v2.6.16.34-rc1 2006-11-25 22:23:42 +01:00
Takashi Iwai 4b066391b2 [ALSA] echoaudio - Remove kfree_nocheck()
Remove obsoleted kfree_nochec() (for debug).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 22:22:08 +01:00
Takashi Iwai 07dda8196a [ALSA] echoaudio - Fix Makefile
Fix missing makefile entries for echoaudio drivers

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 22:21:14 +01:00
Takashi Iwai ba7f7af1da [ALSA] Fix a typo in echoaudio/midi.c
Fixed a typo in echoaudio/midi.c.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 22:20:26 +01:00
Giuliano Pochini pochini@shiny.it d32172fe43 [ALSA] Add echoaudio sound drivers
Add echoaudio sound drivers (darla20, darla24, echo3g, gina20, gina24,
indigo, indigodj, indigoio, layla20, lala24, mia, mona)

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 22:17:19 +01:00
Steve French 0d2da2ad7d CIFS: report rename failure when target file is locked by Windows
Fixes Samba bugzilla bug # 4182

Rename by handle failures (retry after rename by path) were not
being returned back.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 22:14:02 +01:00
Mark M. Hoffman 74fe77b769 i2c: Handle i2c_add_adapter failure in i2c algorithm drivers
It is possible for i2c_add_adapter() to fail.  Several I2C algorithm
drivers ignore that fact.  This (compile-tested only) patch fixes them.

Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 03:02:49 +01:00
David L Stevens 679d6ff3da [IGMP]: Fix IGMPV3_EXP() normalization bit shift value.
The IGMPV3_EXP() macro doesn't correctly shift the normalization bit, so
time-out values are longer than they should be.

Thanks to Dirk Ooms for finding the problem in IGMPv3 - MLDv2 had a
similar problem that was already fixed a year ago. :-(

Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 02:51:50 +01:00
Alan Stern 28bb442258 USB: UHCI: Increase port-reset completion delay for HP controllers
This patch (as657) increases the port-reset completion delay in uhci-hcd
for HP's embedded controllers.  Unlike other UHCI controllers, the HP
chips can take as long as 250 us to carry out the processing associated
with finishing a port reset.

This fixes Novell bug #148761.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-25 02:47:52 +01:00
Christoph Hellwig 6ea2447606 [SCSI] hptiop: backout ioctl mess
The hptiop just got merged with a horrible amount of really bad ioctl
code that is against the standards for new scsi drivers.  This patch
backs it out (and fixes a small bug where scsi_add_host is called to
early).  We can re-add proper APIs once we agree on them.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:38:58 +01:00
HighPoint Linux Team 2918372bc1 [SCSI] hptiop: wrong register used in hptiop_reset_hba()
IOP reset message should be posted to inbound message register
instead of outbound message register.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:36:33 +01:00
James Bottomley 7e5cdf9cd6 [SCSI] hptiop: don't use cmnd->bufflen
use cmnd->request_bufflen instead.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:35:42 +01:00
HighPoint Linux Team 9f7887935b [SCSI] hptiop: HighPoint RocketRAID 3xxx controller driver
Updates:
- don't bypass SYNCHRONIZE_CACHE command
- return SCSI_MLQUEUE_HOST_BUSY when no free request slots
- move scsi_remove_host() to the begin of hpt_remove(), or it will
  not work after resources being released.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-24 04:34:52 +01:00