summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2006-11-20Linux 2.6.16.33-rc1v2.6.16.33-rc1Adrian Bunk
2006-11-20POWERPC: Make alignment exception always check exception tableBenjamin Herrenschmidt
The alignment exception used to only check the exception table for -EFAULT, not for other errors. That opens an oops window if we can coerce the kernel into getting an alignment exception for other reasons in what would normally be a user-protected accessor, which can be done via some of the futex ops. This fixes it by always checking the exception tables. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20Add new PHY to sis900 supported listDaniele Venzano
This patch adds support for a new PHY to the sis900 driver. See also Bugzilla 6919. Signed-off-by: Daniele Venzano <venza@brownhat.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20sis900 adm7001 PHY supportArtur Skawina
this patch is required to get a SIS964 based motherboard ethernet working (FSC D1875) (picking the #1 transceiver, instead of the last one, in case no known ones were found might be a better default, and would have worked in this case too) Signed-off-by: Artur Skawina <art_k@o2.pl> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20Old IDE, fix SATA detection for cablingMichael-Luke Jones
This patch is identical to that introduced in 1a1276e7b6cba549553285f74e87f702bfff6fac to the Linus' 2.6 development tree by Alan Cox. 'This is based on the proposed patches flying around but also checks that the device in question is new enough to have word 93 rather thanb blindly assuming word 93 == 0 means SATA (see ATA-5, ATA-7)' -- Alan Cox Required for my SATA drive on an Asus Pundit-R to operate above 33MBps. Signed-off-by: Michael-Luke Jones <mlj28@cam.ac.uk> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20Fix BeFS slab corruptionDiego Calleja
In bugzilla #6941, Jens Kilian reported: "The function befs_utf2nls (in fs/befs/linuxvfs.c) writes a 0 byte past the end of a block of memory allocated via kmalloc(), leading to memory corruption. This happens only for filenames which are pure ASCII and a multiple of 4 bytes in length. [...] Without DEBUG_SLAB, this leads to further corruption and hard lockups; I believe this is the bug which has made kernels later than 2.6.8 unusable for me. (This must be due to changes in memory management, the bug has been in the BeFS driver since the time it was introduced (AFAICT).) Steps to reproduce: Create a directory (in BeOS, naturally :-) with files named, e.g., "1", "22", "333", "4444", ... Mount it in Linux and do an "ls" or "find"" This patch implements the suggested fix. Credits to Jens Kilian for debugging the problem and finding the right fix. Signed-off-by: Diego Calleja <diegocg@gmail.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20V4L/DVB: Saa7134: rename dmasound_{init,exit}Adrian Bunk
Two different exports with the same name are not a good idea: $ grep -r EXPORT_SYMBOL\(dmasound_init\) * drivers/media/video/saa7134/saa7134-core.c:EXPORT_SYMBOL(dmasound_init); sound/oss/dmasound/dmasound_core.c:EXPORT_SYMBOL(dmasound_init); $ This patch renames the saa7134 dmasound_{init,exit} to saa7134_dmasound_{init,exit}. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20[RTNETLINK]: Fix IFLA_ADDRESS handling.David Miller
The ->set_mac_address handlers expect a pointer to a sockaddr which contains the MAC address, whereas IFLA_ADDRESS provides just the MAC address itself. So whip up a sockaddr to wrap around the netlink attribute for the ->set_mac_address call. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20drivers/scsi/psi240i.c: fix an array overrunAdrian Bunk
This patch fixes an array overrun spotted by the Coverity checker. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20[TG3]: Fix array overrun in tg3_read_partno().Michael Chan
Use proper upper limits for the loops and check for all error conditions. The problem was noticed by Adrian Bunk. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-20disable debugging version of write_lock()Andrew Morton
We've confirmed that the debug version of write_lock() can get stuck for long enough to cause NMI watchdog timeouts and hence a crash. We don't know why, yet. Disable it for now. Also disable the similar read_lock() code. Just in case. Thanks to Dave Olson <olson@unixfolk.com> for reporting and testing. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17Fix timer race in dst GC codeDmitry Mishin
Replace add_timer() by mod_timer() in dst_run_gc in order to avoid BUG message. CPU1 CPU2 dst_run_gc() entered dst_run_gc() entered spin_lock(&dst_lock) ..... del_timer(&dst_gc_timer) fail to get lock .... mod_timer() <--- puts timer back to the list add_timer(&dst_gc_timer) <--- BUG because timer is in list already. Found during OpenVZ internal testing. At first we thought that it is OpenVZ specific as we added dst_run_gc(0) call in dst_dev_event(), but as Alexey pointed to me it is possible to trigger this condition in mainstream kernel. F.e. timer has fired on CPU2, but the handler was preeempted by an irq before dst_lock is tried. Meanwhile, someone on CPU1 adds an entry to gc list and starts the timer. If CPU2 was preempted long enough, this timer can expire simultaneously with resuming timer handler on CPU1, arriving exactly to the situation described. Signed-off-by: Dmitry Mishin <dim@openvz.org> Signed-off-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17ext3 -nobh option causes oopsBadari Pulavarty
For files other than IFREG, nobh option doesn't make sense. Modifications to them are journalled and needs buffer heads to do that. Without this patch, we get kernel oops in page_buffers(). Signed-off-by: Badari Pulavarty <pbadari@us.ibm.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17ipmi_si_intf.c: fix "&& 0xff" typosAlexey Dobriyan
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17security/seclvl.c: fix time wrap (CVE-2005-4352)Adrian Bunk
initlvl=2 in seclvl gives the guarantee "Cannot decrement the system time". But it was possible to set the time to the maximum unixtime value (19 Jan 2038) resulting in a wrap to the minimum value. This patch fixes this by disallowing setting the time to any date after 2030 with initlvl=2. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-17synclink_gt fix receive tty error handlingPaul Fulghum
Fix receive tty error handling in synclink_gt driver. Adrian reported compiler warning for incorrect bit test against char variable. I determined these and other device specific error bits were incorrectly defined. Signed-off-by: Paul Fulghum <paulkf@microgate.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15fix via586 irq routing for pirq 5Daniel Ritz
fix interrput routing for via 586 bridges. pirq can be 5 which needs to be mapped to INTD. but currently the access functions can handle only pirq 1-4. this is similar to the other via chipsets where pirq 4 and 5 are both mapped to INTD. fixes bugzilla #7490 Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15sata_promise: Support FastTrak TX4300/TX4310Daniel Drake
This patch adds support for the Promise FastTrak TX4300/TX4310 4-port PCI SATA controllers based on the PDC40719 chip. Signed-off-by: Daniel Drake <dsd@gentoo.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15Reduce ACPI verbosity on null handle conditionBob Moore
As detailed at http://bugs.gentoo.org/131534 : 2.6.16 converted many ACPI debug messages into error or warning messages. One extraneous message was incorrectly converted, resulting in logs being flooded by "Handle is NULL and Pathname is relative" messages on some systems. This patch (part of a larger ACPICA commit) converts the message back to debug level. Signed-off-by: Daniel Drake <dsd@gentoo.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-15Linux 2.6.16.32v2.6.16.32Adrian Bunk
2006-11-11Linux 2.6.16.32-rc1v2.6.16.32-rc1Adrian Bunk
2006-11-11Fix longstanding load balancing bug in the schedulerChristoph Lameter
The scheduler will stop load balancing if the most busy processor contains processes pinned via processor affinity. The scheduler currently only does one search for busiest cpu. If it cannot pull any tasks away from the busiest cpu because they were pinned then the scheduler goes into a corner and sulks leaving the idle processors idle. F.e. If you have processor 0 busy running four tasks pinned via taskset, there are none on processor 1 and one just started two processes on processor 2 then the scheduler will not move one of the two processes away from processor 2. This patch fixes that issue by forcing the scheduler to come out of its corner and retrying the load balancing by considering other processors for load balancing. This patch was originally developed by John Hawkes and discussed at http://marc.theaimsgroup.com/?l=linux-kernel&m=113901368523205&w=2. I have removed extraneous material and gone back to equipping struct rq with the cpu the queue is associated with since this makes the patch much easier and it is likely that others in the future will have the same difficulty of figuring out which processor owns which runqueue. The overhead added through these patches is a single word on the stack if the kernel is configured to support 32 cpus or less (32 bit). For 32 bit environments the maximum number of cpus that can be configued is 255 which would result in the use of 32 bytes additional on the stack. On IA64 up to 1k cpus can be configured which will result in the use of 128 additional bytes on the stack. The maximum additional cache footprint is one cacheline. Typically memory use will be much less than a cacheline and the additional cpumask will be placed on the stack in a cacheline that already contains other local variable. Signed-off-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11sata_sil24: add a new PCI ID for SiI 3124Tejun Heo
Add a new PCI ID for SiI 3124. Reported by Silicon Image. Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11ia64/sparc: fix local DoS with corrupted ELFs (CVE-2006-4538)Kirill Korotaev
This patch prevents cross-region mappings on IA64 and SPARC which could lead to system crash. Adrian Bunk: Adapted to 2.6.16. Signed-Off-By: Kirill Korotaev <dev@openvz.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11nvidia fbdev: fix powerpc xmon scribblesPaul Mackerras
xmon writes garbage on the screen because the nvidia console driver has changed the line pitch from what the firmware set it to. Fix it by making the nvidia driver inform the btext engine (which xmon uses if the screen is its output device) about changes to display resolution. Signed-off-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11[POWERPC] Fix return value from memcpyPaul Mackerras
As pointed out by Herbert Xu <herbert@gondor.apana.org.au>, our memcpy implementation didn't return the destination pointer as its return value, and there is code in the kernel that expects that. This fixes it. Signed-off-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11[NET]: Update frag_list in pskb_trimHerbert Xu
When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of the packet, the frag_list is not updated to reflect the trimming. This will usually work fine until you hit something that uses the packet length or tail from the frag_list. Examples include esp_output and ip_fragment. Another problem caused by this is that you can end up with a linear packet with a frag_list attached. It is possible to get away with this if we audit everything to make sure that they always consult skb->len before going down onto frag_list. In fact we can do the samething for the paged part as well to avoid copying the data area of the skb. For now though, let's do the conservative fix and update frag_list. Many thanks to Marco Berizzi for helping me to track down this bug. This 4-year old bug took 3 months to track down. Marco was very patient indeed :) Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11scx200_acb: Fix the block transactionsJean Delvare
The scx200_acb i2c bus driver pretends to support SMBus block transactions, but in fact it implements the more simple I2C block transactions. Additionally, it lacks sanity checks on the length of the block transactions, which could lead to a buffer overrun. This fixes an oops reported by Alexander Atanasov: http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094 Thanks to Ben Gardner for fixing my bugs :) Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-11Fix the scx200_acb state machine:Thomas Andrews
* Nack was sent one byte too late on reads >= 2 bytes. * Stop bit was set one byte too late on reads. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09drivers/video/nvidia/nvidia.c: Add ID for Quadro NVS280Pavel Roskin
Quadro NVS280 is a dual-head PCIe card with PCI ID 10de:00fd and subsystem I 10de:0215. Signed-off-by: Pavel Roskin <proski@gnu.org> Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09[DISKLABEL] SUN: Fix signed int usage for sector countJeff Mahoney
The current sun disklabel code uses a signed int for the sector count. When partitions larger than 1 TB are used, the cast to a sector_t causes the partition sizes to be invalid: # cat /proc/paritions | grep sdan 66 112 2146435072 sdan 66 115 9223372036853660736 sdan3 66 120 9223372036853660736 sdan8 This patch switches the sector count to an unsigned int to fix this. Eric Sandeen also submitted the same patch. Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09[NET]: __alloc_pages() failures reported due to fragmentationLarry Woodman
We have seen a couple of __alloc_pages() failures due to fragmentation, there is plenty of free memory but no large order pages available. I think the problem is in sock_alloc_send_pskb(), the gfp_mask includes __GFP_REPEAT but its never used/passed to the page allocator. Shouldnt the gfp_mask be passed to alloc_skb() ? Signed-off-by: Larry Woodman <lwoodman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09[NET]: Set truesize in pskb_copyHerbert Xu
Since pskb_copy tacks on the non-linear bits from the original skb, it needs to count them in the truesize field of the new skb. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09[TCP]: Don't use highmem in tcp hash size calculation.John Heffner
This patch removes consideration of high memory when determining TCP hash table sizes. Taking into account high memory results in tcp_mem values that are too large. Signed-off-by: John Heffner <jheffner@psc.edu> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09[AGPGART] remove unused variableAdrian Bunk
This patch removes an unused variable. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Dave Jones <davej@redhat.com>
2006-11-09[AGPGART] Suspend/Resume support for nVidia nForce AGP.Dave Jones
Based on a patch from the Ubuntu kernel. Signed-off-by: Ben Collins <bcollins@ubuntu.com> Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-09drivers/telephony/ixj: fix an array overrunAdrian Bunk
The Coverity checker noted that in drivers/telephony/ixj.c:ixj_build_filter_cadence(), filter_en[4] or filter_en[5] could be written to. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08nvidiafb: Add support for Geforce 6100 and related chipsetsAntonino Daplas
Add support for Geforce 6100 and related chipsets (PCI device id 0x024x) Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08drivers/md/md.c: update START_ARRAY printkAdrian Bunk
START_ARRAY will not be removed in 2.6.16, therefore replace the date reference with a kernel version reference. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08remove Documentation/feature-removal-schedule.txtAdrian Bunk
The information in Documentation/feature-removal-schedule.txt doesn't apply to the 2.6.16 branch (and most dates were already in the past. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08[IPV4]: Limit rt cache size properly.Kirill Korotaev
During OpenVZ stress testing we found that UDP traffic with random src can generate too much excessive rt hash growing leading finally to OOM and kernel panics. It was found that for 4GB i686 system (having 1048576 total pages and 225280 normal zone pages) kernel allocates the following route hash: syslog: IP route cache hash table entries: 262144 (order: 8, 1048576 bytes) => ip_rt_max_size = 4194304 entries, i.e. max rt size is 4194304 * 256b = 1Gb of RAM > normal_zone Attached the patch which removes HASH_HIGHMEM flag from alloc_large_system_hash() call. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08Don't allow chmod() on the /proc/<pid>/ filesMarcel Holtmann
This just turns off chmod() on the /proc/<pid>/ files, since there is no good reason to allow it, and had we disallowed it originally, the nasty /proc race exploit wouldn't have been possible. The other patches already fixed the problem chmod() could cause, so this is really just some final mop-up.. This particular version is based off a patch by Eugene and Marcel which had much better naming than my original equivalent one. Signed-off-by: Eugene Teo <eteo@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08fbdev: correct buffer size limit in fbmem_read_proc()Geert Uytterhoeven
Address http://bugzilla.kernel.org/show_bug.cgi?id=7189 It should check `clen', not `len'. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-08[NET]: Add missing UFO initialisationsHerbert Xu
This bug was unknowingly fixed the GSO patches (or rather, its effect was unknown at the time). Thanks to Marco Berizzi's persistence which is documented in the thread "ipsec tunnel asymmetrical mtu", we now know that it can have highly non-obvious symptoms. What happens is that uninitialised uso_size fields can cause packets to be incorrectly identified as UFO, which means that it does not get fragmented even if it's over the MTU. The fix is simple enough. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07 from mm/memory.c:Dmitriy Monakhov
1434 static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va) 1435 { 1436 /* 1437 * If the source page was a PFN mapping, we don't have 1438 * a "struct page" for it. We do a best-effort copy by 1439 * just copying from the original user address. If that 1440 * fails, we just zero-fill it. Live with it. 1441 */ 1442 if (unlikely(!src)) { 1443 void *kaddr = kmap_atomic(dst, KM_USER0); 1444 void __user *uaddr = (void __user *)(va & PAGE_MASK); 1445 1446 /* 1447 * This really shouldn't fail, because the page is there 1448 * in the page tables. But it might just be unreadable, 1449 * in which case we just give up and fill the result with 1450 * zeroes. 1451 */ 1452 if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) 1453 memset(kaddr, 0, PAGE_SIZE); 1454 kunmap_atomic(kaddr, KM_USER0); #### D-cache have to be flushed here. #### It seems it is just forgotten. 1455 return; 1456 1457 } 1458 copy_user_highpage(dst, src, va); #### Ok here. flush_dcache_page() called from this func if arch need it 1459 } Signed-off-by: Dmitriy Monakhov <dmonakhov@openvz.org> Acked-by: David Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07[MAINTAINERS]: Add proper entry for TC classifierStephen Hemminger
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07[PKT_SCHED]: act_api: Fix module leak while flushing actionsThomas Graf
Module reference needs to be given back if message header construction fails. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07PKT_SCHED: Return ENOENT if action module is unavailableThomas Graf
Return ENOENT if action module is unavailable Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07PKT_SCHED: Fix illegal memory dereferences when dumping actionsThomas Graf
The TCA_ACT_KIND attribute is used without checking its availability when dumping actions therefore leading to a value of 0x4 being dereferenced. The use of strcmp() in tc_lookup_action_n() isn't safe when fed with string from an attribute without enforcing proper NUL termination. Both bugs can be triggered with malformed netlink message and don't require any privileges. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2006-11-07PKT_SCHED: Fix error handling while dumping actionsThomas Graf
"return -err" and blindly inheriting the error code in the netlink failure exception handler causes errors codes to be returned as positive value therefore making them being ignored by the caller. May lead to sending out incomplete netlink messages. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-28 18:41:02 +0000