summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2007-03-14pwc-uncompress.c shouldn't #include <asm/current.h>Hugh Dickins
Fix a compile error on powerpc. Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11Linux 2.6.16.44-rc1v2.6.16.44-rc1Adrian Bunk
2007-03-11[IPV6] fix ipv6_getsockopt_sticky copy_to_user leakChris Wright
User supplied len < 0 can cause leak of kernel memory. Use unsigned compare instead. Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11[IPV6]: Fix for ipv6_setsockopt NULL dereferenceOlaf Kirch
I came across this bug in http://bugzilla.kernel.org/show_bug.cgi?id=8155 Signed-off-by: Olaf Kirch <olaf.kirch@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11Fix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)Marcel Holtmann
Based on a patch from Don Howard <dhoward@redhat.com> When calling write() with a buffer larger than 512 bytes, the driver's write buffer overflows, allowing to overwrite the EIP and execute arbitrary code with kernel privileges. In read(), there exists a similar problem, but coming from the device. A malicous or buggy device sending more than 512 bytes can overflow of the driver's read buffer, with the same effects as above. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11IB/mthca: Fix off-by-one in FMR handling on memfreeMichael S. Tsirkin
From: Michael S. Tsirkin <mst@mellanox.co.il> mthca_table_find() will return the wrong address when the table entry being searched for is exactly at the beginning of a sglist entry (other than the first), because it uses >= when it should use >. Example: assume we have 2 entries in scatterlist, 4K each, offset is 4K. The current code will return first entry + 4K when we really want the second entry. In particular this means mapping an FMR on a memfree HCA may end up writing the page table into the wrong place, leading to memory corruption and also causing the HCA to use an incorrect address translation table. Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11IPoIB: Rejoin all multicast groups after a port eventEli Cohen
When ipoib_ib_dev_flush() is called because of a port event, the driver needs to rejoin all multicast groups, since the flush will call ipoib_mcast_dev_flush() (via ipoib_ib_dev_down()). Otherwise no (non-broadcast) multicast groups will be rejoined until the networking core calls ->set_multicast_list again, and so multicast reception will be broken for potentially a long time. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11IB/mthca: Use mmiowb after doorbell ringArthur Kepner
We discovered a problem when running IPoIB applications on multiple CPUs on an Altix system. Many messages such as: ib_mthca 0002:01:00.0: SQ 000014 full (19941644 head, 19941707 tail, 64 max, 0 nreq) appear in syslog, and the driver wedges up. Apparently this is because writes to the doorbells from different CPUs reach the device out of order. The following patch adds mmiowb() calls after doorbell rings to ensure the doorbell writes are ordered. Signed-off-by: Arthur Kepner <akepner@sgi.com> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-09SPARC64: Fix memory corruption in pci_4u_free_consistent()David S. Miller
The second argument to free_npages() was being incorrectly calculated, which would thus access far past the end of the arena->map[] bitmap. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-09make ppc64 current preempt-safeHugh Dickins
Repeated -j20 kernel builds on a G5 Quad running an SMP PREEMPT kernel would often collapse within a day, some exec failing with "Bad address". In each case examined, load_elf_binary was doing a kernel_read, but generic_file_aio_read's access_ok saw current->thread.fs.seg as USER_DS instead of KERNEL_DS. objdump of filemap.o shows gcc 4.1.0 emitting "mr r5,r13 ... ld r9,416(r5)" here for get_paca()->__current, instead of the expected and much more usual "ld r9,416(r13)"; I've seen other gcc4s do the same, but perhaps not gcc3s. So, if the task is preempted and rescheduled on a different cpu in between the mr and the ld, r5 will be looking at a different paca_struct from the one it's now on, pick up the wrong __current, and perhaps the wrong seg. Presumably much worse could happen elsewhere, though that split is rare. Other architectures appear to be safe (x86_64's read_pda is more limiting than get_paca), but ppc64 needs to force "current" into one instruction. Signed-off-by: Hugh Dickins <hugh@veritas.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-09dvb-core: fix bug in CRC-32 checking on 64-bit systemsAng Way Chuang
CRC-32 checking during ULE decapsulation always failed on x86_64 systems due to the size of a variable used to store CRC. This bug was discovered on Fedora Core 6 with kernel-2.6.18-1.2849. The i386 counterpart has no such problem. This patch has been tested on 64-bit system as well as 32-bit system. Signed-off-by: Ang Way Chuang <wcang@nrg.cs.usm.my> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-09[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)David S. Miller
Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[TCP]: Fix minisock tcp_create_openreq_child() typo.Arnaldo Carvalho de Melo
On 2/28/07, KOVACS Krisztian <hidden@balabit.hu> wrote: > > Hi, > > While reading TCP minisock code I've found this suspiciously looking > code fragment: > > - 8< - > struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb) > { > struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC); > > if (newsk != NULL) { > const struct inet_request_sock *ireq = inet_rsk(req); > struct tcp_request_sock *treq = tcp_rsk(req); > struct inet_connection_sock *newicsk = inet_csk(sk); > struct tcp_sock *newtp; > - 8< - > > The above code initializes newicsk to inet_csk(sk), isn't that supposed > to be inet_csk(newsk)? As far as I can tell this might leave > icsk_ack.last_seg_size zero even if we do have received data. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08DVB: cxusb: fix firmware patch for big endian systemsJin-Bong lee
Without this patch, the device will not be detected after firmware download on big endian systems. Signed-off-by: Jin-Bong lee <jinbong.lee@samsung.com> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcntDavid Stevens
Reading /proc/net/anycast6 when there is no anycast address on an interface results in an ever-increasing inet6_dev reference count, as well as a reference to the netdevice you can't get rid of. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[IPV6]: anycast refcnt fixMichal Wrobel
This patch fixes a bug in Linux IPv6 stack which caused anycast address to be added to a device prior DAD has been completed. This led to incorrect reference count which resulted in infinite wait for unregister_netdevice completion on interface removal. Signed-off-by: Michal Wrobel <xmxwx@asn.pl> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[SPARC64] bbc_i2c: Fix kenvctrld eating %100 cpu.David S. Miller
Based almost entirely upon a patch by Joerg Friedrich Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[UDP]: Reread uh pointer after pskb_trimHerbert Xu
The header may have moved when trimming. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08[INET]: twcal_jiffie should be unsigned long, not intEric Dumazet
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08video/aty/mach64_ct.c: fix bogus delay loopDavid S. Miller
CT based mach64 cards were reported to hang on sparc64 boxes when compiled with gcc-4.1.x and later. Looking at this piece of code, it's no surprise. A critical delay was implemented as an empty for() loop, and gcc 4.0.x and previous did not optimize it away, so we did get a delay. But gcc-4.1.x and later can optimize it away, and we get crashes. Use a real udelay() to fix this. Fix verified on SunBlade100. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08modify 3c589_cs to be SMP safeKomuro
1. EL3WINDOW is always 1 when lock is not held. 2. The second argument of el3_interrupt is 'void *dev_id', not 'struct el3_private *lp'. Adrian Bunk: backported to 2.6.16 Signed-off-by: Komuro <komurojun-mbn@nifty.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08Missing critical phys_to_virt in lib/swiotlb.cDavid Moore
Adds missing call to phys_to_virt() in the lib/swiotlb.c:swiotlb_sync_sg() function. Without this change, a kernel panic will always occur whenever a SWIOTLB bounce buffer from a scatter-gather list gets synced. Signed-off-by: David Moore <dcm@acm.org> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08init_reap_node() initialization fixDan Yeisley
It looks like there is a bug in init_reap_node() in slab.c that can cause multiple oops's on certain ES7000 configurations. The variable reap_node is defined per cpu, but only initialized on a single CPU. This causes an oops in next_reap_node() when __get_cpu_var(reap_node) returns the wrong value. Fix is below. Signed-off-by: Dan Yeisley <dan.yeisley@unisys.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-08Input: psmouse - fix attribute access on 64-bit systemsSergey Vlasov
psmouse_show_int_attr() and psmouse_set_int_attr() were accessing unsigned int fields as unsigned long, which gave garbage on x86_64. Signed-off-by: Sergey Vlasov <vsu@altlinux.ru> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-02Linux 2.6.16.43v2.6.16.43Adrian Bunk
2007-03-02fs/bad_inode.c 64bit fixAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-27Linux 2.6.16.43-rc1v2.6.16.43-rc1Adrian Bunk
2007-02-27i2c-isa: Restore driver ownerJean Delvare
Commit 2b48716d1d2f2edb1e7cbc5ecf1cb2cb39373e33 back in January 2006 was a bit overzealous. It removed .owner from all i2c drivers, including i2c-isa ones, while they still need it. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26[DECNET]: Fix sfuzz hanging on 2.6.18Patrick McHardy
Dave Jones wrote: > sfuzz D 724EF62A 2828 28717 28691 (NOTLB) > cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0 > dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202 > de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0 > Call Trace: > [<c05b1708>] lock_sock+0x75/0xa6 > [<e0b0b604>] dn_getname+0x18/0x5f [decnet] > [<c05b083b>] sys_getsockname+0x5c/0xb0 > [<c05b0b46>] sys_socketcall+0xef/0x261 > [<c0403f97>] syscall_call+0x7/0xb > DWARF2 unwinder stuck at syscall_call+0x7/0xb > > I wonder if the plethora of lockdep related changes inadvertantly broke something? Looks like unbalanced locking. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sis190: failure to set the MAC address from EEPROMFrancois Romieu
Fix from http://bugzilla.kernel.org/show_bug.cgi?id=7747 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26hwmon: Refactor SENSOR_DEVICE_ATTR_2Jim Cromie
This patch refactors SENSOR_DEVICE_ATTR_2 macro, following pattern set by SENSOR_ATTR. First it creates a new macro SENSOR_ATTR_2() which expands to an initialization expression, then it uses that in SENSOR_DEVICE_ATTR_2, which declares and initializes a struct sensor_device_attribute_2. Signed-off-by: Jim Cromie <jim.cromie@gmail.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26hwmon: Allow sensor attributes arraysJim Cromie
This patch refactors SENSOR_DEVICE_ATTR macro. First it creates a new macro SENSOR_ATTR() which expands to an initialization expression, then it uses that in SENSOR_DEVICE_ATTR, which declares and initializes a struct sensor_device_attribute. IOW, SENSOR_ATTR() imitates __ATTR() in include/linux/device.h. Signed-off-by: Jim Cromie <jim.cromie@gmail.com> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: email and version change.Stephen Hemminger
Put in new email address. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: add more pci idsStephen Hemminger
Update the pci device id table to match 2.6.20 (except for new 88e807x that is still experimental). Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: more statsStephen Hemminger
This is a simple enhancement to dump more device statistics with ethtool. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: fix for use on big endianStephen Hemminger
Ben added this for 2.6.18, it allows sky2 to run on big endian. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: allow multicast pause framesStephen Hemminger
The 802 standard allows pause frames to be either unicast or multicast. Switches seem to send unicast frames, but on a direct link, other boards send multicast pause. Unless the filter bit is set, these pause frames get dropped. Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26sky2: fix ram buffer allocation settingsStephen Hemminger
Different chipsets have different amount of ram buffer (some have none), so need to make sure that driver does proper setup for all cases from 0 on to 48K, in units of 1K. This is a backport of the code from 2.6.19 or later Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26fix ext3 block bitmap leakageKirill Korotaev
This patch fixes ext3 block bitmap leakage, which leads to the following fsck messages on _healthy_ filesystem: Block bitmap differences: -64159 -73707 All kernels up to 2.6.17 have this bug. Found by Vasily Averin <vvs@sw.ru> and Andrey Savochkin <saw@sawoct.com> Test case triggered the issue was created by Dmitry Monakhov <dmonakhov@sw.ru> Signed-Off-By: Kirill Korotaev <dev@openvz.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26[TCP]: Prevent pseudo garbage in SYN's advertized windowIlpo Järvinen
TCP may advertize up to 16-bits window in SYN packets (no window scaling allowed). At the same time, TCP may have rcv_wnd (32-bits) that does not fit to 16-bits without window scaling resulting in pseudo garbage into advertized window from the low-order bits of rcv_wnd. This can happen at least when mss <= (1<<wscale) (see tcp_select_initial_window). This patch fixes the handling of SYN advertized windows (compile tested only). In worst case (which is unlikely to occur though), the receiver advertized window could be just couple of bytes. I'm not sure that such situation would be handled very well at all by the receiver!? Fortunately, the situation normalizes after the first non-SYN ACK is received because it has the correct, scaled window. Alternatively, tcp_select_initial_window could be changed to prevent too large rcv_wnd in the first place. [ tcp_make_synack() has the same bug, and I've added a fix for that to this patch -DaveM ] Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26[IPV4/IPV6] multicast: Check add_grhead() return valueAlexey Dobriyan
add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb from it passed to skb_put() without checking. Adrian Bunk: backported to 2.6.16 Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26hwmon: Add support for the Winbond W83687THFJean Delvare
Add support for the Winbond W83687THF chip to the w83627hf hardware monitoring driver. This new chip is almost similar to the already supported W83627THF chip, except for VID and a few other minor changes. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26w83791d: Documentation updateCharles Spirakis
The alarm bits and the beep enable bits are in different positions in the hardware. Document the problem and leave it to the user-space code to handle the situation. When this driver is updated to the standardized sysfs alarm/beep methodology, this won't be a problem. This is a documentation only change. Signed-off by: Charles Spirakis <bezaur@gmail.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26HWMON: w83791d: New hardware monitoring driver for the Winbond W83791DCharles Spirakis
Add support for the w83791d sensor chip. The w83791d hardware is somewhere between the w83781d and the w83792d and this driver code is derived from the code that supports those chips. Signed-off-by: Charles Spirakis <bezaur@gmail.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26smsc47m192: New hwmon driver for SMSC LPC47M192/997Hartmut Rick
New driver (smsc47m192) which supports voltage and temperature measurement features of SMSC LPC47M192 and LPC47M997 chips. Signed-off-by: Hartmut Rick <linux@rick.claranet.de> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26hwmon: New PC87427 hardware monitoring driverJean Delvare
This is a new hardware monitoring driver for the National Semiconductor PC87427 Super-I/O chip. It only supports fan speed monitoring for now, while the chip can do much more. Thanks to Amir Habibi at Candelis for setting up a test system, and to Michael Kress for testing several iterations of this driver. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26hwmon lm83: Add LM82 supportJordan Crouse
Add LM82 temperature sensor support (similar to the LM83, but less featureful). Signed-off-by: Jordan Crouse <jordan.crouse@amd.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26i2c-piix4: Add ATI IXP200/300/400 supportRudolf Marek
This patch adds the ATI IXP southbridges support to i2c-piix4, as it turned out those chips are compatible with it. Signed-off-by: Rudolf Marek <r.marek@sh.cvut.cz> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26I2C: i2c-piix4: Add Broadcom HT-1000 supportMartin Devera
Add Broadcom HT-1000 south bridge's PCI ID to i2c-piix driver. Note that at least on Supermicro H8SSL it uses non-standard SMBHSTCFG = 3 and standard values like 0 or 9 causes hangup. Signed-off-by: Martin Devera <devik@cdi.cz> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-02-26V4L/DVB: Dvbdev: fix illegal re-usage of fileoperations structMarcel Siegert
Arjan van de Ven <arjan@infradead.org> reported an illegal re-usage of the fileoperations struct if more than one dvb device (e.g. frontend) is present. This patch fixes this issue. It allocates a new fileoperations struct each time a device is registered and copies the default template fileops. Signed-off-by: Marcel Siegert <mws@linuxtv.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Adrian Bunk <bunk@stusta.de>
generated by cgit v1.2.3 (git 2.0.4) at 2025-02-05 18:20:36 +0000