]> git.karo-electronics.de Git - karo-tx-linux.git/log
karo-tx-linux.git
17 years agonvidia fbdev: fix powerpc xmon scribbles
Paul Mackerras [Fri, 10 Nov 2006 23:28:30 +0000 (00:28 +0100)]
nvidia fbdev: fix powerpc xmon scribbles

xmon writes garbage on the screen because the nvidia console driver has
changed the line pitch from what the firmware set it to.  Fix it by making
the nvidia driver inform the btext engine (which xmon uses if the screen is
its output device) about changes to display resolution.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[POWERPC] Fix return value from memcpy
Paul Mackerras [Fri, 10 Nov 2006 23:17:57 +0000 (00:17 +0100)]
[POWERPC] Fix return value from memcpy

As pointed out by Herbert Xu <herbert@gondor.apana.org.au>, our
memcpy implementation didn't return the destination pointer as its
return value, and there is code in the kernel that expects that.
This fixes it.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NET]: Update frag_list in pskb_trim
Herbert Xu [Fri, 10 Nov 2006 23:15:10 +0000 (00:15 +0100)]
[NET]: Update frag_list in pskb_trim

When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of
the packet, the frag_list is not updated to reflect the trimming.  This
will usually work fine until you hit something that uses the packet length
or tail from the frag_list.

Examples include esp_output and ip_fragment.

Another problem caused by this is that you can end up with a linear packet
with a frag_list attached.

It is possible to get away with this if we audit everything to make sure
that they always consult skb->len before going down onto frag_list.  In
fact we can do the samething for the paged part as well to avoid copying
the data area of the skb.  For now though, let's do the conservative fix
and update frag_list.

Many thanks to Marco Berizzi for helping me to track down this bug.

This 4-year old bug took 3 months to track down.  Marco was very patient
indeed :)

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoscx200_acb: Fix the block transactions
Jean Delvare [Fri, 10 Nov 2006 23:13:32 +0000 (00:13 +0100)]
scx200_acb: Fix the block transactions

The scx200_acb i2c bus driver pretends to support SMBus block
transactions, but in fact it implements the more simple I2C block
transactions. Additionally, it lacks sanity checks on the length
of the block transactions, which could lead to a buffer overrun.

This fixes an oops reported by Alexander Atanasov:
http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094

Thanks to Ben Gardner for fixing my bugs :)

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoFix the scx200_acb state machine:
Thomas Andrews [Fri, 10 Nov 2006 23:09:25 +0000 (00:09 +0100)]
Fix the scx200_acb state machine:

* Nack was sent one byte too late on reads >= 2 bytes.
* Stop bit was set one byte too late on reads.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agodrivers/video/nvidia/nvidia.c: Add ID for Quadro NVS280
Pavel Roskin [Thu, 9 Nov 2006 11:00:26 +0000 (12:00 +0100)]
drivers/video/nvidia/nvidia.c: Add ID for Quadro NVS280

Quadro NVS280 is a dual-head PCIe card with PCI ID 10de:00fd and subsystem I
10de:0215.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[DISKLABEL] SUN: Fix signed int usage for sector count
Jeff Mahoney [Thu, 9 Nov 2006 10:31:23 +0000 (11:31 +0100)]
[DISKLABEL] SUN: Fix signed int usage for sector count

The current sun disklabel code uses a signed int for the sector count.
When partitions larger than 1 TB are used, the cast to a sector_t causes
the partition sizes to be invalid:

 # cat /proc/paritions | grep sdan
   66   112 2146435072 sdan
   66   115 9223372036853660736 sdan3
   66   120 9223372036853660736 sdan8

This patch switches the sector count to an unsigned int to fix this.

Eric Sandeen also submitted the same patch.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NET]: __alloc_pages() failures reported due to fragmentation
Larry Woodman [Thu, 9 Nov 2006 10:05:38 +0000 (11:05 +0100)]
[NET]: __alloc_pages() failures reported due to fragmentation

We have seen a couple of __alloc_pages() failures due to
fragmentation, there is plenty of free memory but no large order pages
available.  I think the problem is in sock_alloc_send_pskb(), the
gfp_mask includes __GFP_REPEAT but its never used/passed to the page
allocator.  Shouldnt the gfp_mask be passed to alloc_skb() ?

Signed-off-by: Larry Woodman <lwoodman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NET]: Set truesize in pskb_copy
Herbert Xu [Thu, 9 Nov 2006 10:03:56 +0000 (11:03 +0100)]
[NET]: Set truesize in pskb_copy

Since pskb_copy tacks on the non-linear bits from the original
skb, it needs to count them in the truesize field of the new skb.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[TCP]: Don't use highmem in tcp hash size calculation.
John Heffner [Thu, 9 Nov 2006 10:01:54 +0000 (11:01 +0100)]
[TCP]: Don't use highmem in tcp hash size calculation.

This patch removes consideration of high memory when determining TCP
hash table sizes.  Taking into account high memory results in tcp_mem
values that are too large.

Signed-off-by: John Heffner <jheffner@psc.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[AGPGART] remove unused variable
Adrian Bunk [Thu, 9 Nov 2006 08:54:54 +0000 (09:54 +0100)]
[AGPGART] remove unused variable

This patch removes an unused variable.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Dave Jones <davej@redhat.com>
17 years ago[AGPGART] Suspend/Resume support for nVidia nForce AGP.
Dave Jones [Thu, 9 Nov 2006 08:53:22 +0000 (09:53 +0100)]
[AGPGART] Suspend/Resume support for nVidia nForce AGP.

Based on a patch from the Ubuntu kernel.

Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agodrivers/telephony/ixj: fix an array overrun
Adrian Bunk [Thu, 9 Nov 2006 08:52:07 +0000 (09:52 +0100)]
drivers/telephony/ixj: fix an array overrun

The Coverity checker noted that in
drivers/telephony/ixj.c:ixj_build_filter_cadence(), filter_en[4] or
filter_en[5] could be written to.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agonvidiafb: Add support for Geforce 6100 and related chipsets
Antonino Daplas [Wed, 8 Nov 2006 08:08:58 +0000 (09:08 +0100)]
nvidiafb: Add support for Geforce 6100 and related chipsets

Add support for Geforce 6100 and related chipsets (PCI device id 0x024x)

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agodrivers/md/md.c: update START_ARRAY printk
Adrian Bunk [Wed, 8 Nov 2006 07:19:14 +0000 (08:19 +0100)]
drivers/md/md.c: update START_ARRAY printk

START_ARRAY will not be removed in 2.6.16, therefore replace the date
reference with a kernel version reference.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoremove Documentation/feature-removal-schedule.txt
Adrian Bunk [Wed, 8 Nov 2006 07:14:17 +0000 (08:14 +0100)]
remove Documentation/feature-removal-schedule.txt

The information in Documentation/feature-removal-schedule.txt
doesn't apply to the 2.6.16 branch (and most dates were already
in the past.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV4]: Limit rt cache size properly.
Kirill Korotaev [Wed, 8 Nov 2006 07:12:01 +0000 (08:12 +0100)]
[IPV4]: Limit rt cache size properly.

During OpenVZ stress testing we found that UDP traffic with random src
can generate too much excessive rt hash growing leading finally to OOM
and kernel panics.

It was found that for 4GB i686 system (having 1048576 total pages and
225280 normal zone pages) kernel allocates the following route hash:
syslog: IP route cache hash table entries: 262144 (order: 8, 1048576
bytes) => ip_rt_max_size = 4194304 entries, i.e.  max rt size is
4194304 * 256b = 1Gb of RAM > normal_zone

Attached the patch which removes HASH_HIGHMEM flag from
alloc_large_system_hash() call.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoDon't allow chmod() on the /proc/<pid>/ files
Marcel Holtmann [Wed, 8 Nov 2006 07:10:30 +0000 (08:10 +0100)]
Don't allow chmod() on the /proc/<pid>/ files

This just turns off chmod() on the /proc/<pid>/ files, since there is no
good reason to allow it, and had we disallowed it originally, the nasty
/proc race exploit wouldn't have been possible.

The other patches already fixed the problem chmod() could cause, so this
is really just some final mop-up..

This particular version is based off a patch by Eugene and Marcel which
had much better naming than my original equivalent one.

Signed-off-by: Eugene Teo <eteo@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofbdev: correct buffer size limit in fbmem_read_proc()
Geert Uytterhoeven [Wed, 8 Nov 2006 06:48:45 +0000 (07:48 +0100)]
fbdev: correct buffer size limit in fbmem_read_proc()

Address http://bugzilla.kernel.org/show_bug.cgi?id=7189

It should check `clen', not `len'.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NET]: Add missing UFO initialisations
Herbert Xu [Wed, 8 Nov 2006 06:47:29 +0000 (07:47 +0100)]
[NET]: Add missing UFO initialisations

This bug was unknowingly fixed the GSO patches (or rather, its effect was
unknown at the time).

Thanks to Marco Berizzi's persistence which is documented in the thread
"ipsec tunnel asymmetrical mtu", we now know that it can have highly
non-obvious symptoms.

What happens is that uninitialised uso_size fields can cause packets to
be incorrectly identified as UFO, which means that it does not get
fragmented even if it's over the MTU.

The fix is simple enough.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago from mm/memory.c:
Dmitriy Monakhov [Tue, 7 Nov 2006 14:40:54 +0000 (15:40 +0100)]
 from mm/memory.c:
  1434  static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va)
  1435  {
  1436          /*
  1437           * If the source page was a PFN mapping, we don't have
  1438           * a "struct page" for it. We do a best-effort copy by
  1439           * just copying from the original user address. If that
  1440           * fails, we just zero-fill it. Live with it.
  1441           */
  1442          if (unlikely(!src)) {
  1443                  void *kaddr = kmap_atomic(dst, KM_USER0);
  1444                  void __user *uaddr = (void __user *)(va & PAGE_MASK);
  1445
  1446                  /*
  1447                   * This really shouldn't fail, because the page is there
  1448                   * in the page tables. But it might just be unreadable,
  1449                   * in which case we just give up and fill the result with
  1450                   * zeroes.
  1451                   */
  1452                  if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
  1453                          memset(kaddr, 0, PAGE_SIZE);
  1454                  kunmap_atomic(kaddr, KM_USER0);
  #### D-cache have to be flushed here.
  #### It seems it is just forgotten.

  1455                  return;
  1456
  1457          }
  1458          copy_user_highpage(dst, src, va);
  #### Ok here. flush_dcache_page() called from this func if arch need it
  1459  }

Signed-off-by: Dmitriy Monakhov <dmonakhov@openvz.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[MAINTAINERS]: Add proper entry for TC classifier
Stephen Hemminger [Tue, 7 Nov 2006 14:36:32 +0000 (15:36 +0100)]
[MAINTAINERS]: Add proper entry for TC classifier

Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[PKT_SCHED]: act_api: Fix module leak while flushing actions
Thomas Graf [Tue, 7 Nov 2006 14:34:27 +0000 (15:34 +0100)]
[PKT_SCHED]: act_api: Fix module leak while flushing actions

Module reference needs to be given back if message header
construction fails.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoPKT_SCHED: Return ENOENT if action module is unavailable
Thomas Graf [Tue, 7 Nov 2006 14:32:51 +0000 (15:32 +0100)]
PKT_SCHED: Return ENOENT if action module is unavailable

Return ENOENT if action module is unavailable

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoPKT_SCHED: Fix illegal memory dereferences when dumping actions
Thomas Graf [Tue, 7 Nov 2006 14:31:14 +0000 (15:31 +0100)]
PKT_SCHED: Fix illegal memory dereferences when dumping actions

The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.

The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.

Both bugs can be triggered with malformed netlink message
and don't require any privileges.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoPKT_SCHED: Fix error handling while dumping actions
Thomas Graf [Tue, 7 Nov 2006 14:30:21 +0000 (15:30 +0100)]
PKT_SCHED: Fix error handling while dumping actions

"return -err" and blindly inheriting the error code in the netlink
failure exception handler causes errors codes to be returned as
positive value therefore making them being ignored by the caller.

May lead to sending out incomplete netlink messages.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[PATCH] md: Make sure bi_max_vecs is set properly in bio_split
Neil Brown [Tue, 7 Nov 2006 14:25:48 +0000 (15:25 +0100)]
[PATCH] md: Make sure bi_max_vecs is set properly in bio_split

Else a subsequent bio_clone might make a mess.

Signed-off-by: Neil Brown <neilb@suse.de>
Acked-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[CPUFREQ] Fix powernow-k8 SMP kernel on UP hardware bug.
Randy Dunlap [Tue, 7 Nov 2006 14:15:04 +0000 (15:15 +0100)]
[CPUFREQ] Fix powernow-k8 SMP kernel on UP hardware bug.

Fix powernow-k8 doesn't load bug.
Reference:
https://launchpad.net/distros/ubuntu/+source/linux-source-2.6.15/+bug/35145

Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Dave Jones <davej@redhat.com>
17 years ago[CPUFREQ] Make powernow-k7 work on SMP kernels.
Dave Jones [Tue, 7 Nov 2006 14:14:04 +0000 (15:14 +0100)]
[CPUFREQ] Make powernow-k7 work on SMP kernels.

Even though powernow-k7 doesn't work in SMP environments,
it can work on an SMP configured kernel if there's only
one CPU present, however recalibrate_cpu_khz was returning
-EINVAL on such kernels, so we failed to init the cpufreq driver.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.31 v2.6.16.31
Adrian Bunk [Tue, 7 Nov 2006 13:31:00 +0000 (14:31 +0100)]
Linux 2.6.16.31

18 years agoLinux 2.6.16.31-rc1 v2.6.16.31-rc1
Adrian Bunk [Sun, 5 Nov 2006 08:48:22 +0000 (09:48 +0100)]
Linux 2.6.16.31-rc1

18 years ago[NETFILTER]: Fix ip6_tables extension header bypass bug (CVE-2006-4572)
Patrick McHardy [Sun, 5 Nov 2006 08:04:23 +0000 (09:04 +0100)]
[NETFILTER]: Fix ip6_tables extension header bypass bug (CVE-2006-4572)

As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header
matches.

When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[NETFILTER]: Fix ip6_tables protocol bypass bug (CVE-2006-4572)
Patrick McHardy [Sun, 5 Nov 2006 08:03:48 +0000 (09:03 +0100)]
[NETFILTER]: Fix ip6_tables protocol bypass bug (CVE-2006-4572)

As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.

When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoknfsd: Fix race that can disable NFS server.
Neil Brown [Sun, 5 Nov 2006 08:03:18 +0000 (09:03 +0100)]
knfsd: Fix race that can disable NFS server.

This is a long standing bug that seems to have only recently become
apparent, presumably due to increasing use of NFS over TCP - many
distros seem to be making it the default.

The SK_CONN bit gets set when a listening socket may be ready
for an accept, just as SK_DATA is set when data may be available.

It is entirely possible for svc_tcp_accept to be called with neither
of these set.  It doesn't happen often but there is a small race in
svc_sock_enqueue as SK_CONN and SK_DATA are tested outside the
spin_lock.  They could be cleared immediately after the test and
before the lock is gained.

This normally shouldn't be a problem.  The sockets are non-blocking so
trying to read() or accept() when ther is nothing to do is not a problem.

However: svc_tcp_recvfrom makes the decision "Should I accept() or
should I read()" based on whether SK_CONN is set or not.  This usually
works but is not safe.  The decision should be based on whether it is
a TCP_LISTEN socket or a TCP_CONNECTED socket.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoposix-cpu-timers: prevent signal delivery starvation
Thomas Gleixner [Sun, 5 Nov 2006 08:02:46 +0000 (09:02 +0100)]
posix-cpu-timers: prevent signal delivery starvation

The integer divisions in the timer accounting code can round the result
down to 0.  Adding 0 is without effect and the signal delivery stops.

Clamp the division result to minimum 1 to avoid this.

Problem was reported by Seongbae Park <spark@google.com>, who provided
also an inital patch.

Roland sayeth:

  I have had some more time to think about the problem, and to reproduce it
  using Toyo's test case.  For the record, if my understanding of the problem
  is correct, this happens only in one very particular case.  First, the
  expiry time has to be so soon that in cputime_t units (usually 1s/HZ ticks)
  it's < nthreads so the division yields zero.  Second, it only affects each
  thread that is so new that its CPU time accumulation is zero so now+0 is
  still zero and ->it_*_expires winds up staying zero.  For the VIRT and PROF
  clocks when cputime_t is tick granularity (or the SCHED clock on
  configurations where sched_clock's value only advances on clock ticks), this
  is not hard to arrange with new threads starting up and blocking before they
  accumulate a whole tick of CPU time.  That's what happens in Toyo's test
  case.

  Note that in general it is fine for that division to round down to zero,
  and set each thread's expiry time to its "now" time.  The problem only
  arises with thread's whose "now" value is still zero, so that now+0 winds up
  0 and is interpreted as "not set" instead of ">= now".  So it would be a
  sufficient and more precise fix to just use max(ticks, 1) inside the loop
  when setting each it_*_expires value.

  But, it does no harm to round the division up to one and always advance
  every thread's expiry time.  If the thread didn't already fire timers for
  the expiry time of "now", there is no expectation that it will do so before
  the next tick anyway.  So I followed Thomas's patch in lifting the max out
  of the loops.

  This patch also covers the reload cases, which are harder to write a test
  for (and I didn't try).  I've tested it with Toyo's case and it fixes that.

[toyoa@mvista.com: fix: min_t -> max_t]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[IPV6]: fix lockup via /proc/net/ip6_flowlabel (CVE-2006-5619)
James Morris [Sun, 5 Nov 2006 08:00:45 +0000 (09:00 +0100)]
[IPV6]: fix lockup via /proc/net/ip6_flowlabel (CVE-2006-5619)

There's a bug in the seqfile handling for /proc/net/ip6_flowlabel, where,
after finding a flowlabel, the code will loop forever not finding any
further flowlabels, first traversing the rest of the hash bucket then just
looping.

This patch fixes the problem by breaking after the hash bucket has been
traversed.

Note that this bug can cause lockups and oopses, and is trivially invoked
by an unpriveleged user.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoACPI: enable SMP C-states on x86_64
Shaohua Li [Sun, 5 Nov 2006 07:23:24 +0000 (08:23 +0100)]
ACPI: enable SMP C-states on x86_64

http://bugzilla.kernel.org/show_bug.cgi?id=5653

Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix RARP ic_servaddr breakage
Al Viro [Sun, 5 Nov 2006 07:15:37 +0000 (08:15 +0100)]
fix RARP ic_servaddr breakage

memcpy 4 bytes to address of auto unsigned long variable followed
by comparison with u32 is a bloody bad idea.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[S390] fix user readable uninitialised kernel memory, take 2.
Martin Schwidefsky [Sun, 5 Nov 2006 07:03:01 +0000 (08:03 +0100)]
[S390] fix user readable uninitialised kernel memory, take 2.

The previous patch to correct the copy_from_user padding is quite
broken. The execute instruction needs to be done via the register %r4,
not via %r2 and 31 bit doesn't know the instructions lgr and ahji.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[S390] fix user readable uninitialised kernel memory (CVE-2006-5174)
Martin Schwidefsky [Sun, 5 Nov 2006 07:01:53 +0000 (08:01 +0100)]
[S390] fix user readable uninitialised kernel memory (CVE-2006-5174)

A user space program can read uninitialised kernel memory
by appending to a file from a bad address and then reading
the result back. The cause is the copy_from_user function
that does not clear the remaining bytes of the kernel
buffer after it got a fault on the user space address.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.30 v2.6.16.30
Adrian Bunk [Thu, 2 Nov 2006 07:30:27 +0000 (08:30 +0100)]
Linux 2.6.16.30

18 years agoLinux 2.6.16.30-rc1 v2.6.16.30-rc1
Adrian Bunk [Tue, 17 Oct 2006 12:52:16 +0000 (14:52 +0200)]
Linux 2.6.16.30-rc1

18 years ago[IA64] correct file descriptor reference counting in perfmon (CVE-2006-3741)
Stephane Eranian [Tue, 17 Oct 2006 12:50:56 +0000 (14:50 +0200)]
[IA64] correct file descriptor reference counting in perfmon (CVE-2006-3741)

Fix a bug in sys_perfmonctl() whereby it was not correctly
decrementing the file descriptor reference count.

Signed-off-by: Stephane Eranian <eranian@hpl.hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[PPPOE]: Advertise PPPoE MTU
Michal Ostrowski [Sat, 14 Oct 2006 17:20:16 +0000 (19:20 +0200)]
[PPPOE]: Advertise PPPoE MTU

PPPoE must advertise the underlying device's MTU via the ppp channel
descriptor structure, as multilink functionality depends on it.

Signed-off-by: Michal Ostrowski <mostrows@earthlink.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoPKT_SCHED: cls_basic: Use unsigned int when generating handle
Kim Nordlund [Sat, 14 Oct 2006 08:39:40 +0000 (10:39 +0200)]
PKT_SCHED: cls_basic: Use unsigned int when generating handle

Prevents filters from being added if the first generated
handle already exists.

Signed-off-by: Kim Nordlund <kim.nordlund@nokia.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[SPARC64]: Kill bogus check from bootmem_init().
David S. Miller [Sat, 14 Oct 2006 08:35:26 +0000 (10:35 +0200)]
[SPARC64]: Kill bogus check from bootmem_init().

There is an ancient and totally incorrect sanity check being
done on the ramdisk location.  The check assumes that the
kernel is always loaded to physical address zero, which is
wrong.  It was trying to validate the ramdisk value by saying that
if it fell within the kernel image address range it must be wrong.

Anyways, kill this because it actually creates problems.  The
'ramdisk_image' should always be adjusted down by KERNBASE.
SILO can easily put the ramdisk in a location which causes
this test to trigger, breaking things.

[ Based almost entirely upon a patch from Ben Collins. ]

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[SPARC64]: Fix sched_clock() wrapping every ~17 seconds.
David S. Miller [Sat, 14 Oct 2006 08:33:10 +0000 (10:33 +0200)]
[SPARC64]: Fix sched_clock() wrapping every ~17 seconds.

Unfortunately, sparc64 doesn't have an easy way to do a "64 X 64 -->
128" bit multiply like PowerPC and IA64 do.  We were doing a
"64 X 64 --> 64" bit multiple which causes overflow very quickly with
a 30-bit quotient shift.

So use a quotientshift count of 10 instead of 30, just like x86 and
ARM do.

This also fixes the wrapping of printk timestamp values every ~17
seconds.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] Allow cifsd to suspend if connection is lost
Rafael J. Wysocki [Sat, 14 Oct 2006 08:12:26 +0000 (10:12 +0200)]
[CIFS] Allow cifsd to suspend if connection is lost

Make cifsd allow us to suspend if it has lost the connection with a server

Ref: http://bugzilla.kernel.org/show_bug.cgi?id=6811

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] Fix typo in earlier cifs_unlink change and protect one extra path.
Steve French [Sat, 14 Oct 2006 08:11:47 +0000 (10:11 +0200)]
[CIFS] Fix typo in earlier cifs_unlink change and protect one extra path.

Since cifs_unlink can also be called from rename path and there
was one report of oops am making the extra check for null inode.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] Fix unlink oops when indirectly called in rename error path under heavy stress.
Steve French [Sat, 14 Oct 2006 08:11:16 +0000 (10:11 +0200)]
[CIFS] Fix unlink oops when indirectly called in rename error path under heavy stress.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] fs/cifs/dir.c: fix possible NULL dereference
Steve French [Sat, 14 Oct 2006 08:10:45 +0000 (10:10 +0200)]
[CIFS] fs/cifs/dir.c: fix possible NULL dereference

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[ATM] CLIP: Do not refer freed skbuff in clip_mkip() (CVE-2006-4997)
YOSHIFUJI Hideaki [Fri, 13 Oct 2006 23:13:36 +0000 (01:13 +0200)]
[ATM] CLIP: Do not refer freed skbuff in clip_mkip() (CVE-2006-4997)

In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.

Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofbdev: add modeline for 1680x1050@60
Olaf Hering [Fri, 13 Oct 2006 16:16:26 +0000 (18:16 +0200)]
fbdev: add modeline for 1680x1050@60

Add a modeline for the Philips 200W display.  aty128fb does not do DDC, it
picks 1920x1440 or similar.  It works ok with nvidiafb because it can ask
for DDC data.

mode "1680x1050-60"
    # D: 146.028 MHz, H: 65.191 kHz, V: 59.863 Hz
    geometry 1680 1050 1680 1050 16
    timings 6848 280 104 30 3 176 6
    hsync high
    vsync high
    rgba 5/11,6/5,5/0,0/0
endmode

hwinfo --monitor
20: None 00.0: 10000 Monitor
[Created at monitor.206]
  Unique ID: rdCR.pzUFTofo1S4
  Parent ID: 002j.bJRsY88eNSC
  Hardware Class: monitor
  Model: "PHILIPS Philips 200W"
  Vendor: PHL "PHILIPS"
  Device: eisa 0x0832 "Philips 200W"
  Serial ID: "VN  016596"
  Resolution: 720x400@70Hz
  Resolution: 640x480@60Hz
  Resolution: 640x480@67Hz
  Resolution: 640x480@72Hz
  Resolution: 640x480@75Hz
  Resolution: 800x600@56Hz
  Resolution: 800x600@60Hz
  Resolution: 800x600@72Hz
  Resolution: 800x600@75Hz
  Resolution: 832x624@75Hz
  Resolution: 1024x768@60Hz
  Resolution: 1024x768@70Hz
  Resolution: 1024x768@75Hz
  Resolution: 1280x1024@75Hz
  Resolution: 1152x864@70Hz
  Resolution: 1152x864@75Hz
  Resolution: 1280x960@60Hz
  Resolution: 1280x1024@60Hz
  Resolution: 1680x1050@60Hz
  Size: 433x271 mm
  Driver Info #0:
    Max. Resolution: 1680x1050
    Vert. Sync Range: 56-85 Hz
    Hor. Sync Range: 30-93 kHz
  Config Status: cfg=new, avail=yes, need=no, active=unknown
  Attached to: #5 (VGA compatible controller)

Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: accept flow control
Stephen Hemminger [Fri, 13 Oct 2006 16:13:23 +0000 (18:13 +0200)]
sky2: accept flow control

Don't program the GMAC to reject flow control packets.
This maybe the cause of some of the transmit hangs.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: fix fiber support
Stephen Hemminger [Fri, 13 Oct 2006 16:12:36 +0000 (18:12 +0200)]
sky2: fix fiber support

Fix support for fiber based devices.  Needed to keep track of PMD type to
add workaround in setup. Add support for gigabit half duplex fiber.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: use dev_alloc_skb for receive buffers
Stephen Hemminger [Fri, 13 Oct 2006 16:11:59 +0000 (18:11 +0200)]
sky2: use dev_alloc_skb for receive buffers

Several code paths assume an additional 16 bytes of header padding
on the receive path. Use dev_alloc_skb to get that padding.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agov4l/dvb: Backport the budget driver DISEQC instability fix
Oliver Endriss [Fri, 13 Oct 2006 16:05:48 +0000 (18:05 +0200)]
v4l/dvb: Backport the budget driver DISEQC instability fix

Backport the budget driver DISEQC instability fix.

Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
18 years agov4l/dvb: Backport fix to artec USB DVB devices
Andrew de Quincey [Fri, 13 Oct 2006 16:03:38 +0000 (18:03 +0200)]
v4l/dvb: Backport fix to artec USB DVB devices

Backport fix to artec USB DVB devices

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agov4l/dvb: Fix budget-av frontend detection
Andrew de Quincey [Fri, 13 Oct 2006 16:02:49 +0000 (18:02 +0200)]
v4l/dvb: Fix budget-av frontend detection

The budget-av needs this GPIO set low for most cards to work.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agodvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)
Ang Way Chuang [Fri, 13 Oct 2006 16:01:44 +0000 (18:01 +0200)]
dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)

ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that allows an attacker to send a malformed ULE packet
with SNDU length of 0 and bring down the receiving machine. This patch
fix the bug and has been tested on version 2.6.17.11. This bug is 100%
reproducible and the modified source code (GPL) used to produce this bug
will be posted on http://nrg.cs.usm.my/downloads.htm shortly.  The
kernel will produce a dump during CRC32 checking on faulty ULE packet.

Signed-off-by: Ang Way Chuang <wcang@nrg.cs.usm.my>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoIPV6: Sum real space for RTAs.
YOSHIFUJI Hideaki [Fri, 13 Oct 2006 16:00:31 +0000 (18:00 +0200)]
IPV6: Sum real space for RTAs.

This patch fixes RTNLGRP_IPV6_IFINFO netlink notifications.  Issue
pointed out by Patrick McHardy <kaber@trash.net>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix fdset leakage
Kirill Korotaev [Fri, 13 Oct 2006 15:58:30 +0000 (17:58 +0200)]
fix fdset leakage

When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.30-pre1 v2.6.16.30-pre1
Adrian Bunk [Fri, 22 Sep 2006 18:31:32 +0000 (20:31 +0200)]
Linux 2.6.16.30-pre1

18 years agoUSB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist
Henk Vergonet [Fri, 22 Sep 2006 18:28:19 +0000 (20:28 +0200)]
USB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist

Keys on Yealink based phones will not function properly when using the
generic HID driver. This patch prevents the generic HID code from
grabbing the device before the regular yealink driver can get a grip on
it.

Signed-off-by: Henk Vergonet <Henk.Vergonet@gmail.com>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoUSB: Fix unload oops and memory leak in yealink driver
Henk Vergonet [Fri, 22 Sep 2006 18:20:40 +0000 (20:20 +0200)]
USB: Fix unload oops and memory leak in yealink driver

This patch fixes a memory leak and a kernel oops when trying to unload
the driver, due to an unbalanced cleanup.
Thanks Ivar Jensen for spotting my mistake.

Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agokernel/kmod.c: fix a race condition in usermodehelper.
Martin Schwidefsky [Fri, 22 Sep 2006 00:32:57 +0000 (02:32 +0200)]
kernel/kmod.c: fix a race condition in usermodehelper.

There is a race between call_usermodehelper_keys, __call_usermodehelper
and wait_for_helper. It should only happen if preemption is enabled or
on a virtualized system.

If the cpu is preempted or put to sleep by the hypervisor in
__call_usermodehelper between the creation of the wait_for_helper
thread and the second check on sub_info->wait, the whole execution
of wait_for_helper including the complete call and the continuation
after the wait_for_completion in call_usermodehelper_keys can have
happened before __call_usermodehelper checks sub_info->wait for the
second time. Since sub_info can already have been clobbered,
sub_info->wait could be zero and complete is called a second time
with an invalid argument. This has happened on s390. It took me only
three days to find out ..

Thanks to Arnd Bergmann for his help to spot this bug.

Kenneth Lee also sent the same patch independently.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoI2C: fix 'ignore' module parameter handling
Mark M. Hoffman [Fri, 22 Sep 2006 00:22:54 +0000 (02:22 +0200)]
I2C: fix 'ignore' module parameter handling

This patch fixes a bug in the handling of 'ignore' module parameters of I2C
client drivers.

Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA8290 update
Hartmut Hackmann [Mon, 18 Sep 2006 22:56:25 +0000 (00:56 +0200)]
V4L/DVB: TDA8290 update

This patch
- works around a bug in the I2C bridge that makes the initialization
  of the TDA10046 fail on recent LifeView cards
- puts the AGC output to tristate in sleep mode. This is necessary for
  recent hybrid cards that switch the AGC via tristateing.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Acked-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoConvert idr's internal locking to _irqsave variant
Roland Dreier [Mon, 18 Sep 2006 17:28:17 +0000 (19:28 +0200)]
Convert idr's internal locking to _irqsave variant

Currently, the code in lib/idr.c uses a bare spin_lock(&idp->lock) to do
internal locking.  This is a nasty trap for code that might call idr
functions from different contexts; for example, it seems perfectly
reasonable to call idr_get_new() from process context and idr_remove() from
interrupt context -- but with the current locking this would lead to a
potential deadlock.

The simplest fix for this is to just convert the idr locking to use
spin_lock_irqsave().

In particular, this fixes a very complicated locking issue detected by
lockdep, involving the ib_ipoib driver's priv->lock and dev->_xmit_lock,
which get involved with the ib_sa module's query_idr.lock.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[TEXTSEARCH]: Fix Boyer Moore initialization bug
Michael Rash [Mon, 18 Sep 2006 17:26:29 +0000 (19:26 +0200)]
[TEXTSEARCH]: Fix Boyer Moore initialization bug

The pattern is set after trying to compute the prefix table, which tries
to use it. Initialize it before calling compute_prefix_tbl, make
compute_prefix_tbl consistently use only the data from struct ts_bm
and remove the now unnecessary arguments.

Signed-off-by: Michael Rash <mbr@cipherdyne.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: fix speed and link status reported by ethtool
Jay Cliburn [Mon, 18 Sep 2006 17:23:20 +0000 (19:23 +0200)]
via-velocity: fix speed and link status reported by ethtool

The via-velocity driver reports incorrect speed and link detected status
as viewed by ethtool (and probably other tools). This patch fixes those
incorrect reports and prettifies a long line.

Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: the link is not correctly detected when the device starts
Roy Marples [Mon, 18 Sep 2006 17:20:52 +0000 (19:20 +0200)]
via-velocity: the link is not correctly detected when the device starts

The patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=6711

Signed-off-by: Roy Marples <uberlord@gentoo.org>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] VIA PT880 Ultra support.
Magnus Kessler [Mon, 18 Sep 2006 17:17:43 +0000 (19:17 +0200)]
[AGPGART] VIA PT880 Ultra support.

This patch enables agpgart on a Via "PT880 Ultra" based motherboard
(Asus P4V800D-X). The PCI ID of the PT880 Ultra is 0x0308 instead of
0x0258 of the PT880.

The patched via-agp passes testgart.

Signed-off-by: Magnus Kessler <Magnus.Kessler@gmx.net>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] ATI RS350 support.
Julien Tous [Mon, 18 Sep 2006 17:16:24 +0000 (19:16 +0200)]
[AGPGART] ATI RS350 support.

From: Julien Tous <julien.tous@gmail.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoPFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.
Tushar Gohad [Mon, 18 Sep 2006 17:14:39 +0000 (19:14 +0200)]
PFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.

Fixes inconsistent use of "uint32_t" vs. "u_int32_t".
Fix pfkeyv2 userspace builds.

Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA10046 Driver update
Hartmut Hackmann [Sat, 16 Sep 2006 22:18:45 +0000 (00:18 +0200)]
V4L/DVB: TDA10046 Driver update

- Set outputs to tristate in sleep mode
- Reduce dangerously high firmware download speed with 16MHz xtal
- added tda827x configuration with GPIOs low
- added comments to stupid looking IIC reads that work around bugs in
  the tda10046.
- some minor updates

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoadd drivers/media/video/saa7134/saa7134-input.c:flydvb_codes
Adrian Bunk [Sat, 16 Sep 2006 22:00:29 +0000 (00:00 +0200)]
add drivers/media/video/saa7134/saa7134-input.c:flydvb_codes

based on drivers/media/common/ir-keymaps.c:ir_codes_flydvb
in Linus' tree.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the new Lifeview hybrid cardbus modules
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:55 +0000 (23:38 +0200)]
V4L/DVB: Added support for the new Lifeview hybrid cardbus modules

There seem to be many variants of this cards with different
feature sets. This entry supports
analog TV, CVBS and s-video input, FM radio and DVB-T
if they are supported by the hardware.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:13 +0000 (23:38 +0200)]
V4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T

The .vmux entry needs to be 1 instead of 0

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added PCI IDs of 2 LifeView Cards
Hartmut Hackmann [Sat, 16 Sep 2006 21:37:44 +0000 (23:37 +0200)]
V4L/DVB: Added PCI IDs of 2 LifeView Cards

Added ID entries for the Genius VideoWonder DVB-T
and the LifeView FlyTV Platinum Gold

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: select FW_LOADER
maximilian attems [Sat, 16 Sep 2006 21:37:11 +0000 (23:37 +0200)]
V4L/DVB: Saa7134: select FW_LOADER

The saa7134 drivers uses request_firmware()
and thus needs to select FW_LOADER.

Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Medion 7134: Autodetect second bridge chip
Michael Krufky [Sat, 16 Sep 2006 21:36:05 +0000 (23:36 +0200)]
V4L/DVB: Medion 7134: Autodetect second bridge chip

The device, Medion 7134, has two saa7134 chips on it, but only one of them
is functional in the current saa7134 driver.

This patch adds autodetection for the second, unsupported saa7134 chip,
as SAA7134_BOARD_MD7134_BRIDGE_2, and displays a message to the user
(in dmesg) indicating that the second chip isn't yet functional.

This is useful for users, since two instances of the saa7134 driver
will spawn. This patch will prevent confusion by warning the user that
only one of the chips on the board are functional.

There are other versions of the SAA7134_BOARD_MD7134 with only a single
saa7134 bridge/decoder -- those devices will not be affected by this patch.
Only devices containing the second chip will display the warning.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: make unsupported secondary decoder message generic
Michael Krufky [Sat, 16 Sep 2006 21:35:11 +0000 (23:35 +0200)]
V4L/DVB: Saa7134: make unsupported secondary decoder message generic

There are already some supported devices that contain two
saa713x chips on-board, where only one of these chips is
currently functional in the driver.
We are already printing a warning message for the second
saa7134 decoder in SAA7134_BOARD_AVERMEDIA_A169_B. This
patch alters that case to make it generic, so that other
cards in the same situation can use it.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card
Rickard Osser [Sat, 16 Sep 2006 21:34:30 +0000 (23:34 +0200)]
V4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card

- Added support for AVerMedia A169 Dual Analog tuner card
  (dual saa7134 decoders - only 1 working right now)
- Added autodetection for both parts of the card.
  It shows up like 2 cards, B1 and B
- Enabled tuner B1, SVIDEO on B1 and composite1 through SVIDEO,
  FIXME: B is more or less dead at this point and I suspect the
  FM-radio is on the B part of the board

Adrian Bunk:
slightly adapted to 2.6.16

Signed-off-by: Rickard Osser <ricky@osser.se>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: document that there's also a 220RF from KWorld
Adrian Bunk [Sat, 16 Sep 2006 21:33:38 +0000 (23:33 +0200)]
V4L/DVB: Saa7134: document that there's also a 220RF from KWorld

I have the same card with the same PCI id, but from KWorld.
The patch documents that this is the same card.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
18 years agoV4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID
TAMUKI Shoichi [Sat, 16 Sep 2006 21:33:10 +0000 (23:33 +0200)]
V4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID

- Corrected autodetection for saa7130 card:
  subsystem: 1048:226c, board: ELSA EX-VISION 700TV

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load
Curt Meyers [Sat, 16 Sep 2006 21:32:18 +0000 (23:32 +0200)]
V4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load

- Enable the tuv1236 tuner on the Kworld-ATSC110 card so that the
  tuner can be identified when tuners.ko loads.
- With this change it is no longer necessary to remove and reload
  the tuner module in order to get the tuv1236 identified.
- This code was copied from the ATI HDTV Wonder init routine (in cx88-cards.c)
  which also uses the TUV1236D.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: cleanups
Michael Krufky [Sat, 16 Sep 2006 21:31:38 +0000 (23:31 +0200)]
V4L/DVB: Kworld ATSC110: cleanups

- There is no radio with this tuner card...
Thanks-to: Dwaine Garden <DwaineGarden@rogers.com>
- fixed capitalization in card name.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: enable composite and svideo inputs
Curt Meyers [Sat, 16 Sep 2006 21:30:59 +0000 (23:30 +0200)]
V4L/DVB: Kworld ATSC110: enable composite and svideo inputs

- corrected composite input.
- verified s-video input.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: KWorld ATSC110: implement set_pll_input
Curt Meyers [Sat, 16 Sep 2006 21:30:22 +0000 (23:30 +0200)]
V4L/DVB: KWorld ATSC110: implement set_pll_input

- When tuning VSB, use ANT input
- When tuning QAM, use CABLE input

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for Kworld ATSC110
Andrew Burri [Sat, 16 Sep 2006 21:29:38 +0000 (23:29 +0200)]
V4L/DVB: Add support for Kworld ATSC110

Signed-off-by: Andrew Burri <andrew.burri@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)
Tamuki Shoichi [Sat, 16 Sep 2006 21:28:54 +0000 (23:28 +0200)]
V4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)

Add support for ELSA EX-VISION 700TV, which is the ELSA Japan's
flagship model of the software encoding TV capture card.
All inputs (Television, Composite1 and S-Video) have been tested.

Signed-off-by: Tamuki Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the Tevion DVB-T 220RF card
Hartshorn [Sat, 16 Sep 2006 21:24:47 +0000 (23:24 +0200)]
V4L/DVB: Added support for the Tevion DVB-T 220RF card

This is an analog / digital hybrid card.

Signed-off-by: Peter Hartshorn <p3r@users.sourceforge.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331
Hartmut Hackmann [Sat, 16 Sep 2006 21:23:59 +0000 (23:23 +0200)]
V4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331

Analog and DVB-T are working, Remote not yet.
This card is based on the new LifeView design, there should be many variants.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the LifeView FlyDVB-T LR301 card
Giampiero Giancipoli [Sat, 16 Sep 2006 21:23:23 +0000 (23:23 +0200)]
V4L/DVB: Added support for the LifeView FlyDVB-T LR301 card

Additionally to the card support, this changeset adds the option
tda10046lifeview to get_dvb_firmware to download tda10046 firmware
from LifeView's site.

Signed-off-by: Giampiero Giancipoli <gianci@libero.it>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for the Avermedia 777 DVB-T card
Jose Alberto Reguero [Sat, 16 Sep 2006 21:22:34 +0000 (23:22 +0200)]
V4L/DVB: Add support for the Avermedia 777 DVB-T card

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29 v2.6.16.29
Adrian Bunk [Tue, 12 Sep 2006 18:02:10 +0000 (20:02 +0200)]
Linux 2.6.16.29

18 years agoLinux 2.6.16.29-rc2 v2.6.16.29-rc2
Adrian Bunk [Sat, 9 Sep 2006 15:45:05 +0000 (17:45 +0200)]
Linux 2.6.16.29-rc2

18 years agoHave ext2 reject file handles with bad inode numbers early.
Neil Brown [Sat, 9 Sep 2006 15:44:45 +0000 (17:44 +0200)]
Have ext2 reject file handles with bad inode numbers early.

This prevents bad inode numbers from triggering errors in
ext2_get_inode.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29-rc1 v2.6.16.29-rc1
Adrian Bunk [Wed, 6 Sep 2006 17:55:27 +0000 (19:55 +0200)]
Linux 2.6.16.29-rc1