]> git.karo-electronics.de Git - karo-tx-linux.git/log
karo-tx-linux.git
17 years agoUSB: another unusual device
Phil Dibowitz [Sun, 25 Mar 2007 00:56:30 +0000 (01:56 +0100)]
USB: another unusual device

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: unusual_devs entry for Nokia E61
Alan Stern [Sun, 25 Mar 2007 00:56:02 +0000 (01:56 +0100)]
USB: unusual_devs entry for Nokia E61

This patch (as748) adds an unusual_devs entry for the Nokia E61 mobile
phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: unusual_devs entry for Nokia N91
Alan Stern [Sun, 25 Mar 2007 00:55:30 +0000 (01:55 +0100)]
USB: unusual_devs entry for Nokia N91

This patch (as745) adds an unusual_devs entry for the Nokia N91, just like
the entry for the N80 added a couple of weeks ago.  Apparently Nokia isn't
using very good firmware these days...

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB Storage: US_FL_MAX_SECTORS_64 flag
Phil Dibowitz [Sun, 25 Mar 2007 00:54:59 +0000 (01:54 +0100)]
USB Storage: US_FL_MAX_SECTORS_64 flag

This patch adds a US_FL_MAX_SECTORS_64 and removes the Genesys special-cases
for this that were in scsiglue.c. It also adds the flag to other devices
reported to need it.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: unusual_devs entry for Samsung MP3 player
Ernis [Sun, 25 Mar 2007 00:53:46 +0000 (01:53 +0100)]
USB: unusual_devs entry for Samsung MP3 player

This patch (as730) contains an unusual_devs entry for a Samsung MP3
device.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agousb-storage: unusual_devs entry for Motorola RAZR V3x
Davide Perini [Sun, 25 Mar 2007 00:53:16 +0000 (01:53 +0100)]
usb-storage: unusual_devs entry for Motorola RAZR V3x

This patch (as725) adds an unusual_devs entry for the Motorola RAZR V3x.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: unusual_devs entry for Nokia N80
Alan Stern [Sun, 25 Mar 2007 00:52:47 +0000 (01:52 +0100)]
USB: unusual_devs entry for Nokia N80

Here is a patch (as720) adding an unusual_devs entry for the Nokia N80
mobile phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agousb-storage: unusual_devs entry for Nikon DSC D70s
Alan Stern [Sun, 25 Mar 2007 00:52:12 +0000 (01:52 +0100)]
usb-storage: unusual_devs entry for Nikon DSC D70s

This patch (as704) adds an unusual_devs entry for the Nikon DSC D70s,
which uses a different Product ID from the D70.  It also moves the entry
for the DSC E2000 up in the list, to preserve the numerical ordering.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: storage: atmel unusual dev update
Olivier Blondeau [Sun, 25 Mar 2007 00:51:39 +0000 (01:51 +0100)]
USB: storage: atmel unusual dev update

Originally submitted by Olivier Blondeau <zeitoun@gmail.com>, with re-diffing
by me. Adds a new atmel unusual_dev entry.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: Storage: unusual devs update
Phil Dibowitz [Sun, 25 Mar 2007 00:50:55 +0000 (01:50 +0100)]
USB: Storage: unusual devs update

This patch removes the Protocol portion of the Iomega Click! device as it's not
needed. Not-needed message reported by Kenneth Crudup <kenny@panix.com>

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: storage: new unusual_devs.h entry: Mitsumi 7in1 Card Reader
Rodolfo Quesada [Sun, 25 Mar 2007 00:50:11 +0000 (01:50 +0100)]
USB: storage: new unusual_devs.h entry: Mitsumi 7in1 Card Reader

This patch (as661) adds an unusual_devs entry for the Mitsumi 7in1 Card
reader.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: storage: unusual_devs.h entry 0420:0001
Phil Dibowitz [Sun, 25 Mar 2007 00:49:34 +0000 (01:49 +0100)]
USB: storage: unusual_devs.h entry 0420:0001

Ref
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176584

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: storage: another unusual_devs.h entry
Phil Dibowitz [Sun, 25 Mar 2007 00:48:56 +0000 (01:48 +0100)]
USB: storage: another unusual_devs.h entry

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: storage: sandisk unusual_devices entry
Phil Dibowitz [Sun, 25 Mar 2007 00:48:23 +0000 (01:48 +0100)]
USB: storage: sandisk unusual_devices entry

The following adds an unusual_devs entry for the SanDisk ImageMate CompactFlash
USB drive, for the US_FL_FIX_CAPACITY flag. Additionally, it removes trailing
whitespace from the previous entry. It's based on the patch sent by Roman Hodek
<roman@hodek.net>.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.45 v2.6.16.45
Adrian Bunk [Sat, 24 Mar 2007 22:57:05 +0000 (23:57 +0100)]
Linux 2.6.16.45

17 years agoLinux 2.6.16.45-rc1 v2.6.16.45-rc1
Adrian Bunk [Sat, 24 Mar 2007 20:54:43 +0000 (21:54 +0100)]
Linux 2.6.16.45-rc1

17 years ago[NETFILTER]: tcp conntrack: accept SYN|URG as valid
Patrick McHardy [Sat, 24 Mar 2007 20:36:52 +0000 (21:36 +0100)]
[NETFILTER]: tcp conntrack: accept SYN|URG as valid

Some stacks apparently send packets with SYN|URG set. Linux accepts
these packets, so TCP conntrack should to.

Pointed out by Martijn Posthuma <posthuma@sangine.com>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nfnetlink_log: fix use after free
Michał Mirosław [Sat, 24 Mar 2007 20:36:24 +0000 (21:36 +0100)]
[NETFILTER]: nfnetlink_log: fix use after free

Paranoia: instance_put() might have freed the inst pointer when we
spin_unlock_bh().

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nfnetlink_log: fix reference leak
Michał Mirosław [Sat, 24 Mar 2007 20:34:37 +0000 (21:34 +0100)]
[NETFILTER]: nfnetlink_log: fix reference leak

Stop reference leaking in nfulnl_log_packet(). If we start a timer we
are already taking another reference.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference
Michał Mirosław [Sat, 24 Mar 2007 20:33:56 +0000 (21:33 +0100)]
[NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference

Eliminate possible NULL pointer dereference in nfulnl_recv_config().

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nfnetlink_log: fix NULL pointer dereference
Michał Mirosław [Sat, 24 Mar 2007 20:32:13 +0000 (21:32 +0100)]
[NETFILTER]: nfnetlink_log: fix NULL pointer dereference

Fix the nasty NULL dereference on multiple packets per netlink message.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip:
f8a4b3bf
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: nfnetlink_log ipt_ttl ipt_REDIRECT xt_tcpudp iptable_nat nf_nat nf_conntrack
_ipv4 xt_state ipt_ipp2p xt_NFLOG xt_hashlimit ip6_tables iptable_filter xt_multiport xt_mark i
pt_set iptable_raw xt_MARK iptable_mangle ip_tables cls_fw cls_u32 sch_esfq sch_htb ip_set_ipma
p ip_set ipt_ULOG x_tables dm_snapshot dm_mirror loop e1000 parport_pc parport e100 floppy ide_
cd cdrom
CPU:    0
EIP:    0060:[<f8a4b3bf>]    Not tainted VLI
EFLAGS: 00010206   (2.6.20 #5)
EIP is at __nfulnl_send+0x24/0x51 [nfnetlink_log]
eax: 00000000   ebx: f2b5cbc0   ecx: c03f5f54   edx: c03f4000
esi: f2b5cbc8   edi: c03f5f54   ebp: f8a4b3ec   esp: c03f5f30
ds: 007b   es: 007b   ss: 0068
Process swapper (pid: 0, ti=c03f4000 task=c03bece0 task.ti=c03f4000)
Stack: f2b5cbc0 f8a4b401 00000100 c0444080 c012af49 00000000 f6f19100 f6f19000
       c1707800 c03f5f54 c03f5f54 00000123 00000021 c03e8d08 c0426380 00000009
       c0126932 00000000 00000046 c03e9980 c03e6000 0047b007 c01269bd 00000000
Call Trace:
 [<f8a4b401>] nfulnl_timer+0x15/0x25 [nfnetlink_log]
 [<c012af49>] run_timer_softirq+0x10a/0x164
 [<c0126932>] __do_softirq+0x60/0xba
 [<c01269bd>] do_softirq+0x31/0x35
 [<c0104f6e>] do_IRQ+0x62/0x74
 [<c01036cb>] common_interrupt+0x23/0x28
 [<c0101018>] default_idle+0x0/0x3f
 [<c0101045>] default_idle+0x2d/0x3f
 [<c01010fa>] cpu_idle+0xa0/0xb9
 [<c03fb7f5>] start_kernel+0x1a8/0x1ac
 [<c03fb293>] unknown_bootoption+0x0/0x181
 =======================
Code: 5e 5f 5b 5e 5f 5d c3 53 89 c3 8d 40 1c 83 7b 1c 00 74 05 e8 2c ee 6d c7 83 7b 14 00 75 04
 31 c0 eb 34 83 7b 10 01 76 09 8b 43 18 <66> c7 40 04 03 00 8b 53 34 8b 43 14 b9 40 00 00 00 e8
 08 9a 84
EIP: [<f8a4b3bf>] __nfulnl_send+0x24/0x51 [nfnetlink_log] SS:ESP 0068:c03f5f30
 <0>Kernel panic - not syncing: Fatal exception in interrupt
 <0>Rebooting in 5 seconds..

Panic no more!

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nfnetlink_log: fix crash on bridged packet
Patrick McHardy [Sat, 24 Mar 2007 20:30:53 +0000 (21:30 +0100)]
[NETFILTER]: nfnetlink_log: fix crash on bridged packet

physoutdev is only set on purely bridged packet, when nfnetlink_log is used
in the OUTPUT/FORWARD/POSTROUTING hooks on packets forwarded from or to a
bridge it crashes when trying to dereference skb->nf_bridge->physoutdev.

Reported by Holger Eitzenberger <heitzenberger@astaro.com>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED
Patrick McHardy [Sat, 24 Mar 2007 20:30:06 +0000 (21:30 +0100)]
[NETFILTER]: nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED

The individual fragments of a packet reassembled by conntrack have the
conntrack reference from the reassembled packet attached, but nfctinfo
is not copied. This leaves it initialized to 0, which unfortunately is
the value of IP_CT_ESTABLISHED.

The result is that all IPv6 fragments are tracked as ESTABLISHED,
allowing them to bypass a usual ruleset which accepts ESTABLISHED
packets early.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoFix reference counting (memory leak) problem in __nfulnl_send() and callers related...
Michał Mirosław [Sat, 24 Mar 2007 20:27:27 +0000 (21:27 +0100)]
Fix reference counting (memory leak) problem in __nfulnl_send() and callers related to packet queueing.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: xt_connbytes: fix division by zero
Patrick McHardy [Sat, 24 Mar 2007 20:26:20 +0000 (21:26 +0100)]
NETFILTER: xt_connbytes: fix division by zero

When the packet counter of a connection is zero a division by zero
occurs in div64_64(). Fix that by using zero as average value, which
is correct as long as the packet counter didn't overflow, at which
point we have lost anyway.

Based on patch from Jonas Berlin <xkr47@outerspace.dyndns.org>,
with suggestions from KOVACS Krisztian <hidden@balabit.hu>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value
Patrick McHardy [Sat, 24 Mar 2007 20:22:57 +0000 (21:22 +0100)]
NETFILTER: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value

IP_CT_TCP_FLAG_CLOSE_INIT is a flag and should have a value of 0x4 instead
of 0x3, which is IP_CT_TCP_FLAG_WINDOW_SCALE | IP_CT_TCP_FLAG_SACK_PERM.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: nf_conntrack_ipv6: fix crash when handling fragments
Patrick McHardy [Sat, 24 Mar 2007 20:22:33 +0000 (21:22 +0100)]
NETFILTER: nf_conntrack_ipv6: fix crash when handling fragments

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: Fix iptables ABI breakage on (at least) CRIS
Patrick McHardy [Sat, 24 Mar 2007 20:22:09 +0000 (21:22 +0100)]
NETFILTER: Fix iptables ABI breakage on (at least) CRIS

With the introduction of x_tables we accidentally broke compatibility
by defining IPT_TABLE_MAXNAMELEN to XT_FUNCTION_MAXNAMELEN instead of
XT_TABLE_MAXNAMELEN, which is two bytes larger.

On most architectures it doesn't really matter since we don't have
any tables with names that long in the kernel and the structure
layout didn't change because of alignment requirements of following
members. On CRIS however (and other architectures that don't align
data) this changed the structure layout and thus broke compatibility
with old iptables binaries.

Changing it back will break compatibility with binaries compiled
against recent kernels again, but since the breakage has only been
there for three releases this seems like the better choice.

Spotted by Jonas Berlin <xkr47@outerspace.dyndns.org>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: arp_tables: fix userspace compilation
Bart De Schuymer [Sat, 24 Mar 2007 20:19:35 +0000 (21:19 +0100)]
NETFILTER: arp_tables: fix userspace compilation

The included patch translates arpt_counters to xt_counters, making
userspace arptables compile against recent kernels.

Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: ctnetlink: check for status attribute existence on conntrack creation
Pablo Neira Ayuso [Sat, 24 Mar 2007 20:18:36 +0000 (21:18 +0100)]
NETFILTER: ctnetlink: check for status attribute existence on conntrack creation

Check that status flags are available in the netlink message received
to create a new conntrack.

Fixes a crash in ctnetlink_create_conntrack when the CTA_STATUS attribute
is not present.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: Kconfig: fix xt_physdev dependencies
Patrick McHardy [Sat, 24 Mar 2007 20:18:01 +0000 (21:18 +0100)]
NETFILTER: Kconfig: fix xt_physdev dependencies

xt_physdev depends on bridge netfilter, which is a boolean, but can still
be built modular because of special handling in the bridge makefile. Add
a dependency on BRIDGE to prevent XT_MATCH_PHYSDEV=y, BRIDGE=m.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoload_module: no BUG if module_subsys uninitialized
Ed Swierk [Tue, 20 Mar 2007 23:28:30 +0000 (00:28 +0100)]
load_module: no BUG if module_subsys uninitialized

Invoking load_module() before param_sysfs_init() is called crashes in
mod_sysfs_setup(), since the kset in module_subsys is not initialized yet.

In my case, net-pf-1 is getting modprobed as a result of hotplug trying to
create a UNIX socket.  Calls to hotplug begin after the topology_init
initcall.

Another patch for the same symptom (module_subsys-initialize-earlier.patch)
moves param_sysfs_init() to the subsys initcalls, but this is still not
early enough in the boot process in some cases.  In particular,
topology_init() causes /sbin/hotplug to run, which requests net-pf-1 (the
UNIX socket protocol) which can be compiled as a module.  Moving
param_sysfs_init() to the postcore initcalls fixes this particular race,
but there might well be other cases where a usermodehelper causes a module
to load earlier still.

The patch makes load_module() return an error rather than crashing the
kernel if invoked before module_subsys is initialized.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoi386 bootioremap / kexec fix
Keith Mannthey [Tue, 20 Mar 2007 23:21:48 +0000 (00:21 +0100)]
i386 bootioremap / kexec fix

With CONFIG_PHYSICAL_START set to a non default values the i386
boot_ioremap code calculated its pte index wrong and users of boot_ioremap
have their areas incorrectly mapped (for me SRAT table not mapped during
early boot).  This patch removes the addr < BOOT_PTE_PTRS constraint.

Signed-off-by: Keith Mannthey <kmannth@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SPARC64]: Add missing HPAGE_MASK masks on address parameters.
David S. Miller [Tue, 20 Mar 2007 22:26:06 +0000 (23:26 +0100)]
[SPARC64]: Add missing HPAGE_MASK masks on address parameters.

These pte loops all assume the passed in address is HPAGE
aligned, make sure that is actually true.

[ This also includes other hugepage bug fixes for sparc64
  that occurred between 2.6.16 to 2.6.20 ]

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NET]: Copy mac_len in skb_clone() as well
Alexey Dobriyan [Tue, 20 Mar 2007 22:24:20 +0000 (23:24 +0100)]
[NET]: Copy mac_len in skb_clone() as well

ANK says: "It is rarely used, that's wy it was not noticed.
But in the places, where it is used, it should be disaster."

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV6]: ipv6_fl_socklist is inadvertently shared.
Masayuki Nakagawa [Tue, 20 Mar 2007 22:23:13 +0000 (23:23 +0100)]
[IPV6]: ipv6_fl_socklist is inadvertently shared.

The ipv6_fl_socklist from listening socket is inadvertently shared
with new socket created for connection.  This leads to a variety of
interesting, but fatal, bugs. For example, removing one of the
sockets may lead to the other socket's encountering a page fault
when the now freed list is referenced.

The fix is to not share the flow label list with the new socket.

Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV4]: Do not disable preemption in trie_leaf_remove().
Robert Olsson [Tue, 20 Mar 2007 22:21:39 +0000 (23:21 +0100)]
[IPV4]: Do not disable preemption in trie_leaf_remove().

Hello, Just discussed this Patrick...

We have two users of trie_leaf_remove, fn_trie_flush and fn_trie_delete
both are holding RTNL. So there shouldn't be need for this preempt stuff.
This is assumed to a leftover from an older RCU-take.

> Mhh .. I think I just remembered something - me incorrectly suggesting
> to add it there while we were talking about this at OLS :) IIRC the
> idea was to make sure tnode_free (which at that time didn't use
> call_rcu) wouldn't free memory while still in use in a rcu read-side
> critical section. It should have been synchronize_rcu of course,
> but with tnode_free using call_rcu it seems to be completely
> unnecessary. So I guess we can simply remove it.

Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[XFRM]: Fix missing protocol comparison of larval SAs.
Joy Latten [Tue, 20 Mar 2007 22:19:34 +0000 (23:19 +0100)]
[XFRM]: Fix missing protocol comparison of larval SAs.

I noticed that in xfrm_state_add we look for the larval SA in a few
places without checking for protocol match. So when using both
AH and ESP, whichever one gets added first, deletes the larval SA.
It seems AH always gets added first and ESP is always the larval
SA's protocol since the xfrm->tmpl has it first. Thus causing the
additional km_query()

Adding the check eliminates accidental double SA creation.

Signed-off-by: Joy Latten <latten@austin.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.44 v2.6.16.44
Adrian Bunk [Tue, 20 Mar 2007 21:25:36 +0000 (22:25 +0100)]
Linux 2.6.16.44

17 years agoLinux 2.6.16.44-rc2 v2.6.16.44-rc2
Adrian Bunk [Fri, 16 Mar 2007 16:59:30 +0000 (17:59 +0100)]
Linux 2.6.16.44-rc2

17 years agopwc-uncompress.c shouldn't #include <asm/current.h>
Hugh Dickins [Wed, 14 Mar 2007 21:25:08 +0000 (22:25 +0100)]
pwc-uncompress.c shouldn't #include <asm/current.h>

Fix a compile error on powerpc.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.44-rc1 v2.6.16.44-rc1
Adrian Bunk [Sun, 11 Mar 2007 07:11:10 +0000 (08:11 +0100)]
Linux 2.6.16.44-rc1

17 years ago[IPV6] fix ipv6_getsockopt_sticky copy_to_user leak
Chris Wright [Sun, 11 Mar 2007 06:43:46 +0000 (07:43 +0100)]
[IPV6] fix ipv6_getsockopt_sticky copy_to_user leak

User supplied len < 0 can cause leak of kernel memory.
Use unsigned compare instead.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV6]: Fix for ipv6_setsockopt NULL dereference
Olaf Kirch [Sun, 11 Mar 2007 06:42:33 +0000 (07:42 +0100)]
[IPV6]: Fix for ipv6_setsockopt NULL dereference

I came across this bug in http://bugzilla.kernel.org/show_bug.cgi?id=8155

Signed-off-by: Olaf Kirch <olaf.kirch@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoFix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)
Marcel Holtmann [Sun, 11 Mar 2007 06:39:14 +0000 (07:39 +0100)]
Fix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)

Based on a patch from Don Howard <dhoward@redhat.com>

When calling write() with a buffer larger than 512 bytes, the
driver's write buffer overflows, allowing to overwrite the EIP and
execute arbitrary code with kernel privileges.

In read(), there exists a similar problem, but coming from the device.
A malicous or buggy device sending more than 512 bytes can overflow
of the driver's read buffer, with the same effects as above.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoIB/mthca: Fix off-by-one in FMR handling on memfree
Michael S. Tsirkin [Sun, 11 Mar 2007 06:37:12 +0000 (07:37 +0100)]
IB/mthca: Fix off-by-one in FMR handling on memfree

From: Michael S. Tsirkin <mst@mellanox.co.il>

mthca_table_find() will return the wrong address when the table entry
being searched for is exactly at the beginning of a sglist entry
(other than the first), because it uses >= when it should use >.

Example: assume we have 2 entries in scatterlist, 4K each, offset is 4K.
The current code will return first entry + 4K when we really want
the second entry.

In particular this means mapping an FMR on a memfree HCA may end up
writing the page table into the wrong place, leading to memory
corruption and also causing the HCA to use an incorrect address
translation table.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoIPoIB: Rejoin all multicast groups after a port event
Eli Cohen [Sun, 11 Mar 2007 06:36:27 +0000 (07:36 +0100)]
IPoIB: Rejoin all multicast groups after a port event

When ipoib_ib_dev_flush() is called because of a port event, the
driver needs to rejoin all multicast groups, since the flush will call
ipoib_mcast_dev_flush() (via ipoib_ib_dev_down()).  Otherwise no
(non-broadcast) multicast groups will be rejoined until the networking
core calls ->set_multicast_list again, and so multicast reception will
be broken for potentially a long time.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoIB/mthca: Use mmiowb after doorbell ring
Arthur Kepner [Sun, 11 Mar 2007 06:35:15 +0000 (07:35 +0100)]
IB/mthca: Use mmiowb after doorbell ring

We discovered a problem when running IPoIB applications on multiple
CPUs on an Altix system. Many messages such as:

ib_mthca 0002:01:00.0: SQ 000014 full (19941644 head, 19941707 tail, 64 max, 0 nreq)

appear in syslog, and the driver wedges up.

Apparently this is because writes to the doorbells from different CPUs
reach the device out of order. The following patch adds mmiowb() calls
after doorbell rings to ensure the doorbell writes are ordered.

Signed-off-by: Arthur Kepner <akepner@sgi.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoSPARC64: Fix memory corruption in pci_4u_free_consistent()
David S. Miller [Fri, 9 Mar 2007 09:41:04 +0000 (10:41 +0100)]
SPARC64: Fix memory corruption in pci_4u_free_consistent()

The second argument to free_npages() was being incorrectly
calculated, which would thus access far past the end of the
arena->map[] bitmap.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agomake ppc64 current preempt-safe
Hugh Dickins [Fri, 9 Mar 2007 07:42:48 +0000 (08:42 +0100)]
make ppc64 current preempt-safe

Repeated -j20 kernel builds on a G5 Quad running an SMP PREEMPT kernel
would often collapse within a day, some exec failing with "Bad address".
In each case examined, load_elf_binary was doing a kernel_read, but
generic_file_aio_read's access_ok saw current->thread.fs.seg as USER_DS
instead of KERNEL_DS.

objdump of filemap.o shows gcc 4.1.0 emitting "mr r5,r13 ... ld r9,416(r5)"
here for get_paca()->__current, instead of the expected and much more usual
"ld r9,416(r13)"; I've seen other gcc4s do the same, but perhaps not gcc3s.

So, if the task is preempted and rescheduled on a different cpu in between
the mr and the ld, r5 will be looking at a different paca_struct from the
one it's now on, pick up the wrong __current, and perhaps the wrong seg.
Presumably much worse could happen elsewhere, though that split is rare.

Other architectures appear to be safe (x86_64's read_pda is more limiting
than get_paca), but ppc64 needs to force "current" into one instruction.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agodvb-core: fix bug in CRC-32 checking on 64-bit systems
Ang Way Chuang [Fri, 9 Mar 2007 07:32:38 +0000 (08:32 +0100)]
dvb-core: fix bug in CRC-32 checking on 64-bit systems

CRC-32 checking during ULE decapsulation always failed on x86_64 systems due
to the size of a variable used to store CRC. This bug was discovered on
Fedora Core 6 with kernel-2.6.18-1.2849. The i386 counterpart has no such
problem. This patch has been tested on 64-bit system as well as 32-bit system.

Signed-off-by: Ang Way Chuang <wcang@nrg.cs.usm.my>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)
David S. Miller [Fri, 9 Mar 2007 06:15:40 +0000 (07:15 +0100)]
[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky(). (CVE-2007-1000)

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[TCP]: Fix minisock tcp_create_openreq_child() typo.
Arnaldo Carvalho de Melo [Thu, 8 Mar 2007 07:43:47 +0000 (08:43 +0100)]
[TCP]: Fix minisock tcp_create_openreq_child() typo.

On 2/28/07, KOVACS Krisztian <hidden@balabit.hu> wrote:
>
>   Hi,
>
>   While reading TCP minisock code I've found this suspiciously looking
> code fragment:
>
> - 8< -
> struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
> {
>         struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
>
>         if (newsk != NULL) {
>                 const struct inet_request_sock *ireq = inet_rsk(req);
>                 struct tcp_request_sock *treq = tcp_rsk(req);
>                 struct inet_connection_sock *newicsk = inet_csk(sk);
>                 struct tcp_sock *newtp;
> - 8< -
>
>   The above code initializes newicsk to inet_csk(sk), isn't that supposed
> to be inet_csk(newsk)?  As far as I can tell this might leave
> icsk_ack.last_seg_size zero even if we do have received data.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoDVB: cxusb: fix firmware patch for big endian systems
Jin-Bong lee [Thu, 8 Mar 2007 07:41:19 +0000 (08:41 +0100)]
DVB: cxusb: fix firmware patch for big endian systems

Without this patch, the device will not be detected after firmware download
on big endian systems.

Signed-off-by: Jin-Bong lee <jinbong.lee@samsung.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcnt
David Stevens [Thu, 8 Mar 2007 07:40:07 +0000 (08:40 +0100)]
[IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcnt

Reading /proc/net/anycast6 when there is no anycast address
on an interface results in an ever-increasing inet6_dev reference
count, as well as a reference to the netdevice you can't get rid of.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV6]: anycast refcnt fix
Michal Wrobel [Thu, 8 Mar 2007 07:38:52 +0000 (08:38 +0100)]
[IPV6]: anycast refcnt fix

This patch fixes a bug in Linux IPv6 stack which caused anycast address
to be added to a device prior DAD has been completed. This led to
incorrect reference count which resulted in infinite wait for
unregister_netdevice completion on interface removal.

Signed-off-by: Michal Wrobel <xmxwx@asn.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SPARC64] bbc_i2c: Fix kenvctrld eating %100 cpu.
David S. Miller [Thu, 8 Mar 2007 07:36:44 +0000 (08:36 +0100)]
[SPARC64] bbc_i2c: Fix kenvctrld eating %100 cpu.

Based almost entirely upon a patch by Joerg Friedrich

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[UDP]: Reread uh pointer after pskb_trim
Herbert Xu [Thu, 8 Mar 2007 07:21:15 +0000 (08:21 +0100)]
[UDP]: Reread uh pointer after pskb_trim

The header may have moved when trimming.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[INET]: twcal_jiffie should be unsigned long, not int
Eric Dumazet [Thu, 8 Mar 2007 07:19:00 +0000 (08:19 +0100)]
[INET]: twcal_jiffie should be unsigned long, not int

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agovideo/aty/mach64_ct.c: fix bogus delay loop
David S. Miller [Thu, 8 Mar 2007 07:17:20 +0000 (08:17 +0100)]
video/aty/mach64_ct.c: fix bogus delay loop

CT based mach64 cards were reported to hang on sparc64 boxes when
compiled with gcc-4.1.x and later.

Looking at this piece of code, it's no surprise.  A critical
delay was implemented as an empty for() loop, and gcc 4.0.x
and previous did not optimize it away, so we did get a delay.

But gcc-4.1.x and later can optimize it away, and we get crashes.

Use a real udelay() to fix this.  Fix verified on SunBlade100.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agomodify 3c589_cs to be SMP safe
Komuro [Thu, 8 Mar 2007 07:13:04 +0000 (08:13 +0100)]
modify 3c589_cs to be SMP safe

1. EL3WINDOW is always 1 when lock is not held.

2. The second argument of el3_interrupt is 'void *dev_id',
not 'struct el3_private *lp'.

Adrian Bunk:
backported to 2.6.16

Signed-off-by: Komuro <komurojun-mbn@nifty.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoMissing critical phys_to_virt in lib/swiotlb.c
David Moore [Thu, 8 Mar 2007 07:10:34 +0000 (08:10 +0100)]
Missing critical phys_to_virt in lib/swiotlb.c

Adds missing call to phys_to_virt() in the
lib/swiotlb.c:swiotlb_sync_sg() function.  Without this change, a kernel
panic will always occur whenever a SWIOTLB bounce buffer from a
scatter-gather list gets synced.

Signed-off-by: David Moore <dcm@acm.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoinit_reap_node() initialization fix
Dan Yeisley [Thu, 8 Mar 2007 07:01:53 +0000 (08:01 +0100)]
init_reap_node() initialization fix

It looks like there is a bug in init_reap_node() in slab.c that can cause
multiple oops's on certain ES7000 configurations.  The variable reap_node
is defined per cpu, but only initialized on a single CPU.  This causes an
oops in next_reap_node() when __get_cpu_var(reap_node) returns the wrong
value.  Fix is below.

Signed-off-by: Dan Yeisley <dan.yeisley@unisys.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoInput: psmouse - fix attribute access on 64-bit systems
Sergey Vlasov [Thu, 8 Mar 2007 06:59:05 +0000 (07:59 +0100)]
Input: psmouse - fix attribute access on 64-bit systems

psmouse_show_int_attr() and psmouse_set_int_attr() were accessing
unsigned int fields as unsigned long, which gave garbage on x86_64.

Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.43 v2.6.16.43
Adrian Bunk [Fri, 2 Mar 2007 18:34:36 +0000 (19:34 +0100)]
Linux 2.6.16.43

17 years agofs/bad_inode.c 64bit fix
Adrian Bunk [Fri, 2 Mar 2007 18:34:09 +0000 (19:34 +0100)]
fs/bad_inode.c 64bit fix

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.43-rc1 v2.6.16.43-rc1
Adrian Bunk [Tue, 27 Feb 2007 20:35:57 +0000 (21:35 +0100)]
Linux 2.6.16.43-rc1

17 years agoi2c-isa: Restore driver owner
Jean Delvare [Tue, 27 Feb 2007 20:35:11 +0000 (21:35 +0100)]
i2c-isa: Restore driver owner

Commit 2b48716d1d2f2edb1e7cbc5ecf1cb2cb39373e33 back in January
2006 was a bit overzealous. It removed .owner from all i2c drivers,
including i2c-isa ones, while they still need it.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[DECNET]: Fix sfuzz hanging on 2.6.18
Patrick McHardy [Mon, 26 Feb 2007 22:47:11 +0000 (23:47 +0100)]
[DECNET]: Fix sfuzz hanging on 2.6.18

Dave Jones wrote:
> sfuzz         D 724EF62A  2828 28717  28691                     (NOTLB)
>        cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0
>        dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202
>        de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0
> Call Trace:
>  [<c05b1708>] lock_sock+0x75/0xa6
>  [<e0b0b604>] dn_getname+0x18/0x5f [decnet]
>  [<c05b083b>] sys_getsockname+0x5c/0xb0
>  [<c05b0b46>] sys_socketcall+0xef/0x261
>  [<c0403f97>] syscall_call+0x7/0xb
> DWARF2 unwinder stuck at syscall_call+0x7/0xb
>
> I wonder if the plethora of lockdep related changes inadvertantly broke something?

Looks like unbalanced locking.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosis190: failure to set the MAC address from EEPROM
Francois Romieu [Mon, 26 Feb 2007 22:45:11 +0000 (23:45 +0100)]
sis190: failure to set the MAC address from EEPROM

Fix from http://bugzilla.kernel.org/show_bug.cgi?id=7747

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Refactor SENSOR_DEVICE_ATTR_2
Jim Cromie [Mon, 26 Feb 2007 02:37:36 +0000 (03:37 +0100)]
hwmon: Refactor SENSOR_DEVICE_ATTR_2

This patch refactors SENSOR_DEVICE_ATTR_2 macro, following pattern set by
SENSOR_ATTR.  First it creates a new macro SENSOR_ATTR_2() which expands
to an initialization expression, then it uses that in SENSOR_DEVICE_ATTR_2,
which declares and initializes a struct sensor_device_attribute_2.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Allow sensor attributes arrays
Jim Cromie [Mon, 26 Feb 2007 02:31:01 +0000 (03:31 +0100)]
hwmon: Allow sensor attributes arrays

This patch refactors SENSOR_DEVICE_ATTR macro.  First it creates a new
macro SENSOR_ATTR() which expands to an initialization expression, then
it uses that in SENSOR_DEVICE_ATTR, which declares and initializes a
struct sensor_device_attribute.

IOW, SENSOR_ATTR() imitates __ATTR() in include/linux/device.h.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: email and version change.
Stephen Hemminger [Mon, 26 Feb 2007 00:54:54 +0000 (01:54 +0100)]
sky2: email and version change.

Put in new email address.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: add more pci ids
Stephen Hemminger [Mon, 26 Feb 2007 00:53:52 +0000 (01:53 +0100)]
sky2: add more pci ids

Update the pci device id table to match 2.6.20 (except for new 88e807x
that is still experimental).

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: more stats
Stephen Hemminger [Mon, 26 Feb 2007 00:53:13 +0000 (01:53 +0100)]
sky2: more stats

This is a simple enhancement to dump more device statistics with ethtool.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix for use on big endian
Stephen Hemminger [Mon, 26 Feb 2007 00:52:23 +0000 (01:52 +0100)]
sky2: fix for use on big endian

Ben added this for 2.6.18, it allows sky2 to run on big endian.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: allow multicast pause frames
Stephen Hemminger [Mon, 26 Feb 2007 00:51:40 +0000 (01:51 +0100)]
sky2: allow multicast pause frames

The 802 standard allows pause frames to be either unicast or multicast.
Switches seem to send unicast frames, but on a direct link, other boards send
multicast pause.  Unless the filter bit is set, these pause frames get
dropped.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix ram buffer allocation settings
Stephen Hemminger [Mon, 26 Feb 2007 00:51:03 +0000 (01:51 +0100)]
sky2: fix ram buffer allocation settings

Different chipsets have different amount of ram buffer (some have none),
so need to make sure that driver does proper setup for all cases from 0 on
to 48K, in units of 1K.

This is a backport of the code from 2.6.19 or later

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofix ext3 block bitmap leakage
Kirill Korotaev [Mon, 26 Feb 2007 00:48:36 +0000 (01:48 +0100)]
fix ext3 block bitmap leakage

This patch fixes ext3 block bitmap leakage,
which leads to the following fsck messages on
_healthy_ filesystem:
Block bitmap differences:  -64159 -73707

All kernels up to 2.6.17 have this bug.

Found by
   Vasily Averin <vvs@sw.ru> and Andrey Savochkin <saw@sawoct.com>
Test case triggered the issue was created by
   Dmitry Monakhov <dmonakhov@sw.ru>

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[TCP]: Prevent pseudo garbage in SYN's advertized window
Ilpo Järvinen [Mon, 26 Feb 2007 00:36:47 +0000 (01:36 +0100)]
[TCP]: Prevent pseudo garbage in SYN's advertized window

TCP may advertize up to 16-bits window in SYN packets (no window
scaling allowed). At the same time, TCP may have rcv_wnd
(32-bits) that does not fit to 16-bits without window scaling
resulting in pseudo garbage into advertized window from the
low-order bits of rcv_wnd. This can happen at least when
mss <= (1<<wscale) (see tcp_select_initial_window). This patch
fixes the handling of SYN advertized windows (compile tested
only).

In worst case (which is unlikely to occur though), the receiver
advertized window could be just couple of bytes. I'm not sure
that such situation would be handled very well at all by the
receiver!? Fortunately, the situation normalizes after the
first non-SYN ACK is received because it has the correct,
scaled window.

Alternatively, tcp_select_initial_window could be changed to
prevent too large rcv_wnd in the first place.

[ tcp_make_synack() has the same bug, and I've added a fix for
  that to this patch -DaveM ]

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV4/IPV6] multicast: Check add_grhead() return value
Alexey Dobriyan [Mon, 26 Feb 2007 00:31:58 +0000 (01:31 +0100)]
[IPV4/IPV6] multicast: Check add_grhead() return value

add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb
from it passed to skb_put() without checking.

Adrian Bunk:
backported to 2.6.16

Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Add support for the Winbond W83687THF
Jean Delvare [Sun, 25 Feb 2007 23:55:22 +0000 (00:55 +0100)]
hwmon: Add support for the Winbond W83687THF

Add support for the Winbond W83687THF chip to the w83627hf hardware
monitoring driver. This new chip is almost similar to the already
supported W83627THF chip, except for VID and a few other minor
changes.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agow83791d: Documentation update
Charles Spirakis [Sun, 25 Feb 2007 23:50:40 +0000 (00:50 +0100)]
w83791d: Documentation update

The alarm bits and the beep enable bits are in different positions in
the hardware. Document the problem and leave it to the user-space code
to handle the situation. When this driver is updated to the standardized
sysfs alarm/beep methodology, this won't be a problem.

This is a documentation only change.

Signed-off by: Charles Spirakis <bezaur@gmail.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoHWMON: w83791d: New hardware monitoring driver for the Winbond W83791D
Charles Spirakis [Sun, 25 Feb 2007 23:49:39 +0000 (00:49 +0100)]
HWMON: w83791d: New hardware monitoring driver for the Winbond W83791D

Add support for the w83791d sensor chip. The w83791d hardware is
somewhere between the w83781d and the w83792d and this driver code
is derived from the code that supports those chips.

Signed-off-by: Charles Spirakis <bezaur@gmail.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosmsc47m192: New hwmon driver for SMSC LPC47M192/997
Hartmut Rick [Sun, 25 Feb 2007 23:48:05 +0000 (00:48 +0100)]
smsc47m192: New hwmon driver for SMSC LPC47M192/997

New driver (smsc47m192) which supports voltage and temperature
measurement features of SMSC LPC47M192 and LPC47M997 chips.

Signed-off-by: Hartmut Rick <linux@rick.claranet.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: New PC87427 hardware monitoring driver
Jean Delvare [Sun, 25 Feb 2007 23:46:17 +0000 (00:46 +0100)]
hwmon: New PC87427 hardware monitoring driver

This is a new hardware monitoring driver for the National Semiconductor
PC87427 Super-I/O chip. It only supports fan speed monitoring for now,
while the chip can do much more.

Thanks to Amir Habibi at Candelis for setting up a test system, and to
Michael Kress for testing several iterations of this driver.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon lm83: Add LM82 support
Jordan Crouse [Sun, 25 Feb 2007 23:43:46 +0000 (00:43 +0100)]
hwmon lm83: Add LM82 support

Add LM82 temperature sensor support (similar to the LM83,
but less featureful).

Signed-off-by: Jordan Crouse <jordan.crouse@amd.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoi2c-piix4: Add ATI IXP200/300/400 support
Rudolf Marek [Sun, 25 Feb 2007 23:42:07 +0000 (00:42 +0100)]
i2c-piix4: Add ATI IXP200/300/400 support

This patch adds the ATI IXP southbridges support to i2c-piix4,
as it turned out those chips are compatible with it.

Signed-off-by: Rudolf Marek <r.marek@sh.cvut.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoI2C: i2c-piix4: Add Broadcom HT-1000 support
Martin Devera [Sun, 25 Feb 2007 23:40:16 +0000 (00:40 +0100)]
I2C: i2c-piix4: Add Broadcom HT-1000 support

Add Broadcom HT-1000 south bridge's PCI ID to i2c-piix driver. Note
that at least on Supermicro H8SSL it uses non-standard SMBHSTCFG = 3
and standard values like 0 or 9 causes hangup.

Signed-off-by: Martin Devera <devik@cdi.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoV4L/DVB: Dvbdev: fix illegal re-usage of fileoperations struct
Marcel Siegert [Sun, 25 Feb 2007 23:38:10 +0000 (00:38 +0100)]
V4L/DVB: Dvbdev: fix illegal re-usage of fileoperations struct

Arjan van de Ven <arjan@infradead.org> reported an illegal re-usage of
the fileoperations struct if more than one dvb device (e.g. frontend) is
present.

This patch fixes this issue.

It allocates a new fileoperations struct each time a device is
registered and copies the default template fileops.

Signed-off-by: Marcel Siegert <mws@linuxtv.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.42 v2.6.16.42
Adrian Bunk [Sun, 25 Feb 2007 16:49:51 +0000 (17:49 +0100)]
Linux 2.6.16.42

17 years agoLinux 2.6.16.42-rc1 v2.6.16.42-rc1
Adrian Bunk [Thu, 22 Feb 2007 20:13:55 +0000 (21:13 +0100)]
Linux 2.6.16.42-rc1

17 years agoUSB: rtl8150 new device id
Petko Manolov [Thu, 22 Feb 2007 20:13:05 +0000 (21:13 +0100)]
USB: rtl8150 new device id

This one adds another vendor ID to rtl8150 driver.

Signed-off-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: add ZyXEL vendor/product ID to rtl8150 driver
Dan Streetman [Thu, 22 Feb 2007 20:11:26 +0000 (21:11 +0100)]
USB: add ZyXEL vendor/product ID to rtl8150 driver

I just got a "ZyXEL Prestige USB Adapter" that is actually RTL8150
adapter.  Here is the relevant /proc/bus/usb/devices output (after
adding the vendor/product IDs to the driver):

T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=119 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=0586 ProdID=401a Rev= 1.00
S:  Manufacturer=ZyXEL
S:  Product=Prestige USB Adapter
S:  SerialNumber=1027
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=120mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=ff Driver=rtl8150
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=1ms

This patch adds the ZyXEL vendor ID to the rtl8150.c driver.  The
device has absolutely no identifying marks on the outside for model
type, just a serial number, and I can't find anything on ZyXEL's
website, so I called the product ID PRODUCT_ID_PRESTIGE to match the
product string.

Signed-off-by: Dan Streetman <ddstreet@ieee.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: dual-port pci-x checksum fix
Stephen Hemminger [Thu, 22 Feb 2007 20:07:51 +0000 (21:07 +0100)]
sky2: dual-port pci-x checksum fix

Add a workaround for dual port PCI-X card that returns status out of
order sometimes because of split transactions.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix for NAPI with dual port boards
Stephen Hemminger [Thu, 22 Feb 2007 20:07:11 +0000 (21:07 +0100)]
sky2: fix for NAPI with dual port boards

This driver uses port 0 to handle receives on both ports. So
the netif_poll_disable call in dev_close would end up stopping the
second port on dual port cards.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofix rtl8150
Al Viro [Wed, 21 Feb 2007 11:48:22 +0000 (12:48 +0100)]
fix rtl8150

That code doesn't do what its author apparently thought it would do...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] ambassador, firestream: "-1 >>" is implementation defined
Alexey Dobriyan [Wed, 21 Feb 2007 00:43:24 +0000 (01:43 +0100)]
[ATM] ambassador, firestream: "-1 >>" is implementation defined

6.5.7(5): The result of E1 >> E2 is E1 right-shifted E2 bit positions.
            ...
    If E1 has a signed type and a negative value, the resulting value
    is implementation defined.

So, cast -1 to unsigned type to make result well-defined.

[ Modified to use ~0U based upon recommendation from Al Viro. -DaveM ]

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] firestream: handle thrown error
Jeff Garzik [Wed, 21 Feb 2007 00:42:39 +0000 (01:42 +0100)]
[ATM] firestream: handle thrown error

gcc emits the following warning:

drivers/atm/firestream.c: In function ‘fs_open’:
drivers/atm/firestream.c:870: warning: ‘tmc0’ may be used uninitialized in this function

This indicates a real bug.  We should check make_rate() return value for
potential errors.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] horizon: read_bia() needs to be __devinit
David S. Miller [Wed, 21 Feb 2007 00:41:25 +0000 (01:41 +0100)]
[ATM] horizon: read_bia() needs to be __devinit

Thanks to Randy Dunlap.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>