]> git.karo-electronics.de Git - karo-tx-linux.git/log
karo-tx-linux.git
18 years agoUSB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist
Henk Vergonet [Fri, 22 Sep 2006 18:28:19 +0000 (20:28 +0200)]
USB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist

Keys on Yealink based phones will not function properly when using the
generic HID driver. This patch prevents the generic HID code from
grabbing the device before the regular yealink driver can get a grip on
it.

Signed-off-by: Henk Vergonet <Henk.Vergonet@gmail.com>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoUSB: Fix unload oops and memory leak in yealink driver
Henk Vergonet [Fri, 22 Sep 2006 18:20:40 +0000 (20:20 +0200)]
USB: Fix unload oops and memory leak in yealink driver

This patch fixes a memory leak and a kernel oops when trying to unload
the driver, due to an unbalanced cleanup.
Thanks Ivar Jensen for spotting my mistake.

Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agokernel/kmod.c: fix a race condition in usermodehelper.
Martin Schwidefsky [Fri, 22 Sep 2006 00:32:57 +0000 (02:32 +0200)]
kernel/kmod.c: fix a race condition in usermodehelper.

There is a race between call_usermodehelper_keys, __call_usermodehelper
and wait_for_helper. It should only happen if preemption is enabled or
on a virtualized system.

If the cpu is preempted or put to sleep by the hypervisor in
__call_usermodehelper between the creation of the wait_for_helper
thread and the second check on sub_info->wait, the whole execution
of wait_for_helper including the complete call and the continuation
after the wait_for_completion in call_usermodehelper_keys can have
happened before __call_usermodehelper checks sub_info->wait for the
second time. Since sub_info can already have been clobbered,
sub_info->wait could be zero and complete is called a second time
with an invalid argument. This has happened on s390. It took me only
three days to find out ..

Thanks to Arnd Bergmann for his help to spot this bug.

Kenneth Lee also sent the same patch independently.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoI2C: fix 'ignore' module parameter handling
Mark M. Hoffman [Fri, 22 Sep 2006 00:22:54 +0000 (02:22 +0200)]
I2C: fix 'ignore' module parameter handling

This patch fixes a bug in the handling of 'ignore' module parameters of I2C
client drivers.

Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA8290 update
Hartmut Hackmann [Mon, 18 Sep 2006 22:56:25 +0000 (00:56 +0200)]
V4L/DVB: TDA8290 update

This patch
- works around a bug in the I2C bridge that makes the initialization
  of the TDA10046 fail on recent LifeView cards
- puts the AGC output to tristate in sleep mode. This is necessary for
  recent hybrid cards that switch the AGC via tristateing.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Acked-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoConvert idr's internal locking to _irqsave variant
Roland Dreier [Mon, 18 Sep 2006 17:28:17 +0000 (19:28 +0200)]
Convert idr's internal locking to _irqsave variant

Currently, the code in lib/idr.c uses a bare spin_lock(&idp->lock) to do
internal locking.  This is a nasty trap for code that might call idr
functions from different contexts; for example, it seems perfectly
reasonable to call idr_get_new() from process context and idr_remove() from
interrupt context -- but with the current locking this would lead to a
potential deadlock.

The simplest fix for this is to just convert the idr locking to use
spin_lock_irqsave().

In particular, this fixes a very complicated locking issue detected by
lockdep, involving the ib_ipoib driver's priv->lock and dev->_xmit_lock,
which get involved with the ib_sa module's query_idr.lock.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[TEXTSEARCH]: Fix Boyer Moore initialization bug
Michael Rash [Mon, 18 Sep 2006 17:26:29 +0000 (19:26 +0200)]
[TEXTSEARCH]: Fix Boyer Moore initialization bug

The pattern is set after trying to compute the prefix table, which tries
to use it. Initialize it before calling compute_prefix_tbl, make
compute_prefix_tbl consistently use only the data from struct ts_bm
and remove the now unnecessary arguments.

Signed-off-by: Michael Rash <mbr@cipherdyne.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: fix speed and link status reported by ethtool
Jay Cliburn [Mon, 18 Sep 2006 17:23:20 +0000 (19:23 +0200)]
via-velocity: fix speed and link status reported by ethtool

The via-velocity driver reports incorrect speed and link detected status
as viewed by ethtool (and probably other tools). This patch fixes those
incorrect reports and prettifies a long line.

Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: the link is not correctly detected when the device starts
Roy Marples [Mon, 18 Sep 2006 17:20:52 +0000 (19:20 +0200)]
via-velocity: the link is not correctly detected when the device starts

The patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=6711

Signed-off-by: Roy Marples <uberlord@gentoo.org>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] VIA PT880 Ultra support.
Magnus Kessler [Mon, 18 Sep 2006 17:17:43 +0000 (19:17 +0200)]
[AGPGART] VIA PT880 Ultra support.

This patch enables agpgart on a Via "PT880 Ultra" based motherboard
(Asus P4V800D-X). The PCI ID of the PT880 Ultra is 0x0308 instead of
0x0258 of the PT880.

The patched via-agp passes testgart.

Signed-off-by: Magnus Kessler <Magnus.Kessler@gmx.net>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] ATI RS350 support.
Julien Tous [Mon, 18 Sep 2006 17:16:24 +0000 (19:16 +0200)]
[AGPGART] ATI RS350 support.

From: Julien Tous <julien.tous@gmail.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoPFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.
Tushar Gohad [Mon, 18 Sep 2006 17:14:39 +0000 (19:14 +0200)]
PFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.

Fixes inconsistent use of "uint32_t" vs. "u_int32_t".
Fix pfkeyv2 userspace builds.

Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA10046 Driver update
Hartmut Hackmann [Sat, 16 Sep 2006 22:18:45 +0000 (00:18 +0200)]
V4L/DVB: TDA10046 Driver update

- Set outputs to tristate in sleep mode
- Reduce dangerously high firmware download speed with 16MHz xtal
- added tda827x configuration with GPIOs low
- added comments to stupid looking IIC reads that work around bugs in
  the tda10046.
- some minor updates

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoadd drivers/media/video/saa7134/saa7134-input.c:flydvb_codes
Adrian Bunk [Sat, 16 Sep 2006 22:00:29 +0000 (00:00 +0200)]
add drivers/media/video/saa7134/saa7134-input.c:flydvb_codes

based on drivers/media/common/ir-keymaps.c:ir_codes_flydvb
in Linus' tree.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the new Lifeview hybrid cardbus modules
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:55 +0000 (23:38 +0200)]
V4L/DVB: Added support for the new Lifeview hybrid cardbus modules

There seem to be many variants of this cards with different
feature sets. This entry supports
analog TV, CVBS and s-video input, FM radio and DVB-T
if they are supported by the hardware.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:13 +0000 (23:38 +0200)]
V4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T

The .vmux entry needs to be 1 instead of 0

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added PCI IDs of 2 LifeView Cards
Hartmut Hackmann [Sat, 16 Sep 2006 21:37:44 +0000 (23:37 +0200)]
V4L/DVB: Added PCI IDs of 2 LifeView Cards

Added ID entries for the Genius VideoWonder DVB-T
and the LifeView FlyTV Platinum Gold

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: select FW_LOADER
maximilian attems [Sat, 16 Sep 2006 21:37:11 +0000 (23:37 +0200)]
V4L/DVB: Saa7134: select FW_LOADER

The saa7134 drivers uses request_firmware()
and thus needs to select FW_LOADER.

Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Medion 7134: Autodetect second bridge chip
Michael Krufky [Sat, 16 Sep 2006 21:36:05 +0000 (23:36 +0200)]
V4L/DVB: Medion 7134: Autodetect second bridge chip

The device, Medion 7134, has two saa7134 chips on it, but only one of them
is functional in the current saa7134 driver.

This patch adds autodetection for the second, unsupported saa7134 chip,
as SAA7134_BOARD_MD7134_BRIDGE_2, and displays a message to the user
(in dmesg) indicating that the second chip isn't yet functional.

This is useful for users, since two instances of the saa7134 driver
will spawn. This patch will prevent confusion by warning the user that
only one of the chips on the board are functional.

There are other versions of the SAA7134_BOARD_MD7134 with only a single
saa7134 bridge/decoder -- those devices will not be affected by this patch.
Only devices containing the second chip will display the warning.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: make unsupported secondary decoder message generic
Michael Krufky [Sat, 16 Sep 2006 21:35:11 +0000 (23:35 +0200)]
V4L/DVB: Saa7134: make unsupported secondary decoder message generic

There are already some supported devices that contain two
saa713x chips on-board, where only one of these chips is
currently functional in the driver.
We are already printing a warning message for the second
saa7134 decoder in SAA7134_BOARD_AVERMEDIA_A169_B. This
patch alters that case to make it generic, so that other
cards in the same situation can use it.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card
Rickard Osser [Sat, 16 Sep 2006 21:34:30 +0000 (23:34 +0200)]
V4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card

- Added support for AVerMedia A169 Dual Analog tuner card
  (dual saa7134 decoders - only 1 working right now)
- Added autodetection for both parts of the card.
  It shows up like 2 cards, B1 and B
- Enabled tuner B1, SVIDEO on B1 and composite1 through SVIDEO,
  FIXME: B is more or less dead at this point and I suspect the
  FM-radio is on the B part of the board

Adrian Bunk:
slightly adapted to 2.6.16

Signed-off-by: Rickard Osser <ricky@osser.se>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: document that there's also a 220RF from KWorld
Adrian Bunk [Sat, 16 Sep 2006 21:33:38 +0000 (23:33 +0200)]
V4L/DVB: Saa7134: document that there's also a 220RF from KWorld

I have the same card with the same PCI id, but from KWorld.
The patch documents that this is the same card.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
18 years agoV4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID
TAMUKI Shoichi [Sat, 16 Sep 2006 21:33:10 +0000 (23:33 +0200)]
V4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID

- Corrected autodetection for saa7130 card:
  subsystem: 1048:226c, board: ELSA EX-VISION 700TV

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load
Curt Meyers [Sat, 16 Sep 2006 21:32:18 +0000 (23:32 +0200)]
V4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load

- Enable the tuv1236 tuner on the Kworld-ATSC110 card so that the
  tuner can be identified when tuners.ko loads.
- With this change it is no longer necessary to remove and reload
  the tuner module in order to get the tuv1236 identified.
- This code was copied from the ATI HDTV Wonder init routine (in cx88-cards.c)
  which also uses the TUV1236D.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: cleanups
Michael Krufky [Sat, 16 Sep 2006 21:31:38 +0000 (23:31 +0200)]
V4L/DVB: Kworld ATSC110: cleanups

- There is no radio with this tuner card...
Thanks-to: Dwaine Garden <DwaineGarden@rogers.com>
- fixed capitalization in card name.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: enable composite and svideo inputs
Curt Meyers [Sat, 16 Sep 2006 21:30:59 +0000 (23:30 +0200)]
V4L/DVB: Kworld ATSC110: enable composite and svideo inputs

- corrected composite input.
- verified s-video input.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: KWorld ATSC110: implement set_pll_input
Curt Meyers [Sat, 16 Sep 2006 21:30:22 +0000 (23:30 +0200)]
V4L/DVB: KWorld ATSC110: implement set_pll_input

- When tuning VSB, use ANT input
- When tuning QAM, use CABLE input

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for Kworld ATSC110
Andrew Burri [Sat, 16 Sep 2006 21:29:38 +0000 (23:29 +0200)]
V4L/DVB: Add support for Kworld ATSC110

Signed-off-by: Andrew Burri <andrew.burri@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)
Tamuki Shoichi [Sat, 16 Sep 2006 21:28:54 +0000 (23:28 +0200)]
V4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)

Add support for ELSA EX-VISION 700TV, which is the ELSA Japan's
flagship model of the software encoding TV capture card.
All inputs (Television, Composite1 and S-Video) have been tested.

Signed-off-by: Tamuki Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the Tevion DVB-T 220RF card
Hartshorn [Sat, 16 Sep 2006 21:24:47 +0000 (23:24 +0200)]
V4L/DVB: Added support for the Tevion DVB-T 220RF card

This is an analog / digital hybrid card.

Signed-off-by: Peter Hartshorn <p3r@users.sourceforge.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331
Hartmut Hackmann [Sat, 16 Sep 2006 21:23:59 +0000 (23:23 +0200)]
V4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331

Analog and DVB-T are working, Remote not yet.
This card is based on the new LifeView design, there should be many variants.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the LifeView FlyDVB-T LR301 card
Giampiero Giancipoli [Sat, 16 Sep 2006 21:23:23 +0000 (23:23 +0200)]
V4L/DVB: Added support for the LifeView FlyDVB-T LR301 card

Additionally to the card support, this changeset adds the option
tda10046lifeview to get_dvb_firmware to download tda10046 firmware
from LifeView's site.

Signed-off-by: Giampiero Giancipoli <gianci@libero.it>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for the Avermedia 777 DVB-T card
Jose Alberto Reguero [Sat, 16 Sep 2006 21:22:34 +0000 (23:22 +0200)]
V4L/DVB: Add support for the Avermedia 777 DVB-T card

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29 v2.6.16.29
Adrian Bunk [Tue, 12 Sep 2006 18:02:10 +0000 (20:02 +0200)]
Linux 2.6.16.29

18 years agoLinux 2.6.16.29-rc2 v2.6.16.29-rc2
Adrian Bunk [Sat, 9 Sep 2006 15:45:05 +0000 (17:45 +0200)]
Linux 2.6.16.29-rc2

18 years agoHave ext2 reject file handles with bad inode numbers early.
Neil Brown [Sat, 9 Sep 2006 15:44:45 +0000 (17:44 +0200)]
Have ext2 reject file handles with bad inode numbers early.

This prevents bad inode numbers from triggering errors in
ext2_get_inode.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29-rc1 v2.6.16.29-rc1
Adrian Bunk [Wed, 6 Sep 2006 17:55:27 +0000 (19:55 +0200)]
Linux 2.6.16.29-rc1

18 years agopci_ids.h: add some VIA IDE identifiers
Alan Cox [Wed, 6 Sep 2006 17:55:17 +0000 (19:55 +0200)]
pci_ids.h: add some VIA IDE identifiers

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[PKTGEN]: Make sure skb->{nh,h} are initialized in fill_packet_ipv6() too.
David S. Miller [Wed, 6 Sep 2006 17:35:53 +0000 (19:35 +0200)]
[PKTGEN]: Make sure skb->{nh,h} are initialized in fill_packet_ipv6() too.

Mirror the bug fix from fill_packet_ipv4()

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[PKTGEN]: Fix oops when used with balance-tlb bonding
Chen-Li Tien [Wed, 6 Sep 2006 17:34:53 +0000 (19:34 +0200)]
[PKTGEN]: Fix oops when used with balance-tlb bonding

Signed-off-by: Chen-Li Tien <cltien@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoia64 SGI-SN2: fix silent data corruption caused by XPC
Dean Nelson [Wed, 6 Sep 2006 17:25:46 +0000 (19:25 +0200)]
ia64 SGI-SN2: fix silent data corruption caused by XPC

Jack Steiner identified a problem where XPC can cause a silent
data corruption.  On module load, the placement may cause the
xpc_remote_copy_buffer to span two physical pages.  DMA transfers are
done to the start virtual address translated to physical.

This patch changes the buffer from a statically allocated buffer to a
kmalloc'd buffer.  Dean Nelson reviewed this before posting.  I have
tested it in the configuration that was showing the memory corruption
and verified it works.  I also added a BUG_ON statement to help catch
this if a similar situation is encountered.

Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Dean Nelson <dcn@sgi.com>
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[IPV6]: Fix kernel OOPs when setting sticky socket options.
YOSHIFUJI Hideaki [Wed, 6 Sep 2006 14:30:02 +0000 (16:30 +0200)]
[IPV6]: Fix kernel OOPs when setting sticky socket options.

Bug noticed by Remi Denis-Courmont <rdenis@simphalempin.com>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoidr: fix race in idr code
Sonny Rao [Wed, 6 Sep 2006 14:23:48 +0000 (16:23 +0200)]
idr: fix race in idr code

I ran into a bug where the kernel died in the idr code:

cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710]
    pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330
    lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330
    sp: c000000b7096f990
   msr: 800000000000b032
   dar: 0
 dsisr: 40010000
  current = 0xc000000b70d43830
  paca    = 0xc000000000556900
    pid   = 2022, comm = hwup
1d:mon> t
[c000000b7096f990c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable)
[c000000b7096faa0c0000000001f8bf8 .idr_get_new_above+0x18/0x68
[c000000b7096fb20c00000000002a054 .init_new_context+0x5c/0xf0
[c000000b7096fbc0c000000000049dc8 .copy_process+0x91c/0x1404
[c000000b7096fcd0c00000000004a988 .do_fork+0xd8/0x224
[c000000b7096fdc0c00000000000ebdc .sys_clone+0x5c/0x74
[c000000b7096fe30c000000000008950 .ppc_clone+0x8/0xc
-- Exception: c00 (System Call) at 000000000fde887c
SP (f8b4e7a0) is in userspace

Turned out to be a race-condition and NULL ptr deref, here's my fix:

Users of the idr code are supposed to call idr_pre_get without locking, so the
idr code must serialize itself with respect to layer allocations.  However, it
fails to do so in an error path in idr_get_new_above_int().  I added the
missing locking to fix this.

Signed-off-by: Sonny Rao <sonny@burdell.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix misoptimization in futex unqueue_me
Christian Borntraeger [Wed, 6 Sep 2006 14:01:43 +0000 (16:01 +0200)]
fix misoptimization in futex unqueue_me

This patch adds a barrier() in futex unqueue_me to avoid aliasing of two
pointers.

On my s390x system I saw the following oops:

Unable to handle kernel pointer dereference at virtual kernel address
0000000000000000
Oops: 0004 [#1]
CPU:    0    Not tainted
Process mytool (pid: 13613, task: 000000003ecb6ac0, ksp: 00000000366bdbd8)
Krnl PSW : 0704d00180000000 00000000003c9ac2 (_spin_lock+0xe/0x30)
Krnl GPRS: 00000000ffffffff 000000003ecb6ac0 0000000000000000 0700000000000000
           0000000000000000 0000000000000000 000001fe00002028 00000000000c091f
           000001fe00002054 000001fe00002054 0000000000000000 00000000366bddc0
           00000000005ef8c0 00000000003d00e8 0000000000144f91 00000000366bdcb8
Krnl Code: ba 4e 20 00 12 44 b9 16 00 3e a7 84 00 08 e3 e0 f0 88 00 04
Call Trace:
([<0000000000144f90>] unqueue_me+0x40/0xe4)
 [<0000000000145a0c>] do_futex+0x33c/0xc40
 [<000000000014643e>] sys_futex+0x12e/0x144
 [<000000000010bb00>] sysc_noemu+0x10/0x16
 [<000002000003741c>] 0x2000003741c

The code in question is:

static int unqueue_me(struct futex_q *q)
{
        int ret = 0;
        spinlock_t *lock_ptr;

        /* In the common case we don't take the spinlock, which is nice. */
 retry:
        lock_ptr = q->lock_ptr;
        if (lock_ptr != 0) {
                spin_lock(lock_ptr);
                /*
                 * q->lock_ptr can change between reading it and
                 * spin_lock(), causing us to take the wrong lock.  This
                 * corrects the race condition.
[...]

and my compiler (gcc 4.1.0) makes the following out of it:

00000000000003c8 <unqueue_me>:
     3c8:       eb bf f0 70 00 24       stmg    %r11,%r15,112(%r15)
     3ce:       c0 d0 00 00 00 00       larl    %r13,3ce <unqueue_me+0x6>
                        3d0: R_390_PC32DBL      .rodata+0x2a
     3d4:       a7 f1 1e 00             tml     %r15,7680
     3d8:       a7 84 00 01             je      3da <unqueue_me+0x12>
     3dc:       b9 04 00 ef             lgr     %r14,%r15
     3e0:       a7 fb ff d0             aghi    %r15,-48
     3e4:       b9 04 00 b2             lgr     %r11,%r2
     3e8:       e3 e0 f0 98 00 24       stg     %r14,152(%r15)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
                /* write q->lock_ptr in r12 */
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       a7 84 00 4b             je      48e <unqueue_me+0xc6>
                /* if r12 is zero then jump over the code.... */
     3fc:       e3 20 b0 28 00 04       lg      %r2,40(%r11)
                /* write q->lock_ptr in r2 */
     402:       c0 e5 00 00 00 00       brasl   %r14,402 <unqueue_me+0x3a>
                        404: R_390_PC32DBL      _spin_lock+0x2
                /* use r2 as parameter for spin_lock */

So the code becomes more or less:
if (q->lock_ptr != 0) spin_lock(q->lock_ptr)
instead of
if (lock_ptr != 0) spin_lock(lock_ptr)

Which caused the oops from above.
After adding a barrier gcc creates code without this problem:
[...] (the same)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       b9 04 00 2c             lgr     %r2,%r12
     3fc:       a7 84 00 48             je      48c <unqueue_me+0xc4>
     400:       c0 e5 00 00 00 00       brasl   %r14,400 <unqueue_me+0x38>
                        402: R_390_PC32DBL      _spin_lock+0x2

As a general note, this code of unqueue_me seems a bit fishy. The retry logic
of unqueue_me only works if we can guarantee, that the original value of
q->lock_ptr is always a spinlock (Otherwise we overwrite kernel memory). We
know that q->lock_ptr can change. I dont know what happens with the original
spinlock, as I am not an expert with the futex code.

Signed-off-by: Christian Borntraeger <borntrae@de.ibm.com>
Acked-by: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[SERIAL] icom: select FW_LOADER
maximilian attems [Wed, 6 Sep 2006 13:39:02 +0000 (15:39 +0200)]
[SERIAL] icom: select FW_LOADER

The icom driver uses request_firmware()
and thus needs to select FW_LOADER.

Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoMissing PCI id update for VIA IDE
Alan Cox [Wed, 6 Sep 2006 13:07:59 +0000 (15:07 +0200)]
Missing PCI id update for VIA IDE

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix sctp_primitive_ABORT() call in sctp_close()
Sridhar Samudrala [Tue, 5 Sep 2006 19:59:11 +0000 (21:59 +0200)]
Fix sctp_primitive_ABORT() call in sctp_close()

With the recent fix, the callers of sctp_primitive_ABORT()
need to create an ABORT chunk and pass it as an argument rather
than msghdr that was passed earlier.

Adrian Bunk:
Ported to 2.6.16.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: RME HDSP - fixed proc interface (missing {})
Remy Bruno [Tue, 5 Sep 2006 19:40:12 +0000 (21:40 +0200)]
ALSA: RME HDSP - fixed proc interface (missing {})

Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: hda-intel - Fix race in remove
Takashi Iwai [Tue, 5 Sep 2006 19:39:12 +0000 (21:39 +0200)]
ALSA: hda-intel - Fix race in remove

Call iounmap after free_irq to avoid invalid accesses in the
shared irq.  The patch is taken from
        https://bugzilla.novell.com/show_bug.cgi?id=167869

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix workaround for AD1988A rev2 codec
Takashi Iwai [Tue, 5 Sep 2006 19:38:52 +0000 (21:38 +0200)]
ALSA: Fix workaround for AD1988A rev2 codec

Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix model for HP dc7600
Takashi Iwai [Tue, 5 Sep 2006 19:38:23 +0000 (21:38 +0200)]
ALSA: Fix model for HP dc7600

Changed the assigned model for HP dc7600 with ALC260 codec
to match better with the actual I/O assignment.
Patch taken from ALSA bug#2157.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix missing array terminators in AD1988 codec support
Takashi Iwai [Tue, 5 Sep 2006 19:37:57 +0000 (21:37 +0200)]
ALSA: Fix missing array terminators in AD1988 codec support

Fixed the missing array terminators in AD1988 codec support code.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix a deadlock in snd-rtctimer
Takashi Iwai [Tue, 5 Sep 2006 19:37:16 +0000 (21:37 +0200)]
ALSA: Fix a deadlock in snd-rtctimer

Fix an occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: au88x0 - Fix 64bit address of MPU401 MMIO port
Takashi Iwai [Tue, 5 Sep 2006 19:34:57 +0000 (21:34 +0200)]
ALSA: au88x0 - Fix 64bit address of MPU401 MMIO port

Fix 64bit address of MPU401 MMIO port on au88x0 chip.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoethtool: fix oops in ethtool_set_pauseparam()
Willy Tarreau [Thu, 31 Aug 2006 20:02:56 +0000 (22:02 +0200)]
ethtool: fix oops in ethtool_set_pauseparam()

The function pointers which were checked were for their get_* counterparts.
Typically a copy-paste typo.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Acked-by: Jeff Garzik <jeff@garzik.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoETHTOOL: Fix UFO typo
Herbert Xu [Thu, 31 Aug 2006 19:59:19 +0000 (21:59 +0200)]
ETHTOOL: Fix UFO typo

The function ethtool_get_ufo was referring to ETHTOOL_GTSO instead of
ETHTOOL_GUFO.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix struct file leakage
Kirill Korotaev [Wed, 30 Aug 2006 20:55:59 +0000 (22:55 +0200)]
fix struct file leakage

2.6.16 leaks like hell. While testing, I found massive filp leakage
(reproduced in openvz) in the bowels of namei.c.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoHave ext3 reject file handles with bad inode numbers early
Eric Sandeen [Wed, 30 Aug 2006 16:01:00 +0000 (18:01 +0200)]
Have ext3 reject file handles with bad inode numbers early

blatantly ripped off from Neil Brown's ext2 patch.

Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Acked-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoext3: avoid triggering ext3_error on bad NFS file handle
Neil Brown [Wed, 30 Aug 2006 15:58:44 +0000 (17:58 +0200)]
ext3: avoid triggering ext3_error on bad NFS file handle

The inode number out of an NFS file handle gets passed eventually to
ext3_get_inode_block() without any checking.  If ext3_get_inode_block()
allows it to trigger an error, then bad filehandles can have unpleasant
effect - ext3_error() will usually cause a forced read-only remount, or a
panic if `errors=panic' was used.

So remove the call to ext3_error there and put a matching check in
ext3/namei.c where inode numbers are read off storage.

Andrew Morton fixed an off-by-one error.

Dann Frazier ported the patch to 2.6.16.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoeicon: fix define conflict with ptrace
Alexey Dobriyan [Wed, 30 Aug 2006 15:31:15 +0000 (17:31 +0200)]
eicon: fix define conflict with ptrace

* MODE_MASK is unused in eicon driver.
* Conflicts with a ptrace stuff on arm.

drivers/isdn/hardware/eicon/divasync.h:259:1: warning: "MODE_MASK" redefined
include2/asm/ptrace.h:48:1: warning: this is the location of the previous definition

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Acked-by: Armin Schindler <armin@melware.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoip_tables: fix table locking in ipt_do_table
Patrick McHardy [Wed, 30 Aug 2006 15:25:57 +0000 (17:25 +0200)]
ip_tables: fix table locking in ipt_do_table

table->private might change because of ruleset changes, don't use it without
holding the lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoaic79xx: use BIOS settings
Hannes Reinecke [Wed, 30 Aug 2006 15:23:16 +0000 (17:23 +0200)]
aic79xx: use BIOS settings

This patch fixes the aic79xx driver to properly respond to BIOS
settings.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agotty serialize flush_to_ldisc
Paul Fulghum [Sun, 27 Aug 2006 01:36:58 +0000 (03:36 +0200)]
tty serialize flush_to_ldisc

Serialize processing of tty buffers in flush_to_ldisc
to fix (very rare) corruption of tty buffer free list
on SMP systems.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Acked-by: Alan Cox <alan@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoulog: fix panic on SMP kernels
Mark Huang [Sat, 26 Aug 2006 15:35:49 +0000 (17:35 +0200)]
ulog: fix panic on SMP kernels

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang <mlhuang@cs.princeton.edu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix a potential NULL dereference in md/raid1
Neil Brown [Sat, 26 Aug 2006 15:33:27 +0000 (17:33 +0200)]
Fix a potential NULL dereference in md/raid1

At the point where this 'atomic_add' is, rdev could be NULL,
as seen by the fact that we test for this in the very next
statement.
Further is it is really the wrong place of the add.
We could add to the count of corrected errors
once the are sure it was corrected, not before
trying to correct it.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Send only 1 window update SACK per message.
Tsutomu Fujii [Sat, 26 Aug 2006 00:41:37 +0000 (02:41 +0200)]
SCTP: Send only 1 window update SACK per message.

Right now, every time we increase our rwnd by more then MTU bytes, we
trigger a SACK.  When processing large messages, this will generate a
SACK for almost every other SCTP fragment. However since we are freeing
the entire message at the same time, we might as well collapse the SACK
generation to 1.

Signed-off-by: Tsutomu Fujii <t-fujii@nb.jp.nec.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Reset rtt_in_progress for the chunk when processing its sack.
Vlad Yasevich [Sat, 26 Aug 2006 00:41:12 +0000 (02:41 +0200)]
SCTP: Reset rtt_in_progress for the chunk when processing its sack.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Limit association max_retrans setting in setsockopt.
Vlad Yasevich [Sat, 26 Aug 2006 00:40:29 +0000 (02:40 +0200)]
SCTP: Limit association max_retrans setting in setsockopt.

When using ASSOCINFO socket option, we need to limit the number of
maximum association retransmissions to be no greater than the sum
of all the path retransmissions. This is specified in Section 7.1.2
of the SCTP socket API draft.
However, we only do this if the association has multiple paths. If
there is only one path, the protocol stack will use the
assoc_max_retrans setting when trying to retransmit packets.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Fix persistent slowdown in sctp when a gap ack consumes rx buffer.
Neil Horman [Sat, 26 Aug 2006 00:39:48 +0000 (02:39 +0200)]
SCTP: Fix persistent slowdown in sctp when a gap ack consumes rx buffer.

In the event that our entire receive buffer is full with a series of
chunks that represent a single gap-ack, and then we accept a chunk
(or chunks) that fill in the gap between the ctsn and the first gap,
we renege chunks from the end of the buffer, which effectively does
nothing but move our gap to the end of our received tsn stream. This
does little but move our missing tsns down stream a little, and, if the
sender is sending sufficiently large retransmit frames, the result is a
perpetual slowdown which can never be recovered from, since the only
chunk that can be accepted to allow progress in the tsn stream necessitates
that a new gap be created to make room for it. This leads to a constant
need for retransmits, and subsequent receiver stalls. The fix I've come up
with is to deliver the frame without reneging if we have a full receive
buffer and the receiving sockets sk_receive_queue is empty(indicating that
the receive buffer is being blocked by a missing tsn).

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Reject sctp packets with broadcast addresses.
Vlad Yasevich [Sat, 26 Aug 2006 00:39:03 +0000 (02:39 +0200)]
SCTP: Reject sctp packets with broadcast addresses.

Make SCTP handle broadcast properly

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28 v2.6.16.28
Adrian Bunk [Fri, 25 Aug 2006 20:51:14 +0000 (22:51 +0200)]
Linux 2.6.16.28

18 years agoLinux 2.6.16.28-rc3 v2.6.16.28-rc3
Adrian Bunk [Wed, 23 Aug 2006 17:29:05 +0000 (19:29 +0200)]
Linux 2.6.16.28-rc3

18 years ago1394: fix for recently added firewire patch that breaks things on ppc
Danny Tholen [Wed, 23 Aug 2006 17:28:41 +0000 (19:28 +0200)]
1394: fix for recently added firewire patch that breaks things on ppc

Recently a patch was added for preliminary suspend/resume handling on
!PPC_PMAC.  However, this broke both suspend and firewire on powerpc
because it saves the pci state after the device has already been disabled.

This moves the save state to before the pmac specific code.

Signed-off-by: Danny Tholen <obiwan@mailmij.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix sctp privilege elevation (CVE-2006-3745)
Sridhar Samudrala [Wed, 23 Aug 2006 16:01:55 +0000 (18:01 +0200)]
Fix sctp privilege elevation (CVE-2006-3745)

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix possible UDF deadlock and memory corruption (CVE-2006-4145)
Jan Kara [Wed, 23 Aug 2006 16:00:30 +0000 (18:00 +0200)]
Fix possible UDF deadlock and memory corruption (CVE-2006-4145)

UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28-rc2 v2.6.16.28-rc2
Adrian Bunk [Tue, 22 Aug 2006 15:48:30 +0000 (17:48 +0200)]
Linux 2.6.16.28-rc2

18 years agopowerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)
Olof Johansson [Fri, 18 Aug 2006 19:44:57 +0000 (21:44 +0200)]
powerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)

Clear HID0[en_attn] at CPU init time on PPC970.  Closes CVE-2006-4093.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agocdrom: fix bad cgc.buflen assignment (CVE-2006-2935)
Jens Axboe [Fri, 18 Aug 2006 19:42:43 +0000 (21:42 +0200)]
cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <meissner@suse.de>.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoide-io: increase timeout value to allow for slave wakeup
Al Boldi [Fri, 18 Aug 2006 19:30:53 +0000 (21:30 +0200)]
ide-io: increase timeout value to allow for slave wakeup

During an STR resume cycle, the ide master disk times-out when there is
also a slave present (especially CD).  Increasing the timeout in ide-io
from 10,000 to 100,000 fixes this problem.

Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSPARC64: Fix quad-float multiply emulation.
David S. Miller [Fri, 18 Aug 2006 19:28:03 +0000 (21:28 +0200)]
SPARC64: Fix quad-float multiply emulation.

Something is wrong with the 3-multiply (vs. 4-multiply) optimized
version of _FP_MUL_MEAT_2_*(), so just use the slower version
which actually computes correct values.

Noticed by Rene Rebe

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSPARC32: Fix iommu_flush_iotlb end address
Bob Breuer [Fri, 18 Aug 2006 19:26:56 +0000 (21:26 +0200)]
SPARC32: Fix iommu_flush_iotlb end address

Fix the calculation of the end address when flushing iotlb entries to
ram.  This bug has been a cause of esp dma errors, and it affects
HyperSPARC systems much worse than SuperSPARC systems.

Signed-off-by: Bob Breuer <breuerr@mc.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: William Lee Irwin III <wli@holomorphy.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28-rc1 v2.6.16.28-rc1
Adrian Bunk [Sat, 12 Aug 2006 17:00:06 +0000 (19:00 +0200)]
Linux 2.6.16.28-rc1

18 years agoupdate the i386 defconfig
Adrian Bunk [Sat, 12 Aug 2006 16:59:17 +0000 (18:59 +0200)]
update the i386 defconfig

The i386 defconfig wasn't updated for ages.

Instead of running "make oldconfig" on the old defconfig and trying to
give reasonable answers at all new options, this patch replaces it with
the one I'm using in 2.6.16-rc1.

This way, it's a .config that is confirmed to work on at least one
computer in the world.  ;-)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoieee1394: sbp2: enable auto spin-up for Maxtor disks
Stefan Richter [Fri, 11 Aug 2006 21:42:30 +0000 (23:42 +0200)]
ieee1394: sbp2: enable auto spin-up for Maxtor disks

At least Maxtor OneTouch III require a "start stop unit" command after
auto spin-down before the next access can proceed.  This patch activates
the responsible code in scsi_mod for all Maxtor SBP-2 disks.
https://bugzilla.novell.com/show_bug.cgi?id=183011

Maybe that should be done for all SBP-2 disks, but better be cautious.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix broken suspend/resume in ohci1394
Robert Hancock [Fri, 11 Aug 2006 21:41:52 +0000 (23:41 +0200)]
Fix broken suspend/resume in ohci1394

I've been experimenting to track down the cause of suspend/resume problems
on my Compaq Presario X1050 laptop:

http://bugzilla.kernel.org/show_bug.cgi?id=6075

Essentially the ACPI Embedded Controller and keyboard controller would
get into a bizarre, confused state after resume.

I found that unloading the ohci1394 module before suspend and reloading it
after resume made the problem go away.  Diffing the dmesg output from
resume, with and without the module loaded, I found that with the module
loaded I was missing these:

PM: Writing back config space on device 0000:02:00.0 at offset 1. (Was 2100080, writing 2100007)
PM: Writing back config space on device 0000:02:00.0 at offset 3. (Was 0, writing 8008)
PM: Writing back config space on device 0000:02:00.0 at offset 4. (Was 0, writing 90200000)
PM: Writing back config space on device 0000:02:00.0 at offset 5. (Was 1, writing 2401)
PM: Writing back config space on device 0000:02:00.0 at offset f. (Was 20000100, writing 2000010a)

The default PCI driver performs the pci_restore_state when no driver is
loaded for the device.  When the ohci1394 driver is loaded, it is supposed
to do this, however it appears not to do so.

I created the patch below and tested it, and it appears to resolve the
suspend problems I was having with the module loaded.  I only added in the
pci_save_state and pci_restore_state - however, though I know little of
this hardware, surely the driver should really be doing more than this when
suspending and resuming?  Currently it does almost nothing, what if there
are commands in progress, etc?

Signed-off-by: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix debugfs inode leak
Jens Axboe [Fri, 11 Aug 2006 20:43:42 +0000 (22:43 +0200)]
fix debugfs inode leak

Looking at the reiser4 crash, I found a leak in debugfs. In
debugfs_mknod(), we create the inode before checking if the dentry
already has one attached. We don't free it if that is the case.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix missing ret assignment in __bio_map_user() error path
Jens Axboe [Fri, 11 Aug 2006 20:29:11 +0000 (22:29 +0200)]
Fix missing ret assignment in __bio_map_user() error path

If get_user_pages() returns less pages than what we asked for, we
jump to out_unmap which will return ERR_PTR(ret). But ret can contain
a positive number just smaller than local_nr_pages, so be sure to set
it to -EFAULT always.

Problem found and diagnosed by Damien Le Moal <damien@sdl.hitachi.co.jp>

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] Fix Nforce3 suspend on amd64.
Dave Jones [Wed, 9 Aug 2006 22:03:27 +0000 (00:03 +0200)]
[AGPGART] Fix Nforce3 suspend on amd64.

kernel.org bugzilla #6206

Based on patch from Serge Belyshev <belyshev@depni.sinp.msu.ru>

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSOUND_SSCAPE shouldn't depend on OBSOLETE_OSS_DRIVER
Adrian Bunk [Wed, 9 Aug 2006 21:26:03 +0000 (23:26 +0200)]
SOUND_SSCAPE shouldn't depend on OBSOLETE_OSS_DRIVER

Due to a regression in the correcponding ALSA driver (ALSA #2234), the
OSS driver should stay until it's fixed.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoieee80211: TKIP requires CRC32
Chuck Ebbert [Tue, 8 Aug 2006 21:23:12 +0000 (23:23 +0200)]
ieee80211: TKIP requires CRC32

ieee80211_crypt_tkip will not work without CRC32.

  LD      .tmp_vmlinux1
net/built-in.o: In function `ieee80211_tkip_encrypt':
net/ieee80211/ieee80211_crypt_tkip.c:349: undefined reference to `crc32_le'

Reported by Toralf Foerster <toralf.foerster@gmx.de>

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agomemory hotplug: solve config broken: undefined reference to `online_page'
Yasunori Goto [Tue, 8 Aug 2006 15:35:33 +0000 (17:35 +0200)]
memory hotplug: solve config broken: undefined reference to `online_page'

Memory hotplug code of i386 adds memory to only highmem.  So, if
CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set.
Otherwise, it causes compile error.

In addition, many architecture can't use memory hotplug feature yet.  So, I
introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG.

Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agopdflush: handle resume wakeups
Pavel Machek [Tue, 8 Aug 2006 09:58:01 +0000 (11:58 +0200)]
pdflush: handle resume wakeups

2.6.16 needs this. It was merged into 2.6.18-rc1.

pdflush is carefully designed to ensure that all wakeups have some
corresponding work to do - if a woken-up pdflush thread discovers that
it hasn't been given any work to do then this is considered an error.

That all broke when swsusp came along - because a timer-delivered
wakeup to a frozen pdflush thread will just get lost.  This causes the
pdflush thread to get lost as well: the writeback timer is supposed to
be re-armed by pdflush in process context, but pdflush doesn't execute
the callout which does this.

Fix that up by ignoring the return value from try_to_freeze(): jsut
proceed, see if we have any work pending and only go back to sleep if
that is not the case.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoBLOCK: Fix bounce limit address check
Andi Kleen [Mon, 7 Aug 2006 19:26:18 +0000 (21:26 +0200)]
BLOCK: Fix bounce limit address check

This fixes some OOMs on 64bit systems with <4GB of RAM when accessing
the cdrom.

Do a safer check for when to enable DMA. Currently we enable ISA DMA
for cases that do not need it, resulting in OOM conditions when ZONE_DMA
runs out of space.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoIB/mthca: restore missing PCI registers after reset
Michael S. Tsirkin [Mon, 7 Aug 2006 17:04:22 +0000 (19:04 +0200)]
IB/mthca: restore missing PCI registers after reset

mthca does not restore the following PCI-X/PCI Express registers after reset:
  PCI-X device: PCI-X command register
  PCI-X bridge: upstream and downstream split transaction registers
  PCI Express : PCI Express device control and link control registers

This causes instability and/or bad performance on systems where one of
these registers is set to a non-default value by BIOS.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix the SND_FM801_TEA575X dependencies
Adrian Bunk [Thu, 3 Aug 2006 19:58:11 +0000 (21:58 +0200)]
fix the SND_FM801_TEA575X dependencies

CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:

<--  snip  -->

...
  LD      vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1

<--  snip  -->

This patch fixes kernel Bugzilla #6458.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoremove obsolete swsusp_encrypt
Pavel Machek [Thu, 3 Aug 2006 19:56:53 +0000 (21:56 +0200)]
remove obsolete swsusp_encrypt

Remove SWSUSP_ENCRYPT config option; it is no longer implemented.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.27 v2.6.16.27
Greg Kroah-Hartman [Mon, 17 Jul 2006 13:58:58 +0000 (06:58 -0700)]
Linux 2.6.16.27

18 years ago[PATCH] USB serial ftdi_sio: Prevent userspace DoS (CVE-2006-2936)
Ian Abbott [Mon, 26 Jun 2006 11:59:17 +0000 (12:59 +0100)]
[PATCH] USB serial ftdi_sio: Prevent userspace DoS (CVE-2006-2936)

This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
18 years ago[PATCH] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY
YOSHIFUJI Hideaki [Thu, 22 Jun 2006 08:42:13 +0000 (01:42 -0700)]
[PATCH] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY

We need to update hiscore.rule even if we don't enable CONFIG_IPV6_PRIVACY,
because we have more less significant rule; longest match.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
18 years ago[PATCH] IPV6: Fix source address selection.
$,1 aukasz Stelmach [Thu, 22 Jun 2006 08:39:05 +0000 (01:39 -0700)]
[PATCH] IPV6: Fix source address selection.

Two additional labels (RFC 3484, sec. 10.3) for IPv6 addreses
are defined to make a distinction between global unicast
addresses and Unique Local Addresses (fc00::/7, RFC 4193) and
Teredo (2001::/32, RFC 4380). It is necessary to avoid attempts
of connection that would either fail (eg. fec0:: to 2001:feed::)
or be sub-optimal (2001:0:: to 2001:feed::).

Signed-off-by: \e$,1 aukasz Stelmach <stlman@poczta.fm>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>