]> git.karo-electronics.de Git - karo-tx-linux.git/log
karo-tx-linux.git
18 years ago[CIFS] Fix typo in earlier cifs_unlink change and protect one extra path.
Steve French [Sat, 14 Oct 2006 08:11:47 +0000 (10:11 +0200)]
[CIFS] Fix typo in earlier cifs_unlink change and protect one extra path.

Since cifs_unlink can also be called from rename path and there
was one report of oops am making the extra check for null inode.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] Fix unlink oops when indirectly called in rename error path under heavy stress.
Steve French [Sat, 14 Oct 2006 08:11:16 +0000 (10:11 +0200)]
[CIFS] Fix unlink oops when indirectly called in rename error path under heavy stress.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[CIFS] fs/cifs/dir.c: fix possible NULL dereference
Steve French [Sat, 14 Oct 2006 08:10:45 +0000 (10:10 +0200)]
[CIFS] fs/cifs/dir.c: fix possible NULL dereference

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[ATM] CLIP: Do not refer freed skbuff in clip_mkip() (CVE-2006-4997)
YOSHIFUJI Hideaki [Fri, 13 Oct 2006 23:13:36 +0000 (01:13 +0200)]
[ATM] CLIP: Do not refer freed skbuff in clip_mkip() (CVE-2006-4997)

In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.

Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofbdev: add modeline for 1680x1050@60
Olaf Hering [Fri, 13 Oct 2006 16:16:26 +0000 (18:16 +0200)]
fbdev: add modeline for 1680x1050@60

Add a modeline for the Philips 200W display.  aty128fb does not do DDC, it
picks 1920x1440 or similar.  It works ok with nvidiafb because it can ask
for DDC data.

mode "1680x1050-60"
    # D: 146.028 MHz, H: 65.191 kHz, V: 59.863 Hz
    geometry 1680 1050 1680 1050 16
    timings 6848 280 104 30 3 176 6
    hsync high
    vsync high
    rgba 5/11,6/5,5/0,0/0
endmode

hwinfo --monitor
20: None 00.0: 10000 Monitor
[Created at monitor.206]
  Unique ID: rdCR.pzUFTofo1S4
  Parent ID: 002j.bJRsY88eNSC
  Hardware Class: monitor
  Model: "PHILIPS Philips 200W"
  Vendor: PHL "PHILIPS"
  Device: eisa 0x0832 "Philips 200W"
  Serial ID: "VN  016596"
  Resolution: 720x400@70Hz
  Resolution: 640x480@60Hz
  Resolution: 640x480@67Hz
  Resolution: 640x480@72Hz
  Resolution: 640x480@75Hz
  Resolution: 800x600@56Hz
  Resolution: 800x600@60Hz
  Resolution: 800x600@72Hz
  Resolution: 800x600@75Hz
  Resolution: 832x624@75Hz
  Resolution: 1024x768@60Hz
  Resolution: 1024x768@70Hz
  Resolution: 1024x768@75Hz
  Resolution: 1280x1024@75Hz
  Resolution: 1152x864@70Hz
  Resolution: 1152x864@75Hz
  Resolution: 1280x960@60Hz
  Resolution: 1280x1024@60Hz
  Resolution: 1680x1050@60Hz
  Size: 433x271 mm
  Driver Info #0:
    Max. Resolution: 1680x1050
    Vert. Sync Range: 56-85 Hz
    Hor. Sync Range: 30-93 kHz
  Config Status: cfg=new, avail=yes, need=no, active=unknown
  Attached to: #5 (VGA compatible controller)

Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: accept flow control
Stephen Hemminger [Fri, 13 Oct 2006 16:13:23 +0000 (18:13 +0200)]
sky2: accept flow control

Don't program the GMAC to reject flow control packets.
This maybe the cause of some of the transmit hangs.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: fix fiber support
Stephen Hemminger [Fri, 13 Oct 2006 16:12:36 +0000 (18:12 +0200)]
sky2: fix fiber support

Fix support for fiber based devices.  Needed to keep track of PMD type to
add workaround in setup. Add support for gigabit half duplex fiber.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agosky2: use dev_alloc_skb for receive buffers
Stephen Hemminger [Fri, 13 Oct 2006 16:11:59 +0000 (18:11 +0200)]
sky2: use dev_alloc_skb for receive buffers

Several code paths assume an additional 16 bytes of header padding
on the receive path. Use dev_alloc_skb to get that padding.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agov4l/dvb: Backport the budget driver DISEQC instability fix
Oliver Endriss [Fri, 13 Oct 2006 16:05:48 +0000 (18:05 +0200)]
v4l/dvb: Backport the budget driver DISEQC instability fix

Backport the budget driver DISEQC instability fix.

Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
18 years agov4l/dvb: Backport fix to artec USB DVB devices
Andrew de Quincey [Fri, 13 Oct 2006 16:03:38 +0000 (18:03 +0200)]
v4l/dvb: Backport fix to artec USB DVB devices

Backport fix to artec USB DVB devices

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agov4l/dvb: Fix budget-av frontend detection
Andrew de Quincey [Fri, 13 Oct 2006 16:02:49 +0000 (18:02 +0200)]
v4l/dvb: Fix budget-av frontend detection

The budget-av needs this GPIO set low for most cards to work.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agodvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)
Ang Way Chuang [Fri, 13 Oct 2006 16:01:44 +0000 (18:01 +0200)]
dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)

ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that allows an attacker to send a malformed ULE packet
with SNDU length of 0 and bring down the receiving machine. This patch
fix the bug and has been tested on version 2.6.17.11. This bug is 100%
reproducible and the modified source code (GPL) used to produce this bug
will be posted on http://nrg.cs.usm.my/downloads.htm shortly.  The
kernel will produce a dump during CRC32 checking on faulty ULE packet.

Signed-off-by: Ang Way Chuang <wcang@nrg.cs.usm.my>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoIPV6: Sum real space for RTAs.
YOSHIFUJI Hideaki [Fri, 13 Oct 2006 16:00:31 +0000 (18:00 +0200)]
IPV6: Sum real space for RTAs.

This patch fixes RTNLGRP_IPV6_IFINFO netlink notifications.  Issue
pointed out by Patrick McHardy <kaber@trash.net>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix fdset leakage
Kirill Korotaev [Fri, 13 Oct 2006 15:58:30 +0000 (17:58 +0200)]
fix fdset leakage

When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.30-pre1 v2.6.16.30-pre1
Adrian Bunk [Fri, 22 Sep 2006 18:31:32 +0000 (20:31 +0200)]
Linux 2.6.16.30-pre1

18 years agoUSB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist
Henk Vergonet [Fri, 22 Sep 2006 18:28:19 +0000 (20:28 +0200)]
USB: add YEALINK phones to the HID_QUIRK_IGNORE blacklist

Keys on Yealink based phones will not function properly when using the
generic HID driver. This patch prevents the generic HID code from
grabbing the device before the regular yealink driver can get a grip on
it.

Signed-off-by: Henk Vergonet <Henk.Vergonet@gmail.com>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoUSB: Fix unload oops and memory leak in yealink driver
Henk Vergonet [Fri, 22 Sep 2006 18:20:40 +0000 (20:20 +0200)]
USB: Fix unload oops and memory leak in yealink driver

This patch fixes a memory leak and a kernel oops when trying to unload
the driver, due to an unbalanced cleanup.
Thanks Ivar Jensen for spotting my mistake.

Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agokernel/kmod.c: fix a race condition in usermodehelper.
Martin Schwidefsky [Fri, 22 Sep 2006 00:32:57 +0000 (02:32 +0200)]
kernel/kmod.c: fix a race condition in usermodehelper.

There is a race between call_usermodehelper_keys, __call_usermodehelper
and wait_for_helper. It should only happen if preemption is enabled or
on a virtualized system.

If the cpu is preempted or put to sleep by the hypervisor in
__call_usermodehelper between the creation of the wait_for_helper
thread and the second check on sub_info->wait, the whole execution
of wait_for_helper including the complete call and the continuation
after the wait_for_completion in call_usermodehelper_keys can have
happened before __call_usermodehelper checks sub_info->wait for the
second time. Since sub_info can already have been clobbered,
sub_info->wait could be zero and complete is called a second time
with an invalid argument. This has happened on s390. It took me only
three days to find out ..

Thanks to Arnd Bergmann for his help to spot this bug.

Kenneth Lee also sent the same patch independently.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoI2C: fix 'ignore' module parameter handling
Mark M. Hoffman [Fri, 22 Sep 2006 00:22:54 +0000 (02:22 +0200)]
I2C: fix 'ignore' module parameter handling

This patch fixes a bug in the handling of 'ignore' module parameters of I2C
client drivers.

Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA8290 update
Hartmut Hackmann [Mon, 18 Sep 2006 22:56:25 +0000 (00:56 +0200)]
V4L/DVB: TDA8290 update

This patch
- works around a bug in the I2C bridge that makes the initialization
  of the TDA10046 fail on recent LifeView cards
- puts the AGC output to tristate in sleep mode. This is necessary for
  recent hybrid cards that switch the AGC via tristateing.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Acked-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoConvert idr's internal locking to _irqsave variant
Roland Dreier [Mon, 18 Sep 2006 17:28:17 +0000 (19:28 +0200)]
Convert idr's internal locking to _irqsave variant

Currently, the code in lib/idr.c uses a bare spin_lock(&idp->lock) to do
internal locking.  This is a nasty trap for code that might call idr
functions from different contexts; for example, it seems perfectly
reasonable to call idr_get_new() from process context and idr_remove() from
interrupt context -- but with the current locking this would lead to a
potential deadlock.

The simplest fix for this is to just convert the idr locking to use
spin_lock_irqsave().

In particular, this fixes a very complicated locking issue detected by
lockdep, involving the ib_ipoib driver's priv->lock and dev->_xmit_lock,
which get involved with the ib_sa module's query_idr.lock.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[TEXTSEARCH]: Fix Boyer Moore initialization bug
Michael Rash [Mon, 18 Sep 2006 17:26:29 +0000 (19:26 +0200)]
[TEXTSEARCH]: Fix Boyer Moore initialization bug

The pattern is set after trying to compute the prefix table, which tries
to use it. Initialize it before calling compute_prefix_tbl, make
compute_prefix_tbl consistently use only the data from struct ts_bm
and remove the now unnecessary arguments.

Signed-off-by: Michael Rash <mbr@cipherdyne.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: fix speed and link status reported by ethtool
Jay Cliburn [Mon, 18 Sep 2006 17:23:20 +0000 (19:23 +0200)]
via-velocity: fix speed and link status reported by ethtool

The via-velocity driver reports incorrect speed and link detected status
as viewed by ethtool (and probably other tools). This patch fixes those
incorrect reports and prettifies a long line.

Signed-off-by: Jay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agovia-velocity: the link is not correctly detected when the device starts
Roy Marples [Mon, 18 Sep 2006 17:20:52 +0000 (19:20 +0200)]
via-velocity: the link is not correctly detected when the device starts

The patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=6711

Signed-off-by: Roy Marples <uberlord@gentoo.org>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] VIA PT880 Ultra support.
Magnus Kessler [Mon, 18 Sep 2006 17:17:43 +0000 (19:17 +0200)]
[AGPGART] VIA PT880 Ultra support.

This patch enables agpgart on a Via "PT880 Ultra" based motherboard
(Asus P4V800D-X). The PCI ID of the PT880 Ultra is 0x0308 instead of
0x0258 of the PT880.

The patched via-agp passes testgart.

Signed-off-by: Magnus Kessler <Magnus.Kessler@gmx.net>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[AGPGART] ATI RS350 support.
Julien Tous [Mon, 18 Sep 2006 17:16:24 +0000 (19:16 +0200)]
[AGPGART] ATI RS350 support.

From: Julien Tous <julien.tous@gmail.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoPFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.
Tushar Gohad [Mon, 18 Sep 2006 17:14:39 +0000 (19:14 +0200)]
PFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.

Fixes inconsistent use of "uint32_t" vs. "u_int32_t".
Fix pfkeyv2 userspace builds.

Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: TDA10046 Driver update
Hartmut Hackmann [Sat, 16 Sep 2006 22:18:45 +0000 (00:18 +0200)]
V4L/DVB: TDA10046 Driver update

- Set outputs to tristate in sleep mode
- Reduce dangerously high firmware download speed with 16MHz xtal
- added tda827x configuration with GPIOs low
- added comments to stupid looking IIC reads that work around bugs in
  the tda10046.
- some minor updates

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoadd drivers/media/video/saa7134/saa7134-input.c:flydvb_codes
Adrian Bunk [Sat, 16 Sep 2006 22:00:29 +0000 (00:00 +0200)]
add drivers/media/video/saa7134/saa7134-input.c:flydvb_codes

based on drivers/media/common/ir-keymaps.c:ir_codes_flydvb
in Linus' tree.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the new Lifeview hybrid cardbus modules
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:55 +0000 (23:38 +0200)]
V4L/DVB: Added support for the new Lifeview hybrid cardbus modules

There seem to be many variants of this cards with different
feature sets. This entry supports
analog TV, CVBS and s-video input, FM radio and DVB-T
if they are supported by the hardware.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T
Hartmut Hackmann [Sat, 16 Sep 2006 21:38:13 +0000 (23:38 +0200)]
V4L/DVB: Corrected CVBS input for the AVERMEDIA 777 DVB-T

The .vmux entry needs to be 1 instead of 0

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added PCI IDs of 2 LifeView Cards
Hartmut Hackmann [Sat, 16 Sep 2006 21:37:44 +0000 (23:37 +0200)]
V4L/DVB: Added PCI IDs of 2 LifeView Cards

Added ID entries for the Genius VideoWonder DVB-T
and the LifeView FlyTV Platinum Gold

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: select FW_LOADER
maximilian attems [Sat, 16 Sep 2006 21:37:11 +0000 (23:37 +0200)]
V4L/DVB: Saa7134: select FW_LOADER

The saa7134 drivers uses request_firmware()
and thus needs to select FW_LOADER.

Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Medion 7134: Autodetect second bridge chip
Michael Krufky [Sat, 16 Sep 2006 21:36:05 +0000 (23:36 +0200)]
V4L/DVB: Medion 7134: Autodetect second bridge chip

The device, Medion 7134, has two saa7134 chips on it, but only one of them
is functional in the current saa7134 driver.

This patch adds autodetection for the second, unsupported saa7134 chip,
as SAA7134_BOARD_MD7134_BRIDGE_2, and displays a message to the user
(in dmesg) indicating that the second chip isn't yet functional.

This is useful for users, since two instances of the saa7134 driver
will spawn. This patch will prevent confusion by warning the user that
only one of the chips on the board are functional.

There are other versions of the SAA7134_BOARD_MD7134 with only a single
saa7134 bridge/decoder -- those devices will not be affected by this patch.
Only devices containing the second chip will display the warning.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: make unsupported secondary decoder message generic
Michael Krufky [Sat, 16 Sep 2006 21:35:11 +0000 (23:35 +0200)]
V4L/DVB: Saa7134: make unsupported secondary decoder message generic

There are already some supported devices that contain two
saa713x chips on-board, where only one of these chips is
currently functional in the driver.
We are already printing a warning message for the second
saa7134 decoder in SAA7134_BOARD_AVERMEDIA_A169_B. This
patch alters that case to make it generic, so that other
cards in the same situation can use it.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card
Rickard Osser [Sat, 16 Sep 2006 21:34:30 +0000 (23:34 +0200)]
V4L/DVB: Saa7134: add support for AVerMedia A169 Dual Analog tuner card

- Added support for AVerMedia A169 Dual Analog tuner card
  (dual saa7134 decoders - only 1 working right now)
- Added autodetection for both parts of the card.
  It shows up like 2 cards, B1 and B
- Enabled tuner B1, SVIDEO on B1 and composite1 through SVIDEO,
  FIXME: B is more or less dead at this point and I suspect the
  FM-radio is on the B part of the board

Adrian Bunk:
slightly adapted to 2.6.16

Signed-off-by: Rickard Osser <ricky@osser.se>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Saa7134: document that there's also a 220RF from KWorld
Adrian Bunk [Sat, 16 Sep 2006 21:33:38 +0000 (23:33 +0200)]
V4L/DVB: Saa7134: document that there's also a 220RF from KWorld

I have the same card with the same PCI id, but from KWorld.
The patch documents that this is the same card.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
18 years agoV4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID
TAMUKI Shoichi [Sat, 16 Sep 2006 21:33:10 +0000 (23:33 +0200)]
V4L/DVB: ELSA EX-VISION 700TV: fix incorrect PCI subsystem ID

- Corrected autodetection for saa7130 card:
  subsystem: 1048:226c, board: ELSA EX-VISION 700TV

Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load
Curt Meyers [Sat, 16 Sep 2006 21:32:18 +0000 (23:32 +0200)]
V4L/DVB: Kworld ATSC110: initialize the tuner for analog mode on module load

- Enable the tuv1236 tuner on the Kworld-ATSC110 card so that the
  tuner can be identified when tuners.ko loads.
- With this change it is no longer necessary to remove and reload
  the tuner module in order to get the tuv1236 identified.
- This code was copied from the ATI HDTV Wonder init routine (in cx88-cards.c)
  which also uses the TUV1236D.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: cleanups
Michael Krufky [Sat, 16 Sep 2006 21:31:38 +0000 (23:31 +0200)]
V4L/DVB: Kworld ATSC110: cleanups

- There is no radio with this tuner card...
Thanks-to: Dwaine Garden <DwaineGarden@rogers.com>
- fixed capitalization in card name.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Kworld ATSC110: enable composite and svideo inputs
Curt Meyers [Sat, 16 Sep 2006 21:30:59 +0000 (23:30 +0200)]
V4L/DVB: Kworld ATSC110: enable composite and svideo inputs

- corrected composite input.
- verified s-video input.

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: KWorld ATSC110: implement set_pll_input
Curt Meyers [Sat, 16 Sep 2006 21:30:22 +0000 (23:30 +0200)]
V4L/DVB: KWorld ATSC110: implement set_pll_input

- When tuning VSB, use ANT input
- When tuning QAM, use CABLE input

Signed-off-by: Curt Meyers <cmeyers@boilerbots.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for Kworld ATSC110
Andrew Burri [Sat, 16 Sep 2006 21:29:38 +0000 (23:29 +0200)]
V4L/DVB: Add support for Kworld ATSC110

Signed-off-by: Andrew Burri <andrew.burri@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)
Tamuki Shoichi [Sat, 16 Sep 2006 21:28:54 +0000 (23:28 +0200)]
V4L/DVB: Add saa713x card: ELSA EX-VISION 700TV (saa7130)

Add support for ELSA EX-VISION 700TV, which is the ELSA Japan's
flagship model of the software encoding TV capture card.
All inputs (Television, Composite1 and S-Video) have been tested.

Signed-off-by: Tamuki Shoichi <tamuki@linet.gr.jp>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the Tevion DVB-T 220RF card
Hartshorn [Sat, 16 Sep 2006 21:24:47 +0000 (23:24 +0200)]
V4L/DVB: Added support for the Tevion DVB-T 220RF card

This is an analog / digital hybrid card.

Signed-off-by: Peter Hartshorn <p3r@users.sourceforge.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331
Hartmut Hackmann [Sat, 16 Sep 2006 21:23:59 +0000 (23:23 +0200)]
V4L/DVB: Added support for the ADS Instant TV DUO Cardbus PTV331

Analog and DVB-T are working, Remote not yet.
This card is based on the new LifeView design, there should be many variants.

Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Added support for the LifeView FlyDVB-T LR301 card
Giampiero Giancipoli [Sat, 16 Sep 2006 21:23:23 +0000 (23:23 +0200)]
V4L/DVB: Added support for the LifeView FlyDVB-T LR301 card

Additionally to the card support, this changeset adds the option
tda10046lifeview to get_dvb_firmware to download tda10046 firmware
from LifeView's site.

Signed-off-by: Giampiero Giancipoli <gianci@libero.it>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoV4L/DVB: Add support for the Avermedia 777 DVB-T card
Jose Alberto Reguero [Sat, 16 Sep 2006 21:22:34 +0000 (23:22 +0200)]
V4L/DVB: Add support for the Avermedia 777 DVB-T card

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29 v2.6.16.29
Adrian Bunk [Tue, 12 Sep 2006 18:02:10 +0000 (20:02 +0200)]
Linux 2.6.16.29

18 years agoLinux 2.6.16.29-rc2 v2.6.16.29-rc2
Adrian Bunk [Sat, 9 Sep 2006 15:45:05 +0000 (17:45 +0200)]
Linux 2.6.16.29-rc2

18 years agoHave ext2 reject file handles with bad inode numbers early.
Neil Brown [Sat, 9 Sep 2006 15:44:45 +0000 (17:44 +0200)]
Have ext2 reject file handles with bad inode numbers early.

This prevents bad inode numbers from triggering errors in
ext2_get_inode.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.29-rc1 v2.6.16.29-rc1
Adrian Bunk [Wed, 6 Sep 2006 17:55:27 +0000 (19:55 +0200)]
Linux 2.6.16.29-rc1

18 years agopci_ids.h: add some VIA IDE identifiers
Alan Cox [Wed, 6 Sep 2006 17:55:17 +0000 (19:55 +0200)]
pci_ids.h: add some VIA IDE identifiers

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[PKTGEN]: Make sure skb->{nh,h} are initialized in fill_packet_ipv6() too.
David S. Miller [Wed, 6 Sep 2006 17:35:53 +0000 (19:35 +0200)]
[PKTGEN]: Make sure skb->{nh,h} are initialized in fill_packet_ipv6() too.

Mirror the bug fix from fill_packet_ipv4()

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[PKTGEN]: Fix oops when used with balance-tlb bonding
Chen-Li Tien [Wed, 6 Sep 2006 17:34:53 +0000 (19:34 +0200)]
[PKTGEN]: Fix oops when used with balance-tlb bonding

Signed-off-by: Chen-Li Tien <cltien@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoia64 SGI-SN2: fix silent data corruption caused by XPC
Dean Nelson [Wed, 6 Sep 2006 17:25:46 +0000 (19:25 +0200)]
ia64 SGI-SN2: fix silent data corruption caused by XPC

Jack Steiner identified a problem where XPC can cause a silent
data corruption.  On module load, the placement may cause the
xpc_remote_copy_buffer to span two physical pages.  DMA transfers are
done to the start virtual address translated to physical.

This patch changes the buffer from a statically allocated buffer to a
kmalloc'd buffer.  Dean Nelson reviewed this before posting.  I have
tested it in the configuration that was showing the memory corruption
and verified it works.  I also added a BUG_ON statement to help catch
this if a similar situation is encountered.

Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Dean Nelson <dcn@sgi.com>
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[IPV6]: Fix kernel OOPs when setting sticky socket options.
YOSHIFUJI Hideaki [Wed, 6 Sep 2006 14:30:02 +0000 (16:30 +0200)]
[IPV6]: Fix kernel OOPs when setting sticky socket options.

Bug noticed by Remi Denis-Courmont <rdenis@simphalempin.com>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoidr: fix race in idr code
Sonny Rao [Wed, 6 Sep 2006 14:23:48 +0000 (16:23 +0200)]
idr: fix race in idr code

I ran into a bug where the kernel died in the idr code:

cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710]
    pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330
    lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330
    sp: c000000b7096f990
   msr: 800000000000b032
   dar: 0
 dsisr: 40010000
  current = 0xc000000b70d43830
  paca    = 0xc000000000556900
    pid   = 2022, comm = hwup
1d:mon> t
[c000000b7096f990c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable)
[c000000b7096faa0c0000000001f8bf8 .idr_get_new_above+0x18/0x68
[c000000b7096fb20c00000000002a054 .init_new_context+0x5c/0xf0
[c000000b7096fbc0c000000000049dc8 .copy_process+0x91c/0x1404
[c000000b7096fcd0c00000000004a988 .do_fork+0xd8/0x224
[c000000b7096fdc0c00000000000ebdc .sys_clone+0x5c/0x74
[c000000b7096fe30c000000000008950 .ppc_clone+0x8/0xc
-- Exception: c00 (System Call) at 000000000fde887c
SP (f8b4e7a0) is in userspace

Turned out to be a race-condition and NULL ptr deref, here's my fix:

Users of the idr code are supposed to call idr_pre_get without locking, so the
idr code must serialize itself with respect to layer allocations.  However, it
fails to do so in an error path in idr_get_new_above_int().  I added the
missing locking to fix this.

Signed-off-by: Sonny Rao <sonny@burdell.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix misoptimization in futex unqueue_me
Christian Borntraeger [Wed, 6 Sep 2006 14:01:43 +0000 (16:01 +0200)]
fix misoptimization in futex unqueue_me

This patch adds a barrier() in futex unqueue_me to avoid aliasing of two
pointers.

On my s390x system I saw the following oops:

Unable to handle kernel pointer dereference at virtual kernel address
0000000000000000
Oops: 0004 [#1]
CPU:    0    Not tainted
Process mytool (pid: 13613, task: 000000003ecb6ac0, ksp: 00000000366bdbd8)
Krnl PSW : 0704d00180000000 00000000003c9ac2 (_spin_lock+0xe/0x30)
Krnl GPRS: 00000000ffffffff 000000003ecb6ac0 0000000000000000 0700000000000000
           0000000000000000 0000000000000000 000001fe00002028 00000000000c091f
           000001fe00002054 000001fe00002054 0000000000000000 00000000366bddc0
           00000000005ef8c0 00000000003d00e8 0000000000144f91 00000000366bdcb8
Krnl Code: ba 4e 20 00 12 44 b9 16 00 3e a7 84 00 08 e3 e0 f0 88 00 04
Call Trace:
([<0000000000144f90>] unqueue_me+0x40/0xe4)
 [<0000000000145a0c>] do_futex+0x33c/0xc40
 [<000000000014643e>] sys_futex+0x12e/0x144
 [<000000000010bb00>] sysc_noemu+0x10/0x16
 [<000002000003741c>] 0x2000003741c

The code in question is:

static int unqueue_me(struct futex_q *q)
{
        int ret = 0;
        spinlock_t *lock_ptr;

        /* In the common case we don't take the spinlock, which is nice. */
 retry:
        lock_ptr = q->lock_ptr;
        if (lock_ptr != 0) {
                spin_lock(lock_ptr);
                /*
                 * q->lock_ptr can change between reading it and
                 * spin_lock(), causing us to take the wrong lock.  This
                 * corrects the race condition.
[...]

and my compiler (gcc 4.1.0) makes the following out of it:

00000000000003c8 <unqueue_me>:
     3c8:       eb bf f0 70 00 24       stmg    %r11,%r15,112(%r15)
     3ce:       c0 d0 00 00 00 00       larl    %r13,3ce <unqueue_me+0x6>
                        3d0: R_390_PC32DBL      .rodata+0x2a
     3d4:       a7 f1 1e 00             tml     %r15,7680
     3d8:       a7 84 00 01             je      3da <unqueue_me+0x12>
     3dc:       b9 04 00 ef             lgr     %r14,%r15
     3e0:       a7 fb ff d0             aghi    %r15,-48
     3e4:       b9 04 00 b2             lgr     %r11,%r2
     3e8:       e3 e0 f0 98 00 24       stg     %r14,152(%r15)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
                /* write q->lock_ptr in r12 */
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       a7 84 00 4b             je      48e <unqueue_me+0xc6>
                /* if r12 is zero then jump over the code.... */
     3fc:       e3 20 b0 28 00 04       lg      %r2,40(%r11)
                /* write q->lock_ptr in r2 */
     402:       c0 e5 00 00 00 00       brasl   %r14,402 <unqueue_me+0x3a>
                        404: R_390_PC32DBL      _spin_lock+0x2
                /* use r2 as parameter for spin_lock */

So the code becomes more or less:
if (q->lock_ptr != 0) spin_lock(q->lock_ptr)
instead of
if (lock_ptr != 0) spin_lock(lock_ptr)

Which caused the oops from above.
After adding a barrier gcc creates code without this problem:
[...] (the same)
     3ee:       e3 c0 b0 28 00 04       lg      %r12,40(%r11)
     3f4:       b9 02 00 cc             ltgr    %r12,%r12
     3f8:       b9 04 00 2c             lgr     %r2,%r12
     3fc:       a7 84 00 48             je      48c <unqueue_me+0xc4>
     400:       c0 e5 00 00 00 00       brasl   %r14,400 <unqueue_me+0x38>
                        402: R_390_PC32DBL      _spin_lock+0x2

As a general note, this code of unqueue_me seems a bit fishy. The retry logic
of unqueue_me only works if we can guarantee, that the original value of
q->lock_ptr is always a spinlock (Otherwise we overwrite kernel memory). We
know that q->lock_ptr can change. I dont know what happens with the original
spinlock, as I am not an expert with the futex code.

Signed-off-by: Christian Borntraeger <borntrae@de.ibm.com>
Acked-by: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years ago[SERIAL] icom: select FW_LOADER
maximilian attems [Wed, 6 Sep 2006 13:39:02 +0000 (15:39 +0200)]
[SERIAL] icom: select FW_LOADER

The icom driver uses request_firmware()
and thus needs to select FW_LOADER.

Signed-off-by: maximilian attems <maks@sternwelten.at>
Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoMissing PCI id update for VIA IDE
Alan Cox [Wed, 6 Sep 2006 13:07:59 +0000 (15:07 +0200)]
Missing PCI id update for VIA IDE

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix sctp_primitive_ABORT() call in sctp_close()
Sridhar Samudrala [Tue, 5 Sep 2006 19:59:11 +0000 (21:59 +0200)]
Fix sctp_primitive_ABORT() call in sctp_close()

With the recent fix, the callers of sctp_primitive_ABORT()
need to create an ABORT chunk and pass it as an argument rather
than msghdr that was passed earlier.

Adrian Bunk:
Ported to 2.6.16.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: RME HDSP - fixed proc interface (missing {})
Remy Bruno [Tue, 5 Sep 2006 19:40:12 +0000 (21:40 +0200)]
ALSA: RME HDSP - fixed proc interface (missing {})

Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: hda-intel - Fix race in remove
Takashi Iwai [Tue, 5 Sep 2006 19:39:12 +0000 (21:39 +0200)]
ALSA: hda-intel - Fix race in remove

Call iounmap after free_irq to avoid invalid accesses in the
shared irq.  The patch is taken from
        https://bugzilla.novell.com/show_bug.cgi?id=167869

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix workaround for AD1988A rev2 codec
Takashi Iwai [Tue, 5 Sep 2006 19:38:52 +0000 (21:38 +0200)]
ALSA: Fix workaround for AD1988A rev2 codec

Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix model for HP dc7600
Takashi Iwai [Tue, 5 Sep 2006 19:38:23 +0000 (21:38 +0200)]
ALSA: Fix model for HP dc7600

Changed the assigned model for HP dc7600 with ALC260 codec
to match better with the actual I/O assignment.
Patch taken from ALSA bug#2157.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix missing array terminators in AD1988 codec support
Takashi Iwai [Tue, 5 Sep 2006 19:37:57 +0000 (21:37 +0200)]
ALSA: Fix missing array terminators in AD1988 codec support

Fixed the missing array terminators in AD1988 codec support code.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: Fix a deadlock in snd-rtctimer
Takashi Iwai [Tue, 5 Sep 2006 19:37:16 +0000 (21:37 +0200)]
ALSA: Fix a deadlock in snd-rtctimer

Fix an occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoALSA: au88x0 - Fix 64bit address of MPU401 MMIO port
Takashi Iwai [Tue, 5 Sep 2006 19:34:57 +0000 (21:34 +0200)]
ALSA: au88x0 - Fix 64bit address of MPU401 MMIO port

Fix 64bit address of MPU401 MMIO port on au88x0 chip.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoethtool: fix oops in ethtool_set_pauseparam()
Willy Tarreau [Thu, 31 Aug 2006 20:02:56 +0000 (22:02 +0200)]
ethtool: fix oops in ethtool_set_pauseparam()

The function pointers which were checked were for their get_* counterparts.
Typically a copy-paste typo.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Acked-by: Jeff Garzik <jeff@garzik.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoETHTOOL: Fix UFO typo
Herbert Xu [Thu, 31 Aug 2006 19:59:19 +0000 (21:59 +0200)]
ETHTOOL: Fix UFO typo

The function ethtool_get_ufo was referring to ETHTOOL_GTSO instead of
ETHTOOL_GUFO.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agofix struct file leakage
Kirill Korotaev [Wed, 30 Aug 2006 20:55:59 +0000 (22:55 +0200)]
fix struct file leakage

2.6.16 leaks like hell. While testing, I found massive filp leakage
(reproduced in openvz) in the bowels of namei.c.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoHave ext3 reject file handles with bad inode numbers early
Eric Sandeen [Wed, 30 Aug 2006 16:01:00 +0000 (18:01 +0200)]
Have ext3 reject file handles with bad inode numbers early

blatantly ripped off from Neil Brown's ext2 patch.

Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Acked-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoext3: avoid triggering ext3_error on bad NFS file handle
Neil Brown [Wed, 30 Aug 2006 15:58:44 +0000 (17:58 +0200)]
ext3: avoid triggering ext3_error on bad NFS file handle

The inode number out of an NFS file handle gets passed eventually to
ext3_get_inode_block() without any checking.  If ext3_get_inode_block()
allows it to trigger an error, then bad filehandles can have unpleasant
effect - ext3_error() will usually cause a forced read-only remount, or a
panic if `errors=panic' was used.

So remove the call to ext3_error there and put a matching check in
ext3/namei.c where inode numbers are read off storage.

Andrew Morton fixed an off-by-one error.

Dann Frazier ported the patch to 2.6.16.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoeicon: fix define conflict with ptrace
Alexey Dobriyan [Wed, 30 Aug 2006 15:31:15 +0000 (17:31 +0200)]
eicon: fix define conflict with ptrace

* MODE_MASK is unused in eicon driver.
* Conflicts with a ptrace stuff on arm.

drivers/isdn/hardware/eicon/divasync.h:259:1: warning: "MODE_MASK" redefined
include2/asm/ptrace.h:48:1: warning: this is the location of the previous definition

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Acked-by: Armin Schindler <armin@melware.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoip_tables: fix table locking in ipt_do_table
Patrick McHardy [Wed, 30 Aug 2006 15:25:57 +0000 (17:25 +0200)]
ip_tables: fix table locking in ipt_do_table

table->private might change because of ruleset changes, don't use it without
holding the lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoaic79xx: use BIOS settings
Hannes Reinecke [Wed, 30 Aug 2006 15:23:16 +0000 (17:23 +0200)]
aic79xx: use BIOS settings

This patch fixes the aic79xx driver to properly respond to BIOS
settings.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agotty serialize flush_to_ldisc
Paul Fulghum [Sun, 27 Aug 2006 01:36:58 +0000 (03:36 +0200)]
tty serialize flush_to_ldisc

Serialize processing of tty buffers in flush_to_ldisc
to fix (very rare) corruption of tty buffer free list
on SMP systems.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Acked-by: Alan Cox <alan@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoulog: fix panic on SMP kernels
Mark Huang [Sat, 26 Aug 2006 15:35:49 +0000 (17:35 +0200)]
ulog: fix panic on SMP kernels

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang <mlhuang@cs.princeton.edu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix a potential NULL dereference in md/raid1
Neil Brown [Sat, 26 Aug 2006 15:33:27 +0000 (17:33 +0200)]
Fix a potential NULL dereference in md/raid1

At the point where this 'atomic_add' is, rdev could be NULL,
as seen by the fact that we test for this in the very next
statement.
Further is it is really the wrong place of the add.
We could add to the count of corrected errors
once the are sure it was corrected, not before
trying to correct it.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Send only 1 window update SACK per message.
Tsutomu Fujii [Sat, 26 Aug 2006 00:41:37 +0000 (02:41 +0200)]
SCTP: Send only 1 window update SACK per message.

Right now, every time we increase our rwnd by more then MTU bytes, we
trigger a SACK.  When processing large messages, this will generate a
SACK for almost every other SCTP fragment. However since we are freeing
the entire message at the same time, we might as well collapse the SACK
generation to 1.

Signed-off-by: Tsutomu Fujii <t-fujii@nb.jp.nec.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Reset rtt_in_progress for the chunk when processing its sack.
Vlad Yasevich [Sat, 26 Aug 2006 00:41:12 +0000 (02:41 +0200)]
SCTP: Reset rtt_in_progress for the chunk when processing its sack.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Limit association max_retrans setting in setsockopt.
Vlad Yasevich [Sat, 26 Aug 2006 00:40:29 +0000 (02:40 +0200)]
SCTP: Limit association max_retrans setting in setsockopt.

When using ASSOCINFO socket option, we need to limit the number of
maximum association retransmissions to be no greater than the sum
of all the path retransmissions. This is specified in Section 7.1.2
of the SCTP socket API draft.
However, we only do this if the association has multiple paths. If
there is only one path, the protocol stack will use the
assoc_max_retrans setting when trying to retransmit packets.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Fix persistent slowdown in sctp when a gap ack consumes rx buffer.
Neil Horman [Sat, 26 Aug 2006 00:39:48 +0000 (02:39 +0200)]
SCTP: Fix persistent slowdown in sctp when a gap ack consumes rx buffer.

In the event that our entire receive buffer is full with a series of
chunks that represent a single gap-ack, and then we accept a chunk
(or chunks) that fill in the gap between the ctsn and the first gap,
we renege chunks from the end of the buffer, which effectively does
nothing but move our gap to the end of our received tsn stream. This
does little but move our missing tsns down stream a little, and, if the
sender is sending sufficiently large retransmit frames, the result is a
perpetual slowdown which can never be recovered from, since the only
chunk that can be accepted to allow progress in the tsn stream necessitates
that a new gap be created to make room for it. This leads to a constant
need for retransmits, and subsequent receiver stalls. The fix I've come up
with is to deliver the frame without reneging if we have a full receive
buffer and the receiving sockets sk_receive_queue is empty(indicating that
the receive buffer is being blocked by a missing tsn).

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSCTP: Reject sctp packets with broadcast addresses.
Vlad Yasevich [Sat, 26 Aug 2006 00:39:03 +0000 (02:39 +0200)]
SCTP: Reject sctp packets with broadcast addresses.

Make SCTP handle broadcast properly

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28 v2.6.16.28
Adrian Bunk [Fri, 25 Aug 2006 20:51:14 +0000 (22:51 +0200)]
Linux 2.6.16.28

18 years agoLinux 2.6.16.28-rc3 v2.6.16.28-rc3
Adrian Bunk [Wed, 23 Aug 2006 17:29:05 +0000 (19:29 +0200)]
Linux 2.6.16.28-rc3

18 years ago1394: fix for recently added firewire patch that breaks things on ppc
Danny Tholen [Wed, 23 Aug 2006 17:28:41 +0000 (19:28 +0200)]
1394: fix for recently added firewire patch that breaks things on ppc

Recently a patch was added for preliminary suspend/resume handling on
!PPC_PMAC.  However, this broke both suspend and firewire on powerpc
because it saves the pci state after the device has already been disabled.

This moves the save state to before the pmac specific code.

Signed-off-by: Danny Tholen <obiwan@mailmij.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix sctp privilege elevation (CVE-2006-3745)
Sridhar Samudrala [Wed, 23 Aug 2006 16:01:55 +0000 (18:01 +0200)]
Fix sctp privilege elevation (CVE-2006-3745)

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix possible UDF deadlock and memory corruption (CVE-2006-4145)
Jan Kara [Wed, 23 Aug 2006 16:00:30 +0000 (18:00 +0200)]
Fix possible UDF deadlock and memory corruption (CVE-2006-4145)

UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28-rc2 v2.6.16.28-rc2
Adrian Bunk [Tue, 22 Aug 2006 15:48:30 +0000 (17:48 +0200)]
Linux 2.6.16.28-rc2

18 years agopowerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)
Olof Johansson [Fri, 18 Aug 2006 19:44:57 +0000 (21:44 +0200)]
powerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)

Clear HID0[en_attn] at CPU init time on PPC970.  Closes CVE-2006-4093.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agocdrom: fix bad cgc.buflen assignment (CVE-2006-2935)
Jens Axboe [Fri, 18 Aug 2006 19:42:43 +0000 (21:42 +0200)]
cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <meissner@suse.de>.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoide-io: increase timeout value to allow for slave wakeup
Al Boldi [Fri, 18 Aug 2006 19:30:53 +0000 (21:30 +0200)]
ide-io: increase timeout value to allow for slave wakeup

During an STR resume cycle, the ide master disk times-out when there is
also a slave present (especially CD).  Increasing the timeout in ide-io
from 10,000 to 100,000 fixes this problem.

Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSPARC64: Fix quad-float multiply emulation.
David S. Miller [Fri, 18 Aug 2006 19:28:03 +0000 (21:28 +0200)]
SPARC64: Fix quad-float multiply emulation.

Something is wrong with the 3-multiply (vs. 4-multiply) optimized
version of _FP_MUL_MEAT_2_*(), so just use the slower version
which actually computes correct values.

Noticed by Rene Rebe

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoSPARC32: Fix iommu_flush_iotlb end address
Bob Breuer [Fri, 18 Aug 2006 19:26:56 +0000 (21:26 +0200)]
SPARC32: Fix iommu_flush_iotlb end address

Fix the calculation of the end address when flushing iotlb entries to
ram.  This bug has been a cause of esp dma errors, and it affects
HyperSPARC systems much worse than SuperSPARC systems.

Signed-off-by: Bob Breuer <breuerr@mc.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: William Lee Irwin III <wli@holomorphy.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoLinux 2.6.16.28-rc1 v2.6.16.28-rc1
Adrian Bunk [Sat, 12 Aug 2006 17:00:06 +0000 (19:00 +0200)]
Linux 2.6.16.28-rc1

18 years agoupdate the i386 defconfig
Adrian Bunk [Sat, 12 Aug 2006 16:59:17 +0000 (18:59 +0200)]
update the i386 defconfig

The i386 defconfig wasn't updated for ages.

Instead of running "make oldconfig" on the old defconfig and trying to
give reasonable answers at all new options, this patch replaces it with
the one I'm using in 2.6.16-rc1.

This way, it's a .config that is confirmed to work on at least one
computer in the world.  ;-)

Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoieee1394: sbp2: enable auto spin-up for Maxtor disks
Stefan Richter [Fri, 11 Aug 2006 21:42:30 +0000 (23:42 +0200)]
ieee1394: sbp2: enable auto spin-up for Maxtor disks

At least Maxtor OneTouch III require a "start stop unit" command after
auto spin-down before the next access can proceed.  This patch activates
the responsible code in scsi_mod for all Maxtor SBP-2 disks.
https://bugzilla.novell.com/show_bug.cgi?id=183011

Maybe that should be done for all SBP-2 disks, but better be cautious.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
18 years agoFix broken suspend/resume in ohci1394
Robert Hancock [Fri, 11 Aug 2006 21:41:52 +0000 (23:41 +0200)]
Fix broken suspend/resume in ohci1394

I've been experimenting to track down the cause of suspend/resume problems
on my Compaq Presario X1050 laptop:

http://bugzilla.kernel.org/show_bug.cgi?id=6075

Essentially the ACPI Embedded Controller and keyboard controller would
get into a bizarre, confused state after resume.

I found that unloading the ohci1394 module before suspend and reloading it
after resume made the problem go away.  Diffing the dmesg output from
resume, with and without the module loaded, I found that with the module
loaded I was missing these:

PM: Writing back config space on device 0000:02:00.0 at offset 1. (Was 2100080, writing 2100007)
PM: Writing back config space on device 0000:02:00.0 at offset 3. (Was 0, writing 8008)
PM: Writing back config space on device 0000:02:00.0 at offset 4. (Was 0, writing 90200000)
PM: Writing back config space on device 0000:02:00.0 at offset 5. (Was 1, writing 2401)
PM: Writing back config space on device 0000:02:00.0 at offset f. (Was 20000100, writing 2000010a)

The default PCI driver performs the pci_restore_state when no driver is
loaded for the device.  When the ohci1394 driver is loaded, it is supposed
to do this, however it appears not to do so.

I created the patch below and tested it, and it appears to resolve the
suspend problems I was having with the module loaded.  I only added in the
pci_save_state and pci_restore_state - however, though I know little of
this hardware, surely the driver should really be doing more than this when
suspending and resuming?  Currently it does almost nothing, what if there
are commands in progress, etc?

Signed-off-by: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>