summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2007-11-20[IPV6] TCPMD5: Fix deleting key operation.YOSHIFUJI Hideaki
Due to the bug, refcnt for md5sig pool was leaked when an user try to delete a key if we have more than one key. In addition to the leakage, we returned incorrect return result value for userspace. This fix should close Bug #9418, reported by <ming-baini@163.com>. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20[IPV6] TCPMD5: Check return value of tcp_alloc_md5sig_pool().YOSHIFUJI Hideaki
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20[IPV4] TCPMD5: Use memmove() instead of memcpy() because we have overlaps.YOSHIFUJI Hideaki
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20[IPV4] TCPMD5: Omit redundant NULL check for kfree() argument.YOSHIFUJI Hideaki
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20Merge branch 'fixes-davem' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2007-11-20Pull bugzilla-9327 into release branchLen Brown
Conflicts: drivers/acpi/ec.c Signed-off-by: Len Brown <len.brown@intel.com>
2007-11-20ACPI: EC: Workaround for optimized controllers (version 3)Alexey Starikovskiy
Some controllers fail to send confirmation GPE after address or data write. Detect this and don't expect such confirmation in future. This is a generalization of previous workaround (66c5f4e7367b0085652931b2f3366de29e7ff5ec), which did only read address. Reference: http://bugzilla.kernel.org/show_bug.cgi?id=9327 Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de> Tested-by: Romano Giannetti <romano.giannetti@gmail.com> Tested-by: Mats Johannesson Signed-off-by: Len Brown <len.brown@intel.com>
2007-11-20ACPI: EC: use printk_ratelimit(), add some DEBUG mode messagesMárton Németh
Sometimes it is usefull to see raw protocol dump. Uncomment '#define DEBUG' at the beginning of file to make EC really verbose. Signed-off-by: Márton Németh <nm127@freemail.hu> Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de> Signed-off-by: Len Brown <len.brown@intel.com>
2007-11-20Revert "ACPI: EC: Workaround for optimized controllers"Len Brown
This reverts commit f2d68935ba08cf80f151bbdb5628381184e4a498.
2007-11-20ACPI: acpiphp: Remove dmesg spam on device removeGary Hade
In cases where acpi_pci_bind() does not attach device data, acpi_pci_unbind() complains via an ACPI exception about the missing data when the device is removed. For example, acpi_pci_bind() does not attach data for non-existent device functions so when the device is removed using the ACPI PCI hotplug driver 'acpiphp' an ACPI exception is logged for every non-existent function. This patch avoids the confusing log messages by removing the unnecessary ACPI exception. Signed-off-by: Gary Hade <garyhade@us.ibm.com> Signed-off-by: Len Brown <len.brown@intel.com>
2007-11-20[CIFS] Fix potential data corruption when writing out cached dirty pagesJeff Layton
Fix RedHat bug 329431 The idea here is separate "conscious" from "unconscious" flushes. Conscious flushes are those due to a fsync() or close(). Unconscious ones are flushes that occur as a side effect of some other operation or due to memory pressure. Currently, when an error occurs during an unconscious flush (ENOSPC or EIO), we toss out the page and don't preserve that error to report to the user when a conscious flush occurs. If after the unconscious flush, there are no more dirty pages for the inode, the conscious flush will simply return success even though there were previous errors when writing out pages. This can lead to data corruption. The easiest way to reproduce this is to mount up a CIFS share that's very close to being full or where the user is very close to quota. mv a file to the share that's slightly larger than the quota allows. The writes will all succeed (since they go to pagecache). The mv will do a setattr to set the new file's attributes. This calls filemap_write_and_wait, which will return an error since all of the pages can't be written out. Then later, when the flush and release ops occur, there are no more dirty pages in pagecache for the file and those operations return 0. mv then assumes that the file was written out correctly and deletes the original. CIFS already has a write_behind_rc variable where it stores the results from earlier flushes, but that value is only reported in cifs_close. Since the VFS ignores the return value from the release operation, this isn't helpful. We should be reporting this error during the flush operation. This patch does the following: 1) changes cifs_fsync to use filemap_write_and_wait and cifs_flush and also sync to check its return code. If it returns successful, they then check the value of write_behind_rc to see if an earlier flush had reported any errors. If so, they return that error and clear write_behind_rc. 2) sets write_behind_rc in a few other places where pages are written out as a side effect of other operations and the code waits on them. 3) changes cifs_setattr to only call filemap_write_and_wait for ATTR_SIZE changes. 4) makes cifs_writepages accurately distinguish between EIO and ENOSPC errors when writing out pages. Some simple testing indicates that the patch works as expected and that it fixes the reproduceable known problem. Acked-by: Dave Kleikamp <shaggy@austin.rr.com> Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-11-20ieee80211: Stop net_ratelimit/IEEE80211_DEBUG_DROP log pollutionGuillaume Chazarain
if (net_ratelimit()) IEEE80211_DEBUG_DROP(...) can pollute the logs with messages like: printk: 1 messages suppressed. printk: 2 messages suppressed. printk: 7 messages suppressed. if debugging information is disabled. These messages are printed by net_ratelimit(). Add a wrapper to net_ratelimit() that takes into account the log level, so that net_ratelimit() is called only when we really want to print something. Signed-off-by: Guillaume Chazarain <guichaz@yahoo.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2007-11-20mac80211: add missing space in error messageBruno Randolf
Signed-off-by: Bruno Randolf <bruno@thinktube.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2007-11-20[POWERPC] 83xx: Update mpc8349emitx(gp) defconfig for USBGrant Likely
USB support for the 8349itx got added a while back; but the defconfig never got updated. This patch adds the appropriate USB config options to the defconfigs Signed-off-by: Grant Likely <grant.likely@secretlab.ca> CC: Scott Wood <scottwood@freescale.com> CC: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2007-11-20[POWERPC] 83xx: Update mpc832x_rdb_defconfig to enable MMC-over-SPIAnton Vorontsov
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2007-11-20[POWERPC] 83xx: MPC832x RDB - remove spidev stub, use mmc_spiAnton Vorontsov
mmc_spi has hit the mainline, so we can start using it. Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2007-11-20[POWERPC] 8xxx: MDS board RTC fixesKim Phillips
Now the rtc class ds1374 driver has been added, remove the old rtc driver hookup code, add rtc node to device trees, and turn on the new driver in the defconfigs. Signed-off-by: Kim Phillips <kim.phillips@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2007-11-20mac80211: fix allmulti/promisc behaviourJohannes Berg
When an interface with promisc/allmulti bit is taken down, the mac80211 state can become confused. This fixes it by making mac80211 keep track of all *active* interfaces that have the promisc/allmulti bit set in the sdata, we sync the interface bit into sdata at set_multicast_list() time so this works. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2007-11-20mac80211: fix ieee80211_set_multicast_listJohannes Berg
I recently experienced unexplainable behaviour with the b43 driver when I had broken firmware uploaded. The cause may have been that promisc mode was not correctly enabled or disabled and this bug may have been the cause. Note how the values are compared later in the function so just doing the & will result in the wrong thing being compared and the test being false almost always. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2007-11-20mlx4_core: Fix state check in mlx4_qp_modify()Jack Morgenstein
When checking the states passed in, mlx4_qp_modify() accidentally checks cur_state twice rather than checking cur_state and new_state. Fix this to make sure that both values are in-bounds. Since these values may be passed in from userspace, this bug results in userspace being able to trigger an oops. Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Cc: stable <stable@kernel.org> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-11-20[ALSA] version 1.0.15Jaroslav Kysela
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20IB/ipath: Normalize error return codes for posting work requestsRalph Campbell
The error codes for ib_post_send(), ib_post_recv(), and ib_post_srq_recv() were inconsistent. Use EINVAL for too many SGEs and ENOMEM for too many WRs. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-11-20IB/ipath: Fix offset returned to ibv_modify_srq()Ralph Campbell
The wrong offset was being returned to libipathverbs so that when ibv_modify_srq() calls mmap(), it always fails. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-11-20IB/ipath: Fix error path in QP creationRalph Campbell
This patch fixes the code which frees the partially allocated QP resources if there was an error while creating the QP. In particular, the QPN wasn't deallocated and the QP wasn't removed from the hash table. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-11-20[ALSA] emu10k1 - Check value ranges in ctl callbacksTakashi Iwai
Check value ranges in ctl callbacks properly. This fixes the unexpected crash due to wrong value assignment. Also, remove invalid comments in the last patch. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[ALSA] emu10k1: Add mixer controls parameter checking.James Courtier-Dutton
Signed-off-by: James Courtier-Dutton <James@superbug.co.uk> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20IB/ipath: Fix offset returned to ibv_resize_cq()Ralph Campbell
The wrong offset was being returned to libipathverbs so that when ibv_resize_cq() calls mmap(), it always fails. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-11-20[ALSA] fix private data pointer calculation in CS4270 driverTimur Tabi
Fix the calculation of the private_data pointer in the CS4270 driver. Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[ALSA] portman2x4 - Fix probe errorTakashi Iwai
Reported by Ingo Molnar, when booting an allyesconfig bzImage kernel the bootup hangs in the portman2x4 driver (on a box that does not have this hardware), at: Pid: 1, comm: swapper EIP: 0060:[<c02f763c>] CPU: 0 EIP is at parport_pc_read_status+0x4/0x8 EFLAGS: 00000202 Not tainted (2.6.23-rc9 #904) EAX: f7e57a7f EBX: 00000010 ECX: c2b808c0 EDX: 00000379 ESI: f7cb8230 EDI: 00000010 EBP: f7cb8230 DS: 007b ES: 007b FS: 0000 CR0: 8005003b CR2: fff9c000 CR3: 007ec000 CR4: 00000690 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: ffff0ff0 DR7: 00000400 [<c04613de>] portman_flush_input+0xde/0x12c [<c0461a24>] snd_portman_probe+0x368/0x484 [<c02fbb8c>] __device_attach+0x0/0x8 [<c02fce68>] platform_drv_probe+0xc/0x10 [<c02fba6c>] driver_probe_device+0x74/0x194 [<c0587174>] klist_next+0x38/0x70 [<c02fbb8c>] __device_attach+0x0/0x8 [<c02faea1>] bus_for_each_drv+0x35/0x68 [<c02fbc22>] device_attach+0x72/0x78 the reason is due to an inconsistent error return code of 1 or 2, while snd_portman_probe only realizes negative error codes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[ALSA] ca0106 - Fix write proc assignmentTakashi Iwai
The driver assigns the write proc callback to read wrongly. Fixed now. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[ALSA] s3c2443-ac97: compilation fixKrzysztof Helt
The Samsung S3C24xx uses new architecture file layout in the post 2.6.23 kernel. This patch fixes include path for the s3c2443-ac97.c. Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[ALSA] hda-codec - Revert volume knob controls in STAC codecsTakashi Iwai
Volume knob controls with STAC codecs seem to cause problems with some devices. Volumes change very slowly or silent suddenly. It's likely due to conflict between the software and the hardware volume knob setup. Since we'll have a virtual master control in future, it's safer to remove this control completely right now. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-11-20[NETFILTER]: Fix kernel panic with REDIRECT target.Evgeniy Polyakov
When connection tracking entry (nf_conn) is about to copy itself it can have some of its extension users (like nat) as being already freed and thus not required to be copied. Actually looking at this function I suspect it was copied from nf_nat_setup_info() and thus bug was introduced. Report and testing from David <david@unsolicited.net>. [ Patrick McHardy states: I now understand whats happening: - new connection is allocated without helper - connection is REDIRECTed to localhost - nf_nat_setup_info adds NAT extension, but doesn't initialize it yet - nf_conntrack_alter_reply performs a helper lookup based on the new tuple, finds the SIP helper and allocates a helper extension, causing reallocation because of too little space - nf_nat_move_storage is called with the uninitialized nat extension So your fix is entirely correct, thanks a lot :) ] Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20[WIRELESS] WEXT: Fix userspace corruption on 64-bit.David S. Miller
On 64-bit systems sizeof(struct ifreq) is 8 bytes larger than sizeof(struct iwreq). For GET calls, the wireless extension code copies back into userspace using sizeof(struct ifreq) but userspace and elsewhere only allocates a "struct iwreq". Thus, this copy writes past the end of the iwreq object and corrupts whatever sits after it in memory. Fix the copy_to_user() length. This particularly hurts the compat case because the wireless compat code uses compat_alloc_userspace() and right after this allocated buffer is the current bottom of the user stack, and that's what gets overwritten by the copy_to_user() call. Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-20[S390] cio: Register/unregister subchannels only from kslowcrw.Cornelia Huck
Make sure all subchannel handling is done on the slow path workqueue so that we don't have races between an old subchannel unregistering and a new subchannel with the same name registering. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Add missing die_notifier() call to die().Heiko Carstens
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Fix memory detection.Heiko Carstens
Before we're getting short on memory detection fixes here is the next one: if neither sclp nor diag260 report the storage size the detection loop will return immediately without detecting anything. Fix this by breaking the detection loop only if the memory end is known. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Explicitly code allocpercpu calls in iucvChristoph Lameter
The iucv is the only user of the various functions that are used to bring parts of cpus up and down. Its the only allocpercpu user that will do I/O on per cpu objects (which is difficult to do with virtually mapped memory). And its the only use of allocpercpu where a GFP_DMA allocation is done. Remove the allocpercpu calls from iucv and code the allocation and freeing manually. After this patch it is possible to remove a large part of the allocpercpu API. Signed-off-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Dont overwrite lowcores on smp_send_stop().Heiko Carstens
Don't perform a sigp store-status-at-address on smp_send_stop(). It will overwrite the lowcores of other cpus and destroys valueable debug informations. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Optimize storage key handling for anonymous pagesChristian Borntraeger
page_mkclean used to call page_clear_dirty for every given page. This is different to all other architectures, where the dirty bit in the PTEs is only resetted, if page_mapping() returns a non-NULL pointer. We can move the page_test_dirty/page_clear_dirty sequence into the 2nd if to avoid unnecessary iske/sske sequences, which are expensive. This change also helps kvm for s390 as the host must transfer the dirty bit into the guest status bits. By moving the page_clear_dirty operation into the 2nd if, the vm will only call page_clear_dirty for pages where it walks the mapping anyway. There it calls ptep_clear_flush for writable ptes, so we can transfer the dirty bit to the guest. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Fix kernel preemption.Heiko Carstens
When returning from IRQ handling and TIF_NEED_RESCHED is set we must call preempt_schedule_irq() instead of schedule(). Otherwise the BKL might be unlocked in schedule() and therfore everything that relies on the BKL is broken. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] appldata: remove unused binary sysctls.Heiko Carstens
Remove binary sysctls that never worked due to missing strategy functions. Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Gerald Schaefer <geraldsc@de.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] cmm: remove unused binary sysctls.Heiko Carstens
Remove binary sysctls that never worked due to missing strategy functions. Cc: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] Fix irq tracing and lockdep_sys_exit calls.Heiko Carstens
Current support for TRACE_IRQFLAGS and lockdep_sys_exit is broken. IRQ flag tracing is broken for program checks. Even worse is that the newly introduced calls to lockdep_sys_exit are in the critical section code which is not supposed to call any C functions. In addition the checks if locks are still held are also done when returning to kernel code which is broken as well. Fix all this by disabling interrupts and machine checks at the exit paths and then do the appropriate checks and calls. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] magic sysrq: check for in_atomic before doing an console_unblankChristian Borntraeger
When doing an magic sysrq reboot on s390 the following bug message appears: SysRq : Resetting BUG: sleeping function called from invalid context at include/asm/semaphore.h:61 in_atomic():1, irqs_disabled():0 07000000004002a8 000000000fe6bc48 0000000000000002 0000000000000000 000000000fe6bce8 000000000fe6bc60 000000000fe6bc60 000000000012a79a 0000000000000000 07000000004002a8 0000000000000006 0000000000000000 0000000000000000 000000000fe6bc48 000000000000000d 000000000fe6bcb8 00000000004000c8 0000000000103234 000000000fe6bc48 000000000fe6bc90 Call Trace: (¬<00000000001031b2>| show_trace+0x12e/0x148) ¬<000000000011ffca>| __might_sleep+0x10a/0x118 ¬<0000000000129fba>| acquire_console_sem+0x92/0xf4 ¬<000000000012a2ca>| console_unblank+0xc2/0xc8 ¬<0000000000107bb4>| machine_restart+0x54/0x6c ¬<000000000028e806>| sysrq_handle_reboot+0x26/0x30 ¬<000000000028e52a>| __handle_sysrq+0xa6/0x180 ¬<0000000000140134>| run_workqueue+0xcc/0x18c ¬<000000000014029a>| worker_thread+0xa6/0x108 ¬<00000000001458e4>| kthread+0x64/0x9c ¬<0000000000106f0e>| kernel_thread_starter+0x6/0xc ¬<0000000000106f08>| kernel_thread_starter+0x0/0xc The only reason for doing a console_unblank on s390 is to flush the log buffer. We have to check for in_atomic before doing a console_unblank as the console is otherwise filled with an unrelated bug message. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-20[S390] cio: change device sense procedure to work with pav aliasesPeter Oberparleiter
Modify the sense id channel program to allow device sensing of pav alias devices which belong to a base device with ungrouped paths. Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-11-19[IRDA]: Add missing "space"Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-19[SUNRPC]: Add missing "space"Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-19[SCTP]: Add missing "space"Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-19[IPV6]: Add missing "space"Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>