- 02 Oct, 2007 9 commits
-
-
Linus Torvalds authored
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [IEEE80211]: avoid integer underflow for runt rx frames [TCP]: secure_tcp_sequence_number() should not use a too fast clock [SFQ]: Remove artificial limitation for queue limit.
-
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpcLinus Torvalds authored
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: [POWERPC] Fix xics set_affinity code
-
John W. Linville authored
Reported by Chris Evans <scarybeasts@gmail.com>: > The summary is that an evil 80211 frame can crash out a victim's > machine. It only applies to drivers using the 80211 wireless code, and > only then to certain drivers (and even then depends on a card's > firmware not dropping a dubious packet). I must confess I'm not > keeping track of Linux wireless support, and the different protocol > stacks etc. > > Details are as follows: > > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen". > There are other skb->len checks, but not enough to prevent a subtle > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag > set. > > This leads to integer underflow and crash here: > > if (frag != 0) > flen -= hdrlen; > > (flen is subsequently used as a memcpy length parameter). How about this? Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
Eric Dumazet authored
TCP V4 sequence numbers are 32bits, and RFC 793 assumed a 250 KHz clock. In order to follow network speed increase, we can use a faster clock, but we should limit this clock so that the delay between two rollovers is greater than MSL (TCP Maximum Segment Lifetime : 2 minutes) Choosing a 64 nsec clock should be OK, since the rollovers occur every 274 seconds. Problem spotted by Denys Fedoryshchenko [ This bug was introduced by f8595815 ] Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-
Alexey Kuznetsov authored
This is followup to Patrick's patch. A little optimization to enqueue routine allows to remove artificial limitation on queue length. Plus, testing showed that hash function used by SFQ is too bad or even worse. It does not even sweep the whole range of hash values. Switched to Jenkins' hash. Signed-off-by: Alexey Kuznetsov <kaber@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
-
Linus Torvalds authored
No, I didn't want to do this, but we had more stuff go in after -rc8 than we had in the previous -rc. Gaah.
-
git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds authored
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] vmlinux.lds.S: Handle note sections [MIPS] Fix value of O_TRUNC
-
Andi Kleen authored
For some reason old binutils genertate larger headers so increase the text offset of the vdso to avoid linker errors. Roland McGrath explains: "There are extra symbols in the '.dynsym' section that are responsible for the size difference (They also cause corresponding inflation in '.gnu.version') Older ld's wrongly generated these unneeded symbols in .dynsym. This was fixed not all that long ago (2006); binutils-2.17.50.0.6 might be the first fixed version, but I have not verified for sure where the cutoff was. The unneeded symbols et al from old ld add almost 700 bytes excess. This limits fairly tightly the amount by which the actual text and data in the vDSO can grow in the future without pushing the whole file over 4kb. If it does grow later on, we should consider changing the layout with a config option or something to pack it better without that padding, when building the kernel with newer binutils." Signed-off-by: Andi Kleen <ak@suse.de> Cc: Roland McGrath <roland@redhat.com> Cc: Badari Pulavarty <pbadari@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Anton Blanchard authored
On a POWER6 machine running 2.6.23-rc8 I sometimes see the following error: xics_set_affinity: No online cpus in the mask 00000000,00000000,00000000,00000001 for irq 20 In a desperate attempt to get a changelog entry in 2.6.23, I took a look into it. It turns out we are passing a real and not a virtual irq into get_irq_server. This works for the case where hwirq < NR_IRQS and we set virq = hwirq. In my case however hwirq = 590082 and we try and access irq_desc[590082], slightly past the end at 512 entries. Lucky we ship lots of memory with our machines. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
-
- 01 Oct, 2007 14 commits
-
-
Linus Torvalds authored
Nick Piggin points out that splice isn't being good about the mmap semaphore: while two readers can nest inside each others, it does leave a possible deadlock if a writer (ie a new mmap()) comes in during that nesting. Original "just move the locking" patch by Nick, replaced by one by me based on an optimistic pagefault_disable(). And then Jens tested and updated that patch. Reported-by: Nick Piggin <npiggin@suse.de> Tested-by: Jens Axboe <jens.axboe@oracle.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6Linus Torvalds authored
* 'fixes-jgarzik' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6: [PATCH] libertas: build problems when partially modular
-
Linus Torvalds authored
* master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] Resolve PCI section warnings
-
ssh://master.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvbLinus Torvalds authored
* 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: V4L/DVB (6052): ivtv: fix udma yuv bug
-
git://oss.sgi.com:8090/xfs/xfs-2.6Linus Torvalds authored
* 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6: Revert "[XFS] Avoid replaying inode buffer initialisation log items if .. [ Fixed it and added some commit messages by hand to that branch - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Tim Shimmin authored
This reverts commit b394e43e. Lachlan McIlroy says: It tried to fix an issue where log replay is replaying an inode cluster initialisation transaction that should not be replayed because the inode cluster on disk is more up to date. Since we don't log file sizes (we rely on inode flushing to get them to disk) then we can't just replay all the transations in the log and expect the inode to be completely restored. We lose file size updates. Unfortunately this fix is causing more (serious) problems than it is fixing. SGI-PV: 969656 SGI-Modid: xfs-linux-melb:xfs-kern:29804a Signed-off-by: Lachlan McIlroy <lachlan@sgi.com> Signed-off-by: Tim Shimmin <tes@sgi.com>
-
Martin Schwidefsky authored
Calling handle_futex_death in exit_robust_list for the different robust mutexes of a thread basically frees the mutex. Another thread might grab the lock immediately which updates the next pointer of the mutex. fetch_robust_entry over the next pointer might therefore branch into the robust mutex list of a different thread. This can cause two problems: 1) some mutexes held by the dead thread are not getting freed and 2) some mutexs held by a different thread are freed. The next point need to be read before calling handle_futex_death. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Acked-by: Ingo Molnar <mingo@elte.hu> Acked-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Samuel Ortiz authored
When calling the RELDISP VT ioctl, we are reading vt_newvt while the console workqueue could be messing with it (through change_console()). We fix this race by taking the console semaphore before reading vt_newvt. Signed-off-by: Samuel Ortiz <sameo@openedhand.com> Acked-by: Antonino Daplas <adaplas@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Mark Lord authored
We need to disable all CPUs other than the boot CPU (usually 0) before attempting to power-off modern SMP machines. This fixes the hang-on-poweroff issue on my MythTV SMP box, and also on Thomas Gleixner's new toybox. Signed-off-by: Mark Lord <mlord@pobox.com> Acked-by: Thomas Gleixner <tglx@linutronix.de> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Ralf Baechle authored
The virtual address space argument of clear_user_highpage is supposed to be the virtual address where the page being cleared will eventually be mapped. This allows architectures with virtually indexed caches a few clever tricks. That sort of trick falls over in painful ways if the virtual address argument is wrong. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Dave Jones authored
Signed-off-by: Dave Jones <davej@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: <device@lanana.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Maciej W. Rozycki authored
Store any note sections after the exception tables like the other architectures do. This is required for .note.gnu.build-id emitted from binutils 2.18 onwards if nothing else. Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-
Ralf Baechle authored
A "cleanup" almost two years ago deleted the old definition from <asm/fcntl.h>, so asm-generic/fcntl.h defaulted it to the the same value as FASYNC ... which happened to be the wrong thing. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-
Randy Dunlap authored
Fix missing symbols in libertas USB driver when it is modular and rest of libertas is built-in. Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-
- 30 Sep, 2007 2 commits
-
-
Russell King authored
Fix the following (valid) section warnings: WARNING: vmlinux.o(.text+0xf7b5c): Section mismatch: reference to .init.text:pcibios_fixup_bus (between 'pci_scan_child_bus' and 'pci_scan_bridge') WARNING: vmlinux.o(.text+0xfc5f4): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_map_rom' and 'pci_unmap_rom') WARNING: vmlinux.o(.text+0xfc824): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_update_resource' and 'pci_claim_resource') WARNING: vmlinux.o(.text+0xfd6d8): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd730): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd788): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd7e0): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfe024): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') WARNING: vmlinux.o(.text+0xfe0f4): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') WARNING: vmlinux.o(.text+0xfe17c): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
-
Ian Armstrong authored
Using udma yuv causes the driver becomes locked into that mode. This prevents use of the mpeg decoder & non-udma yuv output. This patch clears the operating mode when the device is closed. Signed-off-by: Ian Armstrong <ian@iarmst.demon.co.uk> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
-
- 29 Sep, 2007 4 commits
-
-
Jan Lübbe authored
The new behaviour of CFS exposes a race which occurs if a switch is requested when vt_mode.mode is VT_PROCESS. The process with vc->vt_pid is signaled before vc->vt_newvt is set. This causes the switch to fail when triggered by the monitoing process because the target is still -1. [ If the signal sending fails, the subsequent "reset_vc(vc)" will then reset vt_newvt to -1, so this works for that case too. - Linus ] Signed-off-by: Jan Lübbe <jluebbe@lasnet.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Torvalds authored
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: mv643xx_eth: Check ETH_INT_CAUSE_STATE bit
-
Nick Piggin authored
The comment being removed by this patch is incorrect and misleading. In the following situation: 1. load ... 2. store 1 -> X 3. wmb 4. rmb 5. load a <- Y 6. store ... 4 will only ensure ordering of 1 with 5. 3 will only ensure ordering of 2 with 6. Further, a CPU with strictly in-order stores will still only provide that 2 and 6 are ordered (effectively, it is the same as a weakly ordered CPU with wmb after every store). In all cases, 5 may still be executed before 2 is visible to other CPUs! The additional piece of the puzzle that mb() provides is the store/load ordering, which fundamentally cannot be achieved with any combination of rmb()s and wmb()s. This can be an unexpected result if one expected any sort of global ordering guarantee to barriers (eg. that the barriers themselves are sequentially consistent with other types of barriers). However sfence or lfence barriers need only provide an ordering partial ordering of memory operations -- Consider that wmb may be implemented as nothing more than inserting a special barrier entry in the store queue, or, in the case of x86, it can be a noop as the store queue is in order. And an rmb may be implemented as a directive to prevent subsequent loads only so long as their are no previous outstanding loads (while there could be stores still in store queues). I can actually see the occasional load/store being reordered around lfence on my core2. That doesn't prove my above assertions, but it does show the comment is wrong (unless my program is -- can send it out by request). So: mb() and smp_mb() always have and always will require a full mfence or lock prefixed instruction on x86. And we should remove this comment. Signed-off-by: Nick Piggin <npiggin@suse.de> Cc: Paul McKenney <paulmck@us.ibm.com> Cc: David Howells <dhowells@redhat.com> Cc: Andi Kleen <ak@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Dale Farnsworth authored
Commit 468d09f8 masked the "state" interrupt (bit 20 of the cause register). This results in Radstone's PPC7D repeatedly re-entering the interrupt routine, locking up the board. The following patch returns the required handling for this interrupt. Signed-off-by: Martyn Welch <martyn.welch@radstone.co.uk> Signed-off-by: Dale Farnsworth <dale@farnsworth.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
-
- 28 Sep, 2007 11 commits
-
-
Benjamin Herrenschmidt authored
Linas reported me that some machines were crashing at boot in quirk_e100_interrupt. It appears that this quirk is doing an ioremap directly on a PCI BAR value, which isn't legal and will cause all sorts of bad things to happen on architectures where PCI BARs don't directly match processor bus addresses. This fixes it by using the proper PCI resources instead which is possible since the quirk has been moved by a previous commit to happen late enough for that. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Linas Vepstas <linas@austin.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Torvalds authored
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [TCP]: Fix MD5 signature handling on big-endian. [NET]: Zero length write() on socket should not simply return 0.
-
Dmitry Torokhov authored
Input: xpad - fix dependancy on LEDS class The driver can not be built-in when LEDS class is a module. Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Trond Myklebust authored
It doesn't look as if the NFS file name limit is being initialised correctly in the struct nfs_server. Make sure that we limit whatever is being set in nfs_probe_fsinfo() and nfs_init_server(). Also ensure that readdirplus and nfs4_path_walk respect our file name limits. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Torvalds authored
* 'for-2.6.23' of master.kernel.org:/pub/scm/linux/kernel/git/galak/powerpc: [POWERPC] mpc8349emitx.dts: Setup USB-DR for peripheral mode. [POWERPC] Fix mpc834x USB-MPH configuration. [POWERPC] Fix cpm_uart driver for cpm1 machines [PPC] Fix cpm_dpram_addr returning phys mem instead of virt mem [POWERPC] Fix copy'n'paste typo in commproc.c
-
Linus Torvalds authored
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: e1000: Add device IDs of blade version of the 82571 quad port sky2: fix transmit state on resume sky2: FE+ vlan workaround sky2: sky2 FE+ receive status workaround
-
David S. Miller authored
Based upon a report and initial patch by Peter Lieven. tcp4_md5sig_key and tcp6_md5sig_key need to start with the exact same members as tcp_md5sig_key. Because they are both cast to that type by tcp_v{4,6}_md5_do_lookup(). Unfortunately tcp{4,6}_md5sig_key use a u16 for the key length instead of a u8, which is what tcp_md5sig_key uses. This just so happens to work by accident on little-endian, but on big-endian it doesn't. Instead of casting, just place tcp_md5sig_key as the first member of the address-family specific structures, adjust the access sites, and kill off the ugly casts. Signed-off-by: David S. Miller <davem@davemloft.net>
-
git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds authored
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Fix fallocate on o32 binary compat ABI [MIPS] Fix CONFIG_BUILD_ELF64 kernels with symbols in CKSEG0. [MIPS] IP32: Fix initialization of UART base addresses.
-
Kyle McMartin authored
MIPS was mistakenly forgetting to use the fallocate compat wrapper, which I noticed while cleaning up all the duplicate fallocate wrappers. Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-
Ralf Baechle authored
The __pa() for those did assume that all symbols have XKPHYS values and the math fails for any other address range. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-
Ralf Baechle authored
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-