- 03 Jun, 2005 1 commit
-
-
brking@us.ibm.com authored
A problem exists todayin the sg driver that if an SG_IO request is outstanding to a device when it is removed from the system. The system may oops if that command completes later in time. 1. sg_remove gets called 2. sg_remove calls sg_finish_req_req on all pending requests This removes the Sg_request's from the headrp list in the Sg_fd 3. The sleeping SG_IO ioctl is woken. It does nothing and returns. 4. The caller closes the fd, which invokes sg_release 5. sg_release calls sg_remove_sfp. It finds no outstanding commands since the headrp list is empty, so it calls __sg_remove_sfp, which frees the sfp. 6. Now when sg_cmd_done gets called, sg uses upper_private_data in the Scsi_Request, which should point to the srp, which has been freed, so it points to freed memory. 7. sg then dereferences the srp pointer to get the sfp, and we oops. The fix is to NULL out the upper_private_data field in this path, which sg_cmd_done already checks for, which will prevent the oops from occurring. cpu 0x1: Vector: 300 (Data Access) at [c00000000fff7aa0] pc: d0000000002bbea8: .sg_cmd_done+0x70/0x394 [sg] lr: d000000000073304: .scsi_finish_command+0x10c/0x130 [scsi_mod] sp: c00000000fff7d20 msr: 8000000000009032 dar: 2f70726f63202f78 dsisr: 40000000 current = 0xc0000000024589b0 paca = 0xc0000000003da800 pid = 7, comm = events/1 [c00000000fff7dc0] d000000000073304 .scsi_finish_command+0x10c/0x130 [scsi_mod] [c00000000fff7e50] d00000000007317c .scsi_softirq+0x140/0x168 [scsi_mod] [c00000000fff7ef0] c0000000000634dc .__do_softirq+0xa0/0x17c [c00000000fff7f90] c000000000018430 .call_do_softirq+0x14/0x24 [c00000000ed472e0] c0000000000142e0 .do_softirq+0x74/0x9c [c00000000ed47370] c000000000013c9c .do_IRQ+0xe8/0x100 [c00000000ed473f0] c00000000000ae34 HardwareInterrupt_entry+0x8/0x54 c00000000003df28 .smp_call_function+0 x100/0x1d0 [c00000000ed47780] c0000000000ba99c .invalidate_bh_lrus+0x30/0x70 [c00000000ed47810] c0000000000b91a0 .invalidate_bdev+0x18/0x3c [c00000000ed478a0] c0000000000da7b8 .__invalidate_device+0x70/0x94 [c00000000ed47930] c0000000001d40bc .invalidate_partition+0x4c/0x7c [c00000000ed479c0] c00000000010a944 .del_gendisk+0x48/0x15c [c00000000ed47a50] d00000000003d55c .sd_remove+0x34/0xe4 [sd_mod] [c00000000ed47ae0] c0000000001c5d30 .device_release_driver+0x90/0xb4 [c00000000ed47b70] c0000000001c6130 .bus_remove_device+0xb0/0x12c [c00000000ed47c00] c0000000001c4378 .device_del+0x120/0x198 [c00000000ed47ca0] d00000000007dcdc .scsi_remove_device+0xb4/0x194 [scsi_mod] [c00000000ed47d30] d0000000000a5864 .ipr_worker_thread+0x1d4/0x27c [ipr] [c00000000ed47dd0] c0000000000734c4 .worker_thread+0x238/0x2f4 [c00000000ed47ee0] c0000000000796c0 .kthread+0xcc/0x11c [c00000000ed47f90] c000000000018ad0 .kernel_thread+0x4c/0x6c Signed-off-by:Brian King <brking@us.ibm.com> Signed-off-by:
James Bottomley <James.Bottomley@SteelEye.com>
-
- 26 May, 2005 14 commits
-
-
James Bottomley authored
Since the aic driver is now taught to speak in terms of the generic linux devices, we can now also dispense with the transport class get routines (since we update the parameters when the driver sees they change) and also plumb it into the spi transport transfer agreement reporting infrastructure. Signed-off-by: -
James Bottomley authored
-
-
James Bottomley authored
This patch basically allows any HBA attached to the SPI transport class to declare an extra area which the mid-layer will allocate as part of its device and target allocations. Signed-off-by: -
Andrew Morton authored
drivers/ieee1394/sbp2.c: In function `sbp2_check_sbp2_response': drivers/ieee1394/sbp2.c:2154: warning: unused variable `device_type' Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
James Bottomley authored
This gives the HBA driver notice when a target is created and destroyed to allow it to manage its own target based allocations accordingly. This is a much reduced verson of the original patch sent in by James.Smart@Emulex.com Signed-off-by: -
Marcello Maggioni authored
From: Marcello Maggioni <hayarms@gmail.com> Problem: Some drives (NEC 3500, TDK 1616N, Mad-dog MD-16XDVD9, RICOH MP5163DA, Memorex DVD9 drive and IO-DATA's too for sure), if a CD/DVD is inserted into the tray when the system is booted and if before the OS bootup the BIOS checked for the presence of a bootable CD/DVD into the drive, during the IDE probe phase the drive may result busy and remain so for the next 25/30 seconds . This cause the drive to be skipped during the booting phase and not begin usable until the next reboot (if the reboot goes well and the drive doesn't timeout again). Solution: Rising the timeout time from 10 seconds to 35 seconds (during these 35 seconds every drive should wake up for sure according to the tests I've done). Signed-off-by:Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>
-
Al Viro authored
a) TYPE_SDAD renamed to TYPE_RBC and taken to scsi.h b) in sbp2.c remapping of TYPE_RPB to TYPE_DISK turned off c) relevant places in midlayer and sd.c taught to accept TYPE_RBC d) sd.c::sd_read_cache_type() looks into page 6 when dealing with TYPE_RBC - these guys have writeback cache flag there and are not guaranteed to have page 8 at all. e) sd_read_cache_type() got an extra sanity check - it checks that it got the page it asked for before using its contents. And screams if mismatch had happened. Rationale: there are broken devices out there that are "helpful" enough to go for "I don't have a page you've asked for, here, have another one". For example, PL3507 had been caught doing just that... f) sbp2 sets sdev->use_10_for_rw and sdev->use_10_for_ms instead of bothering to remap READ6/WRITE6/MOD_SENSE, so most of the conversions in there are gone now. Incidentally, I wonder if USB storage devices that have no mode page 8 are simply RBC ones. I haven't touched that, but it might be interesting to check... Signed-off-by:
Al Viro <viro@parcelfarce.linux.theplanet.co.uk> Signed-off-by:
-
Matthew Wilcox authored
sym2 version 2.2.1: - Fix MMIO BAR detection (Thanks to Bob Picco) - Fix odd-sized transfers with a wide bus (Thanks to Larry Stephens) - Write posting fixes (Thanks to Thibaut Varene) - Change one of the GFP_KERNEL allocations back into a GFP_ATOMIC - Make CCB_BA() return a script-endian address - Move range checks and disabling of devices from the queuecommand path to slave_alloc() - Remove a warning in sym_setup_cdb() - Keep a pointer to the scsi_target instead of the scsi_dev in the tcb - Remove a check for the upper layers passing an oversized cmd - Replace CAM_REQ_ constants with the Linux DID_ constants - Replace CAM_DIR_ constants with the Linux DMA_ constants - Inline sym_read_parisc_pdc() on non-parisc systems Signed-off-by: -
Stuart Hayes authored
From: Stuart Hayes <Stuart_Hayes@dell.com> The system can panic with a null pointer dereference using ide-scsi if PIO is being done on scatter gather pages that are in high memory, because page_address() returns 0. We are actually seeing this using a tape drive. This patch will kmap_atomic() the pages before performing PIO. Signed-off-by: -
Bartlomiej Zolnierkiewicz authored
* add ide_bus_match() and export ide_bus_type * split ide_remove_driver_from_hwgroup() out of ide_unregister() * move device cleanup from ide_unregister() to drive_release_dev() * convert ide_driver_t->name to driver->name * convert ide_driver_t->{attach,cleanup} to driver->{probe,remove} * remove ide_driver_t->busy as ide_bus_type->subsys.rwsem protects against concurrent ->{probe,remove} calls * make ide_{un}register_driver() void as it cannot fail now * use driver_{un}register() directly, remove ide_{un}register_driver() * use device_register() instead of ata_attach(), remove ata_attach() * add proc_print_driver() and ide_drivers_show(), remove ide_drivers_op * fix ide_replace_subdriver() and move it to ide-proc.c * remove ide_driver_t->drives, ide_drives and drives_lock * remove ide_driver_t->drivers, drivers and drivers_lock * remove ide_drive_t->driver and DRIVER() macro Signed-off-by: -
Albert Lee authored
When testing ATAPI PIO data transfer on the ppc64 platform, __atapi_pio_bytes() got zero when sg_dma_len() is used. I checked the <asm-ppc64/scatterlish.h>, the struct scatterlist is defined as: struct scatterlist { struct page *page; unsigned int offset; unsigned int length; /* For TCE support */ u32 dma_address; u32 dma_length; }; #define sg_dma_address(sg) ((sg)->dma_address) #define sg_dma_len(sg) ((sg)->dma_length) So, if the scatterlist is not DMA mapped, sg_dma_len() will return zero on ppc64. The same problem should occur on the x86-64 platform. On the i386 platform, sg_dma_len() returns sg->length, that's why the problem does not occur on an i386. Changes: - Use sg->length if the scatterlist is not DMA mapped (yet). Signed-off-by:Albert Lee <albertcc@tw.ibm.com>
-
-
-
- 25 May, 2005 25 commits
-
-
Francisco Javier authored
-
NAKAMURA Kenta authored
-
Colin Leroy authored
This patch shows the correct locations of the heat sensors present in iBook and PowerBooks G4, instead of displaying them as being on CPU and GPU (which is not always the case). Signed-off-by:
Colin Leroy <colin@colino.net> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
Colin Leroy authored
This patch limits therm_adt746x to currently existing fan controllers in Apple laptops. It may avoid problems with future hardware. Signed-off-by:
-
Roland Dreier authored
Make MTU field in SA PathRecord and MCMemberRecord a u8 rather than an enum to avoid complications with endianness. Signed-off-by:
Roland Dreier <roland@topspin.com> Signed-off-by:
-
Roland Dreier authored
Free all unclaimed MAD receive buffers when userspace closes our file so we don't leak memory. Signed-off-by:
-
Roland Dreier authored
Check if a client passes a NULL callback into an SA query, and if so, never call back. This fixes an oops if someone unloads ib_ipoib and ib_sa in rapid succession. ib_ipoib does an MCMember delete with a NULL callback and 0 timeout on unload, which is usually fine since the delete completes successfully. However, if ib_sa is unloaded immediately afterwards, the delete will be canceled and ib_sa will try to call the (now already unloaded) ib_ipoib module back with the cancel completion, which triggers the oops. Signed-off-by:
-
Alexander Nyberg authored
Fixes some !CONFIG_BUG warnings: include/asm/mmu_context.h: I funktion `switch_mm': include/asm/mmu_context.h:57: varning: implicit declaration of function `out_of_line_bug' Signed-off-by:
Alexander Nyberg <alexn@telia.com> Cc: Andi Kleen <ak@muc.de> Signed-off-by:
-
Neil Horman authored
It looks like the recent IPMI patches had some -mm-onlyisms. Signed-off-by:
Neil Horman <nhorman@redhat.com> Cc: Corey Minyard <minyard@acm.org> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
Gerd Knorr authored
Don't try to access the i2c bus if the register wasn't successful. Signed-off-by:
Gerd Knorr <kraxel@suse.de> Signed-off-by:
-
David S. Miller authored
-
-
-
-
-
-
-
-
Jens Axboe authored
This has been sitting for a while, and is causing lots of grief for people burning CDs. It relaxes the dma restriction for ide-cd, requiring only the length to be 32-byte aligned, address should be fine at normal double word alignment. Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
David Woodhouse authored
There's a bigger Speedtouch update coming your way after 2.6.12 but in the meantime, let's at least make it automatically resync if the DSL signal is lost. Signed-off-by:
David Woodhouse <dwmw2@infradead.org> Signed-off-by:
-
Stephen Rothwell authored
For quite a while, there has existed a hypervisor bug on legacy iSeries which means that we do not get the boot time set in the kernel. This patch works around that bug. This was most noticable when the root partition needed to be checked at every boot as the kernel thought it was some time in 1905 until user mode reset the time correctly. Signed-off-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
-
Stephen Rothwell authored
On PPC64, we keep track of when we need to update jiffies (and the variables used to calculate the time of day) based on the time base. If the time base frequence is sufficiently high compared to the processor clock frequency, then it is possible for the time of day variables to be corrupted at the time of the first decrementer interrupt we take. This became obvious on a legacy iSeries where the time base frequency is the same as the processor clock. This one line patch fixes the initialisation so that the time of day variables and the indicator we use to tell when updates are due are better synchronised. Signed-off-by:
-
Linus Torvalds authored
-
Andrew Morton authored
Fix a c99ism. Cc: James Bottomley <James.Bottomley@steeleye.com> Signed-off-by:
-
Andrew Morton authored
For older gcc's. Signed-off-by:
-
