1. 02 Apr, 2009 9 commits
    • Boaz Harrosh's avatar
      USB: fix USB_STORAGE_CYPRESS_ATACB · 760053b6
      Boaz Harrosh authored
      upstream commit: 1f4159c1
      
      commit 64a87b24: [SCSI] Let scsi_cmnd->cmnd use request->cmd buffer
      changed the scsi_eh_prep_cmnd logic by making it clear
      the ->cmnd buffer. But the sat to cypress atacb translation supposed
      the ->cmnd buffer wasn't modified.
      
      This patch makes it set the ->cmnd buffer after scsi_eh_prep_cmnd call.
      The problem and a fix was reported by Matthieu CASTET <castet.matthieu@free.fr>
      
      It also removes all the hackery fiddling of scsi_cmnd and scsi_eh_save by
      requesting from scsi_eh_prep_cmnd to prepare a read into ->sense_buffer,
      which is much more suitable a buffer for HW transfers, then after the command
      execution the regs read is copied into regs buffer before actual preparation
      of sense_buffer.
      
      Also fix an alien comment character to my utf-8 editor.
      Signed-off-by: default avatarBoaz Harrosh <bharrosh@panasas.com>
      Signed-off-by: default avatarMatthieu CASTET <castet.matthieu@free.fr>
      Cc: stable <stable@kernel.org>
      Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
      Cc: Matthew Dharm <mdharm-kernel@one-eyed-alien.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      760053b6
    • Alan Stern's avatar
      USB: EHCI: add software retry for transaction errors · 39f8c8a3
      Alan Stern authored
      upstream commit: a2c2706e
      
      This patch (as1204) adds a software retry mechanism to ehci-hcd.  It
      gets invoked when the driver encounters transaction errors on an
      asynchronous endpoint.  On many systems, hardware deficiencies cause
      such errors to occur if one device is unplugged while the host is
      communicating with another device.  With the patch, the failed
      transactions are retried and generally succeed the second or third
      time through.
      
      This is based on code originally written by Koichiro Saito.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Tested by: Koichiro Saito <Saito.Koichiro@adniss.jp>
      CC: David Brownell <david-b@pacbell.net>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      39f8c8a3
    • Chuck Ebbert's avatar
      xfrm: spin_lock() should be spin_unlock() in xfrm_state.c · ce2a2dc2
      Chuck Ebbert authored
      [ Upstream commit 7d0b591c ]
      
      spin_lock() should be spin_unlock() in xfrm_state_walk_done().
      
      caused by:
      commit 12a169e7
      "ipsec: Put dumpers on the dump list"
      Reported-by: default avatarMarc Milgram <mmilgram@redhat.com>
      Signed-off-by: default avatarChuck Ebbert <cebbert@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      ce2a2dc2
    • Jesper Nilsson's avatar
      ipv6: Plug sk_buff leak in ipv6_rcv (net/ipv6/ip6_input.c) · c8289b1f
      Jesper Nilsson authored
      [ Upstream commit 71f6f6df ]
      
      Commit 778d80be
      (ipv6: Add disable_ipv6 sysctl to disable IPv6 operaion on specific interface)
      seems to have introduced a leak of sk_buff's for ipv6 traffic,
      at least in some configurations where idev is NULL, or when ipv6
      is disabled via sysctl.
      
      The problem is that if the first condition of the if-statement
      returns non-NULL, it returns an skb with only one reference,
      and when the other conditions apply, execution jumps to the "out"
      label, which does not call kfree_skb for it.
      
      To plug this leak, change to use the "drop" label instead.
      (this relies on it being ok to call kfree_skb on NULL)
      This also allows us to avoid calling rcu_read_unlock here,
      and removes the only user of the "out" label.
      Signed-off-by: default avatarJesper Nilsson <jesper.nilsson@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      c8289b1f
    • Herbert Xu's avatar
      GRO: Disable GRO on legacy netif_rx path · ed421a64
      Herbert Xu authored
      [ Upstream commit 8f1ead2d ]
      
      When I fixed the GRO crash in the legacy receive path I used
      napi_complete to replace __napi_complete.  Unfortunately they're
      not the same when NETPOLL is enabled, which may result in us
      not calling __napi_complete at all.
      
      What's more, we really do need to keep the __napi_complete call
      within the IRQ-off section since in theory an IRQ can occur in
      between and fill up the backlog to the maximum, causing us to
      lock up.
      
      Since we can't seem to find a fix that works properly right now,
      this patch reverts all the GRO support from the netif_rx path.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      ed421a64
    • Stephen Hemminger's avatar
      bridge: bad error handling when adding invalid ether address · 813352bc
      Stephen Hemminger authored
      [ Upstream commit cda6d377 ]
      
      This fixes an crash when empty bond device is added to a bridge.
      If an interface with invalid ethernet address (all zero) is added
      to a bridge, then bridge code detects it when setting up the forward
      databas entry. But the error unwind is broken, the bridge port object
      can get freed twice: once when ref count went to zeo, and once by kfree.
      Since object is never really accessible, just free it.
      Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      813352bc
    • Geert Uytterhoeven's avatar
      dnet: drivers/net/dnet.c needs <linux/io.h> · dcd2d49a
      Geert Uytterhoeven authored
      [ Upstream commit 142071b8 ]
      
      On m68k:
      | drivers/net/dnet.c: In function 'dnet_readw_mac':
      | drivers/net/dnet.c:36: error: implicit declaration of function 'writel'
      | drivers/net/dnet.c:43: error: implicit declaration of function 'readl'
      | drivers/net/dnet.c: In function 'dnet_probe':
      | drivers/net/dnet.c:873: error: implicit declaration of function 'ioremap'
      | drivers/net/dnet.c:873: warning: assignment makes pointer from integer without a cast
      | drivers/net/dnet.c:939: error: implicit declaration of function 'iounmap'
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      dcd2d49a
    • Vitaly Mayatskikh's avatar
      udp: Wrong locking code in udp seq_file infrastructure · efc337c4
      Vitaly Mayatskikh authored
      [ Upstream commit 30842f29 ]
      
      Reading zero bytes from /proc/net/udp or other similar files which use
      the same seq_file udp infrastructure panics kernel in that way:
      
      =====================================
      [ BUG: bad unlock balance detected! ]
      -------------------------------------
      read/1985 is trying to release lock (&table->hash[i].lock) at:
      [<ffffffff81321d83>] udp_seq_stop+0x27/0x29
      but there are no more locks to release!
      
      other info that might help us debug this:
      1 lock held by read/1985:
       #0:  (&p->lock){--..}, at: [<ffffffff810eefb6>] seq_read+0x38/0x348
      
      stack backtrace:
      Pid: 1985, comm: read Not tainted 2.6.29-rc8 #9
      Call Trace:
       [<ffffffff81321d83>] ? udp_seq_stop+0x27/0x29
       [<ffffffff8106dab9>] print_unlock_inbalance_bug+0xd6/0xe1
       [<ffffffff8106db62>] lock_release_non_nested+0x9e/0x1c6
       [<ffffffff810ef030>] ? seq_read+0xb2/0x348
       [<ffffffff8106bdba>] ? mark_held_locks+0x68/0x86
       [<ffffffff81321d83>] ? udp_seq_stop+0x27/0x29
       [<ffffffff8106dde7>] lock_release+0x15d/0x189
       [<ffffffff8137163c>] _spin_unlock_bh+0x1e/0x34
       [<ffffffff81321d83>] udp_seq_stop+0x27/0x29
       [<ffffffff810ef239>] seq_read+0x2bb/0x348
       [<ffffffff810eef7e>] ? seq_read+0x0/0x348
       [<ffffffff8111aedd>] proc_reg_read+0x90/0xaf
       [<ffffffff810d878f>] vfs_read+0xa6/0x103
       [<ffffffff8106bfac>] ? trace_hardirqs_on_caller+0x12f/0x153
       [<ffffffff810d88a2>] sys_read+0x45/0x69
       [<ffffffff8101123a>] system_call_fastpath+0x16/0x1b
      BUG: scheduling while atomic: read/1985/0xffffff00
      INFO: lockdep is turned off.
      Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table dm_multipath kvm ppdev snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event arc4 snd_s
      eq ecb thinkpad_acpi snd_seq_device iwl3945 hwmon sdhci_pci snd_pcm_oss sdhci rfkill mmc_core snd_mixer_oss i2c_i801 mac80211 yenta_socket ricoh_mmc i2c_core iTCO_wdt snd_pcm iTCO_vendor_support rs
      rc_nonstatic snd_timer snd lib80211 cfg80211 soundcore snd_page_alloc video parport_pc output parport e1000e [last unloaded: scsi_wait_scan]
      Pid: 1985, comm: read Not tainted 2.6.29-rc8 #9
      Call Trace:
       [<ffffffff8106b456>] ? __debug_show_held_locks+0x1b/0x24
       [<ffffffff81043660>] __schedule_bug+0x7e/0x83
       [<ffffffff8136ede9>] schedule+0xce/0x838
       [<ffffffff810d7972>] ? fsnotify_access+0x5f/0x67
       [<ffffffff810112d0>] ? sysret_careful+0xb/0x37
       [<ffffffff8106be9c>] ? trace_hardirqs_on_caller+0x1f/0x153
       [<ffffffff8137127b>] ? trace_hardirqs_on_thunk+0x3a/0x3f
       [<ffffffff810112f6>] sysret_careful+0x31/0x37
      read[1985]: segfault at 7fffc479bfe8 ip 0000003e7420a180 sp 00007fffc479bfa0 error 6
      Kernel panic - not syncing: Aiee, killing interrupt handler!
      
      udp_seq_stop() tries to unlock not yet locked spinlock. The lock was lost
      during splitting global udp_hash_lock to subsequent spinlocks.
      
      Signed-off by: Vitaly Mayatskikh <v.mayatskih@gmail.com>
      Acked-by: default avatarEric Dumazet <dada1@cosmosbay.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      efc337c4
    • Mark H. Weaver's avatar
      netfilter: nf_conntrack_tcp: fix unaligned memory access in tcp_sack · cbb1dbb6
      Mark H. Weaver authored
      [ Upstream commit 534f81a5 ]
      
      This patch fixes an unaligned memory access in tcp_sack while reading
      sequence numbers from TCP selective acknowledgement options.  Prior to
      applying this patch, upstream linux-2.6.27.20 was occasionally
      generating messages like this on my sparc64 system:
      
        [54678.532071] Kernel unaligned access at TPC[6b17d4] tcp_packet+0xcd4/0xd00
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
      cbb1dbb6
  2. 23 Mar, 2009 11 commits
  3. 22 Mar, 2009 6 commits
  4. 21 Mar, 2009 2 commits
  5. 20 Mar, 2009 5 commits
  6. 19 Mar, 2009 7 commits