- 07 Aug, 2006 5 commits
-
-
Jean Delvare authored
The scx200_acb i2c bus driver pretends to support SMBus block transactions, but in fact it implements the more simple I2C block transactions. Additionally, it lacks sanity checks on the length of the block transactions, which could lead to a buffer overrun. This fixes an oops reported by Alexander Atanasov: http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094 Thanks to Ben Gardner for fixing my bugs :) Signed-off-by:
Jean Delvare <khali@linux-fr.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Thomas Andrews authored
Fix the scx200_acb state machine: * Nack was sent one byte too late on reads >= 2 bytes. * Stop bit was set one byte too late on reads. Signed-off-by:
-
Patrick McHardy authored
[NETFILTER]: H.323 helper: fix possible NULL-ptr dereference An RCF message containing a timeout results in a NULL-ptr dereference if no RRQ has been seen before. Noticed by the "SATURN tool", reported by Thomas Dillig <tdillig@stanford.edu> and Isil Dillig <isil@stanford.edu>. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Marcel Holtmann authored
Don't allow chmod() on the /proc/<pid>/ files This just turns off chmod() on the /proc/<pid>/ files, since there is no good reason to allow it, and had we disallowed it originally, the nasty /proc race exploit wouldn't have been possible. The other patches already fixed the problem chmod() could cause, so this is really just some final mop-up.. This particular version is based off a patch by Eugene and Marcel which had much better naming than my original equivalent one. Signed-off-by:
Eugene Teo <eteo@redhat.com> Signed-off-by:
Marcel Holtmann <marcel@holtmann.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org> Signed-off-by:
-
Chuck Ebbert authored
On 15 Jun 2006 03:45:10 +0200, Andi Kleen wrote: > Anyways I would say that if the BIOS can't get MCFG right then > it's likely not been validated on that board and shouldn't be used. According to Petr Vandrovec: ... "What is important (and checked) is address of MMCONFIG reported by MCFG table... Unfortunately code does not bother with printing that address :-( "Another problem is that code has hardcoded that MMCONFIG area is 256MB large. Unfortunately for the code PCI specification allows any power of two between 2MB and 256MB if vendor knows that such amount of busses (from 2 to 128) will be sufficient for system. With notebook it is quite possible that not full 8 bits are implemented for MMCONFIG bus number." So here is a patch. Unfortunately my system still fails the test because it doesn't reserve any part of the MMCONFIG area, but this may fix others. Booted on x86_64, only compiled on i386. x86_64 still remaps the max area (256MB) even though only 2MB is checked... but 2.6.16 had no check at all so it is still better. PCI: reduce size of x86 MMCONFIG reserved area check 1. Print the address of the MMCONFIG area when the test for that area being reserved fails. 2. Only check if the first 2MB is reserved, as that is the minimum. Signed-off-by:Chuck Ebbert <76306.1226@compuserve.com> Acked-by:
Arjan van de Ven <arjan@linux.intel.com> Signed-off-by:
Chris Wright <chrisw@sous-sol.org>
-
- 25 Jul, 2006 35 commits
-
-
Greg Kroah-Hartman authored
-
Kirill Korotaev authored
2.6.16 leaks like hell. While testing, I found massive leakage (reproduced in openvz) in: *filp *size-4096 And 1 object leaks in *size-32 *size-64 *size-128 It is the fix for the first one. filp leaks in the bowels of namei.c. Seems, size-4096 is file table leaking in expand_fdtables. I have no idea what are the rest and why they show only accompanying another leaks. Some debugging structs? [akpm@osdl.org, Trond: remove the IS_ERR() check] Signed-off-by:
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: Kirill Korotaev <dev@openvz.org> Cc: Trond Myklebust <trond.myklebust@fys.uio.no> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Andrew Morton authored
Fix http://bugzilla.kernel.org/show_bug.cgi?id=6716 Doing a sysrq over a serial line into an SMP machine presently deadlocks. Cc: Russell King <rmk@arm.linux.org.uk> Cc: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> Signed-off-by:
-
Pavel Machek authored
2.6.16 needs this. It was merged into 2.6.18-rc1 in http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d616e09ab33aa4d013a93c9b393efd5cebf78521 . pdflush is carefully designed to ensure that all wakeups have some corresponding work to do - if a woken-up pdflush thread discovers that it hasn't been given any work to do then this is considered an error. That all broke when swsusp came along - because a timer-delivered wakeup to a frozen pdflush thread will just get lost. This causes the pdflush thread to get lost as well: the writeback timer is supposed to be re-armed by pdflush in process context, but pdflush doesn't execute the callout which does this. Fix that up by ignoring the return value from try_to_freeze(): jsut proceed, see if we have any work pending and only go back to sleep if that is not the case. Signed-off-by:
Pavel Machek <pavel@suse.cz> Signed-off-by:
-
Chuck Ebbert authored
ieee80211_crypt_tkip will not work without CRC32. LD .tmp_vmlinux1 net/built-in.o: In function `ieee80211_tkip_encrypt': net/ieee80211/ieee80211_crypt_tkip.c:349: undefined reference to `crc32_le' Reported by Toralf Foerster <toralf.foerster@gmx.de> Signed-off-by:
-
Patrick McHardy authored
When more rules are present than fit in a single skb, the remaining rules are incorrectly skipped. Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Kirill Korotaev authored
When found, it is obvious. nfds calculated when allocating fdsets is rewritten by calculation of size of fdtable, and when we are unlucky, we try to free fdsets of wrong size. Found due to OpenVZ resource management (User Beancounters). Signed-off-by:
Kirill Korotaev <dev@openvz.org> Signed-off-by:
-
Takashi Iwai authored
Suppress 'irq handler mismatch' messages at auto-probing of irqs in ALSA ISA drivers. Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
Jaroslav Kysela <perex@suse.cz> Signed-off-by:
-
Remy Bruno authored
From: Remy Bruno <remy.bruno@trinnov.com> Signed-off-by:
-
Takashi Iwai authored
Call iounmap after free_irq to avoid invalid accesses in the shared irq. The patch is taken from https://bugzilla.novell.com/show_bug.cgi?id=167869Signed-off-by:
-
Takashi Iwai authored
Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec chips. Signed-off-by:
-
Takashi Iwai authored
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_create WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_pcm WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_timer WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_mixer WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/fs/reiser4/reiser4.ko needs unknown symbol generic_file_read Signed-off-by:
Randy Dunlap <rdunlap@xenotime.net> Signed-off-by:
-
Takashi Iwai authored
CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following compile error: <-- snip --> ... LD vmlinux sound/built-in.o: In function 'snd_fm801_free': fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit' sound/built-in.o: In function 'snd_card_fm801_probe': fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init' make: *** [vmlinux] Error 1 <-- snip --> This patch fixes kernel Bugzilla #6458. Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
-
Takashi Iwai authored
Fixed the master mute switch on VAIO laptops with STAC7661 codec chip. Signed-off-by:
-
Takashi Iwai authored
Changed the assigned model for HP dc7600 with ALC260 codec to match better with the actual I/O assignment. Patch taken from ALSA bug#2157. Signed-off-by:
-
Takashi Iwai authored
Fixed the missing array terminators in AD1988 codec support code. Signed-off-by:
-
Takashi Iwai authored
Fix an occasional deadlock occuring with snd-rtctimer driver, added irqsave to the lock in tasklet (ALSA bug#952). Signed-off-by:
-
Takashi Iwai authored
Fix 64bit address of MPU401 MMIO port on au88x0 chip. Signed-off-by:
-
Herbert Xu authored
This bug was unknowingly fixed the GSO patches (or rather, its effect was unknown at the time). Thanks to Marco Berizzi's persistence which is documented in the thread "ipsec tunnel asymmetrical mtu", we now know that it can have highly non-obvious symptoms. What happens is that uninitialised uso_size fields can cause packets to be incorrectly identified as UFO, which means that it does not get fragmented even if it's over the MTU. The fix is simple enough. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Andrew Morton authored
The recent generic_file_write() deadlock fix caused generic_file_buffered_write() to loop inifinitely when presented with a zero-length iovec segment. Fix. Note that this fix deliberately avoids calling ->prepare_write(), ->commit_write() etc with a zero-length write. This is because I don't trust all filesystems to get that right. This is a cautious approach, for 2.6.17.x. For 2.6.18 we should just go ahead and call ->prepare_write() and ->commit_write() with the zero length and fix any broken filesystems. So I'll make that change once this code is stabilised and backported into 2.6.17.x. The reason for preferring to call ->prepare_write() and ->commit_write() with the zero-length segment: a zero-length segment _should_ be sufficiently uncommon that this is the correct way of handling it. We don't want to optimise for poorly-written userspace at the expense of well-written userspace. Cc: "Vladimir V. Saveliev" <vs@namesys.com> Cc: Neil Brown <neilb@suse.de> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Chris Wright <chrisw@sous-sol.org> Cc: Greg KH <greg@kroah.com> Cc: <stable@kernel.org> Cc: walt <wa1ter@myrealbox.com> Signed-off-by:
-
Vladimir V. Saveliev authored
generic_file_buffered_write() prefaults in user pages in order to avoid deadlock on copying from the same page as write goes to. However, it looks like there is a problem when write is vectored: fault_in_pages_readable brings in current segment or its part (maxlen). OTOH, filemap_copy_from_user_iovec is called to copy number of bytes (bytes) which may exceed current segment, so filemap_copy_from_user_iovec switches to the next segment which is not brought in yet. Pagefault is generated. That causes the deadlock if pagefault is for the same page write goes to: page being written is locked and not uptodate, pagefault will deadlock trying to lock locked page. [akpm@osdl.org: somewhat rewritten] Cc: Neil Brown <neilb@suse.de> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: <stable@kernel.org> Signed-off-by:
-
Ian Abbott authored
This patch limits the amount of outstanding 'write' data that can be queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or simple accidents) that use up all the system memory by writing lots of data to the serial port. The original patch was by Guillaume Autran, who in turn based it on the same mechanism implemented in the 'visor' driver. I (Ian Abbott) re-targeted the patch to the latest sources, fixed a couple of errors, renamed his new structure members, and updated the implementations of the 'write_room' and 'chars_in_buffer' methods to take account of the number of outstanding 'write' bytes. It seems to work fine, though at low baud rates it is still possible to queue up an amount of data that takes an age to shift (a job for another day!). Signed-off-by:
Ian Abbott <abbotti@mev.co.uk> Signed-off-by:
-
Jens Axboe authored
Several issues noticed/fixed: - We cannot reliably block in link_pipe() while holding both input and output mutexes. So do preparatory checks before locking down both mutexes and doing the link. - The ipipe->nrbufs vs i check was bad, because we could have dropped the ipipe lock in-between. This causes us to potentially look at unknown buffers if we were racing with someone else reading this pipe. Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
Jens Axboe authored
The code really means to mask off the high bits, not assign 0xff. Signed-off-by:
-
Randy Dunlap authored
[CPUFREQ] Fix powernow-k8 SMP kernel on UP hardware bug. Fix powernow-k8 doesn't load bug. Reference: https://launchpad.net/distros/ubuntu/+source/linux-source-2.6.15/+bug/35145Signed-off-by:
Ben Collins <bcollins@ubuntu.com> Signed-off-by:
Dave Jones <davej@redhat.com> Signed-off-by:
-
Dave Jones authored
[CPUFREQ] Make powernow-k7 work on SMP kernels. Even though powernow-k7 doesn't work in SMP environments, it can work on an SMP configured kernel if there's only one CPU present, however recalibrate_cpu_khz was returning -EINVAL on such kernels, so we failed to init the cpufreq driver. Signed-off-by:
-
Michael Krufky authored
This patch adds support for the new revision of the DViCO FusionHDTV DVB-T Lite, based on the zl10353 demod instead of mt352. Both mt352 and zl10353 revisions of this card have the same PCI subsystem ID. Signed-off-by:
Michael Krufky <mkrufky@linuxtv.org> Acked-by:
Chris Pascoe <c.pascoe@itee.uq.edu.au> Acked-by:
Manu Abraham <manu@linuxtv.org> Signed-off-by:
-
Andrew de Quincey authored
This patch prevents the stradis driver from breaking all other saa7146 devices by removing the autodetection based on PCI subsystem ID 0000:0000 (no eeprom). Users that want to use the stradis driver will have to manually insert the module, or specify it in modprobe.conf Signed-off-by:
Andrew de Quincey <adq_dvb@lidskialf.net> Signed-off-by:
-
Oliver Endriss authored
Backport the budget driver DISEQC instability fix. Signed-off-by:
Oliver Endriss <o.endriss@gmx.de> Signed-off-by:
-
Andrew de Quincey authored
Backport the DISEQC regression fix to 2.6.17.x Signed-off-by:
-
Andrew de Quincey authored
Backport fix to artec USB DVB devices Signed-off-by:
-
Thomas Graf authored
"return -err" and blindly inheriting the error code in the netlink failure exception handler causes errors codes to be returned as positive value therefore making them being ignored by the caller. May lead to sending out incomplete netlink messages. Signed-off-by:
Thomas Graf <tgraf@suug.ch> Signed-off-by:
-
Thomas Graf authored
Return ENOENT if action module is unavailable Signed-off-by:
-
Thomas Graf authored
The TCA_ACT_KIND attribute is used without checking its availability when dumping actions therefore leading to a value of 0x4 being dereferenced. The use of strcmp() in tc_lookup_action_n() isn't safe when fed with string from an attribute without enforcing proper NUL termination. Both bugs can be triggered with malformed netlink message and don't require any privileges. Signed-off-by:
-
Michael Krufky authored
This Kconfig description is incorrect, due to a previous merge a while back. CONFIG_SAA711X builds module saa7115, which is the newer v4l2 module, and is not obsoleted. Signed-off-by:
-
