This bug prevents their module refcounts being increased by opending upper layer drivers
Thus they can be removed at any time and panic the system.

On Sun, 16 Nov 2003, Kai Makisara wrote:
> On Sun, 16 Nov 2003, Alan Stern wrote:
>
> > The page count calculations in drivers/scsi/st.c (and copied in sg.c) are
> > wrong.  The code says:
> >
> > 	nr_pages = ((uaddr & ~PAGE_MASK) + count - 1 + ~PAGE_MASK) >>
> > 		PAGE_SHIFT;
> >
> > That will compute an incorrect value if the user's buffer happens to end
> > on the first byte of a new page.  Example:  Suppose uaddr starts right on
>
> Your analysis is correct and this is a bug. Could you send the fix to
> James Bottomley for inclusion into the scsi-bugfixes-2.6 bk tree (at least
> the st part).
>
> Thanks for noticing the bug.
>
> 	Kai
>
> P.S. I usually write these ((base ~ mask) + count + PAGE_SIZE - 1) >>
> PAGE_SHIFT. I don't know why I did it like this here. One should never try
> to be clever and do something in a new way or copy something that does not
> match one's own standard ways of doing things ;-)

On Mon, 17 Nov 2003, Douglas Gilbert wrote:
> Alan,
> ... and the sg part as well ..
>
> > Thanks for noticing the bug.
>
> dito
>
> Doug Gilbert

  - shost->my_devices is gone and replaced by ->__devices, which is not
    exposed to drivers and locked by the host lock.  Use the exported
    helpers that do proper refcounting to access it.
  - sdev->access_count is gone as a side-effect, the sg interfaces
    to export it now return 1 for a present scsi_device.
  - drivers/scsi/host.h is empty now.

into home.osdl.org:/home/torvalds/v2.5/linux

into redhat.com:/spare/repo/net-drivers-2.5

(fixes crash)

into hera.kernel.org:/home/davem/BK/net-2.5

This forward-ports some more of the ALI IDE sanity checks from the 2.4.x
tree. 

In particular, we only do the enable bits for revisions < 0xC5

We've resolved some bugs in legacy ALi5455 audio driver.

into home.osdl.org:/home/torvalds/v2.5/linux

This leaves just the minimal oops protection in place, and
maintains the logic that "if we have a non-ALI northbridge,
we shouldn't touch any of the GPIOs because we don't know
what they might be connected to".

- Mucking with the original skb pointers with push/pull around
  the packet quoting was wrong, muching with these pointers could
  cause problems with others using the SKB.

  It was also buggy, it only handled the case where skb->nh.raw was
  ahead of or equal to skb->data

- The fix is to record skb->nh.raw - skb->data and use this as
  a base offset in calls to skb_copy_and_csum_bits().  This is
  what the pre-IPSEC code did.

This fixes IPV6 oopses and packet corruption on 64-bit platforms
when sending UDP port unreachable ICMP messages.

Reported and analyzed by Jan Oravec (jan.oravec@6com.sk)

	signal handler.  Otherwise, a restarted system call that gets
	interrupted before the restart has taken effect by _another_
	signal will potentially restart the wrong system call.

Otherwise, a restarted system call that gets interrupted before
the restart has taken effect by _another_ signal will potentially
restart the wrong system call.

It would oops on any machines that had an ALI northbridge but
didn't have the exact ISA bridge we expected.

The problem with clock_nanosleep() restarting was that the address of
the users return timespec was being saved at the wrong place.  In needs
to be saved in the sys call interface code rather than the
do_clock_nanosleep().  My original tests were a bit weak as they only
did one signal rather than two or more which were required to break it. 

The attached patch fixes the problem.

I also added a few comments about how restart works, and added my name
to the MAINTAINERS list.

Without this patch, SN machines which have nodes that contain memory only (no
CPUs will hang.

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

The bug is probably impossible to trigger on x86, due to its
fairly strong coherency model (the SMP-safe bitops end up being
memory barriers etc), but other architectures - notably ppc64 -
can apparently trigger a race whereby the signal sender doesn't
wake up the target because it doesn't notice that it has gone to
sleep.

The optimization also optimizes only what appears to be the
uncommon case, where the signal happens for an already-running
process.

This makes the AIO submit path holds an extra reference until just
before returning.  This fixes the referencing a free kiocb. 

Without this patch the kernel will oops if the AIO completes early.

Noticed by Petr Vandrovec.

In the out-of-memory case, do_wp_page() would unlock page_table_lock
twice - once before allocating, and once in the exit path.

Rewrite the exit paths to be more readable, and don't try to share
the code between all the exit cases, since they are very different. 

- Delete fd_{enable,disable}_irq() interfaces, never used.
- Move ebus_dma_irq_enable() calls into sun_pci_fd_{request,free}_irq().

into home.osdl.org:/home/torvalds/v2.5/linux

Display of cpumask for /proc/irq/prof_cpu_mask has a botch in the print
loop - should consume 2 bytes per loop.

into home.osdl.org:/home/torvalds/v2.5/linux

Found by Russell King.

Since 2.6.x by default does not remap the disk partitions any more, it
would be a good idea to warn when we see EZD or DM signatures.  That
informs the user to fix his setup (or pass in "hdx=remap" on the kernel
command line).

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

* flush host FIFO after sending data to DIMM window
* don't set SCR addresses, as the hardware doesn't have SCRs
  (cosmetic)