Commit graph

33452 commits

Author SHA1 Message Date
David S. Miller
b8b99e857d [SERIAL] sunzilog: Mirror the sunsab serial setup bug fix.
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-23 15:53:39 -07:00
Marc Zyngier
0f4184f73d [SERIAL] sunsab: Fix E250 console with RSC.
This fixes yet another sunsab problem, when console is set to anything
but the first port. The console framework calls sunsab_console_setup
for each port, and we end up setting up a console on a not yet
discovered port, which leads to an Oops. Instead, defer console setup
until the requested port is properly initialized. Tested on an E250
through an RSC console.

Reported by Daniel Smolik <marvin@mydatex.cz>

Signed-off-by: Marc Zyngier <maz@misterjones.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-23 15:50:57 -07:00
David S. Miller
25848c4e50 [SCSI] esp: Fix build on SUN4.
Noted by Alexey Dobriyan.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-23 15:33:07 -07:00
Greg Kroah-Hartman
1bad998a27 Merge gregkh@master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2006-08-22 15:12:58 -07:00
David S. Miller
c46f477422 [SPARC64]: Fix pfn_pte() build failure.
The "%uhi" needs to be "%%uhi" because we want a real
"%" character in the assembler here, instead of an
assembler variable expansion.

Aparently older GCCs were more liberal and interpreted
this %-letter as a literal "%" for whatever reason.

Based upon a build failure report from Meelis Roos.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-22 14:35:40 -07:00
Michael Rash
3ffaa8c7c0 [TEXTSEARCH]: Fix Boyer Moore initialization bug
The pattern is set after trying to compute the prefix table, which tries
to use it. Initialize it before calling compute_prefix_tbl, make
compute_prefix_tbl consistently use only the data from struct ts_bm
and remove the now unnecessary arguments.

Signed-off-by: Michael Rash <mbr@cipherdyne.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-22 14:33:58 -07:00
Stephen Hemminger
316c1592be [TCP]: Limit window scaling if window is clamped.
This small change allows for easy per-route workarounds for broken hosts or
middleboxes that are not compliant with TCP standards for window scaling.
Rather than having to turn off window scaling globally. This patch allows
reducing or disabling window scaling if window clamp is present.

Example: Mark Lord reported a problem with 2.6.17 kernel being unable to
access http://www.everymac.com

# ip route add 216.145.246.23/32 via 10.8.0.1 window 65535

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-22 14:33:57 -07:00
Patrick McHardy
e0b7cde997 [NETFILTER]: arp_tables: fix table locking in arpt_do_table
table->private might change because of ruleset changes, don't use it
without holding the lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-22 14:33:56 -07:00
Oleg Nesterov
2d8f613160 elv_unregister: fix possible crash on module unload
An exiting task or process which didn't do I/O yet have no io context,
elv_unregister() should check it is not NULL.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Acked-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-08-22 12:52:23 -07:00
Jan Kara
00a2b0f6dd Fix possible UDF deadlock and memory corruption (CVE-2006-4145)
UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-08-22 12:52:23 -07:00
Sridhar Samudrala
c164a9ba0a Fix sctp privilege elevation (CVE-2006-3745)
sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-08-22 12:52:23 -07:00
Greg Kroah-Hartman
ac185bdc02 Merge gregkh@master.kernel.org:/home/rmk/linux-2.6-arm 2006-08-21 14:38:51 -07:00
Greg Kroah-Hartman
ae298c98e5 Merge branch 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block 2006-08-21 10:24:02 -07:00
Oleg Nesterov
be33c3a67b [PATCH] cfq_cic_link: fix usage of wrong cfq_io_context
Obviously, cfq_cic_link() shouldn't free a just allocated cfq_io_context?
The dead key is from __cic, so drop that.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jens Axboe <axboe@suse.de>
2006-08-21 10:02:54 +02:00
Oleg Nesterov
e014ff8d42 [PATCH] uninline ioprio_best()
Saves 376 bytes (5 callers) for me.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jens Axboe <axboe@suse.de>
2006-08-21 10:02:50 +02:00
Oleg Nesterov
9f83e45eb5 [PATCH] Fix current_io_context() vs set_task_ioprio() race
I know nothing about io scheduler, but I suspect set_task_ioprio() is not safe.

current_io_context() initializes "struct io_context", then sets ->io_context.
set_task_ioprio() running on another cpu may see the changes out of order, so
->set_ioprio(ioc) may use io_context which was not initialized properly.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jens Axboe <axboe@suse.de>
2006-08-21 08:34:15 +02:00
Oleg Nesterov
78bd4d484f [PATCH] sys_ioprio_set: minor do_each_thread+break fix
From include/linux/sched.h:

         * Careful: do_each_thread/while_each_thread is a double loop so
         *          'break' will not work as expected - use goto instead.
         */

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jens Axboe <axboe@suse.de>
2006-08-21 08:33:23 +02:00
Len Brown
da547d775f Merge trivial low-risk suspend hotkey bugzilla-5918 into release 2006-08-20 21:49:29 -04:00
Greg Kroah-Hartman
ef7d1b244f Merge gregkh@master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2006-08-18 11:02:52 -07:00
Starikovskiy, Alexey Y
df6fd31995 ACPI: relax BAD_MADT_ENTRY check to allow LSAPIC variable length string UIDs
ACPI 3.0 appended a variable length UID string to the LAPIC structure
as part of support for > 256 processors.  So the BAD_MADT_ENTRY() sanity
check can no longer compare for equality with a fixed structure length.

Signed-off-by: Alexey Y Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2006-08-18 12:56:50 -04:00
Nicolas Pitre
ba9b5d7637 [ARM] 3746/2: Userspace helpers must be Thumb mode interworkable
Patch from Nicolas Pitre

The userspace helpers in clean/arch/arm/kernel/entry-armv.S are called
directly in/from userspace. They need to cope with being called from
Thumb code.

Patch below uses the bx interworking instruction when
CONFIG_ARM_THUMB=y.

Based on an earlier patch from Paul Brook <paul@codesourcery.com>

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 17:20:15 +01:00
Greg Kroah-Hartman
ed0da6fc9d Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc 2006-08-18 09:20:04 -07:00
Catalin Marinas
90af774ab1 [ARM] 3757/1: Use PROCINFO_INITFUNC in head.S
Patch from Catalin Marinas

This is instead of a magic number.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 15:34:46 +01:00
Paul Gortmaker
3a834635e8 [ARM] 3756/1: Assign value for HWCAP_IWMMXT
Patch from Paul Gortmaker

Some folks here at Wind River asked me if I'd push this out
so that the value was generally agreed upon in advance by
all folks interested in working with iWMMXt.  Seems simple
enough...

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 15:32:17 +01:00
Kevin Hilman
e2785f0d42 [ARM] 3755/1: dmabounce: fix return value for find_safe_buffer
Patch from Kevin Hilman

Previous locking changes to dmabounce incorrectly return non-NULL even
when buffer not found.  Fix it up.

Signed-off-by: Kevin Hilman <khilman@mvista.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 15:32:14 +01:00
Ben Dooks
332158e7c2 [ARM] 3754/1: S3C24XX: tidy arch/arm/mach-s3c2410/Makefile
Patch from Ben Dooks

tidy up the makefile by using TABs to indent, and ensure
that all items are indented the same.

Move the DMA to its own section, ready for the next set
of updates

Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 15:32:12 +01:00
Ben Dooks
f57e1abd1b [ARM] 3753/1: S3C24XX: DMA fixes
Patch from Ben Dooks

A number of small issues with the S3C24XX DMA have
cropped up, which this patch fixes. These are:

  - check wether we can load another buff in start
  - update state handling in s3c2410_dma_lastxfer
  - only reload in irq if channel is not idle
  - more informative timeout errors (add source)
  - do not call request_irq() with irqs locked
  - added waitforstop function

The patch also adds a S3C2410_DMAOP_STARTED for
the occasions when the driver wants to ensure that
the DMA system load state is resynced after loading.

Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-08-18 15:32:10 +01:00
Herbert Xu
78eb887733 [BRIDGE]: Disable SG/GSO if TX checksum is off
When the bridge recomputes features, it does not maintain the
constraint that SG/GSO must be off if TX checksum is off.
This patch adds that constraint.

On a completely unrelated note, I've also added TSO6 and TSO_ECN
feature bits if GSO is enabled on the underlying device through
the new NETIF_F_GSO_SOFTWARE macro.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 18:22:32 -07:00
Patrick McHardy
8311731afc [NETFILTER]: ip_tables: fix table locking in ipt_do_table
table->private might change because of ruleset changes, don't use it without
holding the lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 18:13:53 -07:00
Patrick McHardy
d205dc4079 [NETFILTER]: ctnetlink: fix deadlock in table dumping
ip_conntrack_put must not be called while holding ip_conntrack_lock
since destroy_conntrack takes it again.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 18:12:38 -07:00
Jon Loeliger
9e8a9bc2d2 [POWERPC] Fix the mpc8641_hpcn.dts file.
Add 'linux,phandle' entry to i8259@4d0 node.

Signed-off-by: Zhang Wei <wei.zhang@freescale.com>
Signed-off-by: Jon Loeliger <jdl@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-18 10:08:37 +10:00
Jon Loeliger
5315862045 [POWERPC] Offer PCI as a CONFIG choice for PPC_86xx.
Also fix 80-column run-over.

Signed-off-by: Jon Loeliger <jdl@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-18 10:08:36 +10:00
Jon Loeliger
707ba16f0f [POWERPC] Add MPC8641 HPCN Device Tree Source file.
As per list discussion, let's add device tree source files
under powerpc/boot/dts.  If nothing else, it is a starting point.

Signed-off-by: Jon Loeliger <jdl@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-18 10:02:45 +10:00
Jon Loeliger
f583165f6a [POWERPC] Convert to mac-address for ethernet MAC address data.
Also accept "local-mac-address".  However the old "address"
is now obsolete, but accepted for backwards compatibility.
It should be removed after all device trees have been
converted to use "mac-address".

Signed-off-by: Jon Loeliger <jdl@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-18 09:50:16 +10:00
Alexey Kuznetsov
6e8fcbf640 [IPV4]: severe locking bug in fib_semantics.c
Found in 2.4 by Yixin Pan <yxpan@hotmail.com>.

> When I read fib_semantics.c of Linux-2.4.32, write_lock(&fib_info_lock) =
> is used in fib_release_info() instead of write_lock_bh(&fib_info_lock).  =
> Is the following case possible: a BH interrupts fib_release_info() while =
> holding the write lock, and calls ip_check_fib_default() which calls =
> read_lock(&fib_info_lock), and spin forever.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:44:46 -07:00
David L Stevens
acd6e00b8e [MCAST]: Fix filter leak on device removal.
This fixes source filter leakage when a device is removed and a
process leaves the group thereafter.

This also includes corresponding fixes for IPv6 multicast source
filters on device removal.

Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:57 -07:00
David S. Miller
c7fa9d189e [NET]: Disallow whitespace in network device names.
It causes way too much trouble and confusion in userspace.

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:56 -07:00
Panagiotis Issaris
d4274b51a5 [PPP]: handle kmalloc failures and convert to using kzalloc
The PPP code contains two kmalloc()s followed by memset()s without
handling a possible memory allocation failure.  (Suggested by Joe
Perches).

And furthermore, conversions from kmalloc+memset to kzalloc.

[akpm@osdl.org: fix error-path leak]
[akpm@osdl.org: cleanups]
[paulus@samba.org: don't add useless printk and cardmap_destroy calls]

Signed-off-by: Panagiotis Issaris <takis@issaris.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:55 -07:00
Ralf Hildebrandt
c0956bd251 [PKT_SCHED] cls_u32: Fix typo.
Signed-off-by: Ralf Hildebrandt <Ralf.Hildebrandt@charite.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:54 -07:00
Kevin Hilman
b9c6e3e966 [ATM]: Compile error on ARM
atm_proc_exit() is declared as __exit, and thus in .exit.text.  On
some architectures (ARM) .exit.text is discarded at compile time, and
since atm_proc_exit() is called by some other __init functions, it
results in a link error.

Signed-off-by: Kevin Hilman <khilman@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:53 -07:00
Michael Chan
932f3772cf [BNX2]: Convert to netdev_alloc_skb()
Convert dev_alloc_skb() to netdev_alloc_skb() and increase default
rx ring size to 255. The old ring size of 100 was too small.

Update version to 1.4.44.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:52 -07:00
Michael Chan
2f8af120a1 [BNX2]: Fix tx race condition.
Fix a subtle race condition between bnx2_start_xmit() and bnx2_tx_int()
similar to the one in tg3 discovered by Herbert Xu:

CPU0					CPU1
bnx2_start_xmit()
	if (tx_ring_full) {
		tx_lock
					bnx2_tx()
						if (!netif_queue_stopped)
		netif_stop_queue()
		if (!tx_ring_full)
						update_tx_ring
			netif_wake_queue()
		tx_unlock
	}

Even though tx_ring is updated before the if statement in bnx2_tx_int() in
program order, it can be re-ordered by the CPU as shown above.  This
scenario can cause the tx queue to be stopped forever if bnx2_tx_int() has
just freed up the entire tx_ring.  The possibility of this happening
should be very rare though.

The following changes are made, very much identical to the tg3 fix:

1. Add memory barrier to fix the above race condition.

2. Eliminate the private tx_lock altogether and rely solely on
netif_tx_lock.  This eliminates one spinlock in bnx2_start_xmit()
when the ring is full.

3. Because of 2, use netif_tx_lock in bnx2_tx_int() before calling
netif_wake_queue().

4. Add memory barrier to bnx2_tx_avail().

5. Add bp->tx_wake_thresh which is set to half the tx ring size.

6. Check for the full wake queue condition before getting
netif_tx_lock in tg3_tx().  This reduces the number of unnecessary
spinlocks when the tx ring is full in a steady-state condition.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:51 -07:00
Jan "Yenya" Kasprzak
fb33f82568 [NET]: Terminology in ip-sysctl.txt
this minor patch fixes the description of net.ipv4.tcp_mem sysctl
in ip-sysctl.txt - the headline names the values "min, pressure, max",
while the description uses the "low, pressure, high" values.
Both tcp_rmem and tcp_wmem descriptions use the "min, pressure, max"
values, so I have changed the tcp_mem to match this and not vice versa.

Signed-off-by: Jan "Yenya" Kasprzak <kas@fi.muni.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:50 -07:00
Michal Ruzicka
bb699cbca0 [IPV4]: Possible leak of multicast source filter sctructure
There is a leak of a socket's multicast source filter list structure
on closing a socket with a multicast source filter set on an interface
that does not exist any more.

Signed-off-by: Michal Ruzicka <michal.ruzicka@comstar.cz>
Acked-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:49 -07:00
Ingo Molnar
640c41c77a [IPV6] lockdep: annotate __icmpv6_socket
Split off __icmpv6_socket's sk->sk_dst_lock class, because it gets
used from softirqs, which is safe for __icmpv6_sockets (because they
never get directly used via userspace syscalls), but unsafe for normal
sockets.

Has no effect on non-lockdep kernels.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:48 -07:00
Andrew Morton
deb47c66e1 [NETFILTER]: xt_physdev build fix
It needs netfilter_bridge.h for brnf_deferred_hooks

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:47 -07:00
Suresh Siddha
8557511250 [NET]: Fix potential stack overflow in net/core/utils.c
On High end systems (1024 or so cpus) this can potentially cause stack
overflow.  Fix the stack usage.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:47 -07:00
David S. Miller
7ea49ed73c [VLAN]: Make sure bonding packet drop checks get done in hwaccel RX path.
Since __vlan_hwaccel_rx() is essentially bypassing the
netif_receive_skb() call that would have occurred if we did the VLAN
decapsulation in software, we are missing the skb_bond() call and the
assosciated checks it does.

Export those checks via an inline function, skb_bond_should_drop(),
and use this in __vlan_hwaccel_rx().

Signed-off-by: David S. Miller <davem@davemloft.net>
2006-08-17 16:29:46 -07:00
Olof Johansson
9a936a2e05 [POWERPC] powerpc: Clear HID0 attention enable on PPC970 at boot time
Clear HID0[en_attn] at CPU init time on PPC970.  Closes CVE-2006-4093.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-18 07:23:29 +10:00
Benjamin Herrenschmidt
e5c14ce118 [POWERPC] Fix irq radix tree remapping typo
The code for using the radix tree for reverse mapping of interrupts has
a typo that causes it to create incorrect mappings if the software and
hardware numbers happen to be different. This would, among others, cause
the IDE interrupt to fail on js20's. This fixes it.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2006-08-17 16:41:11 +10:00