IPoIB: Fix use-after-free in path_rec_completion()
The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free. Fix this by changing to the _safe
variant of the list walking macro.
This was spotted by the Coverity checker (CID 1567).
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Sean Hefty [Mon, 19 Mar 2007 22:31:36 +0000 (14:31 -0800)]
IPoIB: Fix race in detaching from mcast group before attaching
There's a race between ipoib_mcast_leave() and ipoib_mcast_join_finish()
where we can try to detach from a multicast group before we've
attached to it. Fix this by reordering the code in ipoib_mcast_leave
to free the multicast group first, which waits for the multicast
callback thread (which calls ipoib_mcast_join_finish()) to complete
before detaching from the group.
Signed-off-by: Sean Hefty <sean.hefty@intel.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
The sense of the time_after_eq() test in ipoib_cm_stale_task() is
reversed so that only non-stale connections are reaped. Fix this by
changing to time_before_eq().
Noticed by Pradeep Satyanarayana <pradeep@us.ibm.com>.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Linus Torvalds [Thu, 22 Mar 2007 02:45:50 +0000 (19:45 -0700)]
Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
[IA64] Fix wrong /proc/iomem on SGI Altix
[IA64] Altix: ioremap vga_console_iobase
[IA64] Fix typo/thinko in crash.c
[IA64] Fix get_model_name() for mixed cpu type systems
[IA64] min_low_pfn and max_low_pfn calculation fix
* master.kernel.org:/pub/scm/linux/kernel/git/herbert/crypto-2.6:
[CRYPTO] tcrypt: Fix error checking for comp allocation
[CRYPTO] doc: Fix typo in hash example
[CRYPTO] api: scatterwalk_copychunks() fails to advance through scatterlist
which is a no-op in this case, so we don't advance to the next element
of the scatterlist array:
if (walk->offset >= walk->sg->offset + walk->sg->length)
scatterwalk_start(walk, sg_next(walk->sg));
and we end up copying the same data twice.
It appears that other callers of scatterwalk_{page}done first advance
walk->offset, so I believe that's the correct thing to do here.
This caused a bug in NFS when run with krb5p security, which would
cause some writes to fail with permissions errors--for example, writes
of less than 8 bytes (the des blocksize) at the start of a file.
Bernhard Walle [Wed, 14 Mar 2007 18:07:47 +0000 (19:07 +0100)]
[IA64] Fix wrong /proc/iomem on SGI Altix
In sn_io_slot_fixup(), the parent is re-set from the bus to
io(port|mem)_resource because the address is changed in a way that it's not
child of the bus any more.
However, only the root is set but not the parent/child/sibling relationship in
the resource tree which causes 'cat /proc/iomem' to stop after this memory
area. Depding on the poition in the tree the iomem may be nearly completely
empty.
Signed-off-by: Bernhard Walle <bwalle@suse.de> Acked-by: John Keller <jpk@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
John Keller [Tue, 20 Mar 2007 18:50:10 +0000 (13:50 -0500)]
[IA64] Altix: ioremap vga_console_iobase
When booting an SN system without specifing a console
(i.e., no "console=" on boot line), the system will hang during
boot at the point where /sbin/init is run.
The problem is that vga_console_iobase is not converted to a
virtual address before storing in io_space[0].mmio_base.
The conversion was happening in sn_scan_pcdp(), but not in
setup_vga_console().
Signed-off-by: John Keller <jpk@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
Jack Steiner [Mon, 12 Mar 2007 13:07:49 +0000 (08:07 -0500)]
[IA64] Fix get_model_name() for mixed cpu type systems
If a system consists of mixed processor types, kmalloc()
can be called before the per-cpu data page is initialized.
If the slab contains sufficient memory, then kmalloc() works
ok. However, if the slabs are empty, slab calls the memory
allocator. This requires per-cpu data (NODE_DATA()) & the
cpu dies.
Also noted by Russ Anderson who had a very similar patch.
Signed-off-by: Jack Steiner <steiner@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
Zou Nan hai [Tue, 20 Mar 2007 20:41:57 +0000 (13:41 -0700)]
[IA64] min_low_pfn and max_low_pfn calculation fix
We have seen bad_pte_print when testing crashdump on an SN machine in
recent 2.6.20 kernel. There are tons of bad pte print (pfn < max_low_pfn)
reports when the crash kernel boots up, all those reported bad pages
are inside initmem range; That is because if the crash kernel code and
data happens to be at the beginning of the 1st node. build_node_maps in
discontig.c will bypass reserved regions with filter_rsvd_memory. Since
min_low_pfn is calculated in build_node_map, so in this case, min_low_pfn
will be greater than kernel code and data.
Because pages inside initmem are freed and reused later, we saw
pfn_valid check fail on those pages.
I think this theoretically happen on a normal kernel. When I check
min_low_pfn and max_low_pfn calculation in contig.c and discontig.c.
I found more issues than this.
1. min_low_pfn and max_low_pfn calculation is inconsistent between
contig.c and discontig.c,
min_low_pfn is calculated as the first page number of boot memmap in
contig.c (Why? Though this may work at the most of the time, I don't
think it is the right logic). It is calculated as the lowest physical
memory page number bypass reserved regions in discontig.c.
max_low_pfn is calculated include reserved regions in contig.c. It is
calculated exclude reserved regions in discontig.c.
2. If kernel code and data region is happen to be at the begin or the
end of physical memory, when min_low_pfn and max_low_pfn calculation is
bypassed kernel code and data, pages in initmem will report bad.
3. initrd is also in reserved regions, if it is at the begin or at the
end of physical memory, kernel will refuse to reuse the memory. Because
the virt_addr_valid check in free_initrd_mem.
So it is better to fix and clean up those issues.
Calculate min_low_pfn and max_low_pfn in a consistent way.
Signed-off-by: Zou Nan hai <nanhai.zou@intel.com> Acked-by: Jay Lan <jlan@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: new Novatel device ids for option driver
USB: berry_charge: correct dbg string for second magic command
usblp: quirk flag and device entry for Seiko Epson M129C printer
airprime: USB ID for Novatel EV620 mini PCI-E card
USB: necessary update for mos7720 driver
USB: RAZR v3i unusual_devs
USB: two more device ids for dm9601 usbnet driver
USB: fix usb-serial regression
Linus Torvalds [Tue, 20 Mar 2007 03:13:56 +0000 (20:13 -0700)]
Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
[MIPS] Export except_vec_vi_{mori,lui,ori} as text symbols.
[MIPS] mips-boards: More liberal check for mips-board console
[MIPS] Misc fixes for plat_irq_dispatch functions
[MIPS] Qemu: Fix Symmetric Uniprocessor support.
[MIPS] VI: TRACE_IRQS_OFF clobbers $v0, so save & restore around call.
Linus Torvalds [Tue, 20 Mar 2007 03:04:26 +0000 (20:04 -0700)]
Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
[S390] zcrypt: fix possible race when unloading zcrypt driver modules
[S390] zcrypt: fix possible dead lock in AP bus module
[S390] Wire up sys_utimes.
[S390] reboot from and dump to SCSI under z/VM fails.
[S390] Wire up compat_sys_epoll_pwait.
[S390] strlcpy is smart enough
[S390] memory detection: fix off by one bug.
[S390] cio: qdio slsb setup
Thiemo Seufer [Mon, 19 Mar 2007 00:13:37 +0000 (00:13 +0000)]
[MIPS] Misc fixes for plat_irq_dispatch functions
o adds missing ST0_IM masks, which caused the logging of valid interrupts
as spurious
o stops pnx8550 to log every interrupt as spurious
o adds cause register masks for ip22/ip32, which caused handling of masked
interrupts
o removes some superfluous parentheses in the SNI interrupt code
Atsushi Nemoto [Sat, 17 Mar 2007 16:01:39 +0000 (01:01 +0900)]
[MIPS] Qemu: Fix Symmetric Uniprocessor support.
Might be useful for SMP debugging.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
[Rewritten Kconfig bits to deal better fit in the usual pattern of doing
things - Ralf]
Ken L Johnson [Fri, 16 Mar 2007 16:17:31 +0000 (10:17 -0600)]
USB: berry_charge: correct dbg string for second magic command
I was testing the berry_charge module with my Blackberry 8700c and had
great success, thanks. Looking at the code for my own learning I noticed
the following cut and paste error... just a nit.
Signed-off-by: Ken L Johnson <ken@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Alan Stern [Fri, 16 Mar 2007 19:53:07 +0000 (15:53 -0400)]
usblp: quirk flag and device entry for Seiko Epson M129C printer
This patch (as872) adds a device table entry and a new quirk flag to
the usblp driver for the Seiko Epson Receipt printer. This printer
returns Vendor-Specific values for bInterfaceClass and
bInterfaceSubClass, but the bInterfaceProtocol value is valid and it
works with usblp. The new quirks flag tells the driver to ignore the
Class and SubClass values in the interface descriptor.
Mark Glines [Wed, 14 Mar 2007 18:55:28 +0000 (11:55 -0700)]
airprime: USB ID for Novatel EV620 mini PCI-E card
Add an ID to recognise the Novatel EV620 wireless adapter.
http://www.novatelwireless.com/products/expedite/ev620.html
It looks like a mini PCI-Express adapter. The mPCIE connector includes USB
pins... the card shows up to the system as a USB device, and powers itself
from the PCI bus.
The card I have isn't activated yet, so I can't get a PPP session up yet, but
I have tested basic serial communication successfully in both 2.6.18 and
2.6.20 kernels, once the product ID was added. (the driver changed quite a
bit between the two revs.) In both drivers, it responds to AT commands and
such.
Signed-off-by: Mark Glines <mark@glines.org> Cc: Pete Zaitcev <zaitcev@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Oliver Neukum [Wed, 14 Mar 2007 10:11:08 +0000 (11:11 +0100)]
USB: necessary update for mos7720 driver
these devices have a shared interrupt endpoint. For serialcore to pass
an interrupt endpoint to a subdriver, the subdriver must define and
_export_ a fitting callback. The mos7720 driver failed to do so. This led
invariably to an oops upon open. This patch fixes it. The driver is useless
without it. Please try to get this into 2.6.21 and the stable kernels that
have this driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Tejun Heo [Sat, 17 Mar 2007 19:55:23 +0000 (04:55 +0900)]
pata_ixp4xx_cf: fix oops on detach
pata_ixp4xx_cf dodged dont-clear-drvdata-in-LLD bombing run as it used
platform_set_drvdata() instead of dev_set_drvdata(). This causes OOPS
on devres host release. Kill it.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Mon, 12 Mar 2007 08:24:08 +0000 (17:24 +0900)]
libata: don't whine if ->prereset() returns -ENOENT
->prereset() returns -ENOENT to tell libata that the port is empty and
reset sequencing should be stopped. This is not an error condition.
Update ata_eh_reset() such that it sets device classes to ATA_DEV_NONE
and return success in on -ENOENT. This makes spurious error message
go away.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Ralph Wuerthner [Mon, 19 Mar 2007 12:19:14 +0000 (13:19 +0100)]
[S390] zcrypt: fix possible dead lock in AP bus module
AP bus module uses bus_for_each_dev() in software interrupt context to
poll for completed requests which might cause dead locks. Solution: use
private AP device list for polling in software interrupt context.
Signed-off-by: Ralph Wuerthner <rwuerthn@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Michael Holzheu [Mon, 19 Mar 2007 12:19:03 +0000 (13:19 +0100)]
[S390] reboot from and dump to SCSI under z/VM fails.
We used wrong length values for ipl and dump hardware structures.
Since z/VM checks the ipl parameters more accurately than LPAR,
the operations fail there.
Signed-off-by: Michael Holzheu <holzheu@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Jean Delvare [Mon, 19 Mar 2007 12:18:53 +0000 (13:18 +0100)]
[S390] strlcpy is smart enough
strlcpy already accounts for the trailing zero in its length
computation, so there is no need to substract one to the buffer size.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Heiko Carstens [Mon, 19 Mar 2007 12:18:50 +0000 (13:18 +0100)]
[S390] memory detection: fix off by one bug.
diag 260 returns the address of the last addressable byte and not the
size of memory. Since we want the size we have to add 1 to the return
value.
Disable diag 260 for non z/Arch mode since it doesn't work there
anyway.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
These leaks were reported by: Catalin Marinas <catalin.marians@gmail.com>
and I have been able to very by inspection they are possible.
When converting tty_io.c to store pids as struct pid pointers instead
of pid_t values it appears I overlooked two places where we stop using
the pid value. The very obvious one is in do_tty_hangup, and the one
the less obvious one in __proc_set_tty.
When looking into the code __proc_set_tty only has pids that need to
be put because of failures of other parts of the code to properly
perform hangup processing. Fixing the leak here in __proc_set_tty
is easy and obviously correct so I am doing that first.
Fixing the places that should be performing hangup processing is much
less obviously correct. So those I'm aiming those patches at -mm.
for now, so the can age a while before they are merged.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Build fix: sa1100/generic.c should already have included <asm/gpio.h>,
but it didn't ... causing a build problem with a recent patch.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Thomas Gleixner [Sun, 18 Mar 2007 09:26:13 +0000 (01:26 -0800)]
[PATCH] i386: trust the PM-Timer calibration of the local APIC timer
When PM-Timer is available for local APIC timer calibration we can skip the
verification of the calibrated time value. The resulting error is quite
small on a bunch of evaluated platforms and is less harming than the
observed false positives.
We need to keep the verification on systems, which have no PM-Timer to
avoid bogus local APIC timer calibrations in the range of factor 2-10,
which can be observed when swicthing off the PM-timer support in the kernel
configuration.
The wrong calibration values are probably caused by SMM code trying to
emulate a PS/2 keyboard from a (maybe connected or not) USB keyboard. This
prohibits the accurate delivery of PIT interrupts, which are used to
calibrate the local APIC timer. Unfortunately we have no way to disable
this BIOS misfeature in the early boot process.
Add also the dropped cpu_relax() back to the wait loops.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Ingo Molnar <mingo@elte.hu> Acked-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PATCH] Fix atomicity of TIF update in flush_thread() for x86_64
Fix atomicity of TIF update in flush_thread() for x86_64
Race :
parent process executing :
sys_ptrace()
(lock_kernel())
(ptrace_get_task_struct(pid))
arch_ptrace()
ptrace_detach()
ptrace_disable(child);
clear_singlestep(child);
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
(which clears the TIF_SINGLESTEP flag atomically from a different
process)
(put_task_struct(child))
(unlock_kernel())
And at the same time, in the child process :
sys_execve()
do_execve()
search_binary_handler()
load_elf_binary()
flush_old_exec()
flush_thread()
doing a non-atomic thread flag update
Andrew Morton [Sun, 18 Mar 2007 09:26:10 +0000 (01:26 -0800)]
[PATCH] machzwd warning fix
drivers/char/watchdog/machzwd.c: In function 'zf_ioctl':
drivers/char/watchdog/machzwd.c:327: warning: passing argument 1 of 'zf_ping' makes integer from pointer without a cast
Also some coding-style repairs.
Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Al Viro <viro@ftp.linux.org.uk> Acked-by: Wim Van Sebroeck <wim@iguana.be> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
John Keller [Sun, 18 Mar 2007 09:26:09 +0000 (01:26 -0800)]
[PATCH] ia64: platform_kernel_launch_event is noop on generic kernel
Add a missing #define for the platform_kernel_launch_event. Without this
fix, a call to platform_kernel_launch_event() becomes a noop on generic
kernels. SN systems require this fix to successfully kdump/kexec from
certain hardware errors.
[bwalle@suse.de: fix it] Signed-off-by: John Keller <jpk@sgi.com> Cc: Bernhard Walle <bwalle@suse.de> Acked-by: Simon Horman <horms@verge.net.au> Acked-by: Jay Lan <jlan@sgi.com> Acked-by: "Luck, Tony" <tony.luck@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bernhard Walle [Sun, 18 Mar 2007 09:26:08 +0000 (01:26 -0800)]
[PATCH] Fix wrong /proc/iomem on SGI Altix
In sn_io_slot_fixup(), the parent is re-set from the bus to
io(port|mem)_resource because the address is changed in a way that it's not
child of the bus any more.
However, only the root is set but not the parent/child/sibling relationship
in the resource tree which causes 'cat /proc/iomem' to stop after this
memory area. Depding on the poition in the tree the iomem may be nearly
completely empty.
Signed-off-by: Bernhard Walle <bwalle@suse.de> Cc: John Keller <jpk@sgi.com> Cc: Jay Lan <jlan@engr.sgi.com> Acked-by: "Luck, Tony" <tony.luck@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_verify':p4-clockmod.c:(.text.cpufreq_p4_verify+0x8): undefined reference to `cpufreq_frequency_table_verify'
arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_cpu_exit':p4-clockmod.c:(.text.cpufreq_p4_cpu_exit+0x8): undefined reference to `cpufreq_frequency_table_put_attr'
arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_cpu_init':p4-clockmod.c:(.text.cpufreq_p4_cpu_init+0x13b): undefined reference to `cpufreq_frequency_table_get_attr'
Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: Dave Jones <davej@redhat.com> Cc: David Rientjes <rientjes@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sun, 18 Mar 2007 17:50:44 +0000 (10:50 -0700)]
Merge branch 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa
* 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa:
[ALSA] hda-intel - Fix HDA buffer alignment
[ALSA] hda-codec - Add model for HP Compaq d5750
[ALSA] hda-codec - Add support for MacBook Pro 1st generation
[ALSA] version 1.0.14rc3
[ALSA] hda-codec - Add model for HP Compaq d5700
[ALSA] intel8x0 - Fix Oops at kdump crash kernel
[ALSA] hda-codec - Fix speaker output on MacPro
[ALSA] hda-codec - more systems for Analog Devices
[ALSA] hda-intel - Fix codec probe with ATI contorllers
[ALSA] hda-codec - Add suppoprt for Asus M2N-SLI motherboard
[ALSA] intel8x0 - Fix speaker output after S2RAM
[ALSA] ac97 - fix AD shared shared jack control logic
[ALSA] soc - Fix dependencies in Kconfig files
Avi Kivity [Fri, 9 Mar 2007 11:04:31 +0000 (13:04 +0200)]
KVM: MMU: Fix host memory corruption on i386 with >= 4GB ram
PAGE_MASK is an unsigned long, so using it to mask physical addresses on
i386 (which are 64-bit wide) leads to truncation. This can result in
page->private of unrelated memory pages being modified, with disasterous
results.
Fix by not using PAGE_MASK for physical addresses; instead calculate
the correct value directly from PAGE_SIZE. Also fix a similar BUG_ON().
Acked-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Avi Kivity <avi@qumranet.com>
Avi Kivity [Thu, 8 Mar 2007 15:13:32 +0000 (17:13 +0200)]
KVM: MMU: Fix guest writes to nonpae pde
KVM shadow page tables are always in pae mode, regardless of the guest
setting. This means that a guest pde (mapping 4MB of memory) is mapped
to two shadow pdes (mapping 2MB each).
When the guest writes to a pte or pde, we intercept the write and emulate it.
We also remove any shadowed mappings corresponding to the write. Since the
mmu did not account for the doubling in the number of pdes, it removed the
wrong entry, resulting in a mismatch between shadow page tables and guest
page tables, followed shortly by guest memory corruption.
This patch fixes the problem by detecting the special case of writing to
a non-pae pde and adjusting the address and number of shadow pdes zapped
accordingly.
Acked-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Avi Kivity <avi@qumranet.com>
Avi Kivity [Tue, 6 Mar 2007 10:05:53 +0000 (12:05 +0200)]
KVM: Fix guest sysenter on vmx
The vmx code currently treats the guest's sysenter support msrs as 32-bit
values, which breaks 32-bit compat mode userspace on 64-bit guests. Fix by
using the native word width of the machine.
* master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6:
ide: remove CONFIG_IDEDMA_{ICS,PCI}_AUTO config options
ide: don't allow DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n
scc_pata: dependency fix
jmicron: make ide jmicron driver play nice with libata ones
ide: remove static prototypes from include/asm-mips/mach-au1x00/au1xxx_ide.h
ide: au1xxx: fix use of mixed declarations and code
cmd64x: fix recovery time calculation (take 3)
All modern distributions have been setting these options to "y" for ages.
(additionally "n" cases have been obsoleted for few years). Therefore use
DMA by default and remove CONFIG_IDEDMA_{ICS,PCI}_AUTO (also remove no longer
needed CONFIG_IDEDMA_AUTO). This fixes DMA support for rare configurations
where CONFIG_IDEDMA_{ICS,PCI}_AUTO was set to "n" but "hdparm -d 1" was used
to enable DMA support and which were forced to PIO mode by "ide: don't allow
DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n" patch. There is no
functionality loss because "ide=nodma" kernel option is still available.
Cc: Patrick Horn <phrh@yahoo.com> Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com> Cc: Russell King <rmk+lkml@arm.linux.org.uk> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
ide: don't allow DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n
For CONFIG_IDEDMA_{ICS,PCI}_AUTO=n and/or "ide=nodma" option the host/device
are not programmed for DMA and it is also explicitly disabled by ide_set_dma()
(->ide_dma_check returns "-1"). However the code responsible for manually
enabling DMA ("hdparm -d 1") has a bug which results in DMA being erroneously
enabled - ide_set_dma() incorrectly passes "0" return value to set_using_dma().
This may work if BIOS/firmware configured the host/device for DMA and chipset
allows independent configuration of DMA/PIO modes but won't work after suspend
and is generally unsafe on many chipsets (possibly including data corruption
if the same registers are used for DMA/PIO timings).
This patch fixes kernel bugzilla bug #8169 (piix host driver fixes for
setting PIO mode exposed the problem described above). The side-effect of
the fix is that some rare configuration may be forced to PIO mode when DMA
mode was previously used - this is addressed by the next patch which removes
CONFIG_IDEDMA_{PCI,ICS}_AUTO config option completely.
Thanks goes out to Patrick Horn for reporting the issue, narrowing it down
to the specific commit and testing the fix. Also thanks to Sergei Shtylyov
for help in debugging the problem.
Cc: Patrick Horn <phrh@yahoo.com> Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com> Cc: Russell King <rmk+lkml@arm.linux.org.uk> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Tejun Heo [Sat, 17 Mar 2007 20:57:25 +0000 (21:57 +0100)]
jmicron: make ide jmicron driver play nice with libata ones
When libata is configured, the device is configured such that SATA and
PATA ports live in separate functions with different programming
interfaces. pata_jmicron and ide jmicron drivers can drive only the
PATA part.
This patch makes jmicron match PCI class code such that it doesn't
attach itself to the SATA part preventing the proper ahci driver from
attaching.
Daniel Mack [Sat, 17 Mar 2007 20:57:24 +0000 (21:57 +0100)]
ide: remove static prototypes from include/asm-mips/mach-au1x00/au1xxx_ide.h
This patch removes the static prototypes from the au1xxx_ide.h, some of
them were not even implemented. Also, they caused build breakage since
they differed from the functions actually implemented in
drivers/ide/mips/au1xxx-ide.c.
Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Sergei Shtylyov [Sat, 17 Mar 2007 20:57:24 +0000 (21:57 +0100)]
cmd64x: fix recovery time calculation (take 3)
The driver wrongly takes the address setup time into account when calculating
the PIO recovery time -- this leads to slight overclocking of the PIO modes 0
and 1 (so, the prayers failed to help, as usual :-). Rework the code to be
calculating recovery clock count as a difference between the total cycle count
and the active count (we don't need to calculate the recovery time itself since
it's not specified for the PIO modes 0 to 2, and for modes 3 and 4 this formula
gives enough recovery time anyway in the chip's supported PCI frequency range).
This patch has been inspired by reading the datasheets and looking at what the
libata driver does; it has been compile-tested only (as usual :-) but anyway,
the new code gives the same or longer recovery times than the old one...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Thomas Gleixner [Fri, 16 Mar 2007 23:25:52 +0000 (00:25 +0100)]
[PATCH] clockevents: Fix suspend/resume to disk hangs
I finally found a dual core box, which survives suspend/resume without
crashing in the middle of nowhere. Sigh, I never figured out from the
code and the bug reports what's going on.
The observed hangs are caused by a stale state transition of the clock
event devices, which keeps the RCU synchronization away from completion,
when the non boot CPU is brought back up.
The suspend/resume in oneshot mode needs the similar care as the
periodic mode during suspend to RAM. My assumption that the state
transitions during the different shutdown/bringups of s2disk would go
through the periodic boot phase and then switch over to highres resp.
nohz mode were simply wrong.
Add the appropriate suspend / resume handling for the non periodic
modes.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[IPV6]: ipv6_fl_socklist is inadvertently shared.
[TCP]: Fix tcp_mem[] initialization.
[NET]: Copy mac_len in skb_clone() as well
[IPV4]: Do not disable preemption in trie_leaf_remove().
The set_cs field of struct s3c24xx_spi is declared as returning a int but
the value returned but set_cs is never fixed. Moreover, the default
function for set_cs and the set_cs defintion in the platform data are
returning void.
I'm proposing to change the prototype to void (*set_cs)(...). By doing
this, I'm also fixing 2 build warnings:
drivers/spi/spi_s3c24xx.c: In function 's3c24xx_spi_probe':
drivers/spi/spi_s3c24xx.c:330: warning: assignment from incompatible pointer type
drivers/spi/spi_s3c24xx.c:335: warning: assignment from incompatible pointer type
Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
James Bottomley [Fri, 16 Mar 2007 21:38:35 +0000 (13:38 -0800)]
[PATCH] fix process crash caused by randomisation and 64k pages
This bug was seen on ppc64, but it could have occurred on any
architecture with a page size of 64k or above. The problem is that in
fs/binfmt_elf.c:randomize_stack_top() randomizes the stack to within
0x7ff pages. On 4k page machines, this is 8MB; on 64k page boxes, this
is 128MB.
The problem is that the new binary layout (selected in
arch_pick_mmap_layout) places the mapping segment 128MB or the stack
rlimit away from the top of the process memory, whichever is larger. If
you chose an rlimit of less than 128MB (most defaults are in the 8Mb
range) then you can end up having your entire stack randomized away.
The fix is to make randomize_stack_top() only steal at most 8MB, which this
patch does. However, I have to point out that even with this, your stack
rlimit might not be exactly what you get if it's > 128MB, because you're
still losing the random offset of up to 8MB.
The true fix should be to leave an explicit gap for the randomization plus
a buffer when determining mmap_base, but that would involve fixing all the
architectures.
Cc: Arjan van de Ven <arjan@infradead.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ankita Garg [Fri, 16 Mar 2007 21:38:33 +0000 (13:38 -0800)]
[PATCH] oom fix: prevent oom from killing a process with children/sibling unkillable
Looking at oom_kill.c, found that the intention to not kill the selected
process if any of its children/siblings has OOM_DISABLE set, is not being
met.
Signed-off-by: Ankita Garg <ankita@in.ibm.com> Acked-by: Nick Piggin <npiggin@suse.de> Acked-by: William Irwin <wli@holomorphy.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Johannes Berg [Fri, 16 Mar 2007 21:38:32 +0000 (13:38 -0800)]
[PATCH] change misleading EFI partition support description
Remove the misleading "Presently only useful on the IA-64 platform" text
from the EFI partition Kconfig.
EFI partitions are also used by Apple on their Intel-based machines and
thus you need EFI partition support if you (for example) want to attach
such a machine in target disk mode.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Acked-by: Matt Domsch <Matt_Domsch@dell.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bernhard Walle [Fri, 16 Mar 2007 21:38:30 +0000 (13:38 -0800)]
[PATCH] Initialise SAK member for each virtual console to prevent oops
Initialise the SAK member of the vc_cons variable on all virtual terminals,
not only the first one. This prevents an oops when trying Sysrq-C on e.g.
the second virtual terminal:
Trond Myklebust [Fri, 16 Mar 2007 21:38:28 +0000 (13:38 -0800)]
[PATCH] nfs: nfs_getattr() can't call nfs_sync_mapping_range() for non-regular files
Looks like we need a check in nfs_getattr() for a regular file. It makes
no sense to call nfs_sync_mapping_range() on anything else. I think that
should fix your problem: it will stop the NFS client from interfering
with dirty pages on that inode's mapping.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Acked-by: Olof Johansson <olof@lixom.net> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Peter Zijlstra [Fri, 16 Mar 2007 21:38:26 +0000 (13:38 -0800)]
[PATCH] nfs: fix congestion control
The current NFS client congestion logic is severly broken, it marks the
backing device congested during each nfs_writepages() call but doesn't
mirror this in nfs_writepage() which makes for deadlocks. Also it
implements its own waitqueue.
Replace this by a more regular congestion implementation that puts a cap on
the number of active writeback pages and uses the bdi congestion waitqueue.
Also always use an interruptible wait since it makes sense to be able to
SIGKILL the process even for mounts without 'intr'.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Trond Myklebust <trond.myklebust@fys.uio.no> Cc: Christoph Lameter <clameter@engr.sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
suzuki [Fri, 16 Mar 2007 21:38:25 +0000 (13:38 -0800)]
[PATCH] fix rescan_partitions to return errors properly
The only error code which comes from the partition checkers is -1, when
they finds an EIO. As per the discussion, ENOMEM values were ignored,
as they might scare the users.
So, with the current code, we end up returning -1 and not EIO for the
ioctl() calls. Which doesn't give any clue to the user of what went
wrong.
Signed-off-by: Suzuki K P <suzuki@in.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Andrew Johnson [Fri, 16 Mar 2007 21:38:24 +0000 (13:38 -0800)]
[PATCH] swsusp: fix suspend when console is in VT_AUTO+KD_GRAPHICS mode
When the console is in VT_AUTO+KD_GRAPHICS mode, switching to the
SUSPEND_CONSOLE fails, resulting in vt_waitactive() waiting indefinitely or
until the task is interrupted. This patch tests if a console switch can
occur in set_console() and returns early if a console switch is not
possible.
[akpm@linux-foundation.org: cleanup] Signed-off-by: Andrew Johnson <ajohnson@intrinsyc.com> Acked-by: Pavel Machek <pavel@ucw.cz> Cc: "Antonino A. Daplas" <adaplas@pol.net> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Vasily Averin [Fri, 16 Mar 2007 21:38:24 +0000 (13:38 -0800)]
[PATCH] smbfs: double free memory corruption
smbfs allocates rq_trans2buffer to handle server's multi transaction2 response
messages. As struct smb_request may be reused, rq_trans2buffer is freed
before each new request. However if last servers's response is not multi but
single trans2 message then new rq_trans2buffer is not allocated but last
smb_rput still tries to free it again.
To prevent this issue rq_trans2buffer pointer should be set to NULL after
kfree.
Michael Halcrow [Fri, 16 Mar 2007 21:38:22 +0000 (13:38 -0800)]
[PATCH] eCryptfs: fix possible NULL ptr deref in ecryptfs_d_release()
ecryptfs_d_release() first dereferences a pointer (via
ecryptfs_dentry_to_lower()) and then afterwards checks to see if the
pointer it just dereferenced is NULL (via ecryptfs_dentry_to_private()).
This patch moves all of the work done on the dereferenced pointer inside a
block governed by the condition that the pointer is non-NULL.
Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
projects / linux-2.6 / log