I encountered a kernel panic with my test program, which is a very
simple IPv6 client-server program.
The server side sets IPV6_RECVPKTINFO on a listening socket, and the
client side just sends a message to the server. Then the kernel panic
occurs on the server. (If you need the test program, please let me
know. I can provide it.)
This problem happens because a skb is forcibly freed in
tcp_rcv_state_process().
When a socket in listening state(TCP_LISTEN) receives a syn packet,
then tcp_v6_conn_request() will be called from
tcp_rcv_state_process(). If the tcp_v6_conn_request() successfully
returns, the skb would be discarded by __kfree_skb().
However, in case of a listening socket which was already set
IPV6_RECVPKTINFO, an address of the skb will be stored in
treq->pktopts and a ref count of the skb will be incremented in
tcp_v6_conn_request(). But, even if the skb is still in use, the skb
will be freed. Then someone still using the freed skb will cause the
kernel panic.
I suggest to use kfree_skb() instead of __kfree_skb().
Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Wed, 17 Jan 2007 00:52:02 +0000 (16:52 -0800)]
[IPSEC]: Policy list disorder
The recent hashing introduced an off-by-one bug in policy list insertion.
Instead of adding after the last entry with a lesser or equal priority,
we're adding after the successor of that entry.
This patch fixes this and also adds a warning if we detect a duplicate
entry in the policy list. This should never happen due to this if clause.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Since we stop using dev_alloc_skb on the IrDA TX frame, we constantly run
into the case of the skb headroom being 0, and thus we call skb_cow for
every IrDA TX frame.
This patch uses a local buffer and memcpy the skb to it, saving us a
kmalloc for each of those IrDA TX frames.
Signed-off-by: Samuel Ortiz <samuel@sortiz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Tue, 16 Jan 2007 03:20:21 +0000 (19:20 -0800)]
[SCTP]: Fix SACK sequence during shutdown
Currently, when association enters SHUTDOWN state,the
implementation will SACK any DATA first and then transmit
the SHUTDOWN chunk. This is against the order required by
2960bis spec. SHUTDOWN must always be first, followed by
SACK. This change forces this order and also enables bundling.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Consider the chunk as Out-of-the-Blue if we don't have
an endpoint. Otherwise discard it as before.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Tue, 16 Jan 2007 03:15:45 +0000 (19:15 -0800)]
[SCTP]: Verify some mandatory parameters.
Verify init_tag and a_rwnd mandatory parameters in INIT and
INIT-ACK chunks.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Vlad Yasevich [Tue, 16 Jan 2007 03:12:31 +0000 (19:12 -0800)]
[SCTP]: Set correct error cause value for missing parameters
sctp_process_missing_param() needs to use the SCTP_ERROR_MISS_PARAM
error cause value.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
In file included from net/netfilter/xt_state.c:13:
include/net/netfilter/nf_conntrack_compat.h: In function 'nf_ct_l3proto_try_module_get':
include/net/netfilter/nf_conntrack_compat.h:70: error: 'PF_INET' undeclared (first use in this function)
include/net/netfilter/nf_conntrack_compat.h:70: error: (Each undeclared identifier is reported only once
include/net/netfilter/nf_conntrack_compat.h:70: error: for each function it appears in.)
include/net/netfilter/nf_conntrack_compat.h:71: warning: control reaches end of non-void function
make[2]: *** [net/netfilter/xt_state.o] Error 1
make[1]: *** [net/netfilter] Error 2
make: *** [net] Error 2
A simple fix is to have nf_conntrack_compat.h #include <linux/socket.h>.
Signed-off-by: Mikael Pettersson <mikpe@it.uu.se> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Venkat Yekkirala [Tue, 16 Jan 2007 00:38:45 +0000 (16:38 -0800)]
[SELINUX]: increment flow cache genid
Currently, old flow cache entries remain valid even after
a reload of SELinux policy.
This patch increments the flow cache generation id
on policy (re)loads so that flow cache entries are
revalidated as needed.
Thanks to Herbet Xu for pointing this out. See:
http://marc.theaimsgroup.com/?l=linux-netdev&m=116841378704536&w=2
There's also a general issue as well as a solution proposed
by David Miller for when flow_cache_genid wraps. I might be
submitting a separate patch for that later.
I request that this be applied to 2.6.20 since it's
a security relevant fix.
Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com> Signed-off-by: David S. Miller <davem@davemloft.net>
[IPV6] MCAST: Fix joining all-node multicast group on device initialization.
Join all-node multicast group after assignment of dev->ip6_ptr
because it must be assigned when ipv6_dev_mc_inc() is called.
This fixes Bug#7817, reported by <gernoth@informatik.uni-erlangen.de>.
Closes: 7817 Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Thu, 11 Jan 2007 06:06:32 +0000 (22:06 -0800)]
[IPSEC] flow: Fix potential memory leak
When old flow cache entries that are not at the head of their chain
trigger a transient security error they get unlinked along with all
the entries preceding them in the chain. The preceding entries are
not freed correctly.
This patch fixes this by simply leaving the entry around. It's based
on a suggestion by Venkat Yekkirala.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
[ The irony. Somebody still has his sign-off message hardcoded
in a script or his brainstem ;^] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Tue, 23 Jan 2007 22:16:31 +0000 (14:16 -0800)]
Clear spurious irq stat information when adding irq handler
Any newly added irq handler may obviously make any old spurious irq
status invalid, since the new handler may well be the thing that is
supposed to handle any interrupts that came in.
So just clear the statistics when adding handlers.
Pointed-out-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Tue, 23 Jan 2007 19:13:06 +0000 (11:13 -0800)]
Merge branch 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband
* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
IB/ehca: Fix mismatched spin_unlock in irq handler
IB/ehca: Fix improper use of yield() with spinlock held
IB/srp: Check match_strdup() return
while lock-profiling the -rt kernel i noticed weird contention during
mmap-intense workloads, and the tracer showed the following gem, in one
of our MM hotpaths:
ouch! a global rw-semaphore taken in one of the most performance-
sensitive codepaths of the kernel. And i dont even have oprofile
enabled! All distro kernels have CONFIG_PROFILING enabled, so this
scalability problem affects the majority of Linux users.
The fix is to enhance blocking_notifier_call_chain() to only take the
lock if there appears to be work on the call-chain.
With this patch applied i get nicely saturated system, and much higher
munmap performance, on SMP systems.
And as a bonus this also fixes a similar scalability bottleneck in the
thread-exit codepath: profile_task_exit() ...
Signed-off-by: Ingo Molnar <mingo@elte.hu> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Tue, 23 Jan 2007 19:02:41 +0000 (11:02 -0800)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
NetXen: Use pci_register_driver() instead of pci_module_init() in init_module
NetXen: Firmware check modifications
ehea: Fixed possible nullpointer access
ehea: Added logging off associated errors
ehea: Improved logging of permission issues
ehea: New method to determine number of available ports
ehea: Modified initial autoneg state determination
ehea: Fixing firmware queue config issue
ehea: Fixed wrong dereferencation
PHY: Export phy ethtool helpers
modify 3c589_cs to be SMP safe
Linus Torvalds [Tue, 23 Jan 2007 19:01:46 +0000 (11:01 -0800)]
Merge branch 'kill-jffs-prep' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6
* 'kill-jffs-prep' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
Note that JFFS (v1) is to be deleted, in feature-removal-schedule.txt
Linas Vepstas [Tue, 23 Jan 2007 18:40:54 +0000 (19:40 +0100)]
[PATCH] elevator: move clearing of unplug flag earlier
A flag was recently added to the elevator code to avoid
performing an unplug when reuests are being re-queued.
The goal of this flag was to avoid a deep recursion that
can occur when re-queueing requests after a SCSI device/host
reset. See http://lkml.org/lkml/2006/5/17/254
However, that fix added the flag near the bottom of a case
statement, where an earlier break (in an if statement) could
transport one out of the case, without setting the flag.
This patch sets the flag earlier in the case statement.
I re-discovered the deep recursion recently during testing;
I was told that it was a known problem, and the fix to it was
in the kernel I was testing. Indeed it was ... but it didn't
fix the bug. With the patch below, I no longer see the bug.
Ralf Baechle [Sat, 20 Jan 2007 00:18:01 +0000 (00:18 +0000)]
[MIPS] SMTC: Instant IPI replay.
SMTC pseudo-interrupts between TCs are deferred and queued if the target
TC is interrupt-inhibited (IXMT). In the first SMTC prototypes, these
queued IPIs were serviced on return to user mode, or on entry into the
kernel idle loop. The INSTANT_REPLAY option dispatches them as part of
local_irq_restore() processing, which adds runtime overhead (hence the
option to turn it off), but ensures that IPIs are handled promptly even
under heavy I/O interrupt load.
Mohan Kumar suggested making kexec-tools-testing.tar.gz a link to the
latest version. I have done this and this patch updates the documentation
accordingly.
Signed-off-by: Simon Horman <horms@verge.net.au> Cc: Vivek Goyal <vgoyal@in.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PATCH] resierfs: avoid tail packing if an inode was ever mmapped
This patch fixes a confusion reiserfs has for a long time.
On release file operation reiserfs used to try to pack file data stored in
last incomplete page of some files into metadata blocks. After packing the
page got cleared with clear_page_dirty. It did not take into account that
the page may be mmaped into other process's address space. Recent
replacement for clear_page_dirty cancel_dirty_page found the confusion with
sanity check that page has to be not mapped.
The patch fixes the confusion by making reiserfs avoid tail packing if an
inode was ever mmapped. reiserfs_mmap and reiserfs_file_release are
serialized with mutex in reiserfs specific inode. reiserfs_mmap locks the
mutex and sets a bit in reiserfs specific inode flags.
reiserfs_file_release checks the bit having the mutex locked. If bit is
set - tail packing is avoided. This eliminates a possibility that mmapped
page gets cancel_page_dirty-ed.
Signed-off-by: Vladimir Saveliev <vs@namesys.com> Cc: Jeff Mahoney <jeffm@suse.com> Cc: Chris Mason <mason@suse.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PATCH] mbind: restrict nodes to the currently allowed cpuset
Currently one can specify an arbitrary node mask to mbind that includes
nodes not allowed. If that is done with an interleave policy then we will
go around all the nodes. Those outside of the currently allowed cpuset
will be redirected to the border nodes. Interleave will then create
imbalances at the borders of the cpuset.
This patch restricts the nodes to the currently allowed cpuset.
The RFC for this patch was discussed at
http://marc.theaimsgroup.com/?t=116793842100004&r=1&w=2
Signed-off-by: Christoph Lameter <clameter@sgi.com> Cc: Paul Jackson <pj@sgi.com> Cc: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mark Gross [Tue, 23 Jan 2007 04:40:44 +0000 (20:40 -0800)]
[PATCH] tlclk: bug fix + misc fixes
The following patch fixes a few problems with the tlclk driver.
* bug in the select_amcb1_transmit_clock
* racy read sys call
* racy open sys call
* use of add_timer where mod_timer would be better
* change to the timer data parameter use
Signed-off-by: Mark Gross <mark.gross@intel.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Chen, Kenneth W [Tue, 23 Jan 2007 04:40:43 +0000 (20:40 -0800)]
[PATCH] fix blk_direct_IO bio preparation
For large size DIO that needs multiple bio, one full page worth of data was
lost at the boundary of bio's maximum sector or segment limits. After a
bio is full and got submitted. The outer while (nbytes) { ... } loop will
allocate a new bio and just march on to index into next page. It just
forgets about the page that bio_add_page() rejected when previous bio is
full. Fix it by put the rejected page back to pvec so we pick it up again
for the next bio.
Signed-off-by: Ken Chen <kenneth.w.chen@intel.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Avi Kivity [Tue, 23 Jan 2007 04:40:40 +0000 (20:40 -0800)]
[PATCH] KVM: fix bogus pagefault on writable pages
If a page is marked as dirty in the guest pte, set_pte_common() can set the
writable bit on newly-instantiated shadow pte. This optimization avoids
a write fault after the initial read fault.
However, if a write fault instantiates the pte, fix_write_pf() incorrectly
reports the fault as a guest page fault, and the guest oopses on what appears
to be a correctly-mapped page.
Fix is to detect the condition and only report a guest page fault on a user
access to a kernel page.
With the fix, a kvm guest can survive a whole night of running the kernel
hacker's screensaver (make -j9 in a loop).
Signed-off-by: Avi Kivity <avi@qumranet.com> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Avi Kivity [Tue, 23 Jan 2007 04:40:40 +0000 (20:40 -0800)]
[PATCH] KVM: x86 emulator: fix bit string instructions
The various bit string instructions (bts, btc, etc.) fail to adjust the
address correctly if the bit address is beyond BITS_PER_LONG.
This bug creeped in as the emulator originally relied on cr2 to contain the
memory address; however we now decode it from the mod r/m bits, and must
adjust the offset to account for large bit indices.
The patch is rather large because it switches src and dst decoding around, so
that the bit index is available when decoding the memory address.
This fixes workloads like the FC5 installer.
Signed-off-by: Avi Kivity <avi@qumranet.com> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Avi Kivity [Tue, 23 Jan 2007 04:40:39 +0000 (20:40 -0800)]
[PATCH] KVM: fix race between mmio reads and injected interrupts
The kvm mmio read path looks like:
1. guest read faults
2. kvm emulates read, calls emulator_read_emulated()
3. fails as a read requires userspace help
4. exit to userspace
5. userspace emulates read, kvm sets vcpu->mmio_read_completed
6. re-enter guest, fault again
7. kvm emulates read, calls emulator_read_emulated()
8. succeeds as vcpu->mmio_read_emulated is set
9. instruction completes and guest is resumed
A problem surfaces if the userspace exit (step 5) also requests an interrupt
injection. In that case, the guest does not re-execute the original
instruction, but the interrupt handler. The next time an mmio read is
exectued (likely for a different address), step 3 will find
vcpu->mmio_read_completed set and return the value read for the original
instruction.
The problem manifested itself in a few annoying ways:
- little squares appear randomly on console when switching virtual terminals
- ne2000 fails under nfs read load
- rtl8139 complains about "pci errors" even though the device model is
incapable of issuing them.
Fix by skipping interrupt injection if an mmio read is pending.
A better fix is to avoid re-entry into the guest, and re-emulating immediately
instead. However that's a bit more complex.
Signed-off-by: Avi Kivity <avi@qumranet.com> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
With that, "nmi_watchdog=2" stops working for me on Intel Core 2 CPU
based system.
The problem is, setup_nmi_watchdog is called while parsing the boot
option and identify_cpu is not done yet. So, the return value of
nmi_known_cpu() is not valid at this point.
So revert that check. This should not have any adverse effect as the
nmi_known_cpu() check is done again later in enable_lapic_nmi_watchdog().
Karsten Wiese [Wed, 10 Jan 2007 18:02:26 +0000 (19:02 +0100)]
[ALSA] Repair snd-usb-usx2y over OHCI
The previous patch 'Repair snd-usb-usx2y for usb 2.6.18' assumed
urb->start_frame roll over beyond MAX_INT for both UHCI & OHCI.
This isn't true until now (kernel 2.6.20).
Fix this by only looking at the common between OHCI & UHCI Frame number
range.
This is for mainline and stable kernels >= 2.6.18.
Amit S. Kale [Mon, 22 Jan 2007 14:52:53 +0000 (06:52 -0800)]
NetXen: Use pci_register_driver() instead of pci_module_init() in init_module
This will use pci_register_driver() instead of pci_module_init().
Signed-off-by: Amit S. Kale <amitkale@netxen.com> Signed-off-by: Richard Knutsson <ricknu-0@student.ltu.se> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Thomas Klein [Mon, 22 Jan 2007 11:53:20 +0000 (12:53 +0100)]
ehea: Modified initial autoneg state determination
Logical partitions are not allowed to (try to) set the autonegotiation status.
This patch removes the respective function call from the port setup function.
Signed-off-by: Thomas Klein <tklein@de.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
James Bottomley [Mon, 22 Jan 2007 15:18:31 +0000 (09:18 -0600)]
[PATCH] x86: fix PDA variables to work during boot
The current PDA code, which went in in post 2.6.19 has a flaw in that it
doesn't correctly cycle the GDT and %GS segment through the boot PDA,
the CPU PDA and finally the per-cpu PDA.
The bug generally doesn't show up if the boot CPU id is zero, but
everything falls apart for a non zero boot CPU id. The basically kills
voyager which is perfectly capable of doing non zero CPU id boots, so
voyager currently won't boot without this.
The fix is to be careful and actually do the GDT setups correctly.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com> Cc: Andi Kleen <ak@suse.de> Cc: Jeremy Fitzhardinge <jeremy@goop.org> Cc: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/pci-2.6:
PCI: fix pci-driver kernel-doc
PCI: rework Documentation/pci.txt
PCI: Unhide the SMBus on the Asus P4P800-X
* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: unusual_devs.h entry for nokia 6233
USB: Fix for typo in ohci-ep93xx.c
USB: disable USB_MULTITHREAD_PROBE
USB: add vendor/device id for Option GT Max 3.6 cards
USB: unusual_devs.h for 0x046b:ff40
USB: make usbhid ignore Imation Disc Stakka
USB: rndis_host: fix crash while probing a Nokia S60 mobile
USB: asix: Detect internal PHY and enable/use accordingly
usbtouchscreen: make ITM screens report BTN_TOUCH as zero when not touched
Grant Grundler [Mon, 25 Dec 2006 08:06:35 +0000 (01:06 -0700)]
PCI: rework Documentation/pci.txt
Rewrite Documentation/pci.txt:
o restructure document to match how API is used when writing init code.
o update to reflect changes in struct pci_driver function pointers.
o removed language on "new style vs old style" device discovery.
"Old style" is now deprecated. Don't use it. Left description in
to document existing driver behaviors.
o add section "Legacy I/O Port free driver" by Kenji Kaneshige
http://lkml.org/lkml/2006/11/22/25
(renamed to "pci_enable_device_bars() and Legacy I/O Port space")
o add "MMIO space and write posting" section to help avoid common pitfall
when converting drivers from IO Port space to MMIO space.
Orignally posted http://lkml.org/lkml/2006/2/27/24
o many typo/grammer/spelling corrections from Randy Dunlap
o two more spelling corrections from Stephan Richter
o fix CodingStyle as per Randy Dunlap
Signed-off-by: Grant Grundler <grundler@parisc-linux.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Manuel Osdoba [Thu, 18 Jan 2007 20:28:45 +0000 (21:28 +0100)]
USB: unusual_devs.h entry for nokia 6233
In appendix a patch for the nokia 6233 mobile phone is included.
The patch is against 2.6.20-rc5. It is my first patch. Hopefully it has
the right format. The code makes my nokia 6233 on my computer work.
From: Manuel Osdoba <manuel.osdoba@tu-ilmenau.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Petr Stetiar [Wed, 17 Jan 2007 14:30:39 +0000 (06:30 -0800)]
USB: Fix for typo in ohci-ep93xx.c
Attached patch fixes typo in USB driver reported by Chase Douglas on linux-cirrus mailing
list. http://www.freelists.org/archives/linux-cirrus/12-2006/msg00003.html
Signed-off-by: Petr Stetiar <ynezz@true.cz> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Disable the USB_MULTITHREAD_PROBE option because it causes crashes on
people's machines and they never remember to actually read the config
help files.
No one likes this, everyone hates it, I'm going to go eat worms...
Pete Zaitcev [Sat, 13 Jan 2007 23:17:46 +0000 (15:17 -0800)]
USB: unusual_devs.h for 0x046b:ff40
American Megatrends did something wrong in their floppy emulator. It breaks
with both kinds of MODE SENSE which our stack sends. Alan and I tried a few
tweaks, and got LUNs sensed right, but US_FL_NO_WP_DETECT is still needed.
I set the firmware bracket to 1.00 exactly, in case AMI or Sun fix it with a
firmware update. Hey, you never know.
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com> Signed-off-by: Phil Dibowitz <phil@ipom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel Gollub [Tue, 16 Jan 2007 10:03:01 +0000 (11:03 +0100)]
USB: rndis_host: fix crash while probing a Nokia S60 mobile
Bug fix for driver rndis_host which fixes rndis_host probing certain
Nokia S60 (Series 60) mobiles. While the rndis_host get probed by usbnet
and tries to bind the Nokia mobile the bind is going to fail. The
rndis_host module tries to release the device, in a wrong way, which
cause the oops.
Fixes Bugzilla #7201
Signed-off-by: Daniel Gollub <dgollub@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andres Salomon [Thu, 11 Jan 2007 23:39:16 +0000 (18:39 -0500)]
USB: asix: Detect internal PHY and enable/use accordingly
Different AX88772 dongles use different PHYs; the chip is capable of using
both a primary and secondary PHY, and supports an internal and external PHY.
It appears that some DUB-E100 devices use the internal PHY, so trying to use
an external one will not work (note that this is different across revisions,
as well; the "A" and "B" revs of the DUB-E100 use different PHYs!). The data
sheet for the AX88772 chip specifies that the internal PHY id will be 0x10,
so if that's read from the EEPROM, we should use that rather than attempting
to use an external PHY.
Thanks to Mitch Bradley for pointing this out!
Signed-off-by: Andres Salomon <dilinger@debian.org> Cc: David Hollis <dhollis@davehollis.com> Cc: Chris Ball <cjb@laptop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Daniel Ritz [Mon, 11 Dec 2006 17:17:45 +0000 (18:17 +0100)]
usbtouchscreen: make ITM screens report BTN_TOUCH as zero when not touched
ITM screens send invalid x/y data when not touched. this was fixes a while ago
but the problem is if the screen is not touched anymore the driver never does
not report BTN_TOUCH as zero. fix it by sending the report with the last valid
coordinates when pressure is released.
Linus Torvalds [Mon, 22 Jan 2007 19:31:11 +0000 (11:31 -0800)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
sis190: failure to set the MAC address from EEPROM
Fix phy_read/write redefinition errors in ucc_geth_phy.c
Update ucc_geth.c for new workqueue structure
myri10ge: update driver version to 1.2.0
myri10ge: check that we can get an irq
myri10ge: make wc_fifo usage load-time tunable
8139cp: Don't blindly enable interrupts
[PATCH] bcm43xx: Fix failure to deliver PCI-E interrupts
Linus Torvalds [Mon, 22 Jan 2007 17:23:23 +0000 (09:23 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
hid-core.c: Adds GTCO CalComp Interwrite IPanel PIDs to blacklist
HID: put usb_interface instead of usb_device into hid->dev to fix udevinfo breakage
HID: add missing RX, RZ and RY enum values to hid-debug output
HID: hid/hid-input.c doesn't need to include linux/usb/input.h
HID: compilation fix when DEBUG_DATA is defined
HID: proper LED-mapping for SpaceNavigator
HID: update MAINTAINERS entry for USB-HID
HID: GEYSER4_ISO needs quirk
HID: fix some ARM builds due to HID brokenness - make USB_HID depend on INPUT
Linus Torvalds [Mon, 22 Jan 2007 17:21:02 +0000 (09:21 -0800)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] Update defconfigs
[POWERPC] atomic_dec_if_positive sign extension fix
[POWERPC] Fix OF node refcnt underflow in 836x and 832x platform code
[POWERPC] Make it blatantly clear; mpc5200 device tree is not yet stable
[POWERPC] Fix broken DMA on non-LPAR pSeries
[POWERPC] Fix cell's mmio nvram to properly parse device tree
[POWERPC] Remove bogus sanity check in pci -> OF node code
Linus Torvalds [Mon, 22 Jan 2007 16:57:03 +0000 (08:57 -0800)]
Merge branch 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6
* 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
hwmon/w83793: Hide invalid VID readings
hwmon/w83793: Fix the fan input detection
hwmon/w83793: Ignore disabled temperature channels
hwmon: Fix the VRD 11 decoding
hwmon/w83793: Remove the description of AMDSI and update the voltage formula
* git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs-2.6:
NTFS: Forgot to bump version number in makefile to 2.1.28...
NTFS: 2.1.28 - Fix deadlock reported by Sergey Vlasov due to ntfs_put_inode().
Linus Torvalds [Mon, 22 Jan 2007 16:55:28 +0000 (08:55 -0800)]
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb
* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
V4L/DVB (5023): Fix compilation on ppc32 architecture
V4L/DVB (5071): Tveeprom: autodetect LG TAPC G701D as tuner type 37
V4L/DVB (5069): Fix bttv and friends on 64bit machines with lots of memory
V4L/DVB (5033): MSI TV@nywhere Plus fixes
V4L/DVB (5029): Ks0127 status flags
V4L/DVB (5024): Fix quickcam communicator driver for big endian architectures
V4L/DVB (5021): Cx88xx: Fix lockup on suspend
V4L/DVB (5020): Fix: disable interrupts while at KM_BOUNCE_READ
V4L/DVB (5019): Fix the frame->grabstate update in read() entry point.
"Nadia Derbey has reported that mmap of /dev/kmem no longer works with
the kernel virtual address as offset, and Franck has confirmed that
his patch came from a misunderstanding of what an offset means to
/dev/kmem - whereas his patch description seems to say that he was
correcting the offset on a few plaforms, there was no such problem to
correct, and his patch was in fact changing its API on all platforms."
Suggested-by: Hugh Dickins <hugh@veritas.com> Cc: Franck Bui-Huu <fbuihuu@gmail.com> Cc: Nadia Derbey <Nadia.Derbey@bull.net> Cc: Andi Kleen <ak@suse.de> Cc: Arjan van de Ven <arjan@infradead.org> Cc: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
On 64-bit machines, if an atomic counter is explicitly set to a
negative value, the atomic_dec_if_positive function will decrement and
store the next smallest value in the atomic counter, contrary to its
intended operation.
The comparison to determine if the decrement will make the result
negative was done by the "addic." instruction, which operates on a
64-bit value, namely the zero-extended word loaded from the atomic
variable. This patch uses an explicit word compare (cmpwi) and
changes the addic. to an addi (also changing "=&r" to "=&b" so that r0
isn't used, and addi doesn't become li).
This also fixes a bug for both 32-bit and 64-bit in that previously
0x80000000 was considered positive, since the result after
decrementing is positive. Now it is considered negative.
Also, I clarify the return value in the comments just to make it clear
that the value returned is always the decremented value, even if that
value is not stored back to the atomic counter.
Signed-off-by: Robert Jennings <rcj@linux.vnet.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Li Yang [Wed, 17 Jan 2007 06:42:22 +0000 (14:42 +0800)]
[POWERPC] Fix OF node refcnt underflow in 836x and 832x platform code
Incorrect use of of_find_node_by_name() causes of_node_put()
on a node which has already been put. It causes the refcount of
the node to underflow, which triggers the WARN_ON in kref_get
for 836x and 832x. This fixes it.
Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
projects / linux-2.6 / log