Commit Graph

32605 Commits

Author SHA1 Message Date
Peter Milne
39288e1ac1 [PATCH] i2c-iop3xx: Avoid addressing self
Avoid addressing self when sending a slave address. Follows instruction
in Intel 80331/80321 manuals.
Ignoring this worked previously on 80321, but causes a hang on i2cdetect
on 80331.

Signed-off-by: Peter Milne <peter.milne@d-tacq.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-07-12 15:43:06 -07:00
Mark M. Hoffman
2369df933f [PATCH] i2c: Fix 'ignore' module parameter handling in i2c-core
This patch fixes a bug in the handling of 'ignore' module parameters of I2C
client drivers.

Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-07-12 15:43:06 -07:00
Stephen Hemminger
22e1170310 [PATCH] sky2: optimize receive restart
When the driver handles multiple packets per NAPI poll, it is
better to reload the receive ring, then tell the hardware. Otherwise,
under packet storm with flow control, the driver/hardware will degrade
down to one packet getting through per pause-exchange.

Likewise on transmit, don't wakeup until a little more than minimum
ring space is available.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:22 -04:00
Stephen Hemminger
afa195da45 [PATCH] sky2: PHY power on delays
The documentation says we need to wait after turning on the PHY.
Also, don't enable WOL by default.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Stephen Hemminger
6a5706b99c [PATCH] sky2: NAPI suspend/resume of dual port cards
The changes to handle suspend/resume didn't handle the case where
a dual port card has the first port down, but the second is running.
In this driver, all NAPI polling is done on the primary port.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Stephen Hemminger
59139528c8 [PATCH] sky2: sky2_reset section mismatch
Since sky2_reset gets call from sky2_resume it shouldn't be tagged
with devinit.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Stephen Hemminger
f326fe768b [PATCH] sk98lin: fix truncated collision threshold mask
Patch to correct broken collision threshold mask in (same problem
as sky2 driver).  Should be three bits wide, but the mask only allows
for 1 bit to be set.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Stephen Hemminger
83405f058e [PATCH] skge: fix truncated collision threshold mask
Patch to correct broken collision threshold mask in (same problem
as sky2 driver).  Should be three bits wide, but the mask only allows
for 1 bit to be set.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Stephen Hemminger
fbb88b3e0b [PATCH] sky2: fix truncated collision threshold mask
Patch to correct broken collision threshold mask in sky2 driver.  Should be
three bits wide, but the mask only allows for 1 bit to be set.

Thanks & Regards
Neil

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

 sky2.h |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 18:39:21 -04:00
Adrian Bunk
f01cfb3638 [PATCH] w1: remove drivers/w1/w1.h
drivers/w1/w1_io.h is both a subset of drivers/w1/w1.h and no longer
#include'd by any file.

This patch therefore removes w1_io.h.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-07-12 15:38:28 -07:00
Ben Gardner
b4786f1893 [PATCH] w1: fix idle check loop in ds2482
The idle check loop has a greater-than where it should have a less-than.
This causes the ds2482 driver to check for the idle condition exactly
once, which causes it to fail on faster machines.

Signed-off-by: Ben Gardner <gardner.ben@gmail.com>
Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-07-12 15:38:27 -07:00
Evgeniy Polyakov
4e35dea2f2 [PATCH] W1: remove w1 mail list from lm_sensors.
lm_sensors mail list is going to be splitted into separate subdev lists,
so remove w1 from there.

http://lists.lm-sensors.org/pipermail/lm-sensors/2006-June/016507.html

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-07-12 15:38:27 -07:00
Marcel Holtmann
fd1278d720 [Bluetooth] Fix deadlock in the L2CAP layer
The Bluetooth L2CAP layer has 2 locks that are used in softirq context,
(one spinlock and one rwlock, where the softirq usage is readlock) but
where not all usages of the lock were _bh safe. The patch below corrects
this.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2006-07-12 15:34:35 -07:00
Marcel Holtmann
0263603a01 [Bluetooth] Let BT_HIDP depend on INPUT
This patch lets BT_HIDP depend on instead of select INPUT. This fixes
the following warning during an s390 build:

net/bluetooth/hidp/Kconfig:4:warning: 'select' used by config symbol
'BT_HIDP' refer to undefined symbol 'INPUT'

A dependency on INPUT also implies !S390 (and therefore makes the
explicit dependency obsolete) since INPUT is not available on s390.

The practical difference should be nearly zero, since INPUT is always
set to y unless EMBEDDED=y (or S390=y).

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2006-07-12 15:34:33 -07:00
Marcel Holtmann
420cc3505f [Bluetooth] Avoid NULL pointer dereference with tty->driver
This patch checks for tty->driver before trying to call flush_buffer().

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2006-07-12 15:34:30 -07:00
Marcel Holtmann
25ea6db04a [Bluetooth] Remaining transitions to use kzalloc()
This patch makes the remaining transitions to use kzalloc().

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2006-07-12 15:34:28 -07:00
Brice Goglin
4c2248cc57 [PATCH] myri10ge return value fix
Andrew Morton wrote:
>   All these functions return error codes, and we're not checking them.  We
>   should.  So there's a patch which marks all these things as __must_check,
>   which causes around 1,500 new warnings.
>

The following patch fixes such a warning in myri10ge.

Check pci_enable_device() return value in myri10ge_resume().

Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:44:11 -04:00
Deepak Saxena
8431adfd37 [PATCH] Update smc91x driver with ARM Versatile board info
We need to specify a Versatile-specific SMC_IRQ_FLAGS value or the new
generic IRQ layer will complain thusly:

No IRQF_TRIGGER set_type function for IRQ 25 (<NULL>)

Signed-off-by: Deepak Saxena <dsaxena@plexity.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:40 -04:00
Auke Kok
709cf0187d [PATCH] ixgb: fix tx unit hang - properly calculate desciptor count
There were some tso bugs that only showed up with heavy load and 16kB
pages that this patch fixes by making the driver's internal use count
of descriptors match the count that it was estimating it needed using
the DESC_NEEDED macro.  This bug caused NETDEV_WATCHDOG resets aka
tx timeouts.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:40 -04:00
Dmitry Torokhov
c5d965caa1 [PATCH] smsc-ircc2: fix section reference mismatches
subsystem_configurations array is only used by an __init function,
therefore it should be marked __initdata, not __devinitdata.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:40 -04:00
Andrew Morton
4626dd46f5 [PATCH] 8139cp.c printk fix
drivers/net/8139cp.c: In function 'cp_init_one':
drivers/net/8139cp.c:1919: warning: format '%lx' expects type 'long unsigned int', but argument 4 has type 'resource_size_t'
drivers/net/8139cp.c:1919: warning: format '%lx' expects type 'long unsigned int', but argument 5 has type 'resource_size_t'

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:40 -04:00
Ananda Raju
e6a8fee209 [PATCH] s2io driver irq fix
Modification and bug fixes with respect to irq registration.

- Enable interrupts after request_irq

- Restored MSI data register value at driver unload time

Signed-off-by: Ananda Raju <ananda.raju@neterion.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:40 -04:00
Andrew Morton
61ef5c00a6 [PATCH] e1000: irq naming update
Use the new names.

Cc: Auke Kok <auke-jan.h.kok@intel.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:42:39 -04:00
Jeff Garzik
7d450e0071 Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes 2006-07-12 17:40:45 -04:00
Ayaz Abdulla
95d161cbab [PATCH] forcedeth: watermark fixup
This patch defines the watermark registers and fixes up the use of this
register.

Signed-Off-By: Ayaz Abdulla <aabdulla@nvidia.com>

Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:38:20 -04:00
Ayaz Abdulla
9744e218aa [PATCH] forcedeth: deferral fixup
This patch adds the definition for the deferral registers and fixes up
the use of these registers.

Signed-Off-By: Ayaz Abdulla <aabdulla@nvidia.com>

Signed-off-by: Jeff Garzik <jeff@garzik.org>
2006-07-12 17:38:20 -04:00
Krzysztof Halasa
c2ce920468 [WAN]: converting generic HDLC to use netif_dormant*()
This patch converts generic HDLC (and WAN drivers using it) from
hdlc_set_carrier() to netif_dormant*() interface.
WAN hardware drivers should now use netif_carrier_on|off() like
other network drivers.

Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:59:06 -07:00
Herbert Xu
b47b2ec198 [IPV4]: Fix error handling for fib_insert_node call
The error handling around fib_insert_node was broken because we always
zeroed the error before checking it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:59:04 -07:00
Ralf Baechle
4b260a98f1 [NETROM] lockdep: fix false positive
NETROM network devices are virtual network devices encapsulating NETROM
frames into AX.25 which will be sent through an AX.25 device, so form a
special "super class" of normal net devices; split their locks off into a
separate class since they always nest.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:59:02 -07:00
Ralf Baechle
b1d21ca83c [ROSE] lockdep: fix false positive
ROSE network devices are virtual network devices encapsulating ROSE
frames into AX.25 which will be sent through an AX.25 device, so form a
special "super class" of normal net devices; split their locks off into
a separate class since they always nest.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:59 -07:00
Ralf Baechle
c19c4b9c9a [AX.25]: Optimize AX.25 socket list lock
Right now all uses of the ax25_list_lock lock are _bh locks but knowing
some code is only ever getting invoked from _bh context we can better.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:57 -07:00
Herbert Xu
da952315c9 [IPCOMP]: Fix truesize after decompression
The truesize check has uncovered the fact that we forgot to update truesize
after pskb_expand_head.  Unfortunately pskb_expand_head can't update it for
us because it's used in all sorts of different contexts, some of which would
not allow truesize to be updated by itself.

So the solution for now is to simply update it in IPComp.

This patch also changes skb_put to __skb_put since we've just expanded
tailroom by exactly that amount so we know it's there (but gcc does not).

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:55 -07:00
YOSHIFUJI Hideaki
8a6ce0c083 [IPV6]: Use ipv6_addr_src_scope for link address sorting.
In the source address selection, the address must be sorted
from global to node-local.

But, ifp->scope is different from the scope for source address
selection.

                                 2001::1  fe80::1     ::1
ifp->scope                             0     0x02    0x01
ipv6_addr_src_scope(&ifp->addr)     0x0e     0x02    0x01

So, we need to use ipv6_addr_src_scope(&ifp->addr) for sorting.

And, for backward compatibility, addresses should be sorted from
new one to old one.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Brian Haley <brian.haley@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:53 -07:00
Xiaoliang (David) Wei
6150c22e2a [TCP] tcp_highspeed: Fix AI updates.
I think there is still a problem with the AIMD parameter update in
HighSpeed TCP code.

Line 125~138 of the code (net/ipv4/tcp_highspeed.c):

	/* Update AIMD parameters */
	if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
		while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
		       ca->ai < HSTCP_AIMD_MAX - 1)
			ca->ai++;
	} else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
		while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
		       ca->ai > 0)
			ca->ai--;

In fact, the second part (decreasing ca->ai) never decreases since the
while loop's inequality is in the reverse direction. This leads to
unfairness with multiple flows (once a flow happens to enjoy a higher
ca->ai, it keeps enjoying that even its cwnd decreases)

Here is a tentative fix (I also added a comment, trying to keep the
change clear):

Acked-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:50 -07:00
Stephen Hemminger
781b456a98 [MAINTAINERS]: Add proper entry for TC classifier
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:48 -07:00
Ralf Baechle
8bf2b7b188 [NETROM]: Drop lock before calling nr_destroy_socket
nr_destroy_socket takes the socket lock itself so it should better be
called with the socket unlocked.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:45 -07:00
Ralf Baechle
5cc29e3bea [NETROM]: Fix locking order when establishing a NETROM circuit.
When establishing a new circuit in nr_rx_frame the locks are taken in
a different order than in the rest of the stack.  This should be
harmless but triggers lockdep.  Either way, reordering the code a
little solves the issue.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:43 -07:00
Ralf Baechle
95ff9f4d3c [AX.25]: Fix locking of ax25 protocol function list.
Delivery of AX.25 frame to the layer 3 protocols happens in softirq
context so locking needs to be bh-proof.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:40 -07:00
Brian Haley
e55ffac601 [IPV6]: order addresses by scope
If IPv6 addresses are ordered by scope, then ipv6_dev_get_saddr() can
break-out of the device addr_list for() loop when the candidate source
address scope is less than the destination address scope.

Signed-off-by: Brian Haley <brian.haley@hp.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-07-12 13:58:37 -07:00
Linus Torvalds
155dbfd884 Merge commit master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa of HEAD
* HEAD:
  [ALSA] Fix undefined (missing) references in ISA MIRO sound driver
  [ALSA] make sound/isa/gus/gusextreme.c:devices static
  [ALSA] hda-codec - Fix missing array terminators in AD1988 codec support
  [ALSA] Fix a deadlock in snd-rtctimer
  [ALSA] Fix section mismatch errors in ALSA PCI drivers
  [ALSA] remove unused snd_minor.name field
  [ALSA] Fix no mpu401 interface can cause hard freeze
  [ALSA] wavefront: fix __init/__devinit confusion
  [ALSA] Fix workaround for AD1988A rev2 codec
  [ALSA] trivial: Code clean up of i2c/cs8427.c
  [ALSA] sound/i2c/cs8427.c: don't export a static function
  [ALSA] intel8x0 - Add ac97 quirk for Tyan Thunder K8WE board
  [ALSA] Reduce the string length of Terratec Aureon 7.1 Universe
  [ALSA] sound/pci/Kconfig - fix broken indenting for SND_FM801_TEA575X
  [ALSA] fix the SND_FM801_TEA575X dependencies
  [ALSA] Memory leak in sound/pcmcia/pdaudiocf/pdaudiocf.c
2006-07-12 13:03:35 -07:00
Alan Cox
15e0c69436 [PATCH] ide: fix Jmicron support
Prior to 2.6.18rc1 you could install with devices on a JMicron chipset
using the "all-generic-ide" option. As of this kernel the AHCI driver
grabs the controller and rams it into AHCI mode losing the PATA ports
and making CD drives and the like vanish. The all-generic-ide option
fails because the AHCI driver grabbed the PCI device and reconfigured
it.

To fix this three things are needed.

#1 We must put the chip into dual function mode
#2 The AHCI driver must grab only function 0 (already in your rc1 tree)
#3 Something must grab the PATA ports

The attached patch is the minimal risk edition of this. It puts the chip
into dual function mode so that AHCI will grab the SATA ports without
losing the PATA ports. To keep the risk as low as possible the third
patch adds the PCI identifiers for the PATA port and the FN check to the
ide-generic driver. There is a more featured jmicron driver on its way
but that adds risk and the ide-generic support is sufficient to install
and run a system.

The actual chip setup done by the quirk is the precise setup recommended
by the vendor.

(The JMB368 appears only in the ide-generic entry as it has no AHCI so
does not need the quirk)

Signed-off-by: Alan Cox <alan@redhat.com>
Acked-by: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:59:35 -07:00
Chase Venters
f6dc8c5b8e [PATCH] Make cpu_relax() imply barrier() on all arches
During the recent discussion of taking 'volatile' off of the spinlock, I
noticed that while most arches #define cpu_relax() such that it implies
barrier(), some arches define cpu_relax() to be empty.

This patch changes the definition of cpu_relax() for frv, h8300, m68knommu,
sh, sh64, v850 and xtensa from an empty while(0) to the compiler barrier().

Signed-off-by: Chase Venters <chase.venters@clientec.com>
Acked-by: Arjan van de Ven <arjan@Linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:56:45 -07:00
Ingo Molnar
0f74964627 [PATCH] lockdep: HPET/RTC fix
Joseph Fannin reported that hpet_rtc_interrupt() enables hardirqs
in irq context:

[   25.628000]  [<c014af4e>] trace_hardirqs_on+0xce/0x200
[   25.628000]  [<c036cf21>] _spin_unlock_irq+0x31/0x70
[   25.628000]  [<c0296584>] rtc_get_rtc_time+0x44/0x1a0
[   25.628000]  [<c01198bb>] hpet_rtc_interrupt+0x21b/0x280
[   25.628000]  [<c0161141>] handle_IRQ_event+0x31/0x70
[   25.628000]  [<c0162d37>] handle_edge_irq+0xe7/0x210
[   25.628000]  [<c0106192>] do_IRQ+0x92/0x120
[   25.628000]  [<c0104121>] common_interrupt+0x25/0x2c

the call of rtc_get_rtc_time() is highly suspect. At a minimum we
need the patch below to save/restore hardirq state.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Joseph Fannin <jfannin@gmail.com>
Cc: John Stultz <johnstul@us.ibm.com>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:55 -07:00
Andrew Morton
a29b0b74e7 [PATCH] alloc_fdtable() expansion fix
We're supposed to go the next power of two if nfds==nr.

Of `nr', not of `nfsd'.

Spotted by Rene Scharfe <rene.scharfe@lsrfire.ath.cx>

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:55 -07:00
Eric W. Biederman
ec572e3f87 [PATCH] msi: Only keep one msi_desc in each slab entry.
It looks like someone confused kmem_cache_create with a different allocator
and was attempting to give it knowledge of how many cache entries there
were.

With the unfortunate result that each slab entry was big enough to hold
every irq.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:55 -07:00
Adam B. Jerome
0635170b54 [PATCH] /fs/proc/: 'larger than buffer size' memory accessed by clear_user()
Address a potential 'larger than buffer size' memory access by
clear_user().  Without this patch, this call to clear_user() can attempt to
clear too many (tsz) bytes resulting in a wrong (-EFAULT) return code by
read_kcore().

Signed-off-by: Adam B. Jerome <abj@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:55 -07:00
Arjan van de Ven
232ba9dbd6 [PATCH] lockdep: annotate the sysfs i_mutex to be a separate class
sysfs has a different i_mutex lock order behavior for i_mutex than the
other filesystems; sysfs i_mutex is called in many places with subsystem
locks held.  At the same time, many of the VFS locking rules do not apply
to sysfs at all (cross directory rename for example).  To untangle this
mess (which gives false positives in lockdep), we're giving sysfs inodes
their own class for i_mutex.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:54 -07:00
Kirill Korotaev
d579091b43 [PATCH] fix fdset leakage
When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:52:54 -07:00
Marcel Holtmann
abf75a5033 [PATCH] Fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)
Based on a patch from Ernie Petrides

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.

The prctl() system call should never allow to set "dumpable" to the
value 2. Especially not for non-privileged users.

This can be split into three cases:

  1) running as root -- then core dumps will already be done as root,
     and so prctl(PR_SET_DUMPABLE, 2) is not useful

  2) running as non-root w/setuid-to-root -- this is the debatable case

  3) running as non-root w/setuid-to-non-root -- then you definitely
     do NOT want "dumpable" to get set to 2 because you have the
     privilege escalation vulnerability

With case #2, the only potential usefulness is for a program that has
designed to run with higher privilege (than the user invoking it) that
wants to be able to create root-owned root-validated core dumps. This
might be useful as a debugging aid, but would only be safe if the program
had done a chdir() to a safe directory.

There is no benefit to a production setuid-to-root utility, because it
shouldn't be dumping core in the first place. If this is true, then the
same debugging aid could also be accomplished with the "suid_dumpable"
sysctl.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-12 12:50:25 -07:00
Randy Dunlap
d2a5b9d45f [ALSA] Fix undefined (missing) references in ISA MIRO sound driver
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_create
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_pcm
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_timer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_mixer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/fs/reiser4/reiser4.ko needs
unknown symbol generic_file_read

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-07-12 20:08:15 +02:00