- 10 Feb, 2006 14 commits
-
-
Adrian Bunk authored
CONFIG_PCMCIA=m, CONFIG_HOSTAP_CS=y doesn't compile. Reported by "Gabriel C." <crazy@pimpmylinux.org>. This patch was already included in 2.6.16-rc2. Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
Chris Wright <chrisw@sous-sol.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Davi Arnaut authored
In the small window between strnlen_user() and copy_from_user() userspace could alter the terminating `\0' character. Signed-off-by:
Davi Arnaut <davi.arnaut@gmail.com> Cc: David Howells <dhowells@redhat.com> Cc: <stable@kernel.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
David S. Miller authored
Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Dmitry Torokhov authored
Recent conversion to wait_event_interruptible_timeout() caused USB detection routine erroneously report timeouts for perfectly working devices. Signed-off-by:
Dmitry Torokhov <dtor@mail.ru> Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Zinx Verituse authored
Dynalloc conversion strikes again... Signed-off-by:
Vojtech Pavlik <vojtech@suse.cz> Signed-off-by:
-
Dmitry Torokhov authored
Input: db9 - fix possible crash with Saturn gamepads Signed-off-by:
-
Dmitry Torokhov authored
Signed-off-by:
-
Kimball Murray authored
Input: mousedev - fix memory leak Apparently, "while true; do cat </dev/null >/dev/input/mice; done" causes an OOM in a short amount of time. Funny that nobody noticed, it actually is very easy to trigger just by switching between VT1 and VT7... Signed-off-by:
Pete Zaitcev <zaitcev@redhat.com> Signed-off-by:
-
Nathan Scott authored
Fix regression in xfs_buf_rele dealing with non-hashed buffers, as occur during log replay. Novell bug 145204, Fedora bug 177848. Signed-off-by:
Nathan Scott <nathans@sgi.com> Signed-off-by:
-
Linus Torvalds authored
Don't try to "validate" a non-existing timeval. settime() with a NULL timeval is silly but legal. Noticed by Dave Jones <davej@redhat.com> Signed-off-by:
Linus Torvalds <torvalds@osdl.org> [chrisw: seclvl only] Signed-off-by:
-
Oleg Drokin authored
If we have found aliased dentry that we return, inode reference is not dropped and inode is not attached anywhere, so it seems the reference to inode is leaked in that case. Cc: Trond Myklebust <trond.myklebust@fys.uio.no>, Cc: <viro@parcelfarce.linux.theplanet.co.uk> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by:
-
Stefan Rompf authored
Zap the memory before freeing it so we don't leave crypto information around in memory. Signed-off-by:
Stefan Rompf <stefan@loplof.de> Acked-by:
Clemens Fruhwirth <clemens@endorphin.org> Acked-by:
Alasdair G Kergon <agk@redhat.com> Signed-off-by:
-
Jens Axboe authored
Turn off ordered flush barriers for SCSI driver, since the SCSI barrier code has a command leak. Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
- 06 Feb, 2006 2 commits
-
-
Chris Wright authored
-
Herbert Xu authored
When two ip_route_output_key lookups in icmp_send were combined I forgot to change the error path for ip_options_echo to not drop the dst reference since it now sits before the dst lookup. To fix it we simply jump past the ip_rt_put call. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
- 31 Jan, 2006 12 commits
-
-
Greg Kroah-Hartman authored
-
Ralf Baechle DL5RB authored
ax_encaps() forgot to drop the bufferlock at the end of the function. Patch is already in 2.6.16-rc1. Signed-off-by:
Ralf Baechle DL5RB <ralf@linux-mips.org> Signed-off-by:
-
Markus Lidel authored
>From http://bugzilla.kernel.org/show_bug.cgi?id=5923 When a scsi command failed, an oops would result. Back-to-back SMART queries would make the Seagate drives unhappy. The second SMART query would timeout, and the command would be aborted. From: Markus Lidel <Markus.Lidel@shadowconnect.com> Cc: Kenny Simpson <theonetruekenny@yahoo.com> Signed-off-by:
-
Vitaly Fertman authored
Signed-off-by:
Hans Reiser <reiser@namesys.com> Signed-off-by:
Vitaly Fertman <vitaly@namesys.com> Signed-off-by:
-
Andi Kleen authored
Mask off GFP flags before swiotlb_alloc_coherent Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
Chris Wright <chris@sous-sol.org> Signed-off-by:
-
David S. Miller authored
Some subsystems, such as PPP, can send negative values here. It just happened to work correctly on 32-bit with an unsigned value, but on 64-bit this explodes. Figured out by Paul Mackerras based upon several PPP crash reports. Signed-off-by:
-
Richard Mortimer authored
[SPARC64]: Eliminate race condition reading Hummingbird STICK register Ensure a consistent value is read from the STICK register by ensuring that both high and low are read without high changing due to a roll over of the low register. Various Debian/SPARC users (myself include) have noticed problems with Hummingbird based systems. The symptoms are that the system time is seen to jump forward 3 days, 6 hours, 11 minutes give or take a few seconds. In many cases the system then hangs some time afterwards. I've spotted a race condition in the code to read the STICK register. I could not work out why 3d, 6h, 11m is important but guess that it is due to the 2^32 jump of STICK (forwards on one read and then the next read will seem to be backwards) during a timer interrupt. I'm guessing that a change of -2^32 will get converted to a large unsigned increment after the arithmetic manipulation between STICK, nanoseconds, jiffies etc. I did a test where I modified __hbird_read_stick to artificially inject rollover faults forcefully every few seconds. With this I saw the clock jump over 6 times in 12 hours compared to once every month or so. Signed-off-by:
Richard Mortimer <richm@oldelvet.org.uk> Signed-off-by:
-
Evgeniy authored
There's a lack of parenthesis in fs/ufs/utils.h, so instead of the 512th byte of buffer, the usb2 pointer will point to the nth structure of type ufs_super_block_second. This can cause a mount-time oops if you're unlucky (especially with DEBUG_PAGEALLOC, which is how Alexey Dobriyan saw this problem) Signed-off-by:
Evgeniy Dushistov <dushistov@mail.ru> Acked-by:
-
Alexander Viro authored
Fixed the refcounting on failure exits in sys_mq_open() and cleaned the logics up. Rules are actually pretty simple - dentry_open() expects vfsmount and dentry to be pinned down and it either transfers them into created struct file or drops them. Old code had been very confused in that area - if dentry_open() had failed either in do_open() or do_create(), we ended up dentry and mqueue_mnt dropped twice, once by dentry_open() cleanup and then by sys_mq_open(). Fix consists of making the rules for do_create() and do_open() same as for dentry_open() and updating the sys_mq_open() accordingly; that actually leads to more straightforward code and less work on normal path. Signed-off-by:
Al Viro <aviro@redhat.com> Signed-off-by:
-
Dmitry Torokhov authored
Input: HID - fix an oops in PID initialization code Signed-off-by:
-
Jens Axboe authored
[BLOCK] Kill blk_attempt_remerge() It's a broken interface, it's done way too late. And apparently it triggers slab problems in recent kernels as well (most likely after the generic dispatch code was merged). So kill it, ide-cd is the only user of it. Signed-off-by:
-
Clemens Ladisch authored
Some widespread USB interface chips with adaptive iso endpoints hang after receiving a series of empty packets when they expect data. This completely disables audio playback on those devices. To avoid this, we have to send packets containing silence (zero samples) instead. ALSA bug: http://bugtrack.alsa-project.org/alsa-bug/view.php?id=1585Signed-off-by:
Clemens Ladisch <clemens@ladisch.de> Signed-off-by:
-
- 15 Jan, 2006 12 commits
-
-
Chris Wright authored
-
Adrian Bunk authored
This patch fixes a typo in the dependencies of HUGETLB_PAGE_SIZE_64K. This bug was reported by Jean-Luc Leger <reiga@dspnet.fr.eu.org>. Signed-off-by:
-
Andrey Borzenkov authored
dev->get_wireless_stats is deprecated but removing it also removes wireless subdirectory in sysfs. This patch puts it back. akpm: I don't know what's happening here. This might be appropriate as a 2.6.15.x compatibility backport. Waiting to hear from Jeff. Signed-off-by:
Andrey Borzenkov <arvidjaar@mail.ru> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jeff Garzik <jgarzik@pobox.com> Cc: <stable@kernel.org> Signed-off-by:
-
Alan Cox authored
This requires the proper capabilities for the moxa bios update ioctl's. Signed-off-by:
Alan Cox <alan@redhat.com> Signed-off-by:
-
Martin Murray authored
Sanity check nlmsg_len during netlink_rcv_skb. An nlmsg_len == 0 can cause infinite loop in kernel, effectively DoSing machine. Noted by Martin Murray. Signed-off-by:
-
David S. Miller authored
Noticed by Jakub Jelinek. Signed-off-by:
-
Richard Mortimer authored
Don't clobber register %l0 while checking TI_SYS_NOERROR value in syscall return path. This bug was introduced by: db7d9a4e Problem narrowed down by Luis F. Ortiz and Richard Mortimer. I tried using %l2 as suggested by Luis and that works for me. Looking at the code I wonder if it makes sense to simplify the code a little bit. The following works for me but I'm not sure how to exercise the "NOERROR" codepath. Signed-off-by:
-
Bart De Schuymer authored
Signed-off-by:
Bart De Schuymer <bdschuym@pandora.be> Signed-off-by:
-
Patrick McHardy authored
The PPTP NAT helper calculates the offset at which the packet needs to be mangled as difference between two pointers to the header. With non-linear skbs however the pointers may point to two seperate buffers on the stack and the calculation results in a wrong offset beeing used. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Patrick McHardy authored
When an inbound PPTP_IN_CALL_REQUEST packet is received the PPTP NAT helper uses a NULL pointer in pointer arithmentic to calculate the offset in the packet which needs to be mangled and corrupts random memory or crashes. Signed-off-by:
-
Kirill Korotaev authored
Fixed oops after failed netlink socket creation. Wrong parathenses in if() statement caused err to be 1, instead of negative value. Trivial fix, not trivial to find though. Signed-Off-By:
Dmitry Mishin <dim@sw.ru> Signed-Off-By:
Kirill Korotaev <dev@openvz.org> Signed-off-by:
-
Nathan Lynch authored
Use first_cpu(cpu_possible_map) for the single-thread workqueue case. We used to hardcode 0, but that broke on systems where !cpu_possible(0) when workqueue_struct->cpu_workqueue_struct was changed from a static array to alloc_percpu. Commit id bce61dd4 ("Fix hardcoded cpu=0 in workqueue for per_cpu_ptr() calls") fixed that for Ben's funky sparc64 system, but it regressed my Power5. Offlining cpu 0 oopses upon the next call to queue_work for a single-thread workqueue, because now we try to manipulate per_cpu_ptr(wq->cpu_wq, 1), which is uninitialized. So we need to establish an unchanging "slot" for single-thread workqueues which will have a valid percpu allocation. Since alloc_percpu keys off of cpu_possible_map, which must not change after initialization, make this slot == first_cpu(cpu_possible_map). Signed-off-by:
Nathan Lynch <ntl@pobox.com> Cc: <stable@kernel.org> Signed-off-by:
-
