- 24 Nov, 2005 19 commits
-
-
Andi Kleen authored
Force correct address space size for MTRR on some 64bit Intel Xeons They report 40bit, but only have 36bits of physical address space. This caused problems with setting up the correct masks for MTRR, resulting in incorrect MTRRs. CPUID workaround for steppings 0F33h(supporting x86) and 0F34h(supporting x86 and EM64T). Detail info can be found at: http://download.intel.com/design/Xeon/specupdt/30240216.pdf http://download.intel.com/design/Pentium4/specupdt/30235221.pdf Signed-off-by: Shaohua Li<shaohua.li@intel.com> Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
Chris Wright <chrisw@osdl.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
YOSHIFUJI Hideaki authored
Based on suggestion from Masahide Nakamura <nakam@linux-ipv6.org>. Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
Ville Nuorvala authored
Signed-off-by:
-
YOSHIFUJI Hideaki authored
Signed-off-by:
-
Harald Welte authored
Since we've converted the ftp/irc/tftp helpers to use the new module_parm_array() some time ago, we ware accidentially using signed data types - thus preventing those modules from being used on ports >= 32768. This patch fixes it by using 'ushort' module parameters. Thanks to Jan Nijs for reporting this bug. Signed-off-by:
Harald Welte <laforge@netfilter.org> Signed-off-by:
-
Vlad Drukker authored
Some devices (e.g. Qlogic iSCSI HBA hardware like QLA4010 up to firmware 3.0.0.4) initiates TCP with SYN and PUSH flags set. The Linux TCP/IP stack deals fine with that, but the connection tracking code doesn't. This patch alters TCP connection tracking to accept SYN+PUSH as a valid flag combination. Signed-off-by:
Vlad Drukker <vlad@storewiz.com> Signed-off-by:
-
Krzysztof Piotr Oledzki authored
This patch fixes an userspace triggered oops. If there is no ICMP_ID info the reference to attr will be NULL. Signed-off-by:
Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
-
Philip Craig authored
The reply tuple of the PNS->PAC expectation was using the wrong call id. So we had the following situation: - PNS behind NAT firewall - PNS call id requires NATing - PNS->PAC gre packet arrives first then the PNS->PAC expectation is matched, and the other expectation is deleted, but the PAC->PNS gre packets do not match the gre conntrack because the call id is wrong. We also cannot use ip_nat_follow_master(). Signed-off-by:
Philip Craig <philipc@snapgear.com> Signed-off-by:
-
Harald Welte authored
This fixes an oops triggered from userspace. If we don't pass information about the private protocol info, the reference to attr will be NULL. This is likely to happen in update messages. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by:
-
Harald Welte authored
With the new nf_queue generalization in 2.6.14, we've introduced a bug that causes an oops as soon as a packet is queued but no queue handler registered. This patch fixes it. Signed-off-by:
-
Rusty Rusty authored
The unknown protocol is used as a fallback when a protocol isn't known. Hence we cannot handle it failing, so don't set ".me". It's OK, since we only grab a reference from within the same module (iptable_nat.ko), so we never take the module refcount from 0 to 1. Also, remove the "protocol is NULL" test: it's never NULL. Signed-off-by:
Rusty Rusty <rusty@rustcorp.com.au> Signed-off-by:
-
Harald Welte authored
This endianness bug slipped through while changing the 'gre.key' field in the conntrack tuple from 32bit to 16bit. None of my tests caught the problem, since the linux pptp client always has '0' as call id / gre key. Only windows clients actually trigger the bug. Signed-off-by:
-
Krzysztof Halasa authored
As we are currently unable to fix the problem with carrier and protocol state signaling in net core I've to disable netif_carrier_off() calls used by WAN protocol drivers. The attached patch should make them working again. The remaining netif_carrier_*() calls in hdlc_fr.c are fine as they don't touch the physical device. Signed-off-by:
Krzysztof Halasa <khc@pm.waw.pl> Signed-off-by:
-
J. Bruce Fields authored
The patch http://linux.bkbits.net:8080/linux-2.6/diffs/fs/locks.c@1.70??nav=index.html introduced a pretty nasty memory leak in the lease code. When freeing the lease, the code in locks_delete_lock() will correctly clean up the fasync queue, but when we return to fcntl_setlease(), the freed fasync entry will be reinstated. This patch ensures that we skip the call to fasync_helper() when we're freeing up the lease. Signed-off-by:
J. Bruce Fields <bfields@fieldses.org> Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by:
-
Peter Osterlund authored
There is an old bug in the pkt_count_states() function that causes stack corruption. When compiling with gcc 3.x or 2.x it is harmless, but gcc 4 allocates local variables differently, which makes the bug visible. Signed-off-by:
Peter Osterlund <petero2@telia.com> Cc: <stable@kernel.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Takashi Iwai authored
Fixed the soft lockup of ALSA rtc-timer due to the wrong irq handling in rtc_control(). The call of rtc_control() can be atomic. Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Oleg Nesterov authored
If a task is being traced we never auto-reap it even if it might look like its parent doesn't care. The tracer obviously _does_ care. Signed-off-by:
Linus Torvalds <torvalds@osdl.org> Signed-off-by:
-
Joel Schopp authored
Signed-off-by:
Andy Whitcroft <apw@shadowen.org> Signed-off-by:
Joel Schopp <jschopp@austin.ibm.com> Signed-off-by:
-
- 11 Nov, 2005 13 commits
-
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
Before we did CLONE_THREAD, the way to check whether we were attaching to ourselves was to just check "current == task", but with CLONE_THREAD we should check that the thread group ID matches instead. Signed-off-by: -
Ivan Kokshaysky authored
barrier.h uses barrier() in non-SMP case. And doesn't include compiler.h. Cc: Al Viro <viro@ftp.linux.org.uk> Signed-off-by:
-
Julian Anastasov authored
There was a fix in 2.6.13 that changed the behaviour of ip_vs_conn_expire_now function not to put reference to connection, its callers should hold write lock or connection refcnt. But we forgot to convert one caller, when the real server for connection is unavailable caller should put the connection reference. It happens only when sysctl var expire_nodest_conn is set to 1 and such connections never expire. Thanks to Roberto Nibali who found the problem and tested a 2.4.32-rc2 patch, which is equal to this 2.6 version. Signed-off-by:
Julian Anastasov <ja@ssi.bg> Signed-off-by:
Roberto Nibali <ratz@drugphish.ch> Signed-off-by:
-
Oleg Nesterov authored
When non-leader thread does exec, de_thread calls release_task(leader) before calling exit_itimers(). If local timer interrupt happens in between, it can oops in send_group_sigqueue() while taking ->sighand->siglock == NULL. However, we can't change send_group_sigqueue() to check p->signal != NULL, because sys_timer_create() does get_task_struct() only in SIGEV_THREAD_ID case. So it is possible that this task_struct was already freed and we can't trust p->signal. This patch changes de_thread() so that leader released after exit_itimers() call. Signed-off-by:
Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by:
-
Oleg Nesterov authored
exit_signal() (called from copy_process's error path) should decrement ->signal->live, otherwise forking process will miss 'group_dead' in do_exit(). Signed-off-by:
-
Herbert Xu authored
The recent rewrite of skb_copy_datagram_iovec broke the reception of zero-size datagrams. This patch fixes it. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Adrian Bunk authored
This patch creates a file airo.h containing prototypes of the global functions in airo.c used by airo_cs.c . If you got strange problems with either airo_cs devices or in any other completely unrelated part of the kernel shortly or long after a airo_cs device was detected by the kernel, this might have been caused by the fact that caller and callee disagreed regarding the size of the first argument to init_airo_card()... Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
-
Stephen Hemminger authored
The max growth of BIC TCP is too large. Original code was based on BIC 1.0 and the default there was 32. Later code (2.6.13) included compensation for delayed acks, and should have reduced the default value to 16; since normally TCP gets one ack for every two packets sent. The current value of 32 makes BIC too aggressive and unfair to other flows. Submitted-by:
Injong Rhee <rhee@eos.ncsu.edu> Signed-off-by:
Stephen Hemminger <shemminger@osdl.org> Signed-off-by:
-
Greg Kroah-Hartman authored
This fixes a problem with some cdc acm devices that were not getting automatically loaded as the module alias was not being reported properly. This check was for back in the days when we only reported hotplug events for the main usb device, not the interfaces. We should always give the interface information for MODALIAS/modalias as it can be needed. Signed-off-by: -
Jens Axboe authored
Paul Collins wrote: >I boot with elevator=cfq (wanted to try the ionice stuff, never got >around to it). Having decided to go back to the anticipatory >scheduler, I did the following: > ># echo anticipatory > /sys/block/hda/queue/scheduler ># echo anticipatory > /sys/block/hdc/queue/scheduler > >A while later I did 'sudo snooze', which produced the Oops below. > >Booting with elevator=as and then changing to cfq, sleep works fine. >But if I resume and change back to anticipatory I get a similar Oops >on the next 'sudo snooze'. > > > Oops: kernel access of bad area, sig: 11 [#1] > NIP: C01E1948 LR: C01D6A60 SP: EFBC5C20 REGS: efbc5b70 TRAP: 0300 >Not tainted > MSR: 00001032 EE: 0 PR: 0 FP: 0 ME: 1 IR/DR: 11 > DAR: 00000020, DSISR: 40000000 > TASK = efb012c0[1213] 'pmud' THREAD: efbc4000 > Last syscall: 54 GPR00: 00080000 EFBC5C20 EFB012C0 EFE9E044 >EFBC5CE8 00000002 00000000 C03B0000 GPR08: C046E5D8 00000000 >C03B47C8 E6A58360 22042422 1001E4DC 10010000 10000000 GPR16: >10000000 10000000 10000000 7FE4EB40 10000000 10000000 10010000 >C0400000 GPR24: C0380000 00000002 00000002 C046E0C0 00000000 >00000002 00000000 EFBC5CE8 NIP [c01e1948] as_insert_request+0xa8/0x6b0 > LR [c01d6a60] __elv_add_request+0xa0/0x100 > Call trace: > [c01d6a60] __elv_add_request+0xa0/0x100 > [c01ffb84] ide_do_drive_cmd+0xb4/0x190 > [c01fc1c0] generic_ide_suspend+0x80/0xa0 > [c01d4574] suspend_device+0x104/0x160 > [c01d47c0] device_suspend+0x120/0x330 > [c03f3b50] pmac_suspend_devices+0x50/0x1b0 > [c03f4294] pmu_ioctl+0x344/0x9b0 > [c0082aa4] do_ioctl+0x84/0x90 > [c0082b3c] vfs_ioctl+0x8c/0x460 > [c0082f50] sys_ioctl+0x40/0x80 > [c0004850] ret_from_syscall+0x0/0x4c Don't clear ->elevator_data on exit, if we are switching queues we are overwriting the data of the new io scheduler. Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
Dimitri Puzin authored
This patch by Dimitri Puzin submitted through kernel Bugzilla #5514 fixes the following issue: Cannot build XFS filesystem support as module with quota support. It works only when the XFS filesystem support is compiled into the kernel. Menuconfig prevents from setting CONFIG_XFS_FS=m and CONFIG_XFS_QUOTA=y. How to reproduce: configure the XFS filesystem with quota support as module. The resulting kernel won't have quota support compiled into xfs.ko. Fix: Changing the fs/xfs/Kconfig file from tristate to bool lets you configure the quota support to be compiled into the XFS module. The Makefile-linux-2.6 checks only for CONFIG_XFS_QUOTA=y. Signed-off-by:
Nathan Scott <nathans@sgi.com> Signed-off-by:
-
Roger While authored
prism54 is leaking information when passing transmits to the firmware. There is no requirement to adjust the length to >= ETH_ZLEN. Just pass the skb length (after possible adjustment). Signed-off-by:
Roger While <simrw@sim-basis.de> Acked-by:
Jeff Garzik <jgarzik@pobox.com> Signed-off-by:
-
- 08 Nov, 2005 2 commits
-
-
Greg Kroah-Hartman authored
-
Al Viro authored
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then wait for interface to go away, try to grab as much memory as possible in hope to hit the (kfreed) ctl_table. Then fill it with pointers to your function. Then do read from file you've opened and if you are lucky, you'll get it called as ->proc_handler() in kernel mode. So this is at least an Oops and possibly more. It does depend on an interface going away though, so less of a security risk than it would otherwise be. Signed-off-by:
-
- 28 Oct, 2005 1 commit
-
-
Linus Torvalds authored
"Better late than never"
-
- 27 Oct, 2005 5 commits
-
-
Linus Torvalds authored
-
Dave Jones authored
Don't try to access not-present CPUs. Conservative governor will always oops on SMP without this fix. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=4781Signed-off-by:
Venkatesh Pallipadi <venkatesh.pallipadi@intel.com> Signed-off-by:
Dave Jones <davej@redhat.com> Signed-off-by:
-
Linus Torvalds authored
Commit id 6142891a Andi Kleen reports that it seems to break things for some people, and since it's purely a small optimization, revert it for now. Signed-off-by:
-
Herbert Xu authored
This bug is responsible for causing the infamous "Treason uncloaked" messages that's been popping up everywhere since the printk was added. It has usually been blamed on foreign operating systems. However, some of those reports implicate Linux as both systems are running Linux or the TCP connection is going across the loopback interface. In fact, there really is a bug in the Linux TCP header prediction code that's been there since at least 2.1.8. This bug was tracked down with help from Dale Blount. The effect of this bug ranges from harmless "Treason uncloaked" messages to hung/aborted TCP connections. The details of the bug and fix is as follows. When snd_wnd is updated, we only update pred_flags if tcp_fast_path_check succeeds. When it fails (for example, when our rcvbuf is used up), we will leave pred_flags with an out-of-date snd_wnd value. When the out-of-date pred_flags happens to match the next incoming packet we will again hit the fast path and use the current snd_wnd which will be wrong. In the case of the treason messages, it just happens that the snd_wnd cached in pred_flags is zero while tp->snd_wnd is non-zero. Therefore when a zero-window packet comes in we incorrectly conclude that the window is non-zero. In fact if the peer continues to send us zero-window pure ACKs we will continue making the same mistake. It's only when the peer transmits a zero-window packet with data attached that we get a chance to snap out of it. This is what triggers the treason message at the next retransmit timeout. Signed-off-by:
Arnaldo Carvalho de Melo <acme@mandriva.com>
-
Roland McGrath authored
This just makes sure that a thread's expiry times can't get reset after it clears them in do_exit. This is what allowed us to re-introduce the stricter BUG_ON() check in a362f463. Signed-off-by:
-
