- 14 Dec, 2005 1 commit
-
-
Adrian Bunk authored
The Coverity checker spotted this obvious use-after-free Signed-off-by:
Adrian Bunk <bunk@stusta.de> Acked-by:
Mark Salyzyn <mark_salyzyn@adaptec.com> Signed-off-by:
Chris Wright <chrisw@osdl.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
- 24 Nov, 2005 24 commits
-
-
Chris Wright authored
-
Jean Delvare authored
Fix a bug where setting the low fan speed limits will not work if no data was ever read through the sysfs interface and the fan clock dividers have not been explicitely set yet either. The reason is that data->fan_div[nr] may currently be used before it is initialized from the chip register values. The fix is to explicitely initialize data->fan_div[nr] before using it. Bug reported, and fix tested, by Nicolas Mailhot. Signed-off-by:
Jean Delvare <khali@linux-fr.org> Signed-off-by:
-
Jean Delvare authored
Fix the lm78 VID reading, which I accidentally broke while making this driver use the common vid_from_reg function rather than reimplementing its own in 2.6.14-rc1. I'm not proud of it, trust me. Signed-off-by:
-
Yuan Mu authored
Add SENSORS_LIMIT in store VCore limit functions. This fixes a potential u8 overflow on out-of-range user input. Signed-off-by:
-
Adrian Bunk authored
It's not good if caller and callee disagree regarding the type of the arguments. In this case, this could cause problems on 64bit architectures. Signed-off-by:
Armin Schindler <armin@melware.de> Signed-off-by:
-
Andi Kleen authored
Force correct address space size for MTRR on some 64bit Intel Xeons They report 40bit, but only have 36bits of physical address space. This caused problems with setting up the correct masks for MTRR, resulting in incorrect MTRRs. CPUID workaround for steppings 0F33h(supporting x86) and 0F34h(supporting x86 and EM64T). Detail info can be found at: http://download.intel.com/design/Xeon/specupdt/30240216.pdf http://download.intel.com/design/Pentium4/specupdt/30235221.pdf Signed-off-by: Shaohua Li<shaohua.li@intel.com> Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
-
YOSHIFUJI Hideaki authored
Based on suggestion from Masahide Nakamura <nakam@linux-ipv6.org>. Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
Ville Nuorvala authored
Signed-off-by:
-
YOSHIFUJI Hideaki authored
Signed-off-by:
-
Harald Welte authored
Since we've converted the ftp/irc/tftp helpers to use the new module_parm_array() some time ago, we ware accidentially using signed data types - thus preventing those modules from being used on ports >= 32768. This patch fixes it by using 'ushort' module parameters. Thanks to Jan Nijs for reporting this bug. Signed-off-by:
Harald Welte <laforge@netfilter.org> Signed-off-by:
-
Vlad Drukker authored
Some devices (e.g. Qlogic iSCSI HBA hardware like QLA4010 up to firmware 3.0.0.4) initiates TCP with SYN and PUSH flags set. The Linux TCP/IP stack deals fine with that, but the connection tracking code doesn't. This patch alters TCP connection tracking to accept SYN+PUSH as a valid flag combination. Signed-off-by:
Vlad Drukker <vlad@storewiz.com> Signed-off-by:
-
Krzysztof Piotr Oledzki authored
This patch fixes an userspace triggered oops. If there is no ICMP_ID info the reference to attr will be NULL. Signed-off-by:
Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
-
Philip Craig authored
The reply tuple of the PNS->PAC expectation was using the wrong call id. So we had the following situation: - PNS behind NAT firewall - PNS call id requires NATing - PNS->PAC gre packet arrives first then the PNS->PAC expectation is matched, and the other expectation is deleted, but the PAC->PNS gre packets do not match the gre conntrack because the call id is wrong. We also cannot use ip_nat_follow_master(). Signed-off-by:
Philip Craig <philipc@snapgear.com> Signed-off-by:
-
Harald Welte authored
This fixes an oops triggered from userspace. If we don't pass information about the private protocol info, the reference to attr will be NULL. This is likely to happen in update messages. Signed-off-by:
-
Yasuyuki Kozakai authored
Signed-off-by:
Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp> Signed-off-by:
-
Harald Welte authored
With the new nf_queue generalization in 2.6.14, we've introduced a bug that causes an oops as soon as a packet is queued but no queue handler registered. This patch fixes it. Signed-off-by:
-
Rusty Rusty authored
The unknown protocol is used as a fallback when a protocol isn't known. Hence we cannot handle it failing, so don't set ".me". It's OK, since we only grab a reference from within the same module (iptable_nat.ko), so we never take the module refcount from 0 to 1. Also, remove the "protocol is NULL" test: it's never NULL. Signed-off-by:
Rusty Rusty <rusty@rustcorp.com.au> Signed-off-by:
-
Harald Welte authored
This endianness bug slipped through while changing the 'gre.key' field in the conntrack tuple from 32bit to 16bit. None of my tests caught the problem, since the linux pptp client always has '0' as call id / gre key. Only windows clients actually trigger the bug. Signed-off-by:
-
Krzysztof Halasa authored
As we are currently unable to fix the problem with carrier and protocol state signaling in net core I've to disable netif_carrier_off() calls used by WAN protocol drivers. The attached patch should make them working again. The remaining netif_carrier_*() calls in hdlc_fr.c are fine as they don't touch the physical device. Signed-off-by:
Krzysztof Halasa <khc@pm.waw.pl> Signed-off-by:
-
J. Bruce Fields authored
The patch http://linux.bkbits.net:8080/linux-2.6/diffs/fs/locks.c@1.70??nav=index.html introduced a pretty nasty memory leak in the lease code. When freeing the lease, the code in locks_delete_lock() will correctly clean up the fasync queue, but when we return to fcntl_setlease(), the freed fasync entry will be reinstated. This patch ensures that we skip the call to fasync_helper() when we're freeing up the lease. Signed-off-by:
J. Bruce Fields <bfields@fieldses.org> Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by:
-
Peter Osterlund authored
There is an old bug in the pkt_count_states() function that causes stack corruption. When compiling with gcc 3.x or 2.x it is harmless, but gcc 4 allocates local variables differently, which makes the bug visible. Signed-off-by:
Peter Osterlund <petero2@telia.com> Cc: <stable@kernel.org> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Takashi Iwai authored
Fixed the soft lockup of ALSA rtc-timer due to the wrong irq handling in rtc_control(). The call of rtc_control() can be atomic. Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Oleg Nesterov authored
If a task is being traced we never auto-reap it even if it might look like its parent doesn't care. The tracer obviously _does_ care. Signed-off-by:
Linus Torvalds <torvalds@osdl.org> Signed-off-by:
-
Joel Schopp authored
Signed-off-by:
Andy Whitcroft <apw@shadowen.org> Signed-off-by:
Joel Schopp <jschopp@austin.ibm.com> Signed-off-by:
-
- 11 Nov, 2005 13 commits
-
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
Before we did CLONE_THREAD, the way to check whether we were attaching to ourselves was to just check "current == task", but with CLONE_THREAD we should check that the thread group ID matches instead. Signed-off-by: -
Ivan Kokshaysky authored
barrier.h uses barrier() in non-SMP case. And doesn't include compiler.h. Cc: Al Viro <viro@ftp.linux.org.uk> Signed-off-by:
-
Julian Anastasov authored
There was a fix in 2.6.13 that changed the behaviour of ip_vs_conn_expire_now function not to put reference to connection, its callers should hold write lock or connection refcnt. But we forgot to convert one caller, when the real server for connection is unavailable caller should put the connection reference. It happens only when sysctl var expire_nodest_conn is set to 1 and such connections never expire. Thanks to Roberto Nibali who found the problem and tested a 2.4.32-rc2 patch, which is equal to this 2.6 version. Signed-off-by:
Julian Anastasov <ja@ssi.bg> Signed-off-by:
Roberto Nibali <ratz@drugphish.ch> Signed-off-by:
-
Oleg Nesterov authored
When non-leader thread does exec, de_thread calls release_task(leader) before calling exit_itimers(). If local timer interrupt happens in between, it can oops in send_group_sigqueue() while taking ->sighand->siglock == NULL. However, we can't change send_group_sigqueue() to check p->signal != NULL, because sys_timer_create() does get_task_struct() only in SIGEV_THREAD_ID case. So it is possible that this task_struct was already freed and we can't trust p->signal. This patch changes de_thread() so that leader released after exit_itimers() call. Signed-off-by:
Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by:
-
Oleg Nesterov authored
exit_signal() (called from copy_process's error path) should decrement ->signal->live, otherwise forking process will miss 'group_dead' in do_exit(). Signed-off-by:
-
Herbert Xu authored
The recent rewrite of skb_copy_datagram_iovec broke the reception of zero-size datagrams. This patch fixes it. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Adrian Bunk authored
This patch creates a file airo.h containing prototypes of the global functions in airo.c used by airo_cs.c . If you got strange problems with either airo_cs devices or in any other completely unrelated part of the kernel shortly or long after a airo_cs device was detected by the kernel, this might have been caused by the fact that caller and callee disagreed regarding the size of the first argument to init_airo_card()... Signed-off-by:
-
Stephen Hemminger authored
The max growth of BIC TCP is too large. Original code was based on BIC 1.0 and the default there was 32. Later code (2.6.13) included compensation for delayed acks, and should have reduced the default value to 16; since normally TCP gets one ack for every two packets sent. The current value of 32 makes BIC too aggressive and unfair to other flows. Submitted-by:
Injong Rhee <rhee@eos.ncsu.edu> Signed-off-by:
Stephen Hemminger <shemminger@osdl.org> Signed-off-by:
-
Greg Kroah-Hartman authored
This fixes a problem with some cdc acm devices that were not getting automatically loaded as the module alias was not being reported properly. This check was for back in the days when we only reported hotplug events for the main usb device, not the interfaces. We should always give the interface information for MODALIAS/modalias as it can be needed. Signed-off-by: -
Jens Axboe authored
Paul Collins wrote: >I boot with elevator=cfq (wanted to try the ionice stuff, never got >around to it). Having decided to go back to the anticipatory >scheduler, I did the following: > ># echo anticipatory > /sys/block/hda/queue/scheduler ># echo anticipatory > /sys/block/hdc/queue/scheduler > >A while later I did 'sudo snooze', which produced the Oops below. > >Booting with elevator=as and then changing to cfq, sleep works fine. >But if I resume and change back to anticipatory I get a similar Oops >on the next 'sudo snooze'. > > > Oops: kernel access of bad area, sig: 11 [#1] > NIP: C01E1948 LR: C01D6A60 SP: EFBC5C20 REGS: efbc5b70 TRAP: 0300 >Not tainted > MSR: 00001032 EE: 0 PR: 0 FP: 0 ME: 1 IR/DR: 11 > DAR: 00000020, DSISR: 40000000 > TASK = efb012c0[1213] 'pmud' THREAD: efbc4000 > Last syscall: 54 GPR00: 00080000 EFBC5C20 EFB012C0 EFE9E044 >EFBC5CE8 00000002 00000000 C03B0000 GPR08: C046E5D8 00000000 >C03B47C8 E6A58360 22042422 1001E4DC 10010000 10000000 GPR16: >10000000 10000000 10000000 7FE4EB40 10000000 10000000 10010000 >C0400000 GPR24: C0380000 00000002 00000002 C046E0C0 00000000 >00000002 00000000 EFBC5CE8 NIP [c01e1948] as_insert_request+0xa8/0x6b0 > LR [c01d6a60] __elv_add_request+0xa0/0x100 > Call trace: > [c01d6a60] __elv_add_request+0xa0/0x100 > [c01ffb84] ide_do_drive_cmd+0xb4/0x190 > [c01fc1c0] generic_ide_suspend+0x80/0xa0 > [c01d4574] suspend_device+0x104/0x160 > [c01d47c0] device_suspend+0x120/0x330 > [c03f3b50] pmac_suspend_devices+0x50/0x1b0 > [c03f4294] pmu_ioctl+0x344/0x9b0 > [c0082aa4] do_ioctl+0x84/0x90 > [c0082b3c] vfs_ioctl+0x8c/0x460 > [c0082f50] sys_ioctl+0x40/0x80 > [c0004850] ret_from_syscall+0x0/0x4c Don't clear ->elevator_data on exit, if we are switching queues we are overwriting the data of the new io scheduler. Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
Dimitri Puzin authored
This patch by Dimitri Puzin submitted through kernel Bugzilla #5514 fixes the following issue: Cannot build XFS filesystem support as module with quota support. It works only when the XFS filesystem support is compiled into the kernel. Menuconfig prevents from setting CONFIG_XFS_FS=m and CONFIG_XFS_QUOTA=y. How to reproduce: configure the XFS filesystem with quota support as module. The resulting kernel won't have quota support compiled into xfs.ko. Fix: Changing the fs/xfs/Kconfig file from tristate to bool lets you configure the quota support to be compiled into the XFS module. The Makefile-linux-2.6 checks only for CONFIG_XFS_QUOTA=y. Signed-off-by:
Nathan Scott <nathans@sgi.com> Signed-off-by:
-
Roger While authored
prism54 is leaking information when passing transmits to the firmware. There is no requirement to adjust the length to >= ETH_ZLEN. Just pass the skb length (after possible adjustment). Signed-off-by:
Roger While <simrw@sim-basis.de> Acked-by:
Jeff Garzik <jgarzik@pobox.com> Signed-off-by:
-
- 08 Nov, 2005 2 commits
-
-
Greg Kroah-Hartman authored
-
Al Viro authored
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then wait for interface to go away, try to grab as much memory as possible in hope to hit the (kfreed) ctl_table. Then fill it with pointers to your function. Then do read from file you've opened and if you are lucky, you'll get it called as ->proc_handler() in kernel mode. So this is at least an Oops and possibly more. It does depend on an interface going away though, so less of a security risk than it would otherwise be. Signed-off-by:
-
