- 22 May, 2006 11 commits
-
-
Patrick McHardy authored
Fix memory corruption caused by snmp_trap_decode: - When snmp_trap_decode fails before the id and address are allocated, the pointers contain random memory, but are freed by the caller (snmp_parse_mangle). - When snmp_trap_decode fails after allocating just the ID, it tries to free both address and ID, but the address pointer still contains random memory. The caller frees both ID and random memory again. - When snmp_trap_decode fails after allocating both, it frees both, and the callers frees both again. The corruption can be triggered remotely when the ip_nat_snmp_basic module is loaded and traffic on port 161 or 162 is NATed. Found by multiple testcases of the trap-app and trap-enc groups of the PROTOS c06-snmpv1 testsuite. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Alexey Dobriyan authored
Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Alexey Dobriyan authored
Signed-off-by:
-
Michael Chan authored
Use kmalloc() instead of a local array in bnx2_nvram_write(). Update version to 1.4.40. Signed-off-by:
Michael Chan <mchan@broadcom.com> Signed-off-by:
-
Michael Chan authored
Fix a bug in bnx2_nvram_write() caused by a counter variable not correctly incremented by 4. Signed-off-by:
-
Michael Chan authored
Add some missing rx error counters for 5705 and newer chips. Update version to 3.58. Signed-off-by:
-
David S. Miller authored
Signed-off-by: -
Andrew Morton authored
FATAL: modpost: GPL-incompatible module sunsu uses the GPL-only symbol tty_insert_flip_string_flags Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Linus Torvalds authored
This reverts commit 5ce74abe (and its dependent commit 8a5bc075), because of audio underruns. Reported by Rene Herman <rene.herman@keyaccess.nl>, who also pinpointed the exact cause of the underruns: "Audio underruns galore, with only ogg123 and firefox (browsing the GIT tree online is also a nice trigger by the way). If I back it out, everything is fine for me again." Cc: Rene Herman <rene.herman@keyaccess.nl> Cc: Mike Galbraith <efault@gmx.de> Acked-by:
Con Kolivas <kernel@kolivas.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
Linus Torvalds authored
* master.kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (33 commits) V4L/DVB (3965): Fix CONFIG_VIDEO_VIVI=y build bug V4L/DVB (3964): Bt8xx/bttv-cards.c: fix off-by-one errors V4L/DVB (3914): Vivi build fix V4L/DVB (3912): Sparc32 vivi fix V4L/DVB (3832): Get_dvb_firmware: download nxt2002 firmware from new driver location V4L/DVB (3829): Fix frequency values in the ranges structures of the LG TDVS H06xF tuners V4L/DVB (3826): Saa7134: Missing 'break' in Terratec Cinergy 400 TV initialization V4L/DVB (3825): Remove broken 'fast firmware load' from cx25840. V4L/DVB (3819): Cxusb-bluebird: bug-fix: power down corrupts frontend V4L/DVB (3813): Add support for TCL M2523_5N_E tuner. V4L/DVB (3804): Tweak bandselect setup fox cx24123 V4L/DVB (3803): Various correctness fixes to tuning. V4L/DVB (3797): Always wait for diseqc queue to become ready before transmitting a diseqc message V4L/DVB (3796): Add several debug messages to cx24123 code V4L/DVB (3795): Fix for CX24123 & low symbol rates V4L/DVB (3792): Kbuild: DVB_BT8XX must select DVB_ZL10353 V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c V4L/DVB (3788): Fix compilation with V4L1_COMPAT V4L/DVB (3782): Removed uneeded stuff from pwc Makefile V4L/DVB (3775): Add VIVI Kconfig stuff ...
-
- 21 May, 2006 29 commits
-
-
Andrew Morton authored
WARNING: sound/oss/ad1848.o - Section mismatch: reference to .init.data:ad1848_isapnp_list from .text between 'ad1848_init_generic' (at offset 0x46f0) and 'kmalloc' WARNING: sound/oss/ad1848.o - Section mismatch: reference to .init.data:ad1848_isapnp_list from .text between 'ad1848_init_generic' (at offset 0x46f8) and 'kmalloc' WARNING: sound/oss/ad1848.o - Section mismatch: reference to .init.data:ad1848_isapnp_list from .text between 'ad1848_init_generic' (at offset 0x4818) and 'kmalloc' Also, sound/oss/ad1848.c: In function `ad1848_init': sound/oss/ad1848.c:2029: warning: cast to pointer from integer of different size sound/oss/ad1848.c: In function `ad1848_unload': sound/oss/ad1848.c:2178: warning: cast to pointer from integer of different size sound/oss/ad1848.c: In function `adintr': sound/oss/ad1848.c:2207: warning: cast from pointer to integer of different size Signed-off-by:
-
Andrew Morton authored
WARNING: sound/oss/nm256_audio.o - Section mismatch: reference to .init.text:nm256_peek_for_sig from .text between 'nm256_install' (at offset 0x3ba4) and 'nm256_probe' WARNING: sound/oss/nm256_audio.o - Section mismatch: reference to .init.text:nm256_peek_for_sig from .text between 'nm256_install' (at offset 0x3bac) and 'nm256_probe' WARNING: sound/oss/nm256_audio.o - Section mismatch: reference to .init.text: from .text between 'nm256_install' (at offset 0x3dcc) and 'nm256_probe' WARNING: sound/oss/nm256_audio.o - Section mismatch: reference to .init.text: from .text between 'nm256_install' (at offset 0x3dd0) and 'nm256_probe' Signed-off-by:
-
Andrew Morton authored
sound/isa/es18xx.c: In function `snd_es18xx_identify': sound/isa/es18xx.c:1606: warning: implicit declaration of function `udelay' Cc: Jaroslav Kysela <perex@suse.cz> Cc: Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Andrew Morton authored
WARNING: sound/drivers/mpu401/snd-mpu401.o - Section mismatch: reference to .init.text: from .text between 'snd_mpu401_pnp_probe' (at offset 0x1f7) and 'snd_mpu401_pnp_remove' Cc: Jaroslav Kysela <perex@suse.cz> Cc: Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Andrew Morton authored
WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_fix_offsets' (at offset 0x1b88) and 'i810_alloc_agp_mem' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_fix_offsets' (at offset 0x1b8f) and 'i810_alloc_agp_mem' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_fix_offsets' (at offset 0x1ba3) and 'i810_alloc_agp_mem' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_fix_offsets' (at offset 0x1bb5) and 'i810_alloc_agp_mem' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_fix_offsets' (at offset 0x1bc6) and 'i810_alloc_agp_mem' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_init_defaults' (at offset 0x1dd8) and 'i810_init_device' WARNING: drivers/video/i810/i810fb.o - Section mismatch: reference to .init.data: from .text between 'i810_init_defaults' (at offset 0x1dfb) and 'i810_init_device' Cc: "Antonino A. Daplas" <adaplas@pol.net> Signed-off-by:
-
Andrew Morton authored
WARNING: drivers/pcmcia/pd6729.o - Section mismatch: reference to .init.text: from .text between 'pd6729_pci_probe' (at offset 0x9a8) and 'pd6729_pci_remove' Cc: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by:
-
Bob Picco authored
Andy added code to buddy allocator which does not require the zone's endpoints to be aligned to MAX_ORDER. An issue is that the buddy allocator requires the node_mem_map's endpoints to be MAX_ORDER aligned. Otherwise __page_find_buddy could compute a buddy not in node_mem_map for partial MAX_ORDER regions at zone's endpoints. page_is_buddy will detect that these pages at endpoints are not PG_buddy (they were zeroed out by bootmem allocator and not part of zone). Of course the negative here is we could waste a little memory but the positive is eliminating all the old checks for zone boundary conditions. SPARSEMEM won't encounter this issue because of MAX_ORDER size constraint when SPARSEMEM is configured. ia64 VIRTUAL_MEM_MAP doesn't need the logic either because the holes and endpoints are handled differently. This leaves checking alloc_remap and other arches which privately allocate for node_mem_map. Signed-off-by:
Bob Picco <bob.picco@hp.com> Acked-by:
Mel Gorman <mel@csn.ul.ie> Cc: Dave Hansen <haveblue@us.ibm.com> Cc: Andy Whitcroft <apw@shadowen.org> Signed-off-by:
-
Greg Kroah-Hartman authored
People don't like released kernels yelling at them, no matter how real the error might be. So only report it if CONFIG_KOBJECT_DEBUG is enabled. Sent on request of Andrew Morton. (akpm: should bring this back post-2.6.17) Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by:
-
Alessandro Zummo authored
Appropriately use -ENOIOCTLCMD and -ENOTTY when the ioctl is not implemented by a driver. (akpm: we're not allowed to return -ENOIOCTLCMD to userspace. This patch does the right thing). Signed-off-by:
Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Atsushi Nemoto authored
Here is an updated r_info layout fix. Please apply "check SHT_REL sections" patch before this. 64bit mips has different r_info layout. This patch fixes modpost segfault for 64bit little endian mips kernel. Signed-off-by:
Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: Sam Ravnborg <sam@ravnborg.org> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Atsushi Nemoto authored
I found that modpost can not detect section mismatch on mips and i386. On mips64, the modpost (with r_info layout fix) can detect it. The current modpst only checks SHT_RELA section but I suppose SHT_REL section should be checked also. This patch does not contain r_info layout fix. I'll post an updated r_info layout fix on next mail. Check SHT_REL sections as like as SHT_RELA sections to detect section mismatch. Signed-off-by:
-
Martin Schwidefsky authored
The 32 bit unsigned substraction (next - jiffies) in stop_hz_timer can overflow if jiffies gets advanced between next_timer_interrupt and the read under the xtime lock. The cast to a u64 then results in a large value which causes the cpu to wait too long. Fix this by casting next and jiffies independently to u64 before subtracting them. (Spotted by Zachary Amsden <zach@vmware.com>) Signed-off-by:
Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by:
-
Zachary Amsden authored
Under certain timing conditions, a race during boot occurs where timer ticks are being processed on remote CPUs. The remote timer ticks can increment jiffies, and if this happens during a window when a timeout is very close to expiring but a local tick has not yet been delivered, you can end up with 1) No softirq pending 2) A local timer wheel which is not synced to jiffies 3) No high resolution timer active 4) A local timer which is supposed to fire before the current jiffies value. In this circumstance, the comparison in next_timer_interrupt overflows, because the base of the comparison for high resolution timers is jiffies, but for the softirq timer wheel, it is relative the the current base of the wheel (jiffies_base). Signed-off-by:
Zachary Amsden <zach@vmware.com> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by:
-
Rene Herman authored
st: Version 20050830, fixed bufsize 32768, s/g segs 256 st 0:0:6:0: Attached scsi tape st0<4>st0: try direct i/o: yes (alignment 512 B) Cc: James Bottomley <James.Bottomley@steeleye.com> Signed-off-by:
-
Satoshi Oshima authored
Problem: If we put a probe onto a callq instruction and the probe is executed, kernel panic of Bad RIP value occurs. Root cause: If resume_execution() found 0xff at first byte of p->ainsn.insn, it must check the _second_ byte. But current resume_execution check _first_ byte again. I changed it checks second byte of p->ainsn.insn. Kprobes on i386 don't have this problem, because the implementation is a little bit different from x86_64. Cc: Andi Kleen <ak@muc.de> Signed-off-by:
Satoshi Oshima <soshima@redhat.com> Signed-off-by:
-
Vivek Goyal authored
o Kdump second kernel boot fails after a system crash if second kernel is UP and acpi=off and if crash occurred on a non-boot cpu. o Issue here is that MP tables report boot cpu lapic id as 0 but second kernel is booting on a different processor and MP table data is stale in this context. Hence apic_id_registered() check fails in setup_local_APIC() when called from APIC_init_uniprocessor(). o Problem is not seen if ACPI is enabled as in that case boot_cpu_physical_apicid is read from the LAPIC. o Problem is not seen with SMP kernels as well because in this case also boot_cpu_physical_apicid is read from LAPIC. (smp_boot_cpus()). o The problem is fixed by reading boot_cpu_physical_apicid from LAPIC if it is a UP kernel and CRASH_DUMP is enabled. Signed-off-by:
Vivek Goyal <vgoyal@in.ibm.com> Signed-off-by:
-
Stephen Street authored
Fix some outstanding issues with the pxa2xx_spi driver when running on a PXA270: - Wrong timeout calculation in the setup function due to different peripheral clock rates in the PXAxxx family. - Bad handling of SSSR_TFS interrupts in interrupt_transfer function. - Added locking to interface between the pump_messages workqueue and the pump_transfers tasklet. Much thanks to Juergen Beisert for the extensive testing on the PXA270. Signed-off-by:
Stephen Street <stephen@streetfiresound.com> Signed-off-by:
David Brownell <dbrownell@users.sourceforge.net> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by:
-
Ben Dooks authored
Hardware based SPI driver for Samsung S3C24XX SoC systems Signed-off-by:
Ben Dooks <ben-linux@fluff.org> Cc: David Brownell <david-b@pacbell.net> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
Ben Dooks authored
SPI driver for SPI by GPIO on the Samsung S3C24XX series of SoC processors. Signed-off-by:
-
Adrian Bunk authored
- remove the following global function that is both unused and unimplemented: - register_firmware() - make the following needlessly global function static: - firmware_class_uevent() Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
-
Kumar Gala authored
This driver supports the SPI controller on the MPC83xx SoC devices from Freescale. Note, this driver supports only the simple shift register SPI controller and not the descriptor based CPM or QUICCEngine SPI controller. Signed-off-by:
Kumar Gala <galak@kernel.crashing.org> Signed-off-by:
-
dmitry pervushin authored
Because several developers asked me about referenced but missing spi_add_master(), I think that this patch should be applied ... it corrects comments so they refer to spi_register_master() instead. Signed-off-by:
dmitry pervushin <dpervushin@ru.mvista.com> Signed-off-by:
-
Theodore Tso authored
Signed-off-by:
"Theodore Ts'o" <tytso@mit.edu> Signed-off-by:
-
Alan Cox authored
Signed-off-by:
Alan Cox <alan@redhat.com> Signed-off-by:
-
Eric Sesterhenn authored
This fixes coverity bug id #1237. After the while loop, it is possible for i == ISDN_LMSNLEN. If this happens the terminating '\0' is written after the end of the array. Signed-off-by:
Eric Sesterhenn <snakebyte@gmx.de> Cc: Karsten Keil <kkeil@suse.de> Signed-off-by:
-
Paul Jackson authored
It's too easy to incorrectly call cpuset_zone_allowed() in an atomic context without __GFP_HARDWALL set, and when done, it is not noticed until a tight memory situation forces allocations to be tried outside the current cpuset. Add a 'might_sleep_if()' check, to catch this earlier on, instead of waiting for a similar check in the mutex_lock() code, which is only rarely invoked. Signed-off-by:
Paul Jackson <pj@sgi.com> Signed-off-by:
-
Paul Jackson authored
Update the kernel/cpuset.c:cpuset_zone_allowed() comment. The rule for when mm/page_alloc.c should call cpuset_zone_allowed() was intended to be: Don't call cpuset_zone_allowed() if you can't sleep, unless you pass in the __GFP_HARDWALL flag set in gfp_flag, which disables the code that might scan up ancestor cpusets and sleep. The explanation of this rule in the comment above cpuset_zone_allowed() was stale, as a result of a restructuring of some __alloc_pages() code in November 2005. Rewrite that comment ... Signed-off-by:
-
Paul Jackson authored
Fix a couple of infrequently encountered 'sleeping function called from invalid context' in the cpuset hooks in __alloc_pages. Could sleep while interrupts disabled. The routine cpuset_zone_allowed() is called by code in mm/page_alloc.c __alloc_pages() to determine if a zone is allowed in the current tasks cpuset. This routine can sleep, for certain GFP_KERNEL allocations, if the zone is on a memory node not allowed in the current cpuset, but might be allowed in a parent cpuset. But we can't sleep in __alloc_pages() if in interrupt, nor if called for a GFP_ATOMIC request (__GFP_WAIT not set in gfp_flags). The rule was intended to be: Don't call cpuset_zone_allowed() if you can't sleep, unless you pass in the __GFP_HARDWALL flag set in gfp_flag, which disables the code that might scan up ancestor cpusets and sleep. This rule was being violated in a couple of places, due to a bogus change made (by myself, pj) to __alloc_pages() as part of the November 2005 effort to cleanup its logic, and also due to a later fix to constrain which swap daemons were awoken. The bogus change can be seen at: http://linux.derkeiler.com/Mailing-Lists/Kernel/2005-11/4691.html [PATCH 01/05] mm fix __alloc_pages cpuset ALLOC_* flags This was first noticed on a tight memory system, in code that was disabling interrupts and doing allocation requests with __GFP_WAIT not set, which resulted in __might_sleep() writing complaints to the log "Debug: sleeping function called ...", when the code in cpuset_zone_allowed() tried to take the callback_sem cpuset semaphore. We haven't seen a system hang on this 'might_sleep' yet, but we are at decent risk of seeing it fairly soon, especially since the additional cpuset_zone_allowed() check was added, conditioning wakeup_kswapd(), in March 2006. Special thanks to Dave Chinner, for figuring this out, and a tip of the hat to Nick Piggin who warned me of this back in Nov 2005, before I was ready to listen. Signed-off-by:
-
Kristen Accardi authored
The OSC set and query functions do not allocate enough space for return values, and set the output buffer length to a false, too large value. This causes the acpi-ca code to assume that the output buffer is larger than it actually is, and overwrite memory when copying acpi return buffers into this caller provided buffer. In some cases this can cause kernel oops if the memory that is overwritten is a pointer. This patch will change these calls to use a dynamically allocated output buffer, thus allowing the acpi-ca code to decide how much space is needed. Signed-off-by:
Kristen Carlson Accardi <kristen.c.accardi@intel.com> Cc: "Brown, Len" <len.brown@intel.com> Cc: "Yu, Luming" <luming.yu@intel.com> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
