]> git.itanic.dy.fi Git - linux-stable/log
linux-stable
17 years agoLinux 2.6.16.43-rc1 v2.6.16.43-rc1
Adrian Bunk [Tue, 27 Feb 2007 20:35:57 +0000 (21:35 +0100)]
Linux 2.6.16.43-rc1

17 years agoi2c-isa: Restore driver owner
Jean Delvare [Tue, 27 Feb 2007 20:35:11 +0000 (21:35 +0100)]
i2c-isa: Restore driver owner

Commit 2b48716d1d2f2edb1e7cbc5ecf1cb2cb39373e33 back in January
2006 was a bit overzealous. It removed .owner from all i2c drivers,
including i2c-isa ones, while they still need it.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[DECNET]: Fix sfuzz hanging on 2.6.18
Patrick McHardy [Mon, 26 Feb 2007 22:47:11 +0000 (23:47 +0100)]
[DECNET]: Fix sfuzz hanging on 2.6.18

Dave Jones wrote:
> sfuzz         D 724EF62A  2828 28717  28691                     (NOTLB)
>        cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0
>        dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202
>        de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0
> Call Trace:
>  [<c05b1708>] lock_sock+0x75/0xa6
>  [<e0b0b604>] dn_getname+0x18/0x5f [decnet]
>  [<c05b083b>] sys_getsockname+0x5c/0xb0
>  [<c05b0b46>] sys_socketcall+0xef/0x261
>  [<c0403f97>] syscall_call+0x7/0xb
> DWARF2 unwinder stuck at syscall_call+0x7/0xb
>
> I wonder if the plethora of lockdep related changes inadvertantly broke something?

Looks like unbalanced locking.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosis190: failure to set the MAC address from EEPROM
Francois Romieu [Mon, 26 Feb 2007 22:45:11 +0000 (23:45 +0100)]
sis190: failure to set the MAC address from EEPROM

Fix from http://bugzilla.kernel.org/show_bug.cgi?id=7747

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Refactor SENSOR_DEVICE_ATTR_2
Jim Cromie [Mon, 26 Feb 2007 02:37:36 +0000 (03:37 +0100)]
hwmon: Refactor SENSOR_DEVICE_ATTR_2

This patch refactors SENSOR_DEVICE_ATTR_2 macro, following pattern set by
SENSOR_ATTR.  First it creates a new macro SENSOR_ATTR_2() which expands
to an initialization expression, then it uses that in SENSOR_DEVICE_ATTR_2,
which declares and initializes a struct sensor_device_attribute_2.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Allow sensor attributes arrays
Jim Cromie [Mon, 26 Feb 2007 02:31:01 +0000 (03:31 +0100)]
hwmon: Allow sensor attributes arrays

This patch refactors SENSOR_DEVICE_ATTR macro.  First it creates a new
macro SENSOR_ATTR() which expands to an initialization expression, then
it uses that in SENSOR_DEVICE_ATTR, which declares and initializes a
struct sensor_device_attribute.

IOW, SENSOR_ATTR() imitates __ATTR() in include/linux/device.h.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: email and version change.
Stephen Hemminger [Mon, 26 Feb 2007 00:54:54 +0000 (01:54 +0100)]
sky2: email and version change.

Put in new email address.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: add more pci ids
Stephen Hemminger [Mon, 26 Feb 2007 00:53:52 +0000 (01:53 +0100)]
sky2: add more pci ids

Update the pci device id table to match 2.6.20 (except for new 88e807x
that is still experimental).

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: more stats
Stephen Hemminger [Mon, 26 Feb 2007 00:53:13 +0000 (01:53 +0100)]
sky2: more stats

This is a simple enhancement to dump more device statistics with ethtool.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix for use on big endian
Stephen Hemminger [Mon, 26 Feb 2007 00:52:23 +0000 (01:52 +0100)]
sky2: fix for use on big endian

Ben added this for 2.6.18, it allows sky2 to run on big endian.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: allow multicast pause frames
Stephen Hemminger [Mon, 26 Feb 2007 00:51:40 +0000 (01:51 +0100)]
sky2: allow multicast pause frames

The 802 standard allows pause frames to be either unicast or multicast.
Switches seem to send unicast frames, but on a direct link, other boards send
multicast pause.  Unless the filter bit is set, these pause frames get
dropped.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix ram buffer allocation settings
Stephen Hemminger [Mon, 26 Feb 2007 00:51:03 +0000 (01:51 +0100)]
sky2: fix ram buffer allocation settings

Different chipsets have different amount of ram buffer (some have none),
so need to make sure that driver does proper setup for all cases from 0 on
to 48K, in units of 1K.

This is a backport of the code from 2.6.19 or later

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofix ext3 block bitmap leakage
Kirill Korotaev [Mon, 26 Feb 2007 00:48:36 +0000 (01:48 +0100)]
fix ext3 block bitmap leakage

This patch fixes ext3 block bitmap leakage,
which leads to the following fsck messages on
_healthy_ filesystem:
Block bitmap differences:  -64159 -73707

All kernels up to 2.6.17 have this bug.

Found by
   Vasily Averin <vvs@sw.ru> and Andrey Savochkin <saw@sawoct.com>
Test case triggered the issue was created by
   Dmitry Monakhov <dmonakhov@sw.ru>

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[TCP]: Prevent pseudo garbage in SYN's advertized window
Ilpo Järvinen [Mon, 26 Feb 2007 00:36:47 +0000 (01:36 +0100)]
[TCP]: Prevent pseudo garbage in SYN's advertized window

TCP may advertize up to 16-bits window in SYN packets (no window
scaling allowed). At the same time, TCP may have rcv_wnd
(32-bits) that does not fit to 16-bits without window scaling
resulting in pseudo garbage into advertized window from the
low-order bits of rcv_wnd. This can happen at least when
mss <= (1<<wscale) (see tcp_select_initial_window). This patch
fixes the handling of SYN advertized windows (compile tested
only).

In worst case (which is unlikely to occur though), the receiver
advertized window could be just couple of bytes. I'm not sure
that such situation would be handled very well at all by the
receiver!? Fortunately, the situation normalizes after the
first non-SYN ACK is received because it has the correct,
scaled window.

Alternatively, tcp_select_initial_window could be changed to
prevent too large rcv_wnd in the first place.

[ tcp_make_synack() has the same bug, and I've added a fix for
  that to this patch -DaveM ]

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPV4/IPV6] multicast: Check add_grhead() return value
Alexey Dobriyan [Mon, 26 Feb 2007 00:31:58 +0000 (01:31 +0100)]
[IPV4/IPV6] multicast: Check add_grhead() return value

add_grhead() allocates memory with GFP_ATOMIC and in at least two places skb
from it passed to skb_put() without checking.

Adrian Bunk:
backported to 2.6.16

Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Add support for the Winbond W83687THF
Jean Delvare [Sun, 25 Feb 2007 23:55:22 +0000 (00:55 +0100)]
hwmon: Add support for the Winbond W83687THF

Add support for the Winbond W83687THF chip to the w83627hf hardware
monitoring driver. This new chip is almost similar to the already
supported W83627THF chip, except for VID and a few other minor
changes.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agow83791d: Documentation update
Charles Spirakis [Sun, 25 Feb 2007 23:50:40 +0000 (00:50 +0100)]
w83791d: Documentation update

The alarm bits and the beep enable bits are in different positions in
the hardware. Document the problem and leave it to the user-space code
to handle the situation. When this driver is updated to the standardized
sysfs alarm/beep methodology, this won't be a problem.

This is a documentation only change.

Signed-off by: Charles Spirakis <bezaur@gmail.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoHWMON: w83791d: New hardware monitoring driver for the Winbond W83791D
Charles Spirakis [Sun, 25 Feb 2007 23:49:39 +0000 (00:49 +0100)]
HWMON: w83791d: New hardware monitoring driver for the Winbond W83791D

Add support for the w83791d sensor chip. The w83791d hardware is
somewhere between the w83781d and the w83792d and this driver code
is derived from the code that supports those chips.

Signed-off-by: Charles Spirakis <bezaur@gmail.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosmsc47m192: New hwmon driver for SMSC LPC47M192/997
Hartmut Rick [Sun, 25 Feb 2007 23:48:05 +0000 (00:48 +0100)]
smsc47m192: New hwmon driver for SMSC LPC47M192/997

New driver (smsc47m192) which supports voltage and temperature
measurement features of SMSC LPC47M192 and LPC47M997 chips.

Signed-off-by: Hartmut Rick <linux@rick.claranet.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: New PC87427 hardware monitoring driver
Jean Delvare [Sun, 25 Feb 2007 23:46:17 +0000 (00:46 +0100)]
hwmon: New PC87427 hardware monitoring driver

This is a new hardware monitoring driver for the National Semiconductor
PC87427 Super-I/O chip. It only supports fan speed monitoring for now,
while the chip can do much more.

Thanks to Amir Habibi at Candelis for setting up a test system, and to
Michael Kress for testing several iterations of this driver.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon lm83: Add LM82 support
Jordan Crouse [Sun, 25 Feb 2007 23:43:46 +0000 (00:43 +0100)]
hwmon lm83: Add LM82 support

Add LM82 temperature sensor support (similar to the LM83,
but less featureful).

Signed-off-by: Jordan Crouse <jordan.crouse@amd.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoi2c-piix4: Add ATI IXP200/300/400 support
Rudolf Marek [Sun, 25 Feb 2007 23:42:07 +0000 (00:42 +0100)]
i2c-piix4: Add ATI IXP200/300/400 support

This patch adds the ATI IXP southbridges support to i2c-piix4,
as it turned out those chips are compatible with it.

Signed-off-by: Rudolf Marek <r.marek@sh.cvut.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoI2C: i2c-piix4: Add Broadcom HT-1000 support
Martin Devera [Sun, 25 Feb 2007 23:40:16 +0000 (00:40 +0100)]
I2C: i2c-piix4: Add Broadcom HT-1000 support

Add Broadcom HT-1000 south bridge's PCI ID to i2c-piix driver. Note
that at least on Supermicro H8SSL it uses non-standard SMBHSTCFG = 3
and standard values like 0 or 9 causes hangup.

Signed-off-by: Martin Devera <devik@cdi.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoV4L/DVB: Dvbdev: fix illegal re-usage of fileoperations struct
Marcel Siegert [Sun, 25 Feb 2007 23:38:10 +0000 (00:38 +0100)]
V4L/DVB: Dvbdev: fix illegal re-usage of fileoperations struct

Arjan van de Ven <arjan@infradead.org> reported an illegal re-usage of
the fileoperations struct if more than one dvb device (e.g. frontend) is
present.

This patch fixes this issue.

It allocates a new fileoperations struct each time a device is
registered and copies the default template fileops.

Signed-off-by: Marcel Siegert <mws@linuxtv.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.42 v2.6.16.42
Adrian Bunk [Sun, 25 Feb 2007 16:49:51 +0000 (17:49 +0100)]
Linux 2.6.16.42

17 years agoLinux 2.6.16.42-rc1 v2.6.16.42-rc1
Adrian Bunk [Thu, 22 Feb 2007 20:13:55 +0000 (21:13 +0100)]
Linux 2.6.16.42-rc1

17 years agoUSB: rtl8150 new device id
Petko Manolov [Thu, 22 Feb 2007 20:13:05 +0000 (21:13 +0100)]
USB: rtl8150 new device id

This one adds another vendor ID to rtl8150 driver.

Signed-off-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoUSB: add ZyXEL vendor/product ID to rtl8150 driver
Dan Streetman [Thu, 22 Feb 2007 20:11:26 +0000 (21:11 +0100)]
USB: add ZyXEL vendor/product ID to rtl8150 driver

I just got a "ZyXEL Prestige USB Adapter" that is actually RTL8150
adapter.  Here is the relevant /proc/bus/usb/devices output (after
adding the vendor/product IDs to the driver):

T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#=119 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=0586 ProdID=401a Rev= 1.00
S:  Manufacturer=ZyXEL
S:  Product=Prestige USB Adapter
S:  SerialNumber=1027
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=120mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=ff Driver=rtl8150
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=1ms

This patch adds the ZyXEL vendor ID to the rtl8150.c driver.  The
device has absolutely no identifying marks on the outside for model
type, just a serial number, and I can't find anything on ZyXEL's
website, so I called the product ID PRODUCT_ID_PRESTIGE to match the
product string.

Signed-off-by: Dan Streetman <ddstreet@ieee.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: dual-port pci-x checksum fix
Stephen Hemminger [Thu, 22 Feb 2007 20:07:51 +0000 (21:07 +0100)]
sky2: dual-port pci-x checksum fix

Add a workaround for dual port PCI-X card that returns status out of
order sometimes because of split transactions.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosky2: fix for NAPI with dual port boards
Stephen Hemminger [Thu, 22 Feb 2007 20:07:11 +0000 (21:07 +0100)]
sky2: fix for NAPI with dual port boards

This driver uses port 0 to handle receives on both ports. So
the netif_poll_disable call in dev_close would end up stopping the
second port on dual port cards.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofix rtl8150
Al Viro [Wed, 21 Feb 2007 11:48:22 +0000 (12:48 +0100)]
fix rtl8150

That code doesn't do what its author apparently thought it would do...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] ambassador, firestream: "-1 >>" is implementation defined
Alexey Dobriyan [Wed, 21 Feb 2007 00:43:24 +0000 (01:43 +0100)]
[ATM] ambassador, firestream: "-1 >>" is implementation defined

6.5.7(5): The result of E1 >> E2 is E1 right-shifted E2 bit positions.
            ...
    If E1 has a signed type and a negative value, the resulting value
    is implementation defined.

So, cast -1 to unsigned type to make result well-defined.

[ Modified to use ~0U based upon recommendation from Al Viro. -DaveM ]

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] firestream: handle thrown error
Jeff Garzik [Wed, 21 Feb 2007 00:42:39 +0000 (01:42 +0100)]
[ATM] firestream: handle thrown error

gcc emits the following warning:

drivers/atm/firestream.c: In function ‘fs_open’:
drivers/atm/firestream.c:870: warning: ‘tmc0’ may be used uninitialized in this function

This indicates a real bug.  We should check make_rate() return value for
potential errors.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM] horizon: read_bia() needs to be __devinit
David S. Miller [Wed, 21 Feb 2007 00:41:25 +0000 (01:41 +0100)]
[ATM] horizon: read_bia() needs to be __devinit

Thanks to Randy Dunlap.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoATM horizon.c: missing __devinit
Al Viro [Wed, 21 Feb 2007 00:40:51 +0000 (01:40 +0100)]
ATM horizon.c: missing __devinit

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoKeys: Fix key serial number collision handling (CVE-2007-0006)
David Howells [Wed, 21 Feb 2007 00:20:05 +0000 (01:20 +0100)]
Keys: Fix key serial number collision handling (CVE-2007-0006)

Fix the key serial number collision avoidance code in key_alloc_serial().

This didn't use to be so much of a problem as the key serial numbers were
allocated from a simple incremental counter, and it would have to go through
two billion keys before it could possibly encounter a collision.  However, n
that random numbers are used instead, collisions are much more likely.

This is fixed by finding a hole in the rbtree where the next unused serial
number ought to be and using that by going almost back to the top of the
insertion routine and redoing the insertion with the new serial number rathe
than trying to be clever and attempting to work out the insertion point
pointer directly.

This fixes kernel Bugzilla #7727.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agofix bad_inode_ops memory corruption (CVE-2006-5753)
Eric Sandeen [Tue, 20 Feb 2007 23:57:05 +0000 (00:57 +0100)]
fix bad_inode_ops memory corruption (CVE-2006-5753)

CVE-2006-5753 is for a case where an inode can be marked bad, switching
the ops to bad_inode_ops, which are all connected as:

static int return_EIO(void)
{
        return -EIO;
}

#define EIO_ERROR ((void *) (return_EIO))

static struct inode_operations bad_inode_ops =
{
        .create         = bad_inode_create
...etc...

The problem here is that the void cast causes return types to not be
promoted, and for ops such as listxattr which expect more than 32 bits of
return value, the 32-bit -EIO is interpreted as a large positive 64-bit
number, i.e. 0x00000000fffffffa instead of 0xfffffffa.

This goes particularly badly when the return value is taken as a number of
bytes to copy into, say, a user's buffer for example...

I originally had coded up the fix by creating a return_EIO_<TYPE> macro
for each return type, like this:

static int return_EIO_int(void)
{
    return -EIO;
}
#define EIO_ERROR_INT ((void *) (return_EIO_int))

static struct inode_operations bad_inode_ops =
{
    .create         = EIO_ERROR_INT,
...etc...

but Al felt that it was probably better to create an EIO-returner for each
actual op signature.  Since so few ops share a signature, I just went ahead
& created an EIO function for each individual file & inode op that returns
a value.

Adrian Bunk:
backported to 2.6.16

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Restrict well known PSM to privileged users
Marcel Holtmann [Tue, 20 Feb 2007 23:25:10 +0000 (00:25 +0100)]
[Bluetooth] Restrict well known PSM to privileged users

The PSM values below 0x1001 of L2CAP are reserved for well known
services. Restrict the possibility to bind them to privileged
users.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Missing endian swapping for L2CAP socket list
Marcel Holtmann [Tue, 20 Feb 2007 23:23:40 +0000 (00:23 +0100)]
[Bluetooth] Missing endian swapping for L2CAP socket list

The PSM value in the L2CAP socket list must be converted to host
order before printing it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoFix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)
Greg Banks [Tue, 20 Feb 2007 23:14:36 +0000 (00:14 +0100)]
Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)

Due to type confusion, when an nfsacl verison 2 'ACCESS' request
finishes and tries to clean up, it calls fh_put on entiredly the
wrong thing and this can cause an oops.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoV4L/DVB: Buf_qbuf: fix: videobuf_queue->stream corruption and lockup
Oleg Nesterov [Tue, 20 Feb 2007 15:07:19 +0000 (16:07 +0100)]
V4L/DVB: Buf_qbuf: fix: videobuf_queue->stream corruption and lockup

We are doing ->buf_prepare(buf) before adding buf to q->stream list. This
means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer.

Adrian Bunk:
Backported to 2.6.16.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
17 years agoLinux 2.6.16.41 v2.6.16.41
Adrian Bunk [Sat, 17 Feb 2007 17:23:40 +0000 (18:23 +0100)]
Linux 2.6.16.41

17 years agoLinux 2.6.16.41-rc1 v2.6.16.41-rc1
Adrian Bunk [Thu, 15 Feb 2007 12:56:49 +0000 (13:56 +0100)]
Linux 2.6.16.41-rc1

17 years agouml: fix signal frame alignment
Jeff Dike [Wed, 14 Feb 2007 19:37:44 +0000 (20:37 +0100)]
uml: fix signal frame alignment

Use the same signal frame alignment calculations as the underlying
architecture.  x86_64 appeared to do this, but the "- 8" was really
subtracting 8 * sizeof(struct rt_sigframe) rather than 8 bytes.

UML/i386 might have been OK, but I changed the calculation to match
i386 just to be sure.

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ALSA] echo3g_dsp.c shouldn't include #include <linux/irq.h>
Adrian Bunk [Wed, 14 Feb 2007 19:32:10 +0000 (20:32 +0100)]
[ALSA] echo3g_dsp.c shouldn't include #include <linux/irq.h>

Despite being under linux/, linux/irq.h shouldn't be #include'd by arch
independent code.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoRevert "[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP"
Adrian Bunk [Wed, 14 Feb 2007 13:00:41 +0000 (14:00 +0100)]
Revert "[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP"

This reverts commit ac4d63dab8bb425f1ae037abf349090c12f16883.

Does not work in 2.6.16.

17 years ago[TCP]: struct tcp_sack_block annotations
Al Viro [Wed, 14 Feb 2007 12:58:42 +0000 (13:58 +0100)]
[TCP]: struct tcp_sack_block annotations

Some of the instances of tcp_sack_block are host-endian, some - net-endian.
Define struct tcp_sack_block_wire identical to struct tcp_sack_block
with u32 replaced with __be32; annotate uses of tcp_sack_block replacing
net-endian ones with tcp_sack_block_wire.  Change is obviously safe since
for cc(1) __be32 is typedefed to u32.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[IPX]: Fix NULL pointer dereference on ipx unload
Jiri Bohac [Wed, 14 Feb 2007 08:40:31 +0000 (09:40 +0100)]
[IPX]: Fix NULL pointer dereference on ipx unload

Fixes a null pointer dereference when unloading the ipx module.

On initialization of the ipx module, registering certain packet
types can fail. When this happens, unloading the module later
dereferences NULL pointers.  This patch fixes that. Please apply.

Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[NETFILTER]: Clear GSO bits for TCP reset packet
Herbert Xu [Wed, 14 Feb 2007 08:39:09 +0000 (09:39 +0100)]
[NETFILTER]: Clear GSO bits for TCP reset packet

The TCP reset packet is copied from the original.  This
includes all the GSO bits which do not apply to the new
packet.  So we should clear those bits.

Spotted by Patrick McHardy.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[TCP]: Don't apply FIN exception to full TSO segments.
John Heffner [Wed, 14 Feb 2007 08:34:43 +0000 (09:34 +0100)]
[TCP]: Don't apply FIN exception to full TSO segments.

Signed-off-by: John Heffner <jheffner@psc.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[ATM]: Fix for crash in adummy_init()
Daniel Walker [Wed, 14 Feb 2007 08:33:14 +0000 (09:33 +0100)]
[ATM]: Fix for crash in adummy_init()

This was reported by Ingo Molnar here,

http://lkml.org/lkml/2006/12/18/119

The problem is that adummy_init() depends on atm_init() , but adummy_init()
is called first.

So I put atm_init() into subsys_initcall which seems appropriate, and it
will still get module_init() if it becomes a module.

Interesting to note that you could crash your system here if you just load
the modules in the wrong order.

Signed-off-by: Daniel Walker <dwalker@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoTCP: skb is unexpectedly freed.
Masayuki Nakagawa [Wed, 14 Feb 2007 08:31:02 +0000 (09:31 +0100)]
TCP: skb is unexpectedly freed.

I encountered a kernel panic with my test program, which is a very
simple IPv6 client-server program.

The server side sets IPV6_RECVPKTINFO on a listening socket, and the
client side just sends a message to the server.  Then the kernel panic
occurs on the server.  (If you need the test program, please let me
know. I can provide it.)

This problem happens because a skb is forcibly freed in
tcp_rcv_state_process().

When a socket in listening state(TCP_LISTEN) receives a syn packet,
then tcp_v6_conn_request() will be called from
tcp_rcv_state_process().  If the tcp_v6_conn_request() successfully
returns, the skb would be discarded by __kfree_skb().

However, in case of a listening socket which was already set
IPV6_RECVPKTINFO, an address of the skb will be stored in
treq->pktopts and a ref count of the skb will be incremented in
tcp_v6_conn_request().  But, even if the skb is still in use, the skb
will be freed.  Then someone still using the freed skb will cause the
kernel panic.

I suggest to use kfree_skb() instead of __kfree_skb().

Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoTCP: Fix sorting of SACK blocks.
Baruch Even [Wed, 14 Feb 2007 08:29:14 +0000 (09:29 +0100)]
TCP: Fix sorting of SACK blocks.

The sorting of SACK blocks actually munges them rather than sort,
causing the TCP stack to ignore some SACK information and breaking the
assumption of ordered SACK blocks after sorting.

The sort takes the data from a second buffer which isn't moved causing
subsequent data moves to occur from the wrong location. The fix is to
use a temporary buffer as a normal sort does.

Signed-off-By: Baruch Even <baruch@ev-en.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
17 years agoAF_PACKET: Check device down state before hard header callbacks.
David S. Miller [Wed, 14 Feb 2007 08:25:18 +0000 (09:25 +0100)]
AF_PACKET: Check device down state before hard header callbacks.

If the device is down, invoking the device hard header callbacks
is not legal, so check it early.

Based upon a shaper OOPS report from Frederik Deweerdt.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoSPARC32: Fix over-optimization by GCC near ip_fast_csum.
Bob Breuer [Wed, 14 Feb 2007 08:22:53 +0000 (09:22 +0100)]
SPARC32: Fix over-optimization by GCC near ip_fast_csum.

In some cases such as:
        iph->check = 0;
        iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
GCC may optimize out the previous store.

Observed as a failure of NFS over udp (bad checksums on ip fragments)
when compiled with GCC 3.4.2.

Signed-off-by: Bob Breuer <breuerr@mc.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoDECNET: Handle a failure in neigh_parms_alloc (take 2)
Eric W. Biederman [Wed, 14 Feb 2007 08:02:36 +0000 (09:02 +0100)]
DECNET: Handle a failure in neigh_parms_alloc (take 2)

While enhancing the neighbour code to handle multiple network
namespaces I noticed that decnet is assuming neigh_parms_alloc
will allways succeed, which is clearly wrong.  So handle the
failure.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoFix up CIFS for "test_clear_page_dirty()" removal
Linus Torvalds [Tue, 13 Feb 2007 12:14:45 +0000 (13:14 +0100)]
Fix up CIFS for "test_clear_page_dirty()" removal

This also adds he required page "writeback" flag handling, that cifs
hasn't been doing and that the page dirty flag changes made obvious.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Acked-by: Steve French <smfltc@us.ibm.com>
17 years agofix umask when noACL kernel meets extN tuned for ACLs
Hugh Dickins [Tue, 13 Feb 2007 12:10:20 +0000 (13:10 +0100)]
fix umask when noACL kernel meets extN tuned for ACLs

Fix insecure default behaviour reported by Tigran Aivazian: if an
ext2 or ext3 filesystem is tuned to mount with "acl", but mounted by
a kernel built without ACL support, then umask was ignored when creating
inodes - though root or user has umask 022, touch creates files as 0666,
and mkdir creates directories as 0777.

This appears to have worked right until 2.6.11, when a fix to the default
mode on symlinks (always 0777) assumed VFS applies umask: which it does,
unless the mount is marked for ACLs; but ext[23] set MS_POSIXACL in
s_flags according to s_mount_opt set according to def_mount_opts.

We could revert to the 2.6.10 ext[23]_init_acl (adding an S_ISLNK test);
but other filesystems only set MS_POSIXACL when ACLs are configured.  We
could fix this at another level; but it seems most robust to avoid setting
the s_mount_opt flag in the first place (at the expense of more ifdefs).

Likewise don't set the XATTR_USER flag when built without XATTR support.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.40 v2.6.16.40
Adrian Bunk [Sat, 10 Feb 2007 12:44:25 +0000 (13:44 +0100)]
Linux 2.6.16.40

17 years agoLinux 2.6.16.40-rc1 v2.6.16.40-rc1
Adrian Bunk [Sat, 3 Feb 2007 15:56:17 +0000 (16:56 +0100)]
Linux 2.6.16.40-rc1

17 years agoreiserfs: avoid tail packing if an inode was ever mmapped
Vladimir Saveliev [Sat, 3 Feb 2007 01:38:47 +0000 (02:38 +0100)]
reiserfs: avoid tail packing if an inode was ever mmapped

This patch fixes a confusion reiserfs has for a long time.

On release file operation reiserfs used to try to pack file data stored in
last incomplete page of some files into metadata blocks.  After packing the
page got cleared with clear_page_dirty.  It did not take into account that
the page may be mmaped into other process's address space.  Recent
replacement for clear_page_dirty cancel_dirty_page found the confusion with
sanity check that page has to be not mapped.

The patch fixes the confusion by making reiserfs avoid tail packing if an
inode was ever mmapped.  reiserfs_mmap and reiserfs_file_release are
serialized with mutex in reiserfs specific inode.  reiserfs_mmap locks the
mutex and sets a bit in reiserfs specific inode flags.
reiserfs_file_release checks the bit having the mutex locked.  If bit is
set - tail packing is avoided.  This eliminates a possibility that mmapped
page gets cancel_page_dirty-ed.

Signed-off-by: Vladimir Saveliev <vs@namesys.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[libata] use kmap_atomic(KM_IRQ0) in SCSI simulator
Jeff Garzik [Sat, 3 Feb 2007 01:32:59 +0000 (02:32 +0100)]
[libata] use kmap_atomic(KM_IRQ0) in SCSI simulator

We are inside spin_lock_irqsave().  quoth akpm's debug facility:

 [  231.948000] SCSI device sda: 195371568 512-byte hdwr sectors (100030 MB)
 [  232.232000] ata1.00: configured for UDMA/33
 [  232.404000] WARNING (1) at arch/i386/mm/highmem.c:47 kmap_atomic()
 [  232.404000]  [<c01162e6>] kmap_atomic+0xa9/0x1ab
 [  232.404000]  [<c0242c81>] ata_scsi_rbuf_get+0x1c/0x30
 [  232.404000]  [<c0242caf>] ata_scsi_rbuf_fill+0x1a/0x87
 [  232.404000]  [<c0243ab2>] ata_scsiop_mode_sense+0x0/0x309
 [  232.404000]  [<c01729d5>] end_bio_bh_io_sync+0x0/0x37
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c0242dcc>] ata_scsi_simulate+0xb0/0x13f
[...]

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoia64: add pci_get_legacy_ide_irq()
Bartlomiej Zolnierkiewicz [Sat, 3 Feb 2007 01:26:55 +0000 (02:26 +0100)]
ia64: add pci_get_legacy_ide_irq()

Add pci_get_legacy_ide_irq() identical to the one used by i386/x86_64.
Fixes amd74xx driver build on ia64 (bugzilla bug #6644).

Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: Update Rudolf Marek's e-mail address
Rudolf Marek [Sat, 3 Feb 2007 01:04:01 +0000 (02:04 +0100)]
hwmon: Update Rudolf Marek's e-mail address

The Silicon Hill club is not what it used to be.

Signed-off-by: Rudolf Marek <r.marek@assembler.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agok8temp: Documentation update
Rudolf Marek [Sat, 3 Feb 2007 01:00:19 +0000 (02:00 +0100)]
k8temp: Documentation update

Update the documentation for the k8temp driver.

Signed-off-by: Rudolf Marek <r.marek@assembler.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agok8temp: Add documentation
Rudolf Marek [Sat, 3 Feb 2007 00:59:29 +0000 (01:59 +0100)]
k8temp: Add documentation

Signed-off-by: Rudolf Marek <r.marek@sh.cvut.cz>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoMake 'repair' actually work for raid1.
Neil Brown [Tue, 30 Jan 2007 23:53:52 +0000 (00:53 +0100)]
Make 'repair' actually work for raid1.

When 'repair' finds a block that is different one the various
parts of the mirror. it is meant to write a chosen good version
to the others.  However it currently writes out the original data
to each. The memcpy to make all the data the same is missing.

Also correct a test so that 'repair' causes a repair, rather than
anything other then 'repair'.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agohwmon: New driver k8temp
Rudolf Marek [Sun, 28 Jan 2007 00:02:32 +0000 (01:02 +0100)]
hwmon: New driver k8temp

Add support for the temperature sensor(s) found in AMD K8 CPUs.

Signed-off-by: Rudolf Marek <r.marek@sh.cvut.cz>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SCSI] arcmsr: fix up sysfs values
James Bottomley [Sat, 27 Jan 2007 23:54:39 +0000 (00:54 +0100)]
[SCSI] arcmsr: fix up sysfs values

The sysfs files in arcmsr are non-standard in that they aren't simple
filename value pairs, the values actually contain preceeding text which
would have to be parsed.  The idea of sysfs files is that the file name
is the description and the contents is a simple value.

Fix up arcmsr to conform to this standard.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SCSI] areca sysfs fix
Andrew Morton [Sat, 27 Jan 2007 23:53:31 +0000 (00:53 +0100)]
[SCSI] areca sysfs fix

Remove sysfs_remove_bin_file() return-value checking from the areca driver.

There's nothing a driver can do if sysfs file removal fails, so we'll soon be
changing sysfs_remove_bin_file() to internally print a diagnostic and to
return void.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SCSI] arcmsr: initial driver, version 1.20.00.13
Erich Chen [Sat, 27 Jan 2007 23:52:30 +0000 (00:52 +0100)]
[SCSI] arcmsr: initial driver, version 1.20.00.13

arcmsr is a driver for the Areca Raid controller, a host based RAID
subsystem that speaks SCSI at the firmware level.

This patch is quite a clean up over the initial submission with
contributions from:

Randy Dunlap <rdunlap@xenotime.net>
Christoph Hellwig <hch@lst.de>
Matthew Wilcox <matthew@wil.cx>
Adrian Bunk <bunk@stusta.de>

Signed-off-by: Erich Chen <erich@areca.com.tw>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.39 v2.6.16.39
Adrian Bunk [Tue, 30 Jan 2007 20:10:08 +0000 (21:10 +0100)]
Linux 2.6.16.39

17 years agoLinux 2.6.16.39-rc1 v2.6.16.39-rc1
Adrian Bunk [Fri, 26 Jan 2007 19:47:08 +0000 (20:47 +0100)]
Linux 2.6.16.39-rc1

17 years ago[Bluetooth] Fix deadlock in the L2CAP layer
Marcel Holtmann [Thu, 25 Jan 2007 19:54:35 +0000 (20:54 +0100)]
[Bluetooth] Fix deadlock in the L2CAP layer

The Bluetooth L2CAP layer has 2 locks that are used in softirq context,
(one spinlock and one rwlock, where the softirq usage is readlock) but
where not all usages of the lock were _bh safe. The patch below corrects
this.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Add locking for bt_proto array manipulation
Marcel Holtmann [Thu, 25 Jan 2007 19:38:15 +0000 (20:38 +0100)]
[Bluetooth] Add locking for bt_proto array manipulation

The bt_proto array needs to be protected by some kind of locking to
prevent a race condition between bt_sock_create and bt_sock_register.

And in addition all calls to sk_alloc need to be made GFP_ATOMIC now.

Signed-off-by: Masatake YAMATO <jet@gyve.org>
Signed-off-by: Frederik Deweerdt <frederik.deweerdt@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP
Marcel Holtmann [Thu, 25 Jan 2007 19:34:48 +0000 (20:34 +0100)]
[Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP

There exists no attempt do deal with the fact that a structure with
a uint32_t followed by a pointer is going to be different for 32-bit
and 64-bit userspace. Any 32-bit process trying to use it will be
failing with -EFAULT if it's lucky; suffering from having data dumped
at a random address if it's not.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Handle command complete event for exit periodic inquiry
Marcel Holtmann [Thu, 25 Jan 2007 19:32:22 +0000 (20:32 +0100)]
[Bluetooth] Handle command complete event for exit periodic inquiry

The command complete event of the exit periodic inquiry command must
clear the HCI_INQUIRY flag and finish the HCI request.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Return EINPROGRESS for non-blocking socket calls
Marcel Holtmann [Thu, 25 Jan 2007 19:29:55 +0000 (20:29 +0100)]
[Bluetooth] Return EINPROGRESS for non-blocking socket calls

In case of non-blocking socket calls we should return EINPROGRESS
and not EAGAIN.

Signed-off-by: Ulisses Furquim <ulissesf@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agokbuild: explicitly turn off gcc stack-protector
Adrian Bunk [Fri, 26 Jan 2007 19:49:10 +0000 (20:49 +0100)]
kbuild: explicitly turn off gcc stack-protector

Ubuntu has enabled -fstack-protector per default in gcc
breaking kernel build. Explicit turn it off for now.

Backported based on several patches by Sam Ravnborg <sam@ravnborg.org>.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()
Marcel Holtmann [Thu, 25 Jan 2007 18:40:43 +0000 (19:40 +0100)]
[Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()

When calling send() with a zero length parameter on a RFCOMM socket
it returns a positive value. In this rare case the variable err is
used uninitialized and unfortunately its value is returned.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] More checks if DLC is still attached to the TTY
Marcel Holtmann [Thu, 25 Jan 2007 18:37:21 +0000 (19:37 +0100)]
[Bluetooth] More checks if DLC is still attached to the TTY

If the DLC device is no longer attached to the TTY device, then return
errors or default values for various callbacks of the TTY layer.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoBLUETOOTH: Fix unaligned access in hci_send_to_sock.
David S. Miller [Thu, 25 Jan 2007 18:36:01 +0000 (19:36 +0100)]
BLUETOOTH: Fix unaligned access in hci_send_to_sock.

The "u16 *" derefs of skb->data need to be wrapped inside of
a get_unaligned().

Thanks to Gustavo Zacarias for the bug report.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Check if DLC is still attached to the TTY
Marcel Holtmann [Thu, 25 Jan 2007 18:35:01 +0000 (19:35 +0100)]
[Bluetooth] Check if DLC is still attached to the TTY

If the DLC device is no longer attached to the TTY device, then it
makes no sense to go through with changing the termios settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agosparc32: add offset in pci_map_sg()
Jan Andersson [Wed, 24 Jan 2007 23:10:10 +0000 (00:10 +0100)]
sparc32: add offset in pci_map_sg()

Add sg->offset to sg->dvma_address in pci_map_sg() on sparc32.  Without the
offset, transfers to buffers that do not begin on a page boundary will not
work as expected.

Signed-off-by: Jan Andersson <jan.andersson@ieee.org>
Acked-By: David Miller <davem@davemloft.net>
17 years agoV4L/DVB: Missing statement in drivers/media/dvb/frontends/cx22700.c
Eric Sesterhenn [Wed, 24 Jan 2007 23:05:10 +0000 (00:05 +0100)]
V4L/DVB: Missing statement in drivers/media/dvb/frontends/cx22700.c

Stumbled over this because of coverity (id #492),
seems like we are missing a return statement here and fail
to do proper bounds checking. If this assumption is false
we should at least change the identation to make it clear

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoV4L/DVB: Flexcop-usb: fix debug printk
Alexey Dobriyan [Wed, 24 Jan 2007 18:02:31 +0000 (19:02 +0100)]
V4L/DVB: Flexcop-usb: fix debug printk

.. fix debug printk. Why, oh why, one would want to do
   (u16 & 0xff) << 8
and print it with %02x format?

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoV4L/DVB: Fix uninitialised variable in dvb_frontend_swzigzag
Andrew de Quincey [Wed, 24 Jan 2007 18:00:43 +0000 (19:00 +0100)]
V4L/DVB: Fix uninitialised variable in dvb_frontend_swzigzag

Spotted by coverity/Adrian Bunk.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[Bluetooth] Let BT_HIDP depend on INPUT
Adrian Bunk [Tue, 23 Jan 2007 23:29:07 +0000 (00:29 +0100)]
[Bluetooth] Let BT_HIDP depend on INPUT

This patch lets BT_HIDP depend on instead of select INPUT. This fixes
the following warning during an s390 build:

net/bluetooth/hidp/Kconfig:4:warning: 'select' used by config symbol
'BT_HIDP' refer to undefined symbol 'INPUT'

A dependency on INPUT also implies !S390 (and therefore makes the
explicit dependency obsolete) since INPUT is not available on s390.

The practical difference should be nearly zero, since INPUT is always
set to y unless EMBEDDED=y (or S390=y).

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoi386: fix CPU hotplug with 2GB VMSPLIT
Shaohua Li [Tue, 23 Jan 2007 15:52:07 +0000 (16:52 +0100)]
i386: fix CPU hotplug with 2GB VMSPLIT

In VMSPLIT mode, kernel PGD might have more entries than user space

Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoread_zero_pagealigned() locking fix
Hugh Dickins [Tue, 23 Jan 2007 15:46:22 +0000 (16:46 +0100)]
read_zero_pagealigned() locking fix

Ramiro Voicu hits the BUG_ON(!pte_none(*pte)) in zeromap_pte_range: kernel
bugzilla 7645.  Right: read_zero_pagealigned uses down_read of mmap_sem,
but another thread's racing read of /dev/zero, or a normal fault, can
easily set that pte again, in between zap_page_range and zeromap_page_range
getting there.  It's been wrong ever since 2.4.3.

The simple fix is to use down_write instead, but that would serialize reads
of /dev/zero more than at present: perhaps some app would be badly
affected.  So instead let zeromap_page_range return the error instead of
BUG_ON, and read_zero_pagealigned break to the slower clear_user loop in
that case - there's no need to optimize for it.

Use -EEXIST for when a pte is found: BUG_ON in mmap_zero (the other user of
zeromap_page_range), though it really isn't interesting there.  And since
mmap_zero wants -EAGAIN for out-of-memory, the zeromaps better return that
than -ENOMEM.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoatiixp: hang fix
Alan Cox [Mon, 22 Jan 2007 19:39:00 +0000 (20:39 +0100)]
atiixp: hang fix

When the old IDE layer calls into methods in the driver during error
handling it is essentially random whether ide_lock is already held.  This
causes a deadlock in the atiixp driver which also uses ide_lock internally
for locking.

Switch to a private lock instead.

[akpm@osl.org: cleanup]
Signed-off-by: Alan Cox <alan@redhat.com>
Acked-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agocdrom: set default timeout to 7 seconds
Jens Axboe [Mon, 22 Jan 2007 19:34:31 +0000 (20:34 +0100)]
cdrom: set default timeout to 7 seconds

It's a known fact that Windows times out commands after 7 seconds, so
drives generally try and respond if they can before that happens.  We
default to 5 seconds, which sometimes is a bit too short.

Jeremy Higdon reported here:

    http://lkml.org/lkml/2007/1/1/145

that his drive takes longer than 5 seconds for a "read track
information" command, later confirming that it is about 6.7 seconds.

So just do the sane thing and change the default command timeout to 7
seconds to avoid other surprises.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SCSI] qla1280 bus reset typo
Jes Sorensen [Mon, 22 Jan 2007 19:21:31 +0000 (20:21 +0100)]
[SCSI] qla1280 bus reset typo

Fix typo in check of return value of qla1280_bus_reset() which would
result in an adapter reset in addition to the bus reset.

Signed-off-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years ago[SCSI] qla1280 command timeout
Jes Sorensen [Mon, 22 Jan 2007 19:20:21 +0000 (20:20 +0100)]
[SCSI] qla1280 command timeout

Original patch from Ian Dall in bugzilla. Set command timeout as
specified by the SCSI layer rather than hardcode it to 30 seconds. I
have received a couple of reports of people hitting this one with
various tape configurations and the patch looks obviously correct.

From http://bugzilla.kernel.org/show_bug.cgi?id=6275

Ian Dall <ian@beware.dropbear.id.au>:

The command sent to the card was using a 30second timeout regardless of the
timeout requested in the scsi command passed down from higher levels.

Signed-off-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoadfs: fix filename handling
James Bursa [Sat, 20 Jan 2007 21:58:51 +0000 (22:58 +0100)]
adfs: fix filename handling

Fix filenames on adfs discs being terminated at the first character greater
than 128 (adfs filenames are Latin 1).  I saw this problem when using a
loopback adfs image on a 2.6.17-rc5 x86_64 machine, and the patch fixed it
there.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agos390: connector support
Martin Schwidefsky [Sat, 20 Jan 2007 21:49:42 +0000 (22:49 +0100)]
s390: connector support

Include connector config in the s390 arch Kconfig to get support for
connectors.

This also fixes the following Kconfig warning:
fs/Kconfig:1728:warning: 'select' used by config symbol 'CIFS_UPCALL' refer to undefined symbol 'CONNECTOR'

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: arp_tables: missing unregistration on module unload
Patrick McHardy [Mon, 22 Jan 2007 20:39:03 +0000 (21:39 +0100)]
NETFILTER: arp_tables: missing unregistration on module unload

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoNETFILTER: NAT: fix NOTRACK checksum handling
Patrick McHardy [Sat, 20 Jan 2007 21:18:30 +0000 (22:18 +0100)]
NETFILTER: NAT: fix NOTRACK checksum handling

The whole idea with the NOTRACK netfilter target is that
you can force the netfilter code to avoid connection
tracking, and all costs assosciated with it, by making
traffic match a NOTRACK rule.

But this is totally broken by the fact that we do a checksum
calculation over the packet before we do the NOTRACK bypass
check, which is very expensive.  People setup NOTRACK rules
explicitly to avoid all of these kinds of costs.

This patch from Patrick, already in Linus's tree, fixes the
bug.

Move the check for ip_conntrack_untracked before the call to
skb_checksum_help to fix NOTRACK excemptions from NAT. Pre-2.6.19
NAT code breaks TSO by invalidating hardware checksums for every
packet, even if explicitly excluded from NAT through NOTRACK.

2.6.19 includes a fix that makes NAT and TSO live in harmony,
but the performance degradation caused by this deserves making
at least the workaround work properly in -stable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agomm: fix bug in set_page_dirty_buffers
Nick Piggin [Sat, 20 Jan 2007 21:16:03 +0000 (22:16 +0100)]
mm: fix bug in set_page_dirty_buffers

This was triggered, but not the fault of, the dirty page accounting
patches. Suitable for -stable as well, after it goes upstream.

Unable to handle kernel NULL pointer dereference at virtual address 0000004c
EIP is at _spin_lock+0x12/0x66
Call Trace:
 [<401766e7>] __set_page_dirty_buffers+0x15/0xc0
 [<401401e7>] set_page_dirty+0x2c/0x51
 [<40140db2>] set_page_dirty_balance+0xb/0x3b
 [<40145d29>] __do_fault+0x1d8/0x279
 [<40147059>] __handle_mm_fault+0x125/0x951
 [<401133f1>] do_page_fault+0x440/0x59f
 [<4034d0c1>] error_code+0x39/0x40
 [<08048a33>] 0x8048a33
 =======================

Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
17 years agoLinux 2.6.16.38 v2.6.16.38
Adrian Bunk [Sat, 20 Jan 2007 17:54:03 +0000 (18:54 +0100)]
Linux 2.6.16.38