Commit Graph

64232 Commits

Author SHA1 Message Date
Alan Stern
0bd307e1b9 USB: remove DEBUG definition from dummy_hcd
This patch (as958) removes an unneeded and unwanted #define line from
dummy_hcd.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:47 -07:00
Jesper Juhl
1207cf84f2 USB: Fix a memory leak in em28xx_usb_probe()
If, in em28xx_usb_probe() the memory allocation
	dev->alt_max_pkt_size = kmalloc(32*
						dev->num_alt,GFP_KERNEL);
fails, then we'll bail out and return -ENOMEM.
The problem is that in that case we don't free the storage allocated
to 'dev', thus causing a memory leak.

This patch fixes the leak by freeing 'dev' before we return -ENOMEM.
This fixes Coverity bug #647.


Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:47 -07:00
Andy Green
e48eb085ac USB: belkin_sa: avoid divide by zero error
The belkin_sa module has a problem coping with a 0 return from
tty_get_baud_rate() -- the subsequent BELKIN_SA_BAUD macro

drivers/usb/serial/belkin_sa.h:#define BELKIN_SA_BAUD(b) (230400/b)

performs a divide with it leading to the following divide error:

usb 3-1: Belkin / Peracom / GoHubs USB Serial Adapter converter now attached to ttyUSB0
PM: Adding info for No Bus:usbdev3.3_ep81
PM: Adding info for No Bus:usbdev3.3_ep01
PM: Adding info for No Bus:usbdev3.3_ep82
divide error: 0000 [#1]
SMP
Modules linked in: vfat fat iwl3945 mac80211 cfg80211 belkin_sa usbserial usb_storage autofs4 vmnet(P) vmmon(P) aes nf_conntrack_netbios_ns ipt_REJECT nf_conntrack_ipv4 xt_state nf_conntrack nfnetlink xt_tcpudp iptable_filter ip_tables x_tables cpufreq_ondemand acpi_cpufreq video output sbs button dock battery ac arc4 snd_hda_intel ecb blkcipher snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss sr_mod snd_mixer_oss rtc_cmos cdrom iTCO_wdt iTCO_vendor_support snd_pcm rtc_core snd_timer serio_raw b44 ssb rtc_lib parport ata_piix snd soundcore snd_page_alloc mii ata_generic sg ahci libata sd_mod scsi_mod ext3 jbd mbcache ehci_hcd ohci_hcd uhci_hcd
CPU:    1
EIP:    0060:[<f8dd1747>]    Tainted: P        VLI
EFLAGS: 00010246   (2.6.23-rc1 #1)
EIP is at belkin_sa_set_termios+0x18e/0x5b9 [belkin_sa]
eax: 00038400   ebx: 00000000   ecx: 00000000   edx: 00000000
esi: 00038400   edi: 00001cb2   ebp: de49adb0   esp: de49ad6c
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process minicom (pid: 7306, ti=de49a000 task=eed6c3b0 task.ti=de49a000)
Stack: d85c74f0 00000046 00000002 00000001 d85c74f0 d85c74f0 00000246 c887c658
       00000001 00000cb0 00000001 00000084 00000000 d01b58c0 f6ba10e0 de49ade8
       de49ae40 de49add0 f8e2526b d85c74b8 ca6e6dbc de49ae40 d85c746c eded72e8
Call Trace:
 [<c0405f35>] show_trace_log_lvl+0x1a/0x2f
 [<c0405fe5>] show_stack_log_lvl+0x9b/0xa3
 [<c04061a5>] show_registers+0x1b8/0x289
 [<c0406389>] die+0x113/0x246
 [<c0622f98>] do_trap+0x8a/0xa3
 [<c04068dc>] do_divide_error+0x85/0x8f
 [<c0622d6a>] error_code+0x72/0x78
 [<f8e2526b>] serial_set_termios+0x86/0x8d [usbserial]
 [<c0542d33>] set_termios+0x309/0x34c
 [<c0542ece>] n_tty_ioctl+0x158/0x4ba
 [<c054030b>] tty_ioctl+0xc78/0xcd6
 [<c048aea0>] do_ioctl+0x50/0x67
 [<c048b100>] vfs_ioctl+0x249/0x25c
 [<c048b15c>] sys_ioctl+0x49/0x61
 [<c0404ed2>] sysenter_past_esp+0x5f/0x99
 =======================
Code: 85 c0 79 14 c7 44 24 04 67 1c dd f8 c7 04 24 d4 1e dd f8 e8 96 99 65 c7 8b 46 04 be 00 84 03 00 e8 47 11 77 c7 31 d2 89 c1 89 f0 <f7> f1 66 85 c0 89 c1 b8 01 00 00 00 0f 44 c8 8b 45 d8 85 db 8b
EIP: [<f8dd1747>] belkin_sa_set_termios+0x18e/0x5b9 [belkin_sa] SS:ESP 0068:de49ad6c

The small patch below should take care of this situation.  Note that my
kernel was tainted (vmware) but the problem will occur if
tty_get_baud_rate() ever returns zero and should be taken care of.

Signed-off-by: Andy Green <andy@warmcat.com>
Cc: William Greathouse <wgreathouse@smva.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:46 -07:00
Søren Hauberg
c1f8ea7d35 USB: Support for the Evolution Scorpion robots
The attached (mostly trivial) patches adds support for the Evolution
Scorpion Robots.
  Evolution Robotics supplies a patch against 2.6.8 with their
software. My patch is based on their work, so I don't know if I can
sign it off, or if you need some Evolution people to do this (which
might be hard).
  The patch adds device ID's for some robots which is trivial.



From: Søren Hauberg <hauberg@gmail.com>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Søren
2007-08-22 14:27:46 -07:00
David Brownell
8b2580e265 USB: quirks: multicard reader doesn't like autosuspend
It appears that one reason the "iConnect"-labeled multi-card reader was
on sale for only $5 is that it doesn't handle suspend/resume correctly.
Other than that, it was a good deal for a highspeed MMC/SD bridge.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:45 -07:00
Paul Mundt
71ee9a6c6c usb: r8a66597-hcd: fix up error path.
Currently when registration fails we're left with a stray reference to
release_mem_region(), this leads to the following case:

    r8a66597_hcd r8a66597_hcd: irq 13, io base 0x18040000
    drivers/usb/host/r8a66597-hcd.c: register access fail.
    r8a66597_hcd r8a66597_hcd: startup error -6
    r8a66597_hcd r8a66597_hcd: USB bus 1 deregistered
    drivers/usb/host/r8a66597-hcd.c: Failed to add hcd
    Trying to free nonexistent resource <0000000018040000-0000000018040000>

This fixes it up.

Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:45 -07:00
Paul Mundt
a3b53514bd usb: Enable hcd support on SH unconditionally.
Previous boards were likely seeing USB_ARCH_HAS_HCD selected by way
of PCMCIA or PCI, though none of those are required for hcd support
on SH. Enable support unconditionally.

Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:45 -07:00
Faidon Liambotis
96443218be USB: fix support for Dell Wireless Broadband (aka WWAN)
Dell Wireless Broadband ExpressCards are rebrands of Novatel's cards.
Add all of their known PCI IDs to date along with their mapping to the exact
Novatel model to the Option driver which already claims to support them.

Signed-off-by: Faidon Liambotis <paravoid@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:44 -07:00
Gabriel C
5b570d43ce USB: u132-hcd.c - Fix a warning when CONFIG_PM=n
I noticed this warning with CONFING_PM=n 

...

drivers/usb/host/u132-hcd.c:1525: warning: 'port_power' defined but not used

...

Signed-off-by: Gabriel Craciunescu <nix.or.die@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:44 -07:00
Robert P. J. Day
3aec6e26d7 USB: Typo: "USB_SAFE_PADDED" -> "USB_SERIAL_SAFE_PADDED".
Fix typo in safe_serial.c to match the actual CONFIG variable.

Signed-off-by: Robert P. J. Day <rpjday@mindspring.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:44 -07:00
Luis Lloret
88e45dbbab USB: Stall control endpoint when file storage class request wValue != 0
This patch makes the File Storage Gadget stall the control endpoint
when a MSC class request is made with wValue != 0.  This change makes
some MSC compliance test warnings disappear.

Signed-off-by: Luis Lloret <luislloret@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:44 -07:00
Hermann Kneissel
468d13623b USB: serial: garmin_gps: fixes package loss if used from gpsbabel
This patch contains two fixes submitted by Ondrej Palkovsky:
- the 'ACK' packet is sent after the transfer of the USB packet is
completed, i.e. in the write_callback function. Because the close
function sends the 'abort' command, a parameter is added that allows
the caller of garmin_write_bulk to specify, if the 'ack' should be
propagated to the serial link or dimissed.
This fixes the problem with gpsbabel, it has sent several packets that
were acknowledged before they were sent to the GPS and GpsBabel closed
the device - thus effectively cancelled all outstanding requests in the
queue.
- removed the APP_RESP_SEEN and APP_REQ_SEEN flags and changed
them into counters. It evades USB reset of the gps on every device close.

Signed-off-by: Hermann Kneissel <hermann.kneissel@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:44 -07:00
Maximilian Attems
c8ba84a0c6 USB: visor add ACER S10 palm device id
modprobe visor vendor=0x502 product=0x1
is said to work, plus there are patch instructions for it.
fixes http://bugs.debian.org/340547
see http://www.chinaitpower.com/A/2004-07-28/87909.html

Signed-off-by: Maximilian Attems <max@stro.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:43 -07:00
Alan Stern
74da5d68a5 USB: cdc-acm: fix sysfs attribute registration bug
This patch (as950) fixes a bug in the cdc-acm driver.  It doesn't keep
track of which interface (control or data) the sysfs attributes get
registered for, and as a result, during disconnect it will sometimes
attempt to remove the attributes from the wrong interface.  The
left-over attributes can cause a crash later on, particularly if the driver
module has been unloaded.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Oliver Neukum <oneukum@suse.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:43 -07:00
David Brownell
8c27303390 USB: px2xx_udc bugfix, missing check for gpio_pullup
git commit b2bbb20b37 added direct
support for PXA GPIO D+ pullup as alternative to the older udc_command
ops method.  This was done by introduction of the pxa2xx_udc_mach_info
member "gpio_pullup" which, if initialized, is now used in (almost)
all places where udc_command used to be called.

This patch fixes two places where checks for availability of D+ pullup
control still only honor udc_command.

Signed-off-by: Uli Luckas <u.luckas@road.de>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-08-22 14:27:43 -07:00
Linus Torvalds
74e8f346d5 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] Add support for 1533 bridge to alim1535_wdt
  [WATCHDOG] Add a 00-INDEX file to Documentation/watchdog/
  [WATCHDOG] Eurotechwdt.c - clean-up comments
2007-08-22 12:06:27 -07:00
Linus Torvalds
7da6cd8bdf Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC32]: Revert f642b26380.
  [SPARC64]: Need to clobber global reg vars in switch_to().
2007-08-22 11:13:22 -07:00
Linus Torvalds
13c926e046 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IRDA] irda_nl_get_mode: always results in failure
  [PPP]: Fix output buffer size in ppp_decompress_frame().
  [IRDA]: Avoid a label defined but not used warning in irda_init()
  [IPV6]: Fix kernel panic while send SCTP data with IP fragments
  [SNAP]: Check packet length before reading
  [DCCP]: Allocation in atomic context
2007-08-22 11:13:00 -07:00
Linus Torvalds
53ce2dc271 Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] Change atomic_read/set to inline functions with barrier semantics.
  [S390] kprobes: fix instruction length calculation
  [S390] hypfs: inode corruption due to missing locking
  [S390] disassembler: fix b2 opcodes like srst, bsg, and others
  [S390] vmur: fix reference counting for vmur device structure
  [S390] vmur: fix diag14 exceptions with addresses > 2GB.
  [S390] qdio: Refresh buffer states for IQDIO Asynchronous output queue
  [S390] qdio: fix EQBS handling on CCQ96
  [S390] cio: change confusing message in cmf.
  [S390] cio: dont forget to set last slot to NULL in ccw_uevent().
2007-08-22 11:12:08 -07:00
Zachary Amsden
8b14cb9953 Fix lazy mode vmalloc synchronization for paravirt
Touching vmalloc memory in the middle of a lazy mode update can generate
a kernel PDE update, which must be flushed immediately.  The fix is to
leave lazy mode when doing a vmalloc sync.

Signed-off-by: Zachary Amsden <zach@vmware.com>
Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-22 11:10:47 -07:00
Heiko Carstens
c51b962179 [S390] Change atomic_read/set to inline functions with barrier semantics.
After doing some tests this seems to be the best variant for s390 and
should be correct as well. With gcc 4.2.1 we get the following kernel
image sizes using the default configuration:

atomic_t type volatile, atomic_read/set defines   5311824 bytes
atomic_t type int, atomic_read/set defines        5270864 bytes
atomic_t type int, atomic_read/set inline asm     5279056 bytes
atomic_t type int, atomic_read/set inline barrier 5270864 bytes

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-08-22 13:51:49 +02:00
David Wilder
9c5f225f1a [S390] kprobes: fix instruction length calculation
Placing a kprobe on "bc" instruction (s390/s390x) can cause an oops.
The instruction length is encoded into the first two bits of the s390
instruction. Kprobe is incorrectly computing the instruction length.
The instruction length is used for determining what type of "fix-up" is
needed for conditional branch instruction. The problem can bee seen by
placing a kprobe on a "bc" instruction that will not branch. The
results is that Kprobe incorrectly computes the new instruction
pointer (psw.addr) after single stepping the instruction. The problem
is corrected with this patch.

Signed-off-by: David Wilder <dwilder@us.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:49 +02:00
Michael Holzheu
9b5a03e198 [S390] hypfs: inode corruption due to missing locking
hypfs removes the whole hypfs directory tree and creates a new one, when a
process triggers an update by writing to the "update" attribute. When removing
and creating files, it is necessary to lock the inode of the parent directory
where the files live. Currently hypfs does not lock the parent inode, which
can lead to inode corruption. This patch:
 * Introduces correct locking
 * Fixes i_nlink reference counting for inodes, when creating directories
 * Adds info printk, when hypfs filesystem has been mounted

Signed-off-by: Michael Holzheu <holzheu@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:49 +02:00
Christian Borntraeger
cee9e53f59 [S390] disassembler: fix b2 opcodes like srst, bsg, and others
The instruction table for b2 opcodes was missing an opfrag value
for the cpya instruction. All instructions specified after cpya
were not considered by the disassembler. The fix is simple and
obvious - add the opfrag field to the cpya instruction.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:48 +02:00
Michael Holzheu
8127a1f80a [S390] vmur: fix reference counting for vmur device structure
When a vmur device is removed due to a detach of the device, currently the
ur device structure is freed. Unfortunately it can happen, that there is
still a user of the device structure, when the character device is open
during the detach process. To fix this, reference counting for the vmur
structure is introduced.
In addition to that, the online, offline, probe and remove functions are
serialized now using a global mutex.

Signed-off-by: Michael Holzheu <holzheu@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:48 +02:00
Michael Holzheu
0a87c5cfc0 [S390] vmur: fix diag14 exceptions with addresses > 2GB.
There are several s390 diagnose calls, which must be executed below the
2GB memory boundary. In order to enforce this, those diagnoses must be
compiled into the kernel. Currently diag 14 can be called within the
vmur kernel module from addresses above 2GB. This leads to specification
exceptions. This patch moves diag10, diag14 and diag210 into the new
diag.c file.

Signed-off-by: Michael Holzheu <holzheu@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:47 +02:00
Klaus D. Wacker
37cd0a007f [S390] qdio: Refresh buffer states for IQDIO Asynchronous output queue
Hipersocket Multicast queue works asynchronously. When sending buffers,
the buffer state change may happen delayed. The tasklet for checking
changes in the outbound queue excluded IQDIO async queues from this
process. This created either a hang situation when the queue ran full,
or presented a hang situation a interface close time.
The tasklet processing is changed to include IQDIO async queues when
requesting buffer state refresh.

Signed-off-by: Klaus D. Wacker <kdwacker@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-08-22 13:51:47 +02:00
Klaus D. Wacker
f276730f8d [S390] qdio: fix EQBS handling on CCQ96
QDIO returned from EQBS instruction in any case after return code
CCQ=96 was issued regardless whether buffer states for at least one
buffer were extracted or not.
This caused FCP devices to hang when running under z/VM and having
QIOASSASIST=ON and having high I/O rates.
In order to fix this qdio return code processing of EQBS instruction
after CCQ=96 is changed that buffers are returned and if no buffers
where extracted the instruction is repeated at once.

Signed-off-by: Klaus D. Wacker <kdwacker@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:47 +02:00
Cornelia Huck
23eb68c569 [S390] cio: change confusing message in cmf.
cmf currently prints a message that more than 4096 channels are not
allowed in basic mode - however, this can only be enforced if cmf was
a module (which is no longer possible). It makes much more sense to
not check the specified number of channels and just print a message if
the block for basic mode could not be allocated (which may happen for
any number of specified channels).

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-08-22 13:51:47 +02:00
Cornelia Huck
3520c92283 [S390] cio: dont forget to set last slot to NULL in ccw_uevent().
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2007-08-22 13:51:46 +02:00
Andy Whitcroft
22117ea4fe [IRDA] irda_nl_get_mode: always results in failure
It seems an extraneous trailing ';' has slipped in to the error handling for a
name registration failure causing the error path to trigger unconditionally.

Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 21:23:39 -07:00
Konstantin Sharlaimov
06c7af563d [PPP]: Fix output buffer size in ppp_decompress_frame().
This patch addresses the issue with "osize too small" errors in mppe
encryption.  The patch fixes the issue with wrong output buffer size
being passed to ppp decompression routine.

--------------------
As pointed out by Suresh Mahalingam, the issue addressed by
ppp-fix-osize-too-small-errors-when-decoding patch is not fully resolved yet.
The size of allocated output buffer is correct, however it size passed to
ppp->rcomp->decompress in ppp_generic.c if wrong. The patch fixes that.
--------------------

Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:59:35 -07:00
Jesper Juhl
2c20d72aaa [IRDA]: Avoid a label defined but not used warning in irda_init()
Easily avoidable compiler warnings bug me.

Building irmod without CONFIG_SYSCTL currently results in :
 net/irda/irmod.c:132: warning: label 'out_err_2' defined but not used

But that can easily be avoided by simply moving the label inside
the existing "#ifdef CONFIG_SYSCTL" one line above it.

This patch moves the label and buys us one less warning with no
ill effects.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:59:30 -07:00
Wei Yongjun
8984e41d18 [IPV6]: Fix kernel panic while send SCTP data with IP fragments
If ICMP6 message with "Packet Too Big" is received after send SCTP DATA,
kernel panic will occur when SCTP DATA is send again.

This is because of a bad dest address when call to skb_copy_bits().

The messages sequence is like this:

Endpoint A                             Endpoint B
                               <-------  SCTP DATA (size=1432)
ICMP6 message ------->
(Packet Too Big pmtu=1280)
                               <-------  Resend SCTP DATA (size=1432)
------------kernel panic---------------

 printing eip:
c05be62a
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: scomm l2cap bluetooth ipv6 dm_mirror dm_mod video output sbs battery lp floppy sg i2c_piix4 i2c_core pcnet32 mii button ac parport_pc parport ide_cd cdrom serio_raw mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
CPU:    0
EIP:    0060:[<c05be62a>]    Not tainted VLI
EFLAGS: 00010282   (2.6.23-rc2 #1)
EIP is at skb_copy_bits+0x4f/0x1ef
eax: 000004d0   ebx: ce12a980   ecx: 00000134   edx: cfd5a880
esi: c8246858   edi: 00000000   ebp: c0759b14   esp: c0759adc
ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
Process swapper (pid: 0, ti=c0759000 task=c06d0340 task.ti=c0713000)
Stack: c0759b88 c0405867 ce12a980 c8bff838 c789c084 00000000 00000028 cfd5a880
       d09f1890 000005dc 0000007b ce12a980 cfd5a880 c8bff838 c0759b88 d09bc521
       000004d0 fffff96c 00000200 00000100 c0759b50 cfd5a880 00000246 c0759bd4
Call Trace:
 [<c0405e1d>] show_trace_log_lvl+0x1a/0x2f
 [<c0405ecd>] show_stack_log_lvl+0x9b/0xa3
 [<c040608d>] show_registers+0x1b8/0x289
 [<c0406271>] die+0x113/0x246
 [<c0625dbc>] do_page_fault+0x4ad/0x57e
 [<c0624642>] error_code+0x72/0x78
 [<d09bc521>] ip6_output+0x8e5/0xab2 [ipv6]
 [<d09bcec1>] ip6_xmit+0x2ea/0x3a3 [ipv6]
 [<d0a3f2ca>] sctp_v6_xmit+0x248/0x253 [sctp]
 [<d0a3c934>] sctp_packet_transmit+0x53f/0x5ae [sctp]
 [<d0a34bf8>] sctp_outq_flush+0x555/0x587 [sctp]
 [<d0a34d3c>] sctp_retransmit+0xf8/0x10f [sctp]
 [<d0a3d183>] sctp_icmp_frag_needed+0x57/0x5b [sctp]
 [<d0a3ece2>] sctp_v6_err+0xcd/0x148 [sctp]
 [<d09cf1ce>] icmpv6_notify+0xe6/0x167 [ipv6]
 [<d09d009a>] icmpv6_rcv+0x7d7/0x849 [ipv6]
 [<d09be240>] ip6_input+0x1dc/0x310 [ipv6]
 [<d09be965>] ipv6_rcv+0x294/0x2df [ipv6]
 [<c05c3789>] netif_receive_skb+0x2d2/0x335
 [<c05c5733>] process_backlog+0x7f/0xd0
 [<c05c58f6>] net_rx_action+0x96/0x17e
 [<c042e722>] __do_softirq+0x64/0xcd
 [<c0406f37>] do_softirq+0x5c/0xac
 =======================
Code: 00 00 29 ca 89 d0 2b 45 e0 89 55 ec 85 c0 7e 35 39 45 08 8b 55 e4 0f 4e 45 08 8b 75 e0 8b 7d dc 89 c1 c1 e9 02 03 b2 a0 00 00 00 <f3> a5 89 c1 83 e1 03 74 02 f3 a4 29 45 08 0f 84 7b 01 00 00 01
EIP: [<c05be62a>] skb_copy_bits+0x4f/0x1ef SS:ESP 0068:c0759adc
Kernel panic - not syncing: Fatal exception in interrupt

Arnaldo says:
====================
Thanks! I'm to blame for this one, problem was introduced in:

b0e380b1d8

@@ -761,7 +762,7 @@ slow_path:
                /*
                 *      Copy a block of the IP datagram.
                 */
-               if (skb_copy_bits(skb, ptr, frag->h.raw, len))
+               if (skb_copy_bits(skb, ptr, skb_transport_header(skb),
len))
                        BUG();
                left -= len;
====================

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:59:08 -07:00
Herbert Xu
d92a7db710 [SNAP]: Check packet length before reading
The snap_rcv code reads 5 bytes so we should make sure that
we have 5 bytes in the head before proceeding.

Based on diagnosis and fix by Evgeniy Polyakov, reported by
Alan J. Wylie.

Patch also kills the skb->sk assignment before kfree_skb
since it's redundant.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:58:13 -07:00
Gerrit Renker
39dad26c37 [DCCP]: Allocation in atomic context
This fixes the following bug reported in syslog:

[ 4039.051658] BUG: sleeping function called from invalid context at /usr/src/davem-2.6/mm/slab.c:3032
[ 4039.051668] in_atomic():1, irqs_disabled():0
[ 4039.051670] INFO: lockdep is turned off.
[ 4039.051674]  [<c0104c0f>] show_trace_log_lvl+0x1a/0x30
[ 4039.051687]  [<c0104d4d>] show_trace+0x12/0x14
[ 4039.051691]  [<c0104d65>] dump_stack+0x16/0x18
[ 4039.051695]  [<c011371e>] __might_sleep+0xaf/0xbe
[ 4039.051700]  [<c0157b66>] __kmalloc+0xb1/0xd0
[ 4039.051706]  [<f090416f>] ccid2_hc_tx_alloc_seq+0x35/0xc3 [dccp_ccid2]
[ 4039.051717]  [<f09048d6>] ccid2_hc_tx_packet_sent+0x27f/0x2d9 [dccp_ccid2]
[ 4039.051723]  [<f085486b>] dccp_write_xmit+0x1eb/0x338 [dccp]
[ 4039.051741]  [<f085603d>] dccp_sendmsg+0x113/0x18f [dccp]
[ 4039.051750]  [<c03907fc>] inet_sendmsg+0x2e/0x4c
[ 4039.051758]  [<c033a47d>] sock_aio_write+0xd5/0x107
[ 4039.051766]  [<c015abc1>] do_sync_write+0xcd/0x11c
[ 4039.051772]  [<c015b296>] vfs_write+0x118/0x11f
[ 4039.051840]  [<c015b932>] sys_write+0x3d/0x64
[ 4039.051845]  [<c0103e7c>] syscall_call+0x7/0xb
[ 4039.051848]  =======================

The problem was that GFP_KERNEL was used; fixed by using gfp_any().

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:58:06 -07:00
Robin Getz
cb00e99c0a fix - ensure we don't use bootconsoles after init has been released
Gerd Hoffmann pointed out that my patch from yesterday can lead
to a null pointer dereference if the kernel is booted with no
console, and no earlyprintk defined. This fixes that issue.

Signed-off-by: Robin Getz <rgetz@blackfin.uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-21 20:23:53 -07:00
Kumar Gala
15f6ddc7d9 [POWERPC] Fix PCI Device ID for MPC8544/8533 processors
The initial user manuals for MPC8544/8533 had some issues with properly
documenting the device IDs for MPC8544/8533.  These processors are almost
identical and both show up on the reference boards.

Fix up the quirks for PCIe support to handle MPC8533/E.

Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2007-08-21 19:15:31 -05:00
Stephen Hemminger
f350339cbd sky2: don't clear phy power bits
There are special PHY settings available on Yukon EC-U chip that
should not get cleared. This should solve mysterious errors on some
motherboards (like Gigabyte DS-3).

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-21 11:22:17 -07:00
Martin Bachem
d6c59c13c0 hisax: update hfc_usb driver
This fixes handling of USB ISO completion error -EXDEV and includes
several other changes to current CVS version at isdn4linux.de (changes
in debug flags, style of code remarks, etc)

Signed-off-by: Martin Bachem <info@colognechip.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-21 10:14:28 -07:00
Andi Kleen
36ce151411 i386: Mark NUMA support experimental
I did some testing and found quite a lot of problems (doesn't
boot at all on non NUMA and misassigns cores on Opteron systems).

Mark it as experimental and warn against its use for now.

It's still default y for SUMMIT/NUMAQ because it'll presumably
work on these systems.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-21 10:06:44 -07:00
David S. Miller
efb896300c [SPARC32]: Revert f642b26380.
This causes boot failures for some people.
It looks like in fact that some SILO provided
ramdisk images should not be KERNBASE normalized.

Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-20 23:40:01 -07:00
David S. Miller
195f7fd0a7 [SPARC64]: Need to clobber global reg vars in switch_to().
Otherwise the compiler can't see the things like the
per-cpu area base register are changing.

Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-20 23:40:00 -07:00
Linus Torvalds
8eb891fc80 Revert "USB: EHCI cpufreq fix"
This reverts commit 196705c9bb.  It was
reported to cause a regression by Daniel Exner, and Arjan van de Ven
points out that we actually already have infrastructure in place for
setting limits on acceptable DMA latency that would be the much more
correct fix for the problem with some Broadcom EHCI controllers.

Fixed up trivial conflicts due to the changes to support big-endian host
controller descriptors in drivers/usb/host/{ehci-sched.c,ehci.h}.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-20 23:38:44 -07:00
Zach Brown
848c4dd515 dio: zero struct dio with kzalloc instead of manually
This patch uses kzalloc to zero all of struct dio rather than manually
trying to track which fields we rely on being zero.  It passed aio+dio
stress testing and some bug regression testing on ext3.

This patch was introduced by Linus in the conversation that lead up to
Badari's minimal fix to manually zero .map_bh.b_state in commit:

  6a648fa721

It makes the code a bit smaller.  Maybe a couple fewer cachelines to
load, if we're lucky:

   text    data     bss     dec     hex filename
3285925  568506 1304616 5159047  4eb887 vmlinux
3285797  568506 1304616 5158919  4eb807 vmlinux.patched

I was unable to measure a stable difference in the number of cpu cycles
spent in blockdev_direct_IO() when pushing aio+dio 256K reads at
~340MB/s.

So the resulting intent of the patch isn't a performance gain but to
avoid exposing ourselves to the risk of finding another field like
.map_bh.b_state where we rely on zeroing but don't enforce it in the
code.

Signed-off-by: Zach Brown <zach.brown@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-20 22:50:25 -07:00
Linus Torvalds
38f061c571 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide-disk: workaround for buggy HPA support on ST340823A (take 3)
  hpt34x: fix CONFIG_HPT34X_AUTODMA=n handling
  triflex: add missing ->dma_base check
  pdc202xx_old: add missing ->dma_base check
  pdc202xx_new: add missing ->dma_base check
  cs5530: add missing ->dma_base check
  ide: ide_config_drive_speed() bugfixes
  ide: add cable detection for early UDMA66 devices (take 3)
  ide-pmac: fix drive->init_speed reporting
  ide: config_drive_for_dma() fixes
  ide-cris: fix ->set_pio_mode method to set transfer mode on the device
  ide: fix hidden dependencies on CONFIG_IDE_GENERIC
  ide: make CONFIG_IDE_GENERIC default to N
2007-08-20 22:48:42 -07:00
Linus Torvalds
09d4b9aa90 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb
* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
  V4L/DVB (6028): Turn an unnecessary mdelay() into msleep().
  V4L/DVB (6027): Get rid of an ill-behaved msleep in i2c write
  V4L/DVB (6026): Avoid powering up the camera on resume
  V4L/DVB (6016): get_dvb_firmware: update script for new location of tda10046 firmware
  V4L/DVB (5991): dvb-pll: Set minimum and maximum frequency properly
  V4L/DVB (5969): ivtv: report ivtv version in status log
  V4L/DVB (5967): ivtv: fix VIDIOC_S_FBUF:new OSD values where never set
  V4L/DVB (5968): videodev2.h: remove superfluous FBUF GLOBAL_INV_ALPHA support
2007-08-20 22:48:24 -07:00
David Woodhouse
b574864333 JFFS2 locking regression fix.
Commit a491486a20 introduced a locking
problem in JFFS2 -- we up() the alloc_sem when we weren't previously
holding it. This leads to all kinds of fun behaviour later.

There was a _reason_ for the
	if (1 /* alternative path needs testing */ ||
which the above-mentioned commit removed :)

Discovered and debugged by Giulio Fedel <giulio.fedel@andorsystems.com>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-20 22:44:27 -07:00
Linus Torvalds
2046219364 Merge branch 'fixes-2.6.23' of git://git.kernel.org/pub/scm/linux/kernel/git/galak/powerpc
* 'fixes-2.6.23' of git://git.kernel.org/pub/scm/linux/kernel/git/galak/powerpc:
  [POWERPC] Fix 8xx compile failure
  [POWERPC] Fix FSL BookE machine check reporting
  [POWERPC] Fix interrupt routing and setup of ULI M1575 on FSL boards
  [POWERPC] Add interrupt resource for RTC CMOS driver
2007-08-20 22:43:18 -07:00
Robin Getz
0c5564bd91 ensure we don't use bootconsoles after init has been released
This is a followup to the cleanups for earlyprintk patch from Gerd Hoffmann

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=69331af79cf29e26d1231152a172a1a10c2df511

This ensures that a bootconsole is unregistered if it is not replaced.
The current implementation spews garbage out the bootconsole in this case,
since the bootconsole structure is normally in the init section, and is
freed, but still used.

Signed-off-by: Robin Getz <rgetz@blackfin.uclinux.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Paul Mundt <lethal@linux-sh.org>
Cc: Mike Frysinger <vapier.adi@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-20 22:42:01 -07:00