commit f3c5c1bfd4 (make ip_tables reentrant) introduced a race in
handling the stackptr restore, at the end of ipt_do_table()
We should do it before the call to xt_info_rdunlock_bh(), or we allow
cpu preemption and another cpu overwrites stackptr of original one.
A second fix is to change the underflow test to check the origptr value
instead of 0 to detect underflow, or else we allow a jump from different
hooks.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
The revision of the set type was not checked at the create command: if the
userspace sent a valid set type but with not supported revision number,
it'd create a loop.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
The hash:*port* types with IPv4 silently ignored when address ranges
with non TCP/UDP were added/deleted from the set and used the first
address from the range only.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Add the SMBus Controller DeviceIDs for the Intel DH89xxCC PCH.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
The last legitimate user of i2c_driver.attach_adapter and
.detach_adapter is gone, so we can finally deprecate these callbacks.
The last few drivers which still use these will have to be updated to
make use of standard I2C device instantiation ways instead.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Use the standard driver core mechanism to keep track of i2c adapters
present on the system: i2c_for_each_dev and a notifier. This will let
us deprecate and ultimately remove the legacy attach_adapter and
detach_adapter callbacks in i2c_driver.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Introduce i2c_for_each_dev(), an i2c device iterator with proper
locking for use by i2c-dev. This is needed so that we can get rid of
the attach_adapter and detach_adapter legacy callback functions.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
The last remaining ID in <linux/i2c-id.h> is no longer used anywhere,
so we can finally get rid of it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
* Typical legacy drivers implemented method .detach_client, not
.detach_adapter.
* Drop all references to __devexit, as i2c drivers shouldn't use it.
Cc: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Rename the parameter of i2c_get_adapter() to "nr", to make it clear we
are passing an adapter number and not an adapter ID (which have gone
away by now.)
Signed-off-by: Jean Delvare <khali@linux-fr.org>
The struct i2c_board_info member holding the name is "type", not
"name".
Signed-off-by: Roman Fietze <roman.fietze@telemotive.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: stable@kernel.org
When the OF device driver bits were converted over to the platform
device infrastructure in commit 74888760d4
("dt/net: Eliminate users of of_platform_{,un}register_driver") we
inadvertantly created probing problems in the OF case.
The NIU driver creates a dummy platform device to represent the
board that contains one or more child NIU devices. Unfortunately
we use the same name, "niu", as the OF device driver itself uses.
The result is that we try to probe the dummy "niu" parent device we
create, and since it has a NULL ofdevice pointer etc. everything
explodes:
[783019.128243] niu: niu.c:v1.1 (Apr 22, 2010)
[783019.128810] Unable to handle kernel NULL pointer dereference
[783019.128949] tsk->{mm,active_mm}->context = 000000000000039e
[783019.129078] tsk->{mm,active_mm}->pgd = fffff803afc5a000
[783019.129206] \|/ ____ \|/
[783019.129213] "@'/ .. \`@"
[783019.129220] /_| \__/ |_\
[783019.129226] \__U_/
[783019.129378] modprobe(2004): Oops [#1]
[783019.129423] TSTATE: 0000000011001602 TPC: 0000000010052ff8 TNPC: 000000000061bbb4 Y: 00000000 Not tainted
[783019.129542] TPC: <niu_of_probe+0x3c/0x2dc [niu]>
[783019.129624] g0: 8080000000000000 g1: 0000000000000000 g2: 0000000010056000 g3: 0000000000000002
[783019.129733] g4: fffff803fc1da0c0 g5: fffff800441e2000 g6: fffff803fba84000 g7: 0000000000000000
[783019.129842] o0: fffff803fe7df010 o1: 0000000010055700 o2: 0000000000000000 o3: fffff803fbacaca0
[783019.129951] o4: 0000000000000080 o5: 0000000000777908 sp: fffff803fba866e1 ret_pc: 0000000010052ff4
[783019.130083] RPC: <niu_of_probe+0x38/0x2dc [niu]>
[783019.130165] l0: fffff803fe7df010 l1: fffff803fbacafc0 l2: fffff803fbacaca0 l3: ffffffffffffffed
[783019.130273] l4: 0000000000000000 l5: 000000007fffffff l6: fffff803fba86f40 l7: 0000000000000001
[783019.130382] i0: fffff803fe7df000 i1: fffff803fc20aba0 i2: 0000000000000000 i3: 0000000000000001
[783019.130490] i4: 0000000000000000 i5: 0000000000000000 i6: fffff803fba867a1 i7: 000000000062038c
[783019.130614] I7: <platform_drv_probe+0xc/0x20>
Fix by simply renaming the parent device to "niu-board".
Signed-off-by: David S. Miller <davem@davemloft.net>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (64 commits)
Input: tsc2005 - remove 'disable' sysfs attribute
Input: tsc2005 - add open/close
Input: tsc2005 - handle read errors from SPI layer
Input: tsc2005 - do not rearm timer in hardirq handler
Input: tsc2005 - don't use work for 'pen up' handling
Input: tsc2005 - do not use 0 in place of NULL
Input: tsc2005 - use true/false for boolean variables
Input: tsc2005 - hide selftest attribute if we can't reset
Input: tsc2005 - rework driver initialization code
Input: tsc2005 - set up bus type in input device
Input: tsc2005 - set up parent device
Input: tsc2005 - clear driver data after unbinding
Input: tsc2005 - add module description
Input: tsc2005 - remove driver banner message
Input: tsc2005 - remove incorrect module alias
Input: tsc2005 - convert to using dev_pm_ops
Input: tsc2005 - use spi_get/set_drvdata()
Input: introduce tsc2005 driver
Input: xen-kbdfront - move to drivers/input/misc
Input: xen-kbdfront - add grant reference for shared page
...
A syscall was added without being added to asm-generic, which
makes tile (and presumably score and unicore32) break.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: Chen Liqin <liqin.chen@sunplusct.com>
Cc: Lennox Wu <lennox.wu@gmail.com>
Commit 8d7718aa08 changed "int"
to "u32" in the prototypes but not the definition.
I missed this when I saw the patch go by on LKML.
We cast "u32 *" to "int *" since we are tying into the underlying
atomics framework, and atomic_t uses int as its value type.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Reviewed-by: Michel Lespinasse <walken@google.com>
commit 54405cde76 (r8169: support control of advertising.)
introduced a bug in rtl8169_init_phy()
Reported-by: Piotr Hosowicz <piotr@hosowicz.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: Francois Romieu <romieu@fr.zoreil.com>
Tested-by: Anca Emanuel <anca.emanuel@gmail.com>
Tested-by: Piotr Hosowicz <piotr@hosowicz.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
After "x86-64, mm: Put early page table high" already existing kernel
page table pages can be mapped using early_ioremap too so we need to
update mask_rw_pte to make sure these pages are still mapped RO.
The reason why we have to do that is explain by the commit message of
fef5ba7979:
"Xen requires that all pages containing pagetable entries to be mapped
read-only. If pages used for the initial pagetable are already mapped
then we can change the mapping to RO. However, if they are initially
unmapped, we need to make sure that when they are later mapped, they
are also mapped RO.
..SNIP..
the pagetable setup code early_ioremaps the pages to write their
entries, so we must make sure that mappings created in the early_ioremap
fixmap area are mapped RW. (Those mappings are removed before the pages
are presented to Xen as pagetable pages.)"
We accomplish all this in mask_rw_pte by mapping RO all the pages mapped
using early_ioremap apart from the last one that has been allocated
because it is not a page table page yet (it has not been hooked into the
page tables yet).
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
LKML-Reference: <alpine.DEB.2.00.1103171739050.3382@kaball-desktop>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Do not set max_pfn_mapped to the end of the initial memory mappings,
that also contain pages that don't belong in pfn space (like the mfn
list).
Set max_pfn_mapped to the last real pfn mapped in the initial memory
mappings that is the pfn backing _end.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
LKML-Reference: <alpine.DEB.2.00.1103171739050.3382@kaball-desktop>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Now cleanup_highmap actually is in two steps: one is early in head64.c
and only clears above _end; a second one is in init_memory_mapping() and
tries to clean from _brk_end to _end.
It should check if those boundaries are PMD_SIZE aligned but currently
does not.
Also init_memory_mapping() is called several times for numa or memory
hotplug, so we really should not handle initial kernel mappings there.
This patch moves cleanup_highmap() down after _brk_end is settled so
we can do everything in one step.
Also we honor max_pfn_mapped in the implementation of cleanup_highmap.
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
LKML-Reference: <alpine.DEB.2.00.1103171739050.3382@kaball-desktop>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
nilfs2: move NILFS_SUPER_MAGIC to linux/magic.h
nilfs2: get rid of nilfs_sb_info structure
nilfs2: use sb instance instead of nilfs_sb_info struct
nilfs2: get rid of sc_sbi back pointer
nilfs2: move log writer onto nilfs object
nilfs2: move next generation counter into nilfs object
nilfs2: move s_inode_lock and s_dirty_files into nilfs object
nilfs2: move parameters on nilfs_sb_info into nilfs object
nilfs2: move mount options to nilfs object
nilfs2: record used amount of each checkpoint in checkpoint list
nilfs2: optimize rec_len functions
nilfs2: append blocksize info to warnings during loading super blocks
nilfs2: add compat ioctl
nilfs2: implement FS_IOC_GETFLAGS/SETFLAGS/GETVERSION
nilfs2: tighten restrictions on inode flags
nilfs2: mark S_NOATIME on inodes only if NOATIME attribute is set
nilfs2: use common file attribute macros
nilfs2: add free entries count only if clear bit operation succeeded
nilfs2: decrement inodes count only if raw inode was successfully deleted
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: (53 commits)
mmc: dw_mmc: support mmc power control with regulator
mmc: dw_mmc: fix suspend/resume operation
mmc: dw_mmc: add quirks for unreliable card detect, and capabilities
mmc: tmio: fix address in kunmap_atomic() calls
mmc: core: reset card voltage after power off
mmc: core: export function mmc_do_release_host()
mmc: sdio: remember new card RCA when redetecting card
mmc: dw_mmc: Remove set-but-unused variable.
mmc: sdhci-esdhc-imx: add card detect on custom GPIO for mx25/35
mmc: sdhci-esdhc: broken card detection is not a default quirk
mmc: sdhci-esdhc-imx: add write protect on custom GPIO on mx25/35
mmc: msm_sdcc: remove needless cache flush after dma_unmap_sg()
mmc: sh_mmcif: support aggressive clock gating
mmc: check if mmc cards < 2GB do sector addressing
mmc: core: comment on why sdio_reset is done at init time
mmc: dw_mmc: support DDR mode
mmc: via-sdmmc: Remove set-but-unused variable.
mmc: cb710: Return err value in cb710_wait_while_busy()
mmc: sdhci-pci: Remove set-but-unused variable.
mmc: mxs-mmc: add mmc host driver for i.MX23/28
...
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-2.6-mn10300:
MN10300: Clear ASB2364 peripheral interrupt masks before enabling interrupts
MN10300: Fix the ASB2364 gdbport UART register defs
MN10300: Fix ASB2364 FPGA register defs
MN10300: Select GENERIC_HARDIRQS_NO_DEPRECATED
MN10300: Select HAVE_GENERIC_HARDIRQS rather than GENERIC_HARDIRQS
MN10300: Convert ASB2364 FPGA irq_chip to new functions
MN10300: Convert ipi irq_chip to new functions
MN10300: Convert serial irq_chip to new functions
MN10300: Convert cpu irq_chips to new functions
MN10300: Remove unused mn10300_intc_* functions
MN10300: Remove stale irq_chip.end - V2
MN10300: Use clockevents_calc_mult_shift()
MN10300: Use clocksource_register_hz()
MN10300: Remove stale code
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/vapier/blackfin: (32 commits)
Blackfin: ip0x: fix unused variable warning
Blackfin: punt unused HDMA masks
Blackfin: wire up new syscalls
Blackfin/ipipe: restore pipeline bits in irqflags
Blackfin/ipipe: fix deferred pipeline sync for the root stage
Blackfin/ipipe: upgrade to I-pipe mainline
Blackfin: cpufreq: fix typos
Blackfin: enable GENERIC_HARDIRQS_NO_DEPRECATED
Blackfin: SMP: convert to irq chip functions
Blackfin: use accessor functions in show_interrupts()
Blackfin: use proper wrapper functions for modifying irq status
Blackfin: convert gpio irq_chip to new functions
Blackfin: convert mac irq_chip to new functions
Blackfin: convert error irq_chip to new functions
Blackfin: convert internal irq_chip to new functions
Blackfin: convert core irq_chip to new functions
Blackfin: use proper wrappers for irq_desc
Blackfin: optimize startup code
Blackfin: SMP: work around anomaly 05000491
Blackfin: SMP: implement cpu_freq support
...
The calculation is off-by-one. It should be "end - start + 1". This
patch fixes it to use resource_size() instead. Oddly, the code already
uses resource size correctly a couple lines earlier when it calls
request_mem_region() for this memory.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Similarly to irq_of_parse_and_map(), find the platform_device
object and return the pre-computed resource.
Signed-off-by: David S. Miller <davem@davemloft.net>
Now that we finally have __aligned_xx exported to userspace, convert
the headers that get exported over to the proper type.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Whenever we enter the IP stack proper from bridge netfilter we
need to ensure that the skb is in a form the IP stack expects
it to be in.
The entry point on NF_FORWARD did not meet the requirements of
the IP stack, therefore leading to potential crashes/panics.
This patch fixes the problem.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit c95b819ad7 (gre: Use needed_headroom)
made gre use needed_headroom instead of hard_header_len
This uncover a bug in vlan code.
We should make sure vlan devices take into account their
real_dev->needed_headroom or we risk a crash in ipgre_header(), because
we dont have enough room to push IP header in skb.
Reported-by: Diddi Oscarsson <diddi@diddi.se>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This structure was accidentally defined such that its layout can
differ between 32-bit and 64-bit processes. Add compat structure
definitions and an ioctl wrapper function.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: stable@kernel.org [2.6.30+]
Signed-off-by: David S. Miller <davem@davemloft.net>
__ethtool_set_sg does not check if dev->ethtool_ops->set_sg is defined
which can result in a NULL pointer dereference when ethtool is used to
change SG settings for drivers without SG support.
Signed-off-by: Roger Luethi <rl@hellgate.ch>
Reviewed-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
struct aunhdr has 4 padding bytes between 'pad' and 'handle' fields on
x86_64. These bytes are not initialized in the variable 'ah' before
sending 'ah' to the network. This leads to 4 bytes kernel stack
infoleak.
This bug was introduced before the git epoch.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Acked-by: Phil Blundell <philb@gnu.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
As specified by errata eTSEC49 of MPC8548 and errata eTSEC12 of MPC83xx,
older revisions of gianfar controllers will be unable to calculate a TCP/UDP
packet checksum for some alignments of the appropriate FCB. This patch checks
for FCB alignment on such controllers and falls back to software checksumming
if the alignment is known to be bad.
Signed-off-by: Alex Dubov <oakad@yahoo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
USB defines usb_device_type pointing to usb_device_pm_ops that
provides system-wide PM callbacks only and usb_bus_type pointing to
usb_bus_pm_ops that provides runtime PM callbacks only. However,
the USB runtime PM callbacks may be defined in usb_device_pm_ops
which makes it possible to drop usb_bus_pm_ops and will allow us
to consolidate the handling of subsystems by the PM core code.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
* 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
PCI: label: remove #include of ACPI header to avoid warnings
PCI: label: Fix compilation error when CONFIG_ACPI is unset
PCI: pre-allocate additional resources to devices only after successful allocation of essential resources.
PCI: introduce reset_resource()
PCI: data structure agnostic free list function
PCI: refactor io size calculation code
PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH
PCI hotplug: acpiphp: set current_state to D0 in register_slot
PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs
PCI: add more checking to ICH region quirks
PCI: aer-inject: Override PCIe AER Mask Registers
PCI: fix tlan build when CONFIG_PCI is not enabled
PCI: remove quirk for pre-production systems
PCI: Avoid potential NULL pointer dereference in pci_scan_bridge
PCI/lpc: irq and pci_ids patch for Intel DH89xxCC DeviceIDs
PCI: sysfs: Fix failure path for addition of "vpd" attribute
* 'spi/next' of git://git.secretlab.ca/git/linux-2.6: (34 commits)
spi/dw_spi: move dw_spi.h into drivers/spi
spi/dw_spi: Fix missing header
gpio/langwell: Clear edge bit before handling
gpio/langwell: Simplify demux loop
gpio/langwell: Convert irq name space
gpio/langwell: Fix broken irq_eoi change.
gpio; Make Intel chipset gpio drivers depend on x86
gpio/cs5535-gpio: Fix section mismatch
spi/rtc-{ds1390,ds3234,m41t94}: Use spi_get_drvdata() for SPI devices
spi/davinci: Support DMA transfers larger than 65535 words
spi/davinci: Use correct length parameter to dma_map_single calls
gpio: Use __devexit at necessary places
gpio: add MODULE_DEVICE_TABLE to pch_gpio and ml_ioh_gpio
gpio/mcp23s08: support mcp23s17 variant
of_mmc_spi: add card detect irq support
spi/omap_mcspi: catch xfers of non-multiple SPI word size
spi/omap_mcspi: Off-by-one error in finding the right divisor
gpio/pca953x: Fix wrong pointer type
spi/pl022: rid dangling labels
spi: add support for SuperH SPI
...
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/dlm:
dlm: use alloc_workqueue function
dlm: increase default hash table sizes
dlm: record full callback state
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
fs: call security_d_instantiate in d_obtain_alias V2
lose 'mounting_here' argument in ->d_manage()
don't pass 'mounting_here' flag to follow_down()
change the locking order for namespace_sem
fix deadlock in pivot_root()
vfs: split off vfsmount-related parts of vfs_kern_mount()
Some fixes for pstore
kill simple_set_mnt()
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bcopeland/omfs:
omfs: make readdir stop when filldir says so
omfs: merge unlink() and rmdir(), close leak in rename()
omfs: stop playing silly buggers with omfs_unlink() in ->rename()
omfs: rename() needs to mark old_inode dirty after ctime update
* 'linux-next' of git://git.infradead.org/ubifs-2.6: (25 commits)
UBIFS: clean-up commentaries
UBIFS: save 128KiB or more RAM
UBIFS: allocate orphans scan buffer on demand
UBIFS: allocate lpt dump buffer on demand
UBIFS: allocate ltab checking buffer on demand
UBIFS: allocate scanning buffer on demand
UBIFS: allocate dump buffer on demand
UBIFS: do not check data crc by default
UBIFS: simplify UBIFS Kconfig menu
UBIFS: print max. index node size
UBIFS: handle allocation failures in UBIFS write path
UBIFS: use max_write_size during recovery
UBIFS: use max_write_size for write-buffers
UBIFS: introduce write-buffer size field
UBI: incorporate LEB offset information
UBIFS: incorporate maximum write size
UBI: provide LEB offset information
UBI: incorporate maximum write size
UBIFS: fix LEB number in printk
UBIFS: restrict world-writable debugfs files
...
* 'linux-next' of git://git.infradead.org/ubi-2.6:
UBI: make tests modes dynamic
UBI: make self-checks dynamic
UBI: make debugging messages dynamic
UBI: remove UBI_IO_DEBUG macro
UBI: kill debugging buffer
UBI: allocate erase checking buffer on demand
UBI: allocate write checking buffer on demand
UBI: always re-read in case of read failures
UBI: cleanup comments about corrupted PEBs
UBI: add slab cache for ubi_scan_leb objects
UBI: use raw mtd read function in debugging code
UBI: try to reveal buggy MTD drivers
UBI: add a commentary about allocating VID header buffer on stack
UBI: cleanup LEB start calculations
UBI: fix NOR erase preparation quirk
