Avoid kernel crash in mm/slab.c due to double-free of pointer.
If the ethernet interface is brought down while there is still
RX traffic in flight, the device shutdown routine can end up
trying to double-free an skb, leading to a crash in mm/slab.c
Avoid the double-free by nulling out the skb pointer.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
firewire: Only set client->iso_context if allocation was successful.
ieee1394: fix to ether1394_tx in ether1394.c
firewire: fix hang after card ejection
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/mlx4: Make sure inline data segments don't cross a 64 byte boundary
IB/mlx4: Handle FW command interface rev 3
IB/mlx4: Handle buffer wraparound in __mlx4_ib_cq_clean()
IB/mlx4: Get rid of max_inline_data calculation
IB/mlx4: Handle new FW requirement for send request prefetching
IB/mlx4: Fix warning in rounding up queue sizes
IB/mlx4: Fix handling of wq->tail for send completions
This patch fixes an OOPS on cdev release for an fd where iso context
creation failed.
Signed-off-by: Kristian Høgsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
It's already annoying that they appear on x86 now -- that's for the 3button
emulation needed on x86 macs -- but at least don't make them default.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Not directly related to x86, but I got tired of seeing these warnings on every
kconfig update when building on a non m68k box:
drivers/input/keyboard/Kconfig:170:warning: 'select' used by config symbol 'KEYBOARD_ATARI' refers to undefined symbol 'ATARI_KBD_CORE'
drivers/input/mouse/Kconfig:182:warning: 'select' used by config symbol 'MOUSE_ATARI' refers to undefined symbol 'ATARI_KBD_CORE'
I moved the definition of ATARI_KBD_CORE into drivers/input/keyboard/Kconfig
so it's always seen by Kconfig.
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
For some platforms it's definitions may conflict. So that's the one-liner.
The rest is 10 square kilometers of collateral damage fixup this include
used to paper over.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Added members for volume number and real memory size to header information.
Signed-off-by: Michael Holzheu <holzheu@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Inline data segments in send WQEs are not allowed to cross a 64 byte
boundary. We use inline data segments to hold the UD headers for MLX
QPs (QP0 and QP1). A send with GRH on QP1 will have a UD header that
is too big to fit in a single inline data segment without crossing a
64 byte boundary, so split the header into two inline data segments.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Upcoming firmware introduces command interface revision 3, which
changes the way port capabilities are queried and set. Update the
driver to handle both the new and old command interfaces by adding a
new MLX4_FLAG_OLD_PORT_CMDS that it is set after querying the firmware
interface revision and then using the correct interface based on the
setting of the flag.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
When compacting CQ entries, we need to set the correct value of the
ownership bit in case the value is different between the index we copy
the CQE from and the index we copy it to.
Found by Ronni Zimmerman of Mellanox.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
The calculation of max_inline_data in set_kernel_sq_size() is bogus,
since it doesn't take into account the fact that inline segments may
not cross a 64-byte boundary, and hence multiple inline segments will
probably need to be used to post large inline sends.
We don't support inline sends for kernel QPs anyway, so there's no
point in doing this calculation anyway, since the field is just zeroed
out a little later. So just delete the bogus calculation.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
New ConnectX firmware introduces FW command interface revision 2,
which requires that for each QP, a chunk of send queue entries (the
"headroom") is kept marked as invalid, so that the HCA doesn't get
confused if it prefetches entries that haven't been posted yet. Add
code to the driver to do this, and also update the user ABI so that
userspace can request that the prefetcher be turned off for userspace
QPs (we just leave the prefetcher on for all kernel QPs).
Unfortunately, marking send queue entries this way is confuses older
firmware, so we change the driver to allow only FW command interface
revisions 2. This means that users will have to update their firmware
to work with the new driver, but the firmware is changing quickly and
the old firmware has lots of other bugs anyway, so this shouldn't be too
big a deal.
Based on a patch from Jack Morgenstein <jackm@dev.mellanox.co.il>.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
(As reported by linux@horizon.com)
Folding is done to minimize the theoretical possibility of systematic
weakness in the particular bits of the SHA1 hash output. The result of
this bug is that 16 out of 80 bits are un-folded. Without a major new
vulnerability being found in SHA1, this is harmless, but still worth
fixing.
Signed-off-by: Matt Mackall <mpm@selenic.com>
Cc: <linux@horizon.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
If raid1/repair (which reads all block and fixes any differences it finds)
hits a read error, it doesn't reset the bio for writing before writing
correct data back, so the read error isn't fixed, and the device probably
gets a zero-length write which it might complain about.
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1/ When resyncing a degraded raid10 which has more than 2 copies of each block,
garbage can get synced on top of good data.
2/ We round the wrong way in part of the device size calculation, which
can cause confusion.
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix section error (allyesconfig). The exit function is called from init,
so functions that are called by the exit function cannot be marked __exit.
WARNING: drivers/built-in.o(.text+0xe5bc6): Section mismatch: reference to .exit.
text: (between 'toshiba_acpi_exit' and 'hci_raw')
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Len Brown <len.brown@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Restore tty locked ioctl handler which was replaced with
an unlocked ioctl handler in hung_up_tty_fops by the patch:
commit e10cc1df1d
Author: Paul Fulghum <paulkf@microgate.com>
Date: Thu May 10 22:22:50 2007 -0700
tty: add compat_ioctl
This was reported in:
[Bug 8473] New: Oops: 0010 [1] SMP
The bug is caused by switching to hung_up_tty_fops in do_tty_hangup. An
ioctl call can be waiting on BLK after testing for existence of the locked
ioctl handler in the normal tty fops, but before calling the locked ioctl
handler. If a hangup occurs at that point, the locked ioctl fop is NULL
and an oops occurs.
(akpm: we can remove my debugging code from do_ioctl() now, but it'll be OK to
do that for 2.6.23)
Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit 9b01bd5b28 introduced a
compat_ioctl handler for RADEON_SETPARAM, the sole purpose of which was
to handle the fact that on i386, alignof(uint64_t)==4.
Unfortunately, this handler was installed for _all_ 64-bit
architectures, instead of only x86_64 and ia64. And thus it breaks
32-bit compatibility on every other arch, where 64-bit integers are
aligned to 8 bytes in 32-bit mode just the same as in 64-bit mode.
Arnd has a cunning plan to use 'compat_u64' with appropriate alignment
attributes according to the 32-bit ABI, but for now let's just make the
compat_radeon_cp_setparam routine entirely disappear on 64-bit machines
whose 32-bit compat support isn't for i386. It would be a no-op with
compat_u64 anyway.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Dave Airlie <airlied@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This patch fixes a problem that occurs when packets cannot be sent across
the ieee1394 bus and we return NETDEV_TX_BUSY in the net driver "hard start
xmit" routine ether1394_tx. When we return NETDEV_TX_BUSY the stack will
call ether1394_tx again with the same skb. So we need to restore the header
to look like it did before we munged it for xmit over ieee1394.
[Stefan Richter: changed whitespace, deleted a local variable]
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
generic_ide_resume() should check if dev->driver is not NULL before applying
to_ide_driver() to it. Fix that.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/cooloney/blackfin-2.6: (30 commits)
Blackfin SMC91X ethernet supporting driver: SMC91C111 LEDs are note drived in the kernel like in uboot
Blackfin SPI driver: fix bug SPI DMA incomplete transmission
Blackfin SPI driver: tweak spi cleanup function to match newer kernel changes
Blackfin RTC drivers: update MAINTAINERS information
Blackfin serial driver: decouple PARODD and CMSPAR checking from PARENB
Blackfin serial driver: actually implement the break_ctl() function
Blackfin serial driver: ignore framing and parity errors
Blackfin serial driver: hook up our UARTs STP bit with userspaces CMSPAR
Blackfin arch: move HI/LO macros into blackfin.h and punt the rest of macros.h as it includes VDSP macros we never use
Blackfin arch: redo our linker script a bit
Blackfin arch: make sure we initialize our L1 Data B section properly based on the linked kernel
Blackfin arch: fix bug can not wakeup from sleep via push buttons
Blackfin arch: add support for Alon Bar-Lev's dynamic kernel command-line
Blackfin arch: add missing gpio.h header to fix compiling in some pm configurations
Blackfin arch: As Mike pointed out range goes form m..MAX_BLACKFIN_GPIO -1
Blackfin arch: fix spelling typo in output
Blackfin arch: try to split up functions like this into smaller units according to LKML review
Blackfin arch: add proper ENDPROC()
Blackfin arch: move more of our startup code to .init so it can be freed once we are up and running
Blackfin arch: unify differences between our diff head.S files -- no functional changes
...
The lazy fpu changes did not take into account that some vmexit handlers
can sleep. Move loading the guest state into the inner loop so that it
can be reloaded if necessary, and move loading the host state into
vmx_vcpu_put() so it can be performed whenever we relinquish the vcpu.
Signed-off-by: Avi Kivity <avi@qumranet.com>
* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm: fix radeon setparam on 32/64 bit systems.
drm/i915: Add support for the G33, Q33, and Q35 chipsets.
i915: add new pciids for 945GME, 965GME/GLE
* master.kernel.org:/pub/scm/linux/kernel/git/kyle/parisc-2.6: (30 commits)
[PARISC] remove global_ack_eiem
[PARISC] Fix kernel panic in check_ivt
[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls
[PARISC] be more defensive in process.c::get_wchan
[PARISC] fix "reduce size of task_struct on 64-bit machines" fallout
[PARISC] fix null ptr deref in unwind.c
[PARISC] fix trivial spelling nit in asm/linkage.h
[PARISC] remove remnants of parisc-specific softirq code
[PARISC] fix section mismatch in smp.c
[PARISC] fix "ENTRY" macro redefinition
[PARISC] Wire up utimensat/signalfd/timerfd/eventfd syscalls
[PARISC] fix section mismatch in superio serial drivers
[PARISC] fix section mismatch in parisc eisa driver
[PARISC] fix section mismatches in arch/parisc/kernel
[PARISC] fix section mismatch in ccio-dma
[PARISC] fix section mismatch in parisc STI video drivers
[PARISC] fix section mismatch in parport_gsc
[PARISC] fix lasi_82596 build
[PARISC] Build fixes for power.c
[PARISC] kobject is embedded in subsys, not kset
...
This patch trys to fix device probe in two cases. First we should
correctly detect device if integrated graphics device is not enabled
or exists, like an add-in card is plugged. Second on some type of intel
GMCH, it might have multiple graphic chip models, like 945GME case, so
we should be sure the detect works through the whole table.
Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Jones <davej@redhat.com>
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[IPV6] addrconf: Fix IPv6 on tuntap tunnels
[TCP]: Add missing break to TCP option parsing code
[SCTP] Don't disable PMTU discovery when mtu is small
[SCTP] Flag a pmtu change request
[SCTP] Update pmtu handling to be similar to tcp
[SCTP] Fix leak in sctp_getsockopt_local_addrs when copy_to_user fails
[SCTP]: Allow unspecified port in sctp_bindx()
[SCTP]: Correctly set daddr for IPv6 sockets during peeloff
[TCP]: Set initial_ssthresh default to zero in Cubic and BIC.
[TCP]: Fix left_out setting during FRTO
[TCP]: Disable TSO if MD5SIG is enabled.
[PPP_MPPE]: Fix "osize too small" check.
[PATCH] mac80211: Don't stop tx queue on master device while scanning.
[PATCH] mac80211: fix debugfs tx power reduction output
[PATCH] cfg80211: fix signed macaddress in sysfs
[IrDA]: f-timer reloading when sending rejected frames.
[IrDA]: Fix Rx/Tx path race.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: move input-polldev to drivers/input
Input: i8042 - add ULI EV4873 to noloop list
Input: i8042 - add ASUS P65UP5 to the noloop list
Input: usbtouchscreen - fix fallout caused by move from drivers/usb
esp_reset_cleanup() does everything necessary except clear
the flag, so we never exit resetting state.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Ignoring OMAP_MMC_STAT_CARD_ERR, treating it as if the command
completed correctly.
Signed-off-by: Ragner Magalhaes <ragner.magalhaes@indt.org.br>
Signed-off-by: Carlos Eduardo Aguiar <carlos.aguiar@indt.org.br>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
To work around deficiences in Kconfig that allows to "select"
a symbol without automatically selecting all dependencies for
that symbol move input-polldev from drivers/input/misc to
drivers/input thus removing extra dependency on CONFIG_INPUT_MISC.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Since Myri-10G boards may also run in Myrinet mode instead of Ethernet,
add a message when we detect that the link partner is not running in the
right mode.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Limit the number of recoveries from a NIC hw watchdog reset to 1 by default.
It enables detection of defective NICs immediately since these memory parity
errors are expected to happen very rarely (less than once per century*NIC).
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
NetXen: Fix incorrect link status even with switch turned OFF.
NetXen driver failed to accurately indicate when a link is up or down.
This was encountered during failover testing, when the first port
indicated that the link was up even when the 10G switch it was assigned
to in the Bladecenter was turned off completely.
Signed-off by: Wen Xiong <wenxiong@us.ibm.com>
Signed-off by: Mithlesh Thukral <mithlesh@netxen.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
This reverts commit d52df4a35a.
This patch attempted to fix e100 for non-cache coherent memory
architectures by using the cb style code that eepro100 had and using
the EL and s bits from the RFD list. Unfortunately the hardware
doesn't work exactly like this and therefore this patch actually
breaks e100. Reverting the change brings it back to the previously
known good state for 2.6.22. The pending rewrite in progress to this
code can then be safely merged later.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Prevent mppe_decompress() from generating "osize too small" errors when
checking for output buffer size. When receiving a packet of mru size the
output buffer for decrypted data is 1 byte too small since
mppe_decompress() tries to account for possible PFC, however later in code
it is assumed no PFC.
Adjusting the check prevented these errors from occurring.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
With firmware 5.220.11.p5, this allows to specify the anycast addresses the
device will listen to.
The anycast address range is C0:27:C0:27:C0:XX where XX goes from 00 to 1F (or
0 to 31 in dec). The value to write on anycast_mask will specify which
addresses the device listens to. Bits in a 32 bit int are numbered from 0
(least significative bit) to 31. A specific address ending in YY will be
listened to if bit YY in the value is set to one.
Examples:
0x00000000 : do not listen to any anycast address
0xFFFFFFFF : listen to every anycast address from :00 to :1F
0x00000013 : listen to anycast addresses :00, :01 and :04
Signed-off-by: Luis Carlos Cobo <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This avoids channel mismatch between driver and firmware in case we change
channel while associated to an AP.
Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
