Roland Dreier 24797a3442 RDMA/nes: Fix off-by-one in nes_reg_user_mr() error path ... nes_reg_user_mr() should fail if page_count becomes >= 1024 * 512 rather than just testing for strict >, because page_count is essentially used as an index into an array with 1024 * 512 entries, so allowing the loop to continue with page_count == 1024 * 512 means that memory after the end of the array is corrupted. This leads to a crash triggerable by a userspace application that requests registration of a too-big region. Also get rid of the call to pci_free_consistent() here to avoid corrupting state with a double free, since the same memory will be freed in the code jumped to at reg_user_mr_err. Signed-off-by: Roland Dreier <rolandd@cisco.com>		2008-06-10 12:29:49 -07:00
..
accessibility
acorn/char
acpi
amba
ata	libata: fix G5 SATA broken on -rc5	2008-06-05 08:36:37 -07:00
atm
auxdisplay
base	driver-core: prepare for 2.6.27 api change by adding dev_set_name	2008-05-29 21:10:01 -07:00
block	Add 'rd' alias to new brd ramdisk driver	2008-06-05 14:23:12 -07:00
bluetooth
cdrom
char	ipwireless: Fix blocked sending	2008-06-06 11:31:02 -07:00
clocksource
connector
cpufreq	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq	2008-06-09 11:27:55 -07:00
cpuidle
crypto
dca
dio
dma
edac
eisa
firewire
firmware	edd: fix incorrect return of 1 from module_init	2008-06-06 11:29:09 -07:00
gpio
hid
hwmon	hdaps: fix module loading on Thinkpad T61P	2008-06-06 11:29:13 -07:00
i2c
ide
ieee1394
infiniband	RDMA/nes: Fix off-by-one in nes_reg_user_mr() error path	2008-06-10 12:29:49 -07:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2008-05-30 10:17:19 -07:00
isdn
leds
lguest	virtio: set device index in common code.	2008-05-30 15:09:42 +10:00
macintosh
mca
md	md: do not compute parity unless it is on a failed drive	2008-06-06 11:29:08 -07:00
media	V4L/DVB (8001): dib0070: fix dib0070_attach when !CONFIG_DVB_TUNER_DIB0070	2008-06-05 10:26:21 -03:00
memstick
message
mfd
misc	fujitsu-laptop: autoload module on Lifebook P1510D	2008-06-06 11:29:09 -07:00
mmc	mmc: Fix crash in mmc_block on 64-bit	2008-06-05 16:14:17 -07:00
mtd	Merge git://git.infradead.org/~dwmw2/mtd-2.6.26	2008-06-06 11:31:18 -07:00
net	[POWERPC] ehea: Remove dependency on MEMORY_HOTPLUG	2008-06-09 11:32:44 +10:00
nubus
of	rtc-ds1374: rename device to just "ds1374"	2008-06-06 11:29:10 -07:00
oprofile
parisc
parport
pci	PCI: fix rpadlpar pci hotplug driver sysfs usage	2008-05-30 09:50:46 -07:00
pcmcia
pnp	PNP: skip UNSET MEM resources as well as DISABLED ones	2008-06-05 10:30:37 -07:00
power	power_supply: Fix race in power_supply_uevent	2008-06-10 02:13:51 +04:00
ps3
rapidio
rtc	rtc: class driver for ppc_md RTC functions	2008-06-06 11:29:13 -07:00
s390	Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus	2008-05-30 10:20:03 -07:00
sbus
scsi	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6	2008-06-04 08:36:09 -07:00
serial	Blackfin serial driver: fix up tty core set_ldisc API change breakage bug	2008-06-07 15:36:33 +08:00
sh
sn
spi	spi: fix refcount-related spidev oops-on-rmmod	2008-06-06 11:29:08 -07:00
ssb	ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable	2008-06-04 15:57:10 -04:00
tc
telephony
thermal
uio
usb	usb: r8a66597-hcd: Add support for SH7723 USB host	2008-06-09 16:04:12 +09:00
video	fbdev: export symbol fb_mode_option	2008-06-06 11:29:12 -07:00
virtio	virtio: force callback on empty.	2008-05-30 15:09:46 +10:00
w1
watchdog	drivers/watchdog/geodewdt.c: build fix	2008-05-30 10:16:58 -07:00
xen
zorro
Kconfig
Makefile