- 25 Jul, 2006 15 commits
-
-
Thomas Graf authored
Return ENOENT if action module is unavailable Signed-off-by:
Thomas Graf <tgraf@suug.ch> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Chris Wright <chrisw@sous-sol.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Thomas Graf authored
The TCA_ACT_KIND attribute is used without checking its availability when dumping actions therefore leading to a value of 0x4 being dereferenced. The use of strcmp() in tc_lookup_action_n() isn't safe when fed with string from an attribute without enforcing proper NUL termination. Both bugs can be triggered with malformed netlink message and don't require any privileges. Signed-off-by:
-
Michael Krufky authored
This Kconfig description is incorrect, due to a previous merge a while back. CONFIG_SAA711X builds module saa7115, which is the newer v4l2 module, and is not obsoleted. Signed-off-by:
Michael Krufky <mkrufky@linuxtv.org> Signed-off-by:
-
Willy Tarreau authored
The function pointers which were checked were for their get_* counterparts. Typically a copy-paste typo. Signed-off-by:
Willy Tarreau <w@1wt.eu> Acked-by:
Jeff Garzik <jeff@garzik.org> Signed-off-by:
-
Francois Romieu authored
via-velocity: the link is not correctly detected when the device starts The patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=6711Signed-off-by:
Roy Marples <uberlord@gentoo.org> Signed-off-by:
Francois Romieu <romieu@fr.zoreil.com> Signed-off-by:
-
Bob Moore authored
As detailed at http://bugs.gentoo.org/131534 : 2.6.16 converted many ACPI debug messages into error or warning messages. One extraneous message was incorrectly converted, resulting in logs being flooded by "Handle is NULL and Pathname is relative" messages on some systems. This patch (part of a larger ACPICA commit) converts the message back to debug level. Signed-off-by:
Daniel Drake <dsd@gentoo.org> Signed-off-by:
-
Andrew Morton authored
Suppress the "setup_irq: irq handler mismatch" coming out of pnp_check_irq(): failures are expected here. Cc: Santiago Garcia Mantinan <manty@manty.net> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org> Signed-off-by:
-
Andrew de Quincey authored
The original driver had a restriction that if a card as an saa7113 chip, then it cannot have a CI interface. This is not the case. Signed-off-by:
Andrew de Quincey <adq_dvb@lidskialf.net> Signed-off-by:
-
Andrew de Quincey authored
These cards do not need the tda10021 configuration change when data is streamed through a CAM module. This disables it for these ones. Signed-off-by:
-
Andrew de Quincey authored
The budget-av needs this GPIO set low for most cards to work. Signed-off-by:
-
Yasunori Goto authored
Memory hotplug code of i386 adds memory to only highmem. So, if CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set. Otherwise, it causes compile error. In addition, many architecture can't use memory hotplug feature yet. So, I introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG. Signed-off-by:
Yasunori Goto <y-goto@jp.fujitsu.com> Signed-off-by:
-
Andi Kleen authored
This fixes some OOMs on 64bit systems with <4GB of RAM when accessing the cdrom. Do a safer check for when to enable DMA. Currently we enable ISA DMA for cases that do not need it, resulting in OOM conditions when ZONE_DMA runs out of space. Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
Jens Axboe <axboe@suse.de> Signed-off-by:
-
Piotr Kaczuba authored
It turned out that the following change is needed when the speaker is compiled as a module. Signed-off-by:
-
Michael S. Tsirkin authored
mthca does not restore the following PCI-X/PCI Express registers after reset: PCI-X device: PCI-X command register PCI-X bridge: upstream and downstream split transaction registers PCI Express : PCI Express device control and link control registers This causes instability and/or bad performance on systems where one of these registers is set to a non-default value by BIOS. Signed-off-by:
Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by:
-
Mandy Kirkconnell authored
Fix nused counter. It's currently getting set to -1 rather than getting decremented by 1. Since nused never reaches 0, the "if (!free->hdr.nused)" check in xfs_dir2_leafn_remove() fails every time and xfs_dir2_shrink_inode() doesn't get called when it should. This causes extra blocks to be left on an empty directory and the directory in unable to be converted back to inline extent mode. Signed-off-by:
Mandy Kirkconnell <alkirkco@sgi.com> Signed-off-by:
Nathan Scott <nathans@sgi.com> Signed-off-by:
-
- 15 Jul, 2006 4 commits
-
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
Relax /proc fix a bit Clearign all of i_mode was a bit draconian. We only really care about S_ISUID/ISGID, after all. Signed-off-by:
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
Fix nasty /proc vulnerability We have a bad interaction with both the kernel and user space being able to change some of the /proc file status. This fixes the most obvious part of it, but I expect we'll also make it harder for users to modify even their "own" files in /proc. Signed-off-by:
-
- 06 Jul, 2006 2 commits
-
-
Greg Kroah-Hartman authored
-
Greg Kroah-Hartman authored
Based on a patch from Ernie Petrides During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges. Signed-off-by:
-
- 30 Jun, 2006 19 commits
-
-
Chris Wright authored
-
Patrick McHardy authored
When a packet without any chunks is received, the newconntrack variable in sctp_packet contains an out of bounds value that is used to look up an pointer from the array of timeouts, which is then dereferenced, resulting in a crash. Make sure at least a single chunk is present. Problem noticed by George A. Theall <theall@tenablesecurity.com> Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Chris Wright authored
-
Richard Purdie authored
Input: return correct size when reading modalias attribute Signed-off-by:
Richard Purdie <rpurdie@rpsys.net> Signed-off-by:
Dmitry Torokhov <dtor@mail.ru> Signed-off-by:
-
Sonny Rao authored
From: Sonny Rao <sonny@burdell.org> I ran into a bug where the kernel died in the idr code: cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710] pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330 lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330 sp: c000000b7096f990 msr: 800000000000b032 dar: 0 dsisr: 40010000 current = 0xc000000b70d43830 paca = 0xc000000000556900 pid = 2022, comm = hwup 1d:mon> t [c000000b7096f990] c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable) [c000000b7096faa0] c0000000001f8bf8 .idr_get_new_above+0x18/0x68 [c000000b7096fb20] c00000000002a054 .init_new_context+0x5c/0xf0 [c000000b7096fbc0] c000000000049dc8 .copy_process+0x91c/0x1404 [c000000b7096fcd0] c00000000004a988 .do_fork+0xd8/0x224 [c000000b7096fdc0] c00000000000ebdc .sys_clone+0x5c/0x74 [c000000b7096fe30] c000000000008950 .ppc_clone+0x8/0xc -- Exception: c00 (System Call) at 000000000fde887c SP (f8b4e7a0) is in userspace Turned out to be a race-condition and NULL ptr deref, here's my fix: Users of the idr code are supposed to call idr_pre_get without locking, so the idr code must serialize itself with respect to layer allocations. However, it fails to do so in an error path in idr_get_new_above_int(). I added the missing locking to fix this. Signed-off-by:Sonny Rao <sonny@burdell.org> Cc: <stable@kernel.org> Signed-off-by:
-
Anton Blanchard authored
From: Anton Blanchard <anton@samba.org> If futexes are disabled we fail to link on ppc64. Signed-off-by:
Anton Blanchard <anton@samba.org> Cc: <stable@kernel.org> Signed-off-by:
-
Nickolay authored
This patch fix double inclusion of ramfs-input. Signed-off-by:
Nickolay Vinogradov <nickolay@protei.ru> Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Signed-off-by:
-
Al Boldi authored
During an STR resume cycle, the ide master disk times-out when there is also a slave present (especially CD). Increasing the timeout in ide-io from 10,000 to 100,000 fixes this problem. Acked-by:
Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl> Cc: <stable@kernel.org> Signed-off-by:
-
Tejun Heo authored
Problem: - With 2.6.17 libata, some PIO-only devices are given DMA commands. Changes: - Do not clear the ATA_DFLAG_PIO flag in ata_dev_configure(). Signed-off-by:
Tejun Heo <htejun@gmail.com> Signed-off-by:
Albert Lee <albertcc@tw.ibm.com> Signed-off-by:
-
Robert Hancock authored
I've been experimenting to track down the cause of suspend/resume problems on my Compaq Presario X1050 laptop: http://bugzilla.kernel.org/show_bug.cgi?id=6075 Essentially the ACPI Embedded Controller and keyboard controller would get into a bizarre, confused state after resume. I found that unloading the ohci1394 module before suspend and reloading it after resume made the problem go away. Diffing the dmesg output from resume, with and without the module loaded, I found that with the module loaded I was missing these: PM: Writing back config space on device 0000:02:00.0 at offset 1. (Was 2100080, writing 2100007) PM: Writing back config space on device 0000:02:00.0 at offset 3. (Was 0, writing 8008) PM: Writing back config space on device 0000:02:00.0 at offset 4. (Was 0, writing 90200000) PM: Writing back config space on device 0000:02:00.0 at offset 5. (Was 1, writing 2401) PM: Writing back config space on device 0000:02:00.0 at offset f. (Was 20000100, writing 2000010a) The default PCI driver performs the pci_restore_state when no driver is loaded for the device. When the ohci1394 driver is loaded, it is supposed to do this, however it appears not to do so. I created the patch below and tested it, and it appears to resolve the suspend problems I was having with the module loaded. I only added in the pci_save_state and pci_restore_state - however, though I know little of this hardware, surely the driver should really be doing more than this when suspending and resuming? Currently it does almost nothing, what if there are commands in progress, etc? Signed-off-by:
Robert Hancock <hancockr@shaw.ca> Signed-off-by:
-
YOSHIFUJI Hideaki authored
We need to update hiscore.rule even if we don't enable CONFIG_IPV6_PRIVACY, because we have more less significant rule; longest match. Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
Łukasz Stelmach authored
Two additional labels (RFC 3484, sec. 10.3) for IPv6 addreses are defined to make a distinction between global unicast addresses and Unique Local Addresses (fc00::/7, RFC 4193) and Teredo (2001::/32, RFC 4380). It is necessary to avoid attempts of connection that would either fail (eg. fec0:: to 2001:feed::) or be sub-optimal (2001:0:: to 2001:feed::). Signed-off-by:
Łukasz Stelmach <stlman@poczta.fm> Signed-off-by:
-
Jeff Dike authored
The use of signed instead of unsigned here broke the calculations on negative numbers that are involved in calculating wall_to_monotonic. Signed-off-by:
Jeff Dike <jdike@addtoit.com> Signed-off-by:
-
Michael Buesch authored
Place the Init-vs-IRQ workaround before any card register access, because we might not have the wireless core mapped at all times in init. So this will result in a Machine Check caused by a bus error. Signed-off-by:
Michael Buesch <mb@bu3sch.de> Signed-off-by:
-
Kirill Smelkov authored
compile fix: <asm-i386/alternative.h> needs <asm/types.h> for 'u8' -- just look at struct alt_instr. My module includes <asm/bitops.h> as the first header, and as of 2.6.17 this leads to compilation errors. Signed-off-by:
Kirill Smelkov <kirr@mns.spb.ru> Cc: <stable@kernel.org> Signed-off-by:
-
Anton Altaparmakov authored
It fixes a crash in NTFS on architectures where flush_dcache_page() is a real function. I never noticed this as all my testing is done on i386 where flush_dcache_page() is NULL. http://bugzilla.kernel.org/show_bug.cgi?id=6700 Many thanks to Pauline Ng for the detailed bug report and analysis! Signed-off-by:
Anton Altaparmakov <aia21@cantab.net> Cc: <stable@kernel.org> Signed-off-by:
-
David Miller authored
Fix the calculation of the end address when flushing iotlb entries to ram. This bug has been a cause of esp dma errors, and it affects HyperSPARC systems much worse than SuperSPARC systems. Signed-off-by:
Bob Breuer <breuerr@mc.net> Signed-off-by:
-
Herbert Xu authored
The function ethtool_get_ufo was referring to ETHTOOL_GTSO instead of ETHTOOL_GUFO. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Neil Horman authored
In the event that our entire receive buffer is full with a series of chunks that represent a single gap-ack, and then we accept a chunk (or chunks) that fill in the gap between the ctsn and the first gap, we renege chunks from the end of the buffer, which effectively does nothing but move our gap to the end of our received tsn stream. This does little but move our missing tsns down stream a little, and, if the sender is sending sufficiently large retransmit frames, the result is a perpetual slowdown which can never be recovered from, since the only chunk that can be accepted to allow progress in the tsn stream necessitates that a new gap be created to make room for it. This leads to a constant need for retransmits, and subsequent receiver stalls. The fix I've come up with is to deliver the frame without reneging if we have a full receive buffer and the receiving sockets sk_receive_queue is empty(indicating that the receive buffer is being blocked by a missing tsn). Signed-off-by:
Neil Horman <nhorman@tuxdriver.com> Signed-off-by:
Sridhar Samudrala <sri@us.ibm.com> Signed-off-by:
-
