Jeff,

Atmel driver in 2.6.0-test11 is leaking SKBs if card gets disassociated
from an AP when it's about to transfer packet. Simon (atmel maintainer)
is OK with the patch. Given the fact that we are leaking memory I think
it may be beneficial to push it to Linus (if you like the patch).

Dmitry

===================================================================


ChangeSet@1.1517, 2003-12-11 01:44:56-05:00, dtor_core@ameritech.net
  NET: atmel - do not leak SKBs when dropping packets


 atmel.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)


===================================================================

Patch looks fine to me, thanks.   I've queued up the below.


From: Ville Nuorvala <vnuorval@tcs.hut.fi>

I've experienced random lockups witch become almost certain under heavy
loads, like when doing ping6 -f. The culprit seems to be the 3c574_cs
driver, which locks lp->window_lock twice when calling update_stats() from
el3_interrupt().



 drivers/net/pcmcia/3c574_cs.c |   15 +++++++++------
 1 files changed, 9 insertions(+), 6 deletions(-)

into redhat.com:/spare/repo/net-drivers-2.5

(required because of driver's use of rtnl_lock/unlock)

 1/ make sure raid5 doesn't try to handle multiple overlaping
    requests at the same time as this would confuse things badly.
    Currently it justs BUGs if this is attempted.
 2/ Fix a possible data-loss-on-write problem.  If two or
    more bio's that write to the same page are processed at the
    same time, only the first was actually commited to storage.
 3/ Fix a use-after-free bug.  raid5 keeps the bio's it is given
    in linked lists when more than one bio touch a single page.
    In some cases the tail of this list can be freed, and
    the current test for 'are we at the end' isn't reliable.
    This patch strengths the test to make it reliable.

Petr Vandrovec noticed a problem where the thread group leader
would not be properly reaped if the parent of the thread group
was ignoring SIGCHLD, and the thread group leader had exited
before the last sub-thread.

Fixed by Ingo Molnar.

This time we have a SMP memory ordering issue in prepare_to_wait(),
where we really need to make sure that subsequent tests for the
event we are waiting for can not migrate up to before the wait
queue has been set up.

In 2.5.x, the BKL was pushed from vfs_readdir() into the filesystem
specific functions.  But only the unlock_kernel() made it into the HPFS
code, lock_kernel() got lost on the way.  This rendered the filesystem
unusable.

This adds the missing lock_kernel().  It's been tested by Timo Maier who
also reported the problem earlier today.

The previous scsi_ioctl.c patch didn't cleanup the buffer/bio in the
error case. 

Fix it by copying the command data earlier.

corruption on SMP because of another CPU still accessing a waitqueue
even after it was de-allocated.

Use a careful version of the list emptiness check to make sure we
don't de-allocate the stack frame before the waitqueue is all done.

James reported a bug in scsi_ioctl.c where it mem copies a user pointer
instead of using copy_from_user(). I inadvertently introduced this one
when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it.

TCP IPV6 ->hash() method should not grab a socket reference.

The problem was that the cursor was in the list being walked, and when
the pointer pointed to the cursor the list_del/list_add_tail pair would
oops trying to find the entry pointed to by the prev pointer of the
deleted cursor element.

The solution I found was to move the list_del earlier, before the
beginning of the list walk. since it is not used during the list walk and
should not count in the list enumeration it can be deleted, then the
list pointer cannot point to it so it can be added safely with the
list_add_tail without oopsing, and everything works as expected.

I am unable to oops this version with any of my test programs. 

Patch acked by Al Viro.

into home.osdl.org:/home/torvalds/v2.5/linux

Based upon a patch from devik.

into redhat.com:/spare/repo/net-drivers-2.5

From Javier Achirica:

Delay MIC activation to prevent Oops

Clean up the tests while at it.

From: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
   
   Such poisoning can cause oopses either because the refcount is not
   zero when the poisoning occurs, or due to kernel debugging options
   being enabled.

The driver was calling pci_unregister_driver for each _device_, and then
again at the end of the module unload routine.  Remove the call that's
inside the loop, pci_unregister_driver should only be called once.
   
Caught by Don Fry (and many others)

Fixes oops some were seeing on module unload.

Caught by Jon Burgess.

Driver was calling pci_unregister_driver for each _device_, and then
again at the end of the module unload routine.  Remove the call that's
inside the loop, pci_unregister_driver should only be called once.

Caught by Don Fry (and many others)

into home.osdl.org:/home/torvalds/v2.5/linux

into redhat.com:/spare/repo/net-drivers-2.5

We should not allow mmap() with PROT_EXEC on mounts marked "noexec",
since otherwise there is no way for user-supplied executable loaders
(like ld.so and emulator environments) to properly honour the
"noexec"ness of the target.

into home.osdl.org:/home/torvalds/v2.5/linux

This patch fixes i2c_smbus_write_byte() being broken for i2c-nforce2.
This causes trouble when that module is used together with eeprom (which
is also in 2.6). We have had three user reports about the problem.

Credits go to Mark D. Studebaker for finding and fixing the problem.

The scheduler is completed b0rked on x86_64, and I finally found out
why.  sched_clock() always returned 0, because rdtscll() always returned
0.  The 'a' in the macro doesn't agree with the 'a' in the function,
yippe :-)

This is a show stopper for x86_64.

Such poisoning can cause oopses either because the refcount is not
zero when the poisoning occurs, or due to kernel debugging options
being enabled.

into home.osdl.org:/home/torvalds/v2.5/linux

The pid_alive() check within the loop is incorrect.  If we are within
the tasklist lock and the thread group leader is valid then the thread
chain will be fully intact.

Instead, the check should be _outside_ the loop, since if the group
leader no longer exists, the whole list is gone and we must not try
to access it.

Move the check around, and add comment.

Bug-hunting and fix by Srivatsa Vaddagiri

When doing sync wakeups we must not skip the notification of other cpus
if the task is not on this runqueue.