1. 09 May, 2006 7 commits
    • Roland Dreier's avatar
      IB/mthca: Fix race in reference counting · a3285aa4
      Roland Dreier authored
      Fix races in in destroying various objects.  If a destroy routine
      waits for an object to become free by doing
      
      	wait_event(&obj->wait, !atomic_read(&obj->refcount));
      	/* now clean up and destroy the object */
      
      and another place drops a reference to the object by doing
      
      	if (atomic_dec_and_test(&obj->refcount))
      		wake_up(&obj->wait);
      
      then this is susceptible to a race where the wait_event() and final
      freeing of the object occur between the atomic_dec_and_test() and the
      wake_up().  And this is a use-after-free, since wake_up() will be
      called on part of the already-freed object.
      
      Fix this in mthca by replacing the atomic_t refcounts with plain old
      integers protected by a spinlock.  This makes it possible to do the
      decrement of the reference count and the wake_up() so that it appears
      as a single atomic operation to the code waiting on the wait queue.
      
      While touching this code, also simplify mthca_cq_clean(): the CQ being
      cleaned cannot go away, because it still has a QP attached to it.  So
      there's no reason to be paranoid and look up the CQ by number; it's
      perfectly safe to use the pointer that the callers already have.
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      a3285aa4
    • Roland Dreier's avatar
      IB/srp: Fix tracking of pending requests during error handling · d945e1df
      Roland Dreier authored
      If a SCSI abort completes, or the command completes successfully, then
      the driver must remove the command from its queue of pending
      commands.  Similarly, if a device reset succeeds, then all commands
      queued for the given device must be removed from the queue.
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      d945e1df
    • Ralph Campbell's avatar
      IB: Fix display of 4-bit port counters in sysfs · d8b9f23b
      Ralph Campbell authored
      The code to display local_link_integrity_errors and
      excessive_buffer_overrun_errors in
      /sys/class/infiniband/<hca>/ports/<n>/counters/
      uses the wrong shift to extract the 4 bit values.
      Signed-off-by: default avatarRalph Campbell <ralph.campbell@qlogic.com>
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      d8b9f23b
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6 · 3cd73eed
      Linus Torvalds authored
      * 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6:
        [PATCH] bcm43xx: Fix access to non-existent PHY registers
        [PATCH] bcm43xx: Fix array overrun in bcm43xx_geo_init
        [PATCH] bcm43xx: check for valid MAC address in SPROM
        [PATCH] ieee80211: Fix A band channel count (resent)
        [PATCH] bcm43xx: fix iwmode crash when down
        [PATCH] softmac: make non-operational after being stopped
        [PATCH] softmac: don't reassociate if user asked for deauthentication
        spidernet: enable support for bcm5461 ethernet phy
        spidernet: introduce new setting
        Fix RTL8019AS init for Toshiba RBTX49xx boards
        au1000_eth.c: use ether_crc() from <linux/crc32.h>
        sky2: version 1.3
        Add more support for the Yukon Ultra chip found in dual core centino laptops.
        sky2: synchronize irq on remove
        sky2: dont write status ring
        sky2: edge triggered workaround enhancement
        sky2: use mask instead of modulo operation
        sky2: tx ring index mask fix
        sky2: status irq hang fix
        sky2: backout NAPI reschedule
      3cd73eed
    • Marcelo Tosatti's avatar
      [PATCH] ppc32/8xx: Fix r3 trashing due to 8MB TLB page instantiation · c51e078f
      Marcelo Tosatti authored
      Instantiation of 8MB pages on the TLB cache for the kernel static
      mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations.
      This ensures r3 gets saved and restored.
      Signed-off-by: default avatarMarcelo Tosatti <marcelo@kvack.org>
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      c51e078f
    • Paul Mackerras's avatar
      powerpc/32: Define an is_kernel_addr() to fix ARCH=ppc compilation · e4de0021
      Paul Mackerras authored
      My commit 6bfd93c3 broke the ARCH=ppc
      compilation by using the is_kernel_addr() macro in asm/uaccess.h.
      This fixes it by defining a suitable is_kernel_addr() for ARCH=ppc.
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      e4de0021
    • Linus Torvalds's avatar
      Merge git://oss.sgi.com:8090/xfs-2.6 · e515f048
      Linus Torvalds authored
      * git://oss.sgi.com:8090/xfs-2.6:
        [XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an
        [XFS] Fix a project quota space accounting leak on rename.
        [XFS] Fix a possible forced shutdown due to mishandling write barriers
      e515f048
  2. 08 May, 2006 30 commits
  3. 07 May, 2006 3 commits