- 16 Nov, 2007 40 commits
-
-
Roland Dreier authored
patch cbf5d9e6 in mainline. While reading the MSI code trying to find a reason why MSI wouldn't work for devices that have a 32-bit MSI address capability, I noticed that read_msi_msg() seems to read the message data from the wrong offset in this case. Signed-off-by:
Roland Dreier <roland@digitalvampire.org> Acked-by:
Eric W. Biederman <ebiederm@xmission.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Dan Williams authored
raid5: fix clearing of biofill operations This is the correct merge of the two upstream patches for this issue (it was mis-merged...) ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the 'pending' and 'ack' bits. Since the test_and_ack_op() macro only checks against 'complete' it can get an inconsistent snapshot of pending work. Move the clearing of these bits to handle_stripe5(), under the lock. Signed-off-by:
Dan Williams <dan.j.williams@intel.com> Tested-by:
Joel Bertrand <joel.bertrand@systella.fr> Signed-off-by:
Neil Brown <neilb@suse.de> Signed-off-by:
-
NeilBrown authored
patch 85bfb4da in mainline. As page->index is unsigned, this all becomes an unsigned comparison, which almost always returns an error. Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
-
Jun'ichi Nomura authored
patch ae9da83f in mainline. This patch fixes a bd_mount_sem counter corruption bug in device-mapper. thaw_bdev() should be called only when freeze_bdev() was called for the device. Otherwise, thaw_bdev() will up bd_mount_sem and corrupt the semaphore counter. struct block_device with the corrupted semaphore may remain in slab cache and be reused later. Attached patch will fix it by calling unlock_fs() instead. unlock_fs() will determine whether it should call thaw_bdev() by checking the device is frozen or not. Easy reproducer is: #!/bin/sh while [ 1 ]; do dmsetup --notable create a dmsetup --nolockfs suspend a dmsetup remove a done It's not easy to see the effect of corrupted semaphore. So I have tested with putting printk below in bdev_alloc_inode(): if (atomic_read(&ei->bdev.bd_mount_sem.count) != 1) printk(KERN_DEBUG "Incorrect semaphore count = %d (%p)\n", atomic_read(&ei->bdev.bd_mount_sem.count), &ei->bdev); Without the patch, I saw something like: Incorrect semaphore count = 17 (f2ab91c0) With the patch, the message didn't appear. The bug was introduced in 2.6.16 with this bug fix: commit d9dde59b Date: Fri Feb 24 13:04:24 2006 -0800 [PATCH] dm: missing bdput/thaw_bdev at removal Need to unfreeze and release bdev otherwise the bdev inode with inconsistent state is reused later and cause problem. and backported to 2.6.15.5. It occurs only in free_dev(), which is called only when the dm device is removed. The buggy code is executed only if md->suspended_bdev is non-NULL and that can happen only when the device was suspended without noflush. Signed-off-by:
Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Signed-off-by:
Alasdair G Kergon <agk@redhat.com> Signed-off-by:
-
Milan Broz authored
patch 79662d1e in mainline. Fix missing space in dm-delay target status output if separate read and write delay are configured. Signed-off-by:
Milan Broz <mbroz@redhat.com> Signed-off-by:
-
Tejun Heo authored
Synchronize NCQ blacklist with the current upstream. Based on changes already in Linus's 2.6.24-rc kernel tree. Signed-off-by:
Tejun Heo <htejun@gmail.com> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by:
-
Takashi Iwai authored
patch 2a3988f6 in mainline. Fix zero-division bug in the calculation dds offset. Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
Jaroslav Kysela <perex@perex.cz> Cc: Maarten Bressers <mbressers@gmail.com> Cc: gentoo kernel <kernel@gentoo.org> Signed-off-by:
-
Takashi Iwai authored
patch 7583cb51 from mainline. [ALSA] emu10k1 - Fix memory corruption The number of mixer elements for SPDIF control don't match with the actual array size (3). This may result in a memory corruption that overwrites the i2c_capture_source field (ALSA bug#3095). Signed-off-by:
-
Takashi Iwai authored
patch 8f11551b in mainline [ALSA] Fix build error without CONFIG_HAS_DMA The recent change of include/asm-generic/dma-mapping-broken.h breaks the build without CONFIG_HAS_DMA. This patch is an ad hoc fix. Signed-off-by:
-
Russ Cox authored
patch 38977e96 in mainline. [ALSA] fix selector unit bug affecting some USB speakerphones Following the suggestion in this thread: https://bugs.launchpad.net/ubuntu/+source/alsa-lib/+bug/26683 the correct upper bound on desc[0] is 5 + num_ins not 6 + num_ins, because the index used later is 5+i, not 6+i. This change makes my Vosky Chatterbox speakerphone work. Apparently it also helps with the Minivox MV100. Signed-off-by:
Russ Cox <rsc@swtch.com> Signed-off-by:
-
Takashi Iwai authored
patch c480f79b in mainline [ALSA] hda-codec - Avoid zero NID in line_out_pins[] of STAC codecs The STAC codes adds line_out_pins[] for shared mic/line-inputs accordingly. But, the current code may give a hole with NID=0 in some setting, which results in an error at probe. This patch fixes the problem. Signed-off-by:
-
Roland Dreier authored
Upstream as 76d7cc03 Firmware commands are sent to the HCA by writing multiple words to a command register block. Access to this block of registers is serialized with a mutex. However, on large SGI systems, problems were seen with multiple CPUs issuing FW commands at the same time, because the writes to the register block may be reordered within the system interconnect and reach the HCA in a different order than they were issued (even with the mutex). Fix this by adding an mmiowb() before dropping the mutex. Tested-by:
Arthur Kepner <akepner@sgi.com> Signed-off-by:
Roland Dreier <rolandd@cisco.com> Signed-off-by:
-
Roland Dreier authored
Upstream as cbfb50e6 Commit 9ead190b ("IB/uverbs: Don't serialize with ib_uverbs_idr_mutex") rewrote how userspace objects are looked up in the uverbs module's idrs, and introduced a severe bug in the process: there is no checking that an operation is being performed by the right process any more. Fix this by adding the missing check of uobj->context in __idr_get_uobj(). Apparently everyone is being very careful to only touch their own objects, because this bug was introduced in June 2006 in 2.6.18, and has gone undetected until now. Signed-off-by:
-
Jean Delvare authored
Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8 A stupid bit shifting bug caused the VID value to be always exported even when the hardware is configured for something different. Signed-off-by:
Jean Delvare <khali@linux-fr.org> Signed-off-by:
Mark M. Hoffman <mhoffman@lightlink.com> Signed-off-by:
-
Jean Delvare authored
Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2 Missing parentheses in the definition of FAN_FROM_REG cause a division by zero for a specific register value. Signed-off-by:
Hans de Goede <j.w.r.degoede@hhs.nl> Signed-off-by:
-
Jean Delvare authored
Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44 The bank switching code assumes that the bank selector is set to 0 when the driver is loaded. This might not be the case. This is exactly the same bug as was fixed in the w83627ehf driver two months ago: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d In practice, this bug was causing the sensor thermal types to be improperly reported for my W83627THF the first time I was loading the w83627hf driver. From the driver history, I'd say that it has been broken since September 2005 (when we stopped resetting the chip by default at driver load.) Signed-off-by:
-
Jean Delvare authored
Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd We need to read the fan clock dividers at initialization time, otherwise the code in store_fan_min() may use uninitialized values. That's pretty much the same bug and same fix as for the w83627ehf driver last month. Signed-off-by:
-
Dave Airlie authored
This is upstream as 54583bf4 Oops... Signed-off-by:
Dave Airlie <airlied@linux.ie> Signed-off-by:
-
Benjamin Herrenschmidt authored
Patch 4c2a54b0 in mailine. Current kernels have a non-working platinumfb due to some resource management issues. This fixes it. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by:
Paul Mackerras <paulus@samba.org> Signed-off-by:
-
Greg Kroah-Hartman authored
-
Marc Pignat authored
patch e0579d57 in mainline. The disconnect function can dereference the net_device structure when it is never allocated. This is the case when ejecting the device installer. Signed-off-by:
Marc Pignat <marc.pignat@hevs.ch> Acked-by:
Daniel Drake <dsd@gentoo.org> Signed-off-by:
John W. Linville <linville@tuxdriver.com> Signed-off-by:
-
Michael Wu authored
patch 98798f48 in mainline. The wrong pointer is passed to ieee80211_get_morefrag. Fix this. While we're at it, reorder things so they look better and the rts duration calculation is done with the right length. Thanks to Christoph Hellwig for finding the ieee80211_get_morefrag issue. Signed-off-by:
Michael Wu <flamingice@sourmilk.net> Signed-off-by:
-
Dan Williams authored
patch d20c678a in mainline ipw2100 wasn't sending WEXT scan events at all on scan completion. And like ipw2200, the driver aggressively auto-scans, requiring non-user-requested scan events to be batched together and sent at specific intervals instead of many times per seconds. Signed-off-by:
Dan Williams <dcbw@redhat.com> Signed-off-by:
-
John W. Linville authored
patch 3ba72b25 in mainline. skb->dev is not set until eth_type_trans is called... Signed-off-by:
-
Stephen Hemminger authored
patch ff35164e in mainline. Make sure PCI register for PHY power gets set correctly. Signed-off-by:
Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Stephen Hemminger authored
patch 295b54c4 in mainline. Make sure and not dump reserved areas of device space. Touching some of these causes machine check exceptions on boards like D-Link DGE-550SX. Coding note, used a complex switch statement rather than bitmap because it is easier to relate the block values to the documentation rather than looking at a encoded bitmask. Signed-off-by:
-
Stephen Hemminger authored
patch ab5adecb in mainline. The D-Link PCI-X board (and maybe others) can lie about status ring entries. It seems it will update the register for last status index before completing the DMA for the ring entry. To avoid reading stale data, zap the old entry and check. Signed-off-by:
Jeff Garzik <jeff@garzik.org> Signed-off-by:
-
Stephen Hemminger authored
patch 501fb72d in mainline. Change how PHY is managed on SysKonnect fibre based boards. Poll for PHY coming up 1 per second, but use interrupt to detect loss. Signed-off-by:
-
James Chapman authored
changeset 91781004 in mainline. [PPP]: L2TP: Fix oops in transmit and receive paths Changes made on 18-sep to fix skb handling in the pppol2tp driver broke the transmit and receive paths. Users are only running into this now because distros are now using 2.6.23 and I must have messed up when I tested the change. For receive, we now do our own calculation of how much to pull from the skb (variable length L2TP header) rather than using skb_transport_offset(). Also, if the skb isn't a data packet, it must be passed back to UDP with skb->data pointing to the UDP header. For transmit, make sure skb->sk is set up because ip_queue_xmit() needs it. Signed-off-by:
James Chapman <jchapman@katalix.com> Signed-off-by:
-
Michael Chan authored
patch 114342f2 in mainline. A performance regression was introduced by the following commit: commit ee6a99b5 Author: Michael Chan <mchan@broadcom.com> Date: Wed Jul 18 21:49:10 2007 -0700 [TG3]: Fix msi issue with kexec/kdump. In making that change, the PCI latency timer and cache line size registers were not restored after chip reset. On the 5705, the latency timer gets reset to 0 during chip reset and this causes very poor performance. Update version to 3.81.1 Signed-off-by:
Michael Chan <mchan@broadcom.com> Signed-off-by:
-
Ayaz Abdulla authored
patch 96fd4cd3 in mainline. Signed-off-by:
Ayaz Abdulla <aabdulla@nvidia.com> Signed-off-by:
Jeff Garzik <jgarzik@redhat.com> Signed-off-by:
-
Manfred Spraul authored
patch a7475906 in mainline. pci_enable_msi() replaces the INTx irq number in pci_dev->irq with the new MSI irq number. The forcedeth driver did not update the copy in netdevice->irq and parts of the driver used the stale copy. See bugzilla.kernel.org, bug 9047. The patch - updates netdevice->irq - replaces all accesses to netdevice->irq with pci_dev->irq. The patch is against 2.6.23.1. IMHO suitable for both 2.6.23 and 2.6.24 Signed-off-by:
Manfred Spraul <manfred@colorfullife.com> Signed-off-by:
-
Jan-Bernd Themann authored
based on 2c69448b in mainline. The current eHEA module compiled for 64K page kernels can not be loaded with insmod due to bad hypervisor call parameters. The patch is a subset of the follwing patch which has been applied for 2.6.24 upstream: http://www.spinics.net/lists/netdev/msg42814.htmlSigned-off-by:
Jan-Bernd Themann <themann@de.ibm.com> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by:
-
Al Viro authored
patch 57077081 in mainline. wep->keytype[] is u8 Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Al Viro authored
based on patch 8362cd41 in mainline. domain->header.len is le16 and has just been assigned cpu_to_le16(arithmetical expression). And all fields of adapter->logmsg are __le32; not a single 16-bit among them... That's incremental to the previous one Signed-off-by:
-
Greg Kroah-Hartman authored
-
John W. Linville authored
patch 67a4cce4 in mainline. Some APs send management frames with junk padding after the last IE. We already account for a similar problem with some Apple Airport devices, but at least one device is known to send more than a single extra byte. The device in question is the Draytek Vigor2900: http://www.draytek.com.au/products/Vigor2900.php The junk in question looks like an IE that runs off the end of the frame. This cause us to return ParseFailed. Since the frame in question is an association response, this causes us to fail to associate with this AP. The return code from ieee802_11_parse_elems is superfluous. All callers still check for the presence of the specific IEs that interest them anyway. So, remove the return code so the parse never "fails". Acked-by:
-
John W. Linville authored
patch d114f399 in mainline. The previous IW_SCAN_THIS_ESSID patch left a hole allowing scan requests on interfaces in inappropriate modes. Signed-off-by:
-
Bill Moss authored
patch 107acb23 in mainline. This patch fixes the problem of associating with wpa_secured hidden AP. Please try out. The original author of this patch is Bill Moss <bmoss@clemson.edu> Signed-off-by:
Abhijeet Kolekar <abhijeet.kolekar@intel.com> Signed-off-by:
-
John W. Linville authored
patch cffdd30d in mainline. Some AP equipment "in the wild" services multiple SSIDs using the same BSSID. This patch changes the key of sta_bss_list to include the SSID as well as the BSSID and the channel so as to prevent one SSID from eclipsing another SSID with the same BSSID. Signed-off-by:
-
