1. 02 Mar, 2010 1 commit
  2. 28 Feb, 2010 5 commits
    • Michael S. Tsirkin's avatar
      virtio: fix out of range array access · 31198159
      Michael S. Tsirkin authored
      I have observed the following error on virtio-net module unload:
      
      ------------[ cut here ]------------
      WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c()
      Hardware name: Bochs
      Trying to free already-free IRQ 0
      Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring
      virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last
      unloaded: scsi_wait_scan]
      Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24
      Call Trace:
       [<ffffffff8103e195>] warn_slowpath_common+0x7c/0x94
       [<ffffffff8103e204>] warn_slowpath_fmt+0x41/0x43
       [<ffffffff810a7a36>] ? __free_pages+0x5a/0x70
       [<ffffffff8107cc00>] __free_irq+0xa0/0x14c
       [<ffffffff8107cceb>] free_irq+0x3f/0x65
       [<ffffffffa0081424>] vp_del_vqs+0x81/0xb1 [virtio_pci]
       [<ffffffffa0091d29>] virtnet_remove+0xda/0x10b [virtio_net]
       [<ffffffffa0075200>] virtio_dev_remove+0x22/0x4a [virtio]
       [<ffffffff812709ee>] __device_release_driver+0x66/0xac
       [<ffffffff81270ab7>] driver_detach+0x83/0xa9
       [<ffffffff8126fc66>] bus_remove_driver+0x91/0xb4
       [<ffffffff81270fcf>] driver_unregister+0x6c/0x74
       [<ffffffffa0075418>] unregister_virtio_driver+0xe/0x10 [virtio]
       [<ffffffffa0091c4d>] fini+0x15/0x17 [virtio_net]
       [<ffffffff8106997b>] sys_delete_module+0x1c3/0x230
       [<ffffffff81007465>] ? old_ich_force_enable_hpet+0x117/0x164
       [<ffffffff813bb720>] ? do_page_fault+0x29c/0x2cc
       [<ffffffff81028e58>] sysenter_dispatch+0x7/0x27
      ---[ end trace 15e88e4c576cc62b ]---
      
      The bug is in virtio-pci: we use msix_vector as array index to get irq
      entry, but some vqs do not have a dedicated vector so this causes an out
      of bounds access.  By chance, we seem to often get 0 value, which
      results in this error.
      
      Fix by verifying that vector is legal before using it as index.
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
      Acked-by: default avatarShirley Ma <xma@us.ibm.com>
      Acked-by: default avatarAmit Shah <amit.shah@redhat.com>
      31198159
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k · 847f9c60
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (24 commits)
        m68k: Define sigcontext ABI of ColdFire
        m68knommu: NPTL support for uClinux
        m68k: Add NPTL support
        m68k: Eliminate unused variable in page_to_phys()
        m68k: Switch to generic siginfo layout
        macfb: fix 24-bit visual and stuff
        macfb: cleanup
        fbdev: add some missing mac modes
        mac68k: start CUDA early
        valkyriefb: various fixes
        fbdev: mac_var_to_mode() fix
        mac68k: move macsonic and macmace platform devices
        mac68k: move mac_esp platform device
        mac68k: replace mac68k SCC code with platform device
        pmac-zilog: add platform driver
        pmac-zilog: cleanup
        mac68k: rework SWIM platform device
        mac68k: cleanup
        ataflop: Killl warning about unused variable flags
        m68k: Use DIV_ROUND_CLOSEST
        ...
      847f9c60
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 · 79811647
      Linus Torvalds authored
      * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: (35 commits)
        [S390] time: remove unused code
        [S390] zcore: Add prefix registers to dump header
        [S390] correct vdso version string
        [S390] add support for compressed kernels
        [S390] Define new s390 ELF note sections in elf.h
        [S390] codepage conversion of kernel parameter line
        [S390] seq_file: convert drivers/s390/
        [S390] add z9-ec/z10 instruction to kernel disassembler
        [S390] dasd: correct offline processing
        [S390] dasd: fix refcounting.
        [S390] dasd: fix online/offline race
        [S390] use kprobes_built_in() in mm/fault code
        [S390] bug: use relative pointers in bug table entries
        [S390] Cleanup struct _lowcore usage and defines.
        [S390] free_initmem: reduce code duplication
        [S390] Replace ENOTSUPP usage with EOPNOTSUPP
        [S390] spinlock: check virtual cpu running status
        [S390] sysinfo: fix SYSIB 3,2,2 structure
        [S390] add MACHINE_IS_LPAR flag
        [S390] qdio: optimize cache line usage of struct qdio_irq
        ...
      79811647
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus · f1dd6ad5
      Linus Torvalds authored
      * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (141 commits)
        MIPS: Alchemy: defconfig updates
        MIPS: Alchemy: Fix Au1100 ethernet build failure
        MIPS: Alchemy: Repair db1500/bosporus builds
        MIPS: ARC: Cleanup unused definitions from sgialib.h
        MIPS: Cobalt: convert legacy port addresses to GT-64111 bus addresses
        MIPS: Alchemy: use 36bit addresses for PCMCIA resources.
        MIPS: Cobalt: Fix theoretical port aliasing issue
        MIPS: Use ALIGN(x, bytes) instead of __ALIGN_MASK(x, bytes - 1)
        MIPS: Crazy spinlock speed test.
        MIPS: Optimize spinlocks.
        MIPS: Alchemy: devboard PM needs to save CPLD registers.
        MIPS: PowerTV: Eliminate duplicate opcode definition macros
        MIPS: Lemote 2F: Move printks out of port_access_lock.
        MIPS: PNX833x: Convert IRQ controller locks to raw spinlocks.
        MIPS: Octeon: Replace spinlock with raw_spinlocks in dma-octeon.c.
        MIPS: Octeon: Replace rwlocks in irq_chip handlers with raw_spinlocks.
        MIPS: Octeon: Convert octeon_irq_msi_lock to raw spinlock.
        MIPS: Loongson: Remove pointless sample_lock from oprofile code.
        MIPS: SNI: Convert sni_rm200_i8259A_lock to raw spinlock.
        MIPS: i8259: Convert IRQ controller lock to raw spinlock.
        ...
      f1dd6ad5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 · 8d37a371
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: (49 commits)
        pcmcia: validate late-added resources
        pcmcia: allow for extension of resource interval
        pcmcia: remove useless msleep in ds.c
        pcmcia: use read_cis_mem return value
        pcmcia: handle error in serial_cs config calls
        pcmcia: add locking to pcmcia_{read,write}_cis_mem
        pcmcia: avoid prod_id memleak
        pcmcia: avoid sysfs-related lockup for cardbus
        pcmcia: use state machine for extended requery
        pcmcia: delay re-scanning and re-querying of PCMCIA bus
        pcmcia: use pccardd to handle eject, insert, suspend and resume requests
        pcmcia: use ops_mutex for rsrc_{mgr,nonstatic} locking
        pcmcia: use mutex for dynid lock
        pcmcia: assert locking to struct pcmcia_device
        pcmcia: add locking documentation
        pcmcia: simplify locking
        pcmcia: add locking to struct pcmcia_socket->pcmcia_state()
        pcmcia: protect s->device_count
        pcmcia: properly lock skt->irq, skt->irq_mask
        pcmcia: lock ops->set_socket
        ...
      8d37a371
  3. 27 Feb, 2010 34 commits