- 01 May, 2006 10 commits
-
-
Jose Alberto Reguero authored
This patch fixes tv-out support for the newer model of the pvr350, which has a saa7129 instead of a saa7127 video encoder. Signed-off-by:
Jose Alberto Reguero <jareguero@telefonica.net> Signed-off-by:
Mauro Carvalho Chehab <mchehab@infradead.org> Signed-off-by:
Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
Michael Krufky <mkrufky@linuxtv.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
Andrew Morton authored
Backport for_each_possible_cpu() into 2.6.16. Fixes the alpha build, and any future occurrences. Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
-
Michael Krufky authored
BBTI has updated their driver, and removed the old one from their website. This patch updates the get_dvb_firmware script to download the firmware from the new driver location. Signed-off-by:
-
Daniel Drake authored
If compiled into the kernel, parport_register_driver() is called before the parport driver has been initalised. This means that it is expected that tp_count is 0 after the parport_register_driver() call() - tipar's attach function will not be called until later during bootup. Signed-off-by:
Daniel Drake <dsd@gentoo.org> Signed-off-by:
-
Eric Sesterhenn authored
since the arrays are declared as in_urbs[N_IN_URB] and out_urbs[N_OUT_URB] both for loops, go one over the end of the array. This fixes coverity id #555 This patch was already included in Linus' tree. Signed-off-by:
Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by:
Adrian Bunk <bunk@stusta.de> Signed-off-by:
-
Mike Waychison authored
We do this by removing a micro-optimization that tries to avoid grabbing the iommu_bitmap_lock spinlock and using a bus-locked operation. This still races with other simultaneous alloc_iommu or free_iommu(size > 1) which both use bus-unlocked operations. The end result of this race is eventually ending up with an iommu_gart_bitmap that has bits errornously set all over, making large contiguous iommu space allocations fail with 'PCI-DMA: Out of IOMMU space'. Signed-off-by:
Mike Waychison <mikew@google.com> Signed-off-by:
Andi Kleen <ak@suse.de> Signed-off-by:
-
Andi Kleen authored
This quietens warnings and actually fixes a bug. The unwind tables would come out wrong without -32, causing pthread cancellation during them to crash in the gcc runtime. The problem seems to only happen with newer binutils (it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5) Thanks to Brian Baker @ HP for test case and initial analysis. Cc: brian.b@hp.com Signed-off-by:
-
Jason Baron authored
hi, The motivation behind the patch below was to address messages in /var/log/messages such as: Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing multiple contexts (1) Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing multiple contexts (2) I can reproduce by running 'get-edid' from: http://john.fremlin.de/programs/linux/read-edid/. These messages come about in the log b/c the vm86 calls do not exit via the normal system call exit paths and thus do not call 'audit_syscall_exit'. The next system call will then free the context for itself and for the vm86 context, thus generating the above messages. This patch addresses the issue by simply adding a call to 'audit_syscall_exit' from the vm86 code. Besides fixing the above error messages the patch also now allows vm86 system calls to become auditable. This is useful since strace does not appear to properly record the return values from sys_vm86. I think this patch is also a step in the right direction in terms of cleaning up some core auditing code. If we can correct any other paths that do not properly call the audit exit and entries points, then we can also eliminate the notion of context chaining. I've tested this patch by verifying that the log messages no longer appear, and that the audit records for sys_vm86 appear to be correct. Also, 'read_edid' produces itentical output. thanks, -Jason Signed-off-by:
Jason Baron <jbaron@redhat.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Thayumanavar Sachithanantham authored
[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups During module unloading, cdev_del() must be called to unmap cdev related kobject references and other cleanups(such as inode->i_cdev being set to NULL) which prevents the OOPS upon subsequent loading, usage and unloading of modules(as seen in the mail thread http://marc.theaimsgroup.com/?l=linux-kernel&m=114533640609018&w=2). Also, remove unneeded test of gpio_base. Signed-off-by:
Thayumanavar Sachithanantham <thayumk@gmail.com> Signed-off-by:
Linus Torvalds <torvalds@osdl.org> Signed-off-by:
-
Arnaud MAZIN authored
Add a test to detect the ICH7 based Core Duo SONY laptops (such as the SZ1) as type3 models. Signed-off-by:
Arnaud MAZIN <arnaud.mazin@gmail.com> Acked-by:
Stelian Pop <stelian@poppies.net> Signed-off-by:
-
- 24 Apr, 2006 25 commits
-
-
Greg Kroah-Hartman authored
-
Steve French authored
Unless Posix paths have been negotiated, the backslash, "\", is not a valid character in a path component. Signed-off-by:
Dave Kleikamp <shaggy@austin.ibm.com> Signed-off-by:
Steve French <sfrench@us.ibm.com> Signed-off-by:
-
Greg Kroah-Hartman authored
-
Alexey Kuznetsov authored
grow_ary() should not copy struct ipc_id_ary (it copies new->p, not new). Due to this, memcpy() src pointer could hit unmapped vmalloc page when near page boundary. Found during OpenVZ stress testing Signed-off-by:
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by:
Kirill Korotaev <dev@openvz.org> Signed-off-by:
-
OGAWA Hirofumi authored
Those also break userland regs like following. 00000000 <sys_chown16>: 0: 0f b7 44 24 0c movzwl 0xc(%esp),%eax 5: 83 ca ff or $0xffffffff,%edx 8: 0f b7 4c 24 08 movzwl 0x8(%esp),%ecx d: 66 83 f8 ff cmp $0xffffffff,%ax 11: 0f 44 c2 cmove %edx,%eax 14: 66 83 f9 ff cmp $0xffffffff,%cx 18: 0f 45 d1 cmovne %ecx,%edx 1b: 89 44 24 0c mov %eax,0xc(%esp) 1f: 89 54 24 08 mov %edx,0x8(%esp) 23: e9 fc ff ff ff jmp 24 <sys_chown16+0x24> where the tailcall at the end overwrites the incoming stack-frame. Signed-off-by:OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Signed-off-by:
-
KAI.HSU authored
>From http://bugzilla.kernel.org/show_bug.cgi?id=6358 The alim15x3.c havn't been update for 3 years. Recently when we use this "ULI M1573" south bridge chip found that can't mount CDROM(VCD) smoothly, must waiting for a long time. After I check the "ULI M1573" south bridge datasheet, I found the reason. The reason is the "ULI M1573" version in the Linux is "0xC7" not "0xC4" anymore So I was modified the source than it was successed. Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl> Acked-by:
Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by:
-
Samuel Thibault authored
Fix the "apm: set display: Interface not engaged" error on Armada laptops again. Jordan said: I think this is fine. It seems to me that this may be the fault of one or both of the APM solutions handling this situation in a non-standard way, but since APM is used very little on the Geode, and I have direct access to our BIOS folks, if this problem comes up with a customer again, we'll solve it from the firmware. Signed-off-by:
Samuel Thibault <samuel.thibault@ens-lyon.org> Cc: "Jordan Crouse" <jordan.crouse@amd.com> Cc: Zachary Amsden <zach@vmware.com> Signed-off-by:
-
Antonino A. Daplas authored
Fix return code of fb_write(): If at least 1 byte was transferred to the device, return number of bytes, otherwise: - return -EFBIG - if file offset is past the maximum allowable offset or size is greater than framebuffer length - return -ENOSPC - if size is greater than framebuffer length - offset Signed-off-by:Antonino Daplas <adaplas@pol.net> Signed-off-by:
-
Dipankar Sarma authored
There are places in the kernel where we look up files in fd tables and access the file structure without holding refereces to the file. So, we need special care to avoid the race between looking up files in the fd table and tearing down of the file in another CPU. Otherwise, one might see a NULL f_dentry or such torn down version of the file. This patch fixes those special places where such a race may happen. Signed-off-by:
Dipankar Sarma <dipankar@in.ibm.com> Acked-by:
"Paul E. McKenney" <paulmck@us.ibm.com> Signed-off-by:
-
David Barksdale authored
Fix the bitmasks used when writing to the M41T00 registers. The original code used a mask of 0x7f when writing to each register, this is incorrect and probably the result of a copy-paste error. As a result years from 1980 to 1999 will be read back as 2000 to 2019. Signed-off-by:
David Barksdale <amatus@ocgnet.org> Acked-by:
Jean Delvare <khali@linux-fr.org> Signed-off-by:
-
Heikki Orsila authored
I was looking into random driver code and found a suspicious looking memcpy() in drivers/char/ipmi/ipmi_bt_sm.c on 2.6.17-rc1: if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH)) return -1; ... memcpy(bt->write_data + 3, data + 1, size - 1); where sizeof bt->write_data is IPMI_MAX_MSG_LENGTH. It looks like the memcpy would overflow by 2 bytes if size == IPMI_MAX_MSG_LENGTH. A patch attached to limit size to (IPMI_MAX_LENGTH - 2). Cc: Corey Minyard <minyard@acm.org> Signed-off-by:
-
Linus Torvalds authored
x86: be careful about tailcall breakage for sys_open[at] too Came up through a quick grep for other cases similar to the ftruncate() one in commit 0a489cb3. Also, add a comment, so that people who read the code understand why we do what looks like a no-op. (Again, this won't actually matter to any sane user, since libc will save and restore the register gcc stomps on, but it's still wrong to stomp on it) Signed-off-by:
-
Linus Torvalds authored
x86: don't allow tail-calls in sys_ftruncate[64]() Gcc thinks it owns the incoming argument stack, but that's not true for "asmlinkage" functions, and it corrupts the caller-set-up argument stack when it pushes the third argument onto the stack. Which can result in %ebx getting corrupted in user space. Now, normally nobody sane would ever notice, since libc will save and restore %ebx anyway over the system call, but it's still wrong. I'd much rather have "asmlinkage" tell gcc directly that it doesn't own the stack, but no such attribute exists, so we're stuck with our hacky manual "prevent_tail_call()" macro once more (we've had the same issue before with sys_waitpid() and sys_wait4()). Thanks to Hans-Werner Hilse <hilse@sub.uni-goettingen.de> for reporting the issue and testing the fix. Signed-off-by:
-
YOSHIFUJI Hideaki / �$B5HF#1QL@�(B authored
[IPV6] XFRM: Fix decoding session with preceding extension header(s). We did not correctly decode session with preceding extension header(s). This was because we had already pulled preceding headers, skb->nh.raw + 40 + 1 - skb->data was minus, and pskb_may_pull() failed. We now have IP6CB(skb)->nhoff and skb->h.raw, and we can start parsing / decoding upper layer protocol from current position. Tracked down by Noriaki TAKAMIYA <takamiya@po.ntts.co.jp> and tested by Kazunori Miyazawa <kazunori@miyazawa.org>. Signed-off-by:
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by:
-
YOSHIFUJI Hideaki / �$B5HF#1QL@�(B authored
[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull(). Signed-off-by:
-
YOSHIFUJI Hideaki / �$B5HF#1QL@�(B authored
[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff. Signed-off-by:
-
Ron Yorston authored
Fix an off-by-one error in the MLS compatibility code that was causing contexts with a MLS suffix to be rejected, preventing sharing partitions between FC4 and FC5. Bug reported in https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188068Signed-off-by:
Stephen Smalley <sds@tycho.nsa.gov> Acked-by:
James Morris <jmorris@redhat.com> Signed-off-by:
-
Guido Guenther authored
this fixes an oops in 2.6.16.X when loading the snd_powermac module. The name of the requested module changed during the 2.6.16 development cycle from i2c-keylargo to i2c-powermac: Signed-off-by:
Guido Guenther <agx@sigxcpu.org> Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by:
-
Adrian Bunk authored
MTD_NAND=m and MTD_NAND_SHARPSL=y or MTD_NAND_NANDSIM=y are illegal combinations that mustn't be allowed. This patch fixes this bug by making MTD_NAND_SHARPSL and MTD_NAND_NANDSIM tristate's. Additionally, it fixes some whitespace damage at these options. This patch was already included in Linus' tree. Signed-off-by:
-
Jean Delvare authored
Fix for bug #6395: Fail to resume on Tecra M2 with ADM1032 and Intel 82801DBM The BIOS of the Tecra M2 doesn't like it when it has to reboot or resume after the i2c-i801 driver has left the SMBus in PEC mode. I have a more complete fix for 2.6.17 but the simple approach of leaving the SMBus in non-PEC mode after every transaction should do for -stable. That's what the i2c-i801 driver was doing up to 2.6.15 (inclusive). Signed-off-by:
-
Thomas de Grenier de Latour authored
On Sun, 9 Apr 2006 21:56:59 +0400, Sergey Vlasov <vsu@altlinux.ru> wrote: > However, show_address() does not output anything unless > dev->reg_state == NETREG_REGISTERED - and this state is set by > netdev_run_todo() only after netdev_register_sysfs() returns, so in > the meantime (while netdev_register_sysfs() is busy adding the > "statistics" attribute group) some process may see an empty "address" > attribute. I've tried the attached patch, suggested by Sergey Vlasov on hotplug-devel@, and as far as i can test it works just fine. Signed-off-by:
Alexander Patrakov <patrakov@ums.usu.ru> Signed-off-by:
David Miller <davem@davemloft.net> Signed-off-by:
-
Herbert Xu authored
[TCP]: Fix truesize underflow There is a problem with the TSO packet trimming code. The cause of this lies in the tcp_fragment() function. When we allocate a fragment for a completely non-linear packet the truesize is calculated for a payload length of zero. This means that truesize could in fact be less than the real payload length. When that happens the TSO packet trimming can cause truesize to become negative. This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE which would trigger the warning. I've copied the code DaveM used in tso_fragment which should work here. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
H. Peter Anvin authored
Original patch by Benjamin Herrenschmidt after debugging by Brian Hinz. Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Brian Hinz <bphinz@hotmail.com> Signed-off-by:
H Peter Anvin <hpa@zytor.com> Signed-off-by:
-
adam radford authored
The attached patch for 2.6.17-rc2 updates the 3ware 9000 driver: - Disable local interrupts during kmap/unmap_atomic(). Signed-off-by:
Adam Radford <linuxraid@amcc.com> Signed-off-by:
-
Andrew Morton authored
We must disable local IRQs while holding KM_IRQ0 or KM_IRQ1. Otherwise, an IRQ handler could use those kmap slots while this code is using them, resulting in memory corruption. Thanks to Nick Orlov <bugfixer@list.ru> for reporting. Cc: <linuxraid@amcc.com> Cc: James Bottomley <James.Bottomley@SteelEye.com> Signed-off-by:
-
- 19 Apr, 2006 2 commits
-
-
Greg Kroah-Hartman authored
-
Andi Kleen authored
AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE when an exception is pending. This means the value leak through context switches and allow processes to observe some x87 instruction state of other processes. This was actually documented by AMD, but nobody recognized it as being different from Intel before. The fix first adds an optimization: instead of unconditionally calling FNCLEX after each FXSAVE test if ES is pending and skip it when not needed. Then do a x87 load from a kernel variable to clear FOP/FIP/FDP. This means other processes always will only see a constant value defined by the kernel in their FP state. I took some pain to make sure to chose a variable that's already in L1 during context switch to make the overhead of this low. Also alternative() is used to patch away the new code on CPUs who don't need it. Patch for both i386/x86-64. The problem was discovered originally by Jan Beulich. Richard Brunner provided the basic code for the workarounds, with contribution from Jan. This is CVE-2006-1056 Cc: richard.brunner@amd.com Cc: jbeulich@novell.com Signed-off-by:
-
- 18 Apr, 2006 2 commits
-
-
Greg Kroah-Hartman authored
-
Stephen Hemminger authored
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388 The bug is caused by ip_route_input dereferencing skb->nh.protocol of the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing it). It only happens if the route requested is for a multicast IP address. Signed-off-by:
Stephen Hemminger <shemminger@osdl.org> Signed-off-by:
-
- 17 Apr, 2006 1 commit
-
-
Greg Kroah-Hartman authored
-
