- 15 Aug, 2007 2 commits
-
-
Alexey Dobriyan authored
Steps to reproduce: modprobe econet rmmod econet modprobe econet Unable to handle kernel paging request at ffffffff8870a098 RIP: [<ffffffff8040bfb8>] dev_add_pack+0x48/0x90 PGD 203067 PUD 207063 PMD 7817f067 PTE 0 Oops: 0002 [1] PREEMPT SMP CPU 1 Modules linked in: econet [maaaany] Pid: 10671, comm: modprobe Not tainted 2.6.23-rc3-bloat #6 RIP: 0010:[<ffffffff8040bfb8>] [<ffffffff8040bfb8>] dev_add_pack+0x48/0x90 RSP: 0000:ffff810076293df8 EFLAGS: 00010202 RAX: ffffffff88659090 RBX: ffffffff88659060 RCX: ffffffff8870a090 RDX: 0000000000000080 RSI: ffffffff805ec660 RDI: ffff810078ce4680 RBP: ffff810076293e08 R08: 0000000000000002 R09: 0000000000000000 R10: ffffffff8040bf88 R11: 0000000000000001 R12: ffff810076293e18 R13: 000000000000001b R14: ffff810076dd06b0 R15: ffffffff886590c0 FS: 00002b96a525dae0(0000) GS:ffff81007e0e2138(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffff8870a098 CR3: 000000007bb67000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 10671, threadinfo ffff810076292000, task ffff810078ce4680) Stack: ffff810076dd06b0 0000000000000000 ffff810076293e38 ffffffff8865b180 0000000000800000 0000000000000000 ffffffff886590c0 ffff810076dd01c8 ffff810076293f78 ffffffff8026723c ffff810076293e48 ffffffff886590d8 Call Trace: [<ffffffff8865b180>] :econet:econet_proto_init+0x180/0x1da [<ffffffff8026723c>] sys_init_module+0x15c/0x19e0 [<ffffffff8020c13e>] system_call+0x7e/0x83 Code: 48 89 41 08 48 89 82 e0 c5 5e 80 48 c7 c7 a0 08 5d 80 e8 f1 RIP [<ffffffff8040bfb8>] dev_add_pack+0x48/0x90 RSP <ffff810076293df8> CR2: ffffffff8870a098 Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Alexey Dobriyan authored
commit 8d5cf596 started to add statically allocated ax25_protocol's to list. However kfree() was still in place waiting for unsuspecting ones on module removal. Steps to reproduce: modprobe netrom rmmod netrom P.S.: code would benefit greatly from list_add/list_del usage kernel BUG at mm/slab.c:592! invalid opcode: 0000 [1] PREEMPT SMP CPU 0 Modules linked in: netrom ax25 af_packet usbcore rtc_cmos rtc_core rtc_lib Pid: 4477, comm: rmmod Not tainted 2.6.23-rc3-bloat #2 RIP: 0010:[<ffffffff802ac646>] [<ffffffff802ac646>] kfree+0x1c6/0x260 RSP: 0000:ffff810079a05e48 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff81000000c000 RDX: ffff81007e552458 RSI: 0000000000000000 RDI: 000000000000805d RBP: ffff810079a05e88 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8805d080 R13: ffffffff8805d080 R14: 0000000000000000 R15: 0000000000000282 FS: 00002b73fc98aae0(0000) GS:ffffffff805dc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000000053f3b8 CR3: 0000000079ff2000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process rmmod (pid: 4477, threadinfo ffff810079a04000, task ffff8100775aa480) Stack: ffff810079a05e68 0000000000000246 ffffffff8804eca0 0000000000000000 ffffffff8805d080 00000000000000cf 0000000000000000 0000000000000880 ffff810079a05eb8 ffffffff8803ec90 ffff810079a05eb8 0000000000000000 Call Trace: [<ffffffff8803ec90>] :ax25:ax25_protocol_release+0xa0/0xb0 [<ffffffff88056ecb>] :netrom:nr_exit+0x6b/0xf0 [<ffffffff80268bf0>] sys_delete_module+0x170/0x1f0 [<ffffffff8025da35>] trace_hardirqs_on+0xd5/0x170 [<ffffffff804835aa>] trace_hardirqs_on_thunk+0x35/0x37 [<ffffffff8020c13e>] system_call+0x7e/0x83 Code: 0f 0b eb fe 66 66 90 66 66 90 48 8b 52 10 48 8b 02 25 00 40 RIP [<ffffffff802ac646>] kfree+0x1c6/0x260 RSP <ffff810079a05e48> Kernel panic - not syncing: Fatal exception Signed-off-by:
-
- 14 Aug, 2007 38 commits
-
-
Jussi Kivilinna authored
Signed-off-by:
Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Acked-by:
Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by:
-
Stephen Hemminger authored
The stp change code generates "sleeping function called from invalid context" because rtnl_lock() called with BH disabled. This fixes it by not acquiring then dropping the bridge lock. Signed-off-by:
-
Patrick McHardy authored
Don't drop packets shorter than "SIP/2.0", just ignore them. Keep-alives can validly be shorter for example. Signed-off-by:
Patrick McHardy <kaber@trash.net> Signed-off-by:
-
Patrick McHardy authored
The userinfo component of a SIP-URI is optional, continue parsing at the beginning of the SIP-URI in case its not found. Signed-off-by:
-
Patrick McHardy authored
The check got lost during the conversion to nf_conntrack. Signed-off-by:
-
Eric Dumazet authored
An extraneous ";" makes xt_u32 match useless Signed-off-by:
Eric Dumazet <dada1@cosmosbay.com> Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixesLinus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: [GFS2] Revert remounting w/o acl option leaves acls enabled [GFS2] Fix setting of inherit jdata attr [GFS2] Fix incorrect error path in prepare_write() [GFS2] Fix incorrect return code in rgrp.c [GFS2] soft lockup in rgblk_search [GFS2] soft lockup detected in databuf_lo_before_commit [DLM] fix basts for granted PR waiting CW [DLM] More othercon fixes [DLM] Fix memory leak in dlm_add_member() when dlm_node_weight() returns less than zero [DLM] zero unused parts of sockaddr_storage [DLM] fix NULL ls usage [DLM] Clear othercon pointers when a connection is closed
-
git://jdelvare.pck.nerim.net/jdelvare-2.6Linus Torvalds authored
* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6: i2c-s3c2410: Build fix i2c/menelaus: Build fix i2c-mv64xxx: Reinitialize hw and driver on I2C bus hang i2c-mpc: Don't disable I2C module on stop condition i2c-iop3xx: Set I2C_CLASS_HWMON to adapter class i2c/isp1301_omap: Build fixes, whitespace i2c-mpc: Pass correct dev_id to free_irq on error path i2c-i801: Typo: erroneous
-
Ben Dooks authored
Fixup the include files after the arch moves that where included in 2.6.23. Signed-off-by:
Ben Dooks <ben-linux@fluff.org> Signed-off-by:
Jean Delvare <khali@linux-fr.org>
-
David Brownell authored
Fix Menelaus build error, and remove needless "#define DEBUG". Signed-off-by:
David Brownell <dbrownell@users.sourceforge.net> Signed-off-by:
-
Dale Farnsworth authored
Under certain conditions, the mv64xxx I2C bus can hang preventing further operation. To make the driver more robust, we now reset the I2C hardware and the driver state machine when such hangs are detected. Signed-off-by:
Dale Farnsworth <dale@farnsworth.org> Acked-by:
Mark A. Greer <mgreer@mvista.com> Signed-off-by:
-
Domen Puncer authored
Disabling module on stop doesn't work on some CPUs (ie. mpc8241, as reported by Guennadi Liakhovetski), so remove that. Disable I2C module on errors/interrupts to prevent it from locking up on mpc5200b. Signed-off-by:
Domen Puncer <domen.puncer@telargo.com> Acked-by:
Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by:
-
Arnaud Patard authored
In order to be able to use sensors on the IOP3xx SoCs, one needs to set the adapter class to I2C_CLASS_HWMON. Signed-off-by:
Arnaud Patard <arnaud.patard@rtp-net.org> Signed-off-by:
-
David Brownell authored
Build fixes for isp1301_omap driver. I think an earlier version of this must have gotten lost somewhere, or maybe it only went into the Linux-OMAP tree. Also, some whitespace fixes to bring this more into sync with the version of this found in the Linux-OMAP tree. (That version has updates for the OTG controller on the OMAP 1710 which break that functionality on OMAP 161x boards like the H2, so merging all of it is not currently an option.) Signed-off-by:
-
Scott Wood authored
Signed-off-by:
Scott Wood <scottwood@freescale.com> Signed-off-by:
-
Jean Delvare authored
Signed-off-by: -
Linus Torvalds authored
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [IPVS]: Use IP_VS_WAIT_WHILE when encessary. [NET]: Share correct feature code between bridging and bonding [ATM] drivers/atm/iphase.c: mostly kmalloc + memset conversion to kzalloc [IRDA] irda-usb.c: mostly kmalloc + memset conversion to k[cz]alloc [WAN] drivers/net/wan/hdlc_fr.c: kmalloc + memset conversion to kzalloc [DCCP]: fix memory leak and clean up style - dccp_feat_empty_confirm() [DCCP]: fix theoretical ccids_{read,write}_lock() race [XFRM]: Clean up duplicate includes in net/xfrm/ [TIPC]: Clean up duplicate includes in net/tipc/ [SUNRPC]: Clean up duplicate includes in net/sunrpc/ [PKT_SCHED]: Clean up duplicate includes in net/sched/ [IPV6]: Clean up duplicate includes in net/ipv6/ [IPV4]: Clean up duplicate includes in net/ipv4/ [ATM]: Clean up duplicate includes in net/atm/ [ATM]: Clean up duplicate includes in drivers/atm/ [IPCONFIG]: ip_auto_config fix [ATM]: fore200e_param_bs_queue() must be __devinit -
Linus Torvalds authored
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: e1000: Add device IDs of new 82571 board variants xen-netfront: Avoid deref'ing skbafter it is potentially freed. 3c59x maintainer 3c59x: fix duplex configuration natsemi: fix netdev error acounting ax88796 printk fixes myri10ge: Use the pause counter to avoid a needless device reset via-rhine: disable rx_copybreak on archs that don't allow unaligned DMA access
-
Steven Whitehouse authored
This reverts commit 569a7b6c. The code was correct originally. The default setting for ACLs after a remount should be to be the same as before the remount. Signed-off-by:
Abhijith Das <adas@redhat.com> Signed-off-by:
Steven Whitehouse <swhiteho@redhat.com>
-
Steven Whitehouse authored
Due to a mix up between the jdata attribute and inherit jdata attribute it has not been possible to set the inherit jdata attribute on directories. This is now fixed and the ioctl will report the inherit jdata attribute for directories rather than the jdata attribute as it did previously. This stems from our need to have the one bit in the ioctl attr flags mean two different things according to whether the underlying inode is a directory or not. Signed-off-by: -
Steven Whitehouse authored
The error path in prepare_write() was incorrect in the (very rare) event that the transaction fails to start. The following prevents a NULL pointer dereference, Signed-off-by: -
Steven Whitehouse authored
The following patch fixes a bug where 0 was being used as a return code to indicate "nothing to do" when in fact 0 was a valid block location which might be returned by the function. Signed-off-by: -
Bob Peterson authored
This patch seems to fix the problem described in bugzilla bug 246114. It was written by Steve Whitehouse with some tweaking by me. The code was looping in the relatively new section of code designed to search for and reuse unlinked inodes. In cases where it was finding an appropriate inode to reuse, it was looping around and finding the same block over and over because a "<=" check should have been a "<" when comparing the goal block to the last unlinked block found. Signed-off-by:
Bob Peterson <rpeterso@redhat.com> Signed-off-by:
-
Bob Peterson authored
This is part 2 of the patch for bug #245832, part 1 of which is already in the git tree. The problem was that sdp->sd_log_num_databuf was not always being protected by the gfs2_log_lock spinlock, but the sd_log_le_databuf (which it is supposed to reflect) was protected. That meant there was a timing window during which gfs2_log_flush called databuf_lo_before_commit and the count didn't match what was really on the linked list in that window. So when it ran out of items on the linked list, it decremented total_dbuf from 0 to -1 and thus never left the "while(total_dbuf)" loop. The solution is to protect the variable sdp->sd_log_num_databuf so that the value will always match the contents of the linked list, and therefore the number will never go negative, and therefore, the loop will be exited properly. Signed-off-by:
-
David Teigland authored
Fix a long standing bug where a blocking callback would be missed when there's a granted lock in PR mode and waiting locks in both PR and CW modes (and the PR lock was added to the waiting queue before the CW lock). The logic simply compared the numerical values of the modes to determine if a blocking callback was required, but in the one case of PR and CW, the lower valued CW mode blocks the higher valued PR mode. We just need to add a special check for this PR/CW case in the tests that decide when a blocking callback is needed. Signed-off-by:
David Teigland <teigland@redhat.com> Signed-off-by:
-
Patrick Caulfield authored
The last patch to clean out 'othercon' structures only fixed half the problem. The attached addresses the other situations too, and fixes bz#238490 Signed-Off-By:
Patrick Caulfield <pcaulfie@redhat.com> Signed-off-by:
-
Jesper Juhl authored
There's a memory leak in fs/dlm/member.c::dlm_add_member(). If "dlm_node_weight(ls->ls_name, nodeid)" returns < 0, then we'll return without freeing the memory allocated to the (at that point yet unused) 'memb'. This patch frees the allocated memory in that case and thus avoids the leak. Signed-off-by:
Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by:
-
Patrick Caulfield authored
When we build a sockaddr_storage for an IP address, clear the unused parts as they could be used for node comparisons. I have seen this occasionally make sctp connections fail. Signed-Off-By:
-
David Teigland authored
Fix regression in recent patch "[DLM] variable allocation" which attempts to dereference an "ls" struct when it's NULL. Signed-off-by:
-
Patrick Caulfield authored
This patch clears the othercon pointer and frees the memory when a connnection is closed. This could cause a small memory leak when nodes leave the cluster. Signed-Off-By:
-
Auke Kok authored
This patch adds support for 2 new board variants: - A Quad port fiber 82571 board - A blade version of the 82571 quad copper board Signed-off-by:
Auke Kok <auke-jan.h.kok@intel.com> Signed-off-by:
Jeff Garzik <jeff@garzik.org>
-
Heiko Carstens authored
For architectures that don't have a volatile atomic_ts constructs like while (atomic_read(&something)); might result in endless loops since a barrier() is missing which forces the compiler to generate code that actually reads memory contents. Fix this in ipvs by using the IP_VS_WAIT_WHILE macro which resolves to while (expr) { cpu_relax(); } (why isn't this open coded btw?) Signed-off-by:Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by:
Simon Horman <horms@verge.net.au> Signed-off-by:
-
Herbert Xu authored
http://bugzilla.kernel.org/show_bug.cgi?id=8797 shows that the bonding driver may produce bogus combinations of the checksum flags and SG/TSO. For example, if you bond devices with NETIF_F_HW_CSUM and NETIF_F_IP_CSUM you'll end up with a bonding device that has neither flag set. If both have TSO then this produces an illegal combination. The bridge device on the other hand has the correct code to deal with this. In fact, the same code can be used for both. So this patch moves that logic into net/core/dev.c and uses it for both bonding and bridging. In the process I've made small adjustments such as only setting GSO_ROBUST if at least one constituent device supports it. Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
-
Mariusz Kozlowski authored
drivers/atm/iphase.c | 111508 -> 111431 (-77 bytes) drivers/atm/iphase.o | 254740 -> 254260 (-480 bytes) Signed-off-by:
Mariusz Kozlowski <m.kozlowski@tuxland.pl> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Mariusz Kozlowski authored
drivers/net/irda/irda-usb.c | 59694 -> 59541 (-153 bytes) drivers/net/irda/irda-usb.o | 170588 -> 169256 (-1332 bytes) Signed-off-by:
-
Mariusz Kozlowski authored
drivers/net/wan/hdlc_fr.c | 31260 -> 31223 (-37 bytes) drivers/net/wan/hdlc_fr.o | 144872 -> 144728 (-144 bytes) Signed-off-by:
Krzysztof Halasa <khc@pm.waw.pl> Signed-off-by:
-
Jesper Juhl authored
There's a memory leak in net/dccp/feat.c::dccp_feat_empty_confirm(). If we hit the 'default:' case of the 'switch' statement, then we return without freeing 'opt', thus leaking 'struct dccp_opt_pend' bytes. The leak is fixed easily enough by adding a kfree(opt); before the return statement. The patch also changes the layout of the 'switch' to be more in line with CodingStyle. Signed-off-by:
Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by:
-
Oleg Nesterov authored
Make sure that spin_unlock_wait() is properly ordered wrt atomic_inc(). (akpm: can't we convert this code to use rwlocks?) Signed-off-by:
Oleg Nesterov <oleg@tv-sign.ru> Signed-off-by:
-
