1. 11 May, 2006 3 commits
    • Linus Torvalds's avatar
      Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 · f7a014af
      Linus Torvalds authored
      * master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (25 commits)
        [SCSI] mptfc: race between mptfc_register_dev and mptfc_target_alloc
        [SCSI] lpfc 8.1.6 : Fix Data Corruption in Bus Reset Path
        [SCSI] mptspi: revalidate negotiation parameters after host reset and resume
        [SCSI] srp.h: avoid padding of structs
        [SCSI] ibmvscsi: fix leak when failing to send srp event
        [SCSI] qla2xxx: Correct eh_abort recovery logic.
        [SCSI] megaraid_{mm,mbox}: fix a bug in reset handler
        [SCSI] fusion - bug fix stack overflow in mptbase
        [SCSI] scsi: Add IBM 2104-DU3 to blist
        [SCSI] Fix DVD burning issues.
        [SCSI] SCSI: aic7xxx_osm_pci resource leak fix.
        [SCSI] - fusion - mptfc bug fix's to prevent deadlock situations
        [SCSI] mptfusion: bug fix's for raid components adding/deleting
        [SCSI] aic7xxx: ahc_pci_write_config() fix
        [SCSI] megaraid: unused variable
        [SCSI] qla2xxx: only free_irq() after request_irq() succeeds
        [SCSI] Overrun in drivers/scsi/sim710.c
        [SCSI] lpfc 8.1.5 : Change version number to 8.1.5
        [SCSI] lpfc 8.1.5 : Misc small fixes
        [SCSI] lpfc 8.1.5 : Additional fixes to LOGO, PLOGI, and RSCN processing
        ...
      f7a014af
    • Jens Axboe's avatar
      [BLOCK] limit request_fn recursion · dac07ec1
      Jens Axboe authored
      Don't recurse back into the driver even if the unplug threshold is met,
      when the driver asks for a requeue. This is both silly from a logical
      point of view (requeues typically happen due to driver/hardware
      shortage), and also dangerous since we could hit an endless request_fn
      -> requeue -> unplug -> request_fn loop and crash on stack overrun.
      
      Also limit blk_run_queue() to one level of recursion, similar to how
      blk_start_queue() works.
      
      This patch fixed a real problem with SLES10 and lpfc, and it could hit
      any SCSI lld that returns non-zero from it's ->queuecommand() handler.
      Signed-off-by: default avatarJens Axboe <axboe@suse.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      dac07ec1
    • Linus Torvalds's avatar
      ptrace_attach: fix possible deadlock schenario with irqs · f358166a
      Linus Torvalds authored
      Eric Biederman points out that we can't take the task_lock while holding
      tasklist_lock for writing, because another CPU that holds the task lock
      might take an interrupt that then tries to take tasklist_lock for writing.
      
      Which would be a nasty deadlock, with one CPU spinning forever in an
      interrupt handler (although admittedly you need to really work at
      triggering it ;)
      
      Since the ptrace_attach() code is special and very unusual, just make it
      be extra careful, and use trylock+repeat to avoid the possible deadlock.
      
      Cc: Oleg Nesterov <oleg@tv-sign.ru>
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Cc: Roland McGrath <roland@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      f358166a
  2. 10 May, 2006 10 commits
  3. 09 May, 2006 7 commits
    • Roland Dreier's avatar
      IB/mthca: Fix race in reference counting · a3285aa4
      Roland Dreier authored
      Fix races in in destroying various objects.  If a destroy routine
      waits for an object to become free by doing
      
      	wait_event(&obj->wait, !atomic_read(&obj->refcount));
      	/* now clean up and destroy the object */
      
      and another place drops a reference to the object by doing
      
      	if (atomic_dec_and_test(&obj->refcount))
      		wake_up(&obj->wait);
      
      then this is susceptible to a race where the wait_event() and final
      freeing of the object occur between the atomic_dec_and_test() and the
      wake_up().  And this is a use-after-free, since wake_up() will be
      called on part of the already-freed object.
      
      Fix this in mthca by replacing the atomic_t refcounts with plain old
      integers protected by a spinlock.  This makes it possible to do the
      decrement of the reference count and the wake_up() so that it appears
      as a single atomic operation to the code waiting on the wait queue.
      
      While touching this code, also simplify mthca_cq_clean(): the CQ being
      cleaned cannot go away, because it still has a QP attached to it.  So
      there's no reason to be paranoid and look up the CQ by number; it's
      perfectly safe to use the pointer that the callers already have.
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      a3285aa4
    • Roland Dreier's avatar
      IB/srp: Fix tracking of pending requests during error handling · d945e1df
      Roland Dreier authored
      If a SCSI abort completes, or the command completes successfully, then
      the driver must remove the command from its queue of pending
      commands.  Similarly, if a device reset succeeds, then all commands
      queued for the given device must be removed from the queue.
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      d945e1df
    • Ralph Campbell's avatar
      IB: Fix display of 4-bit port counters in sysfs · d8b9f23b
      Ralph Campbell authored
      The code to display local_link_integrity_errors and
      excessive_buffer_overrun_errors in
      /sys/class/infiniband/<hca>/ports/<n>/counters/
      uses the wrong shift to extract the 4 bit values.
      Signed-off-by: default avatarRalph Campbell <ralph.campbell@qlogic.com>
      Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
      d8b9f23b
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6 · 3cd73eed
      Linus Torvalds authored
      * 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6:
        [PATCH] bcm43xx: Fix access to non-existent PHY registers
        [PATCH] bcm43xx: Fix array overrun in bcm43xx_geo_init
        [PATCH] bcm43xx: check for valid MAC address in SPROM
        [PATCH] ieee80211: Fix A band channel count (resent)
        [PATCH] bcm43xx: fix iwmode crash when down
        [PATCH] softmac: make non-operational after being stopped
        [PATCH] softmac: don't reassociate if user asked for deauthentication
        spidernet: enable support for bcm5461 ethernet phy
        spidernet: introduce new setting
        Fix RTL8019AS init for Toshiba RBTX49xx boards
        au1000_eth.c: use ether_crc() from <linux/crc32.h>
        sky2: version 1.3
        Add more support for the Yukon Ultra chip found in dual core centino laptops.
        sky2: synchronize irq on remove
        sky2: dont write status ring
        sky2: edge triggered workaround enhancement
        sky2: use mask instead of modulo operation
        sky2: tx ring index mask fix
        sky2: status irq hang fix
        sky2: backout NAPI reschedule
      3cd73eed
    • Marcelo Tosatti's avatar
      [PATCH] ppc32/8xx: Fix r3 trashing due to 8MB TLB page instantiation · c51e078f
      Marcelo Tosatti authored
      Instantiation of 8MB pages on the TLB cache for the kernel static
      mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations.
      This ensures r3 gets saved and restored.
      Signed-off-by: default avatarMarcelo Tosatti <marcelo@kvack.org>
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      c51e078f
    • Paul Mackerras's avatar
      powerpc/32: Define an is_kernel_addr() to fix ARCH=ppc compilation · e4de0021
      Paul Mackerras authored
      My commit 6bfd93c3 broke the ARCH=ppc
      compilation by using the is_kernel_addr() macro in asm/uaccess.h.
      This fixes it by defining a suitable is_kernel_addr() for ARCH=ppc.
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      e4de0021
    • Linus Torvalds's avatar
      Merge git://oss.sgi.com:8090/xfs-2.6 · e515f048
      Linus Torvalds authored
      * git://oss.sgi.com:8090/xfs-2.6:
        [XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an
        [XFS] Fix a project quota space accounting leak on rename.
        [XFS] Fix a possible forced shutdown due to mishandling write barriers
      e515f048
  4. 08 May, 2006 20 commits