The check in sys_brk() on minimum value the brk might have must take
CONFIG_COMPAT_BRK setting into account. When this option is turned on
(i.e. we support ancient legacy binaries, e.g. libc5-linked stuff), the
lower bound on brk value is mm->end_code, otherwise the brk start is
allowed to be arbitrarily shifted.
Roland.Kletzing [Fri, 6 Jun 2008 05:46:04 +0000 (22:46 -0700)]
drivers/char/ip2: fix Kconfig after ip2/ip2main merge
As commit 6089093e588ee3f6aed99d08b1cf5ea37c52cf97 ("ip2: fix crashes on
load/unload") fixed the ip2 crashes on load/unload by making ip2/ip2main
one module (ip2), Kconfig shouldn't mention a now non-existing module.
Signed-off-by: Roland.Kletzing <devzero@web.de> Acked-by: Alan Cox <alan@redhat.com> Cc: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michael Halcrow [Fri, 6 Jun 2008 05:46:02 +0000 (22:46 -0700)]
eCryptfs: remove unnecessary page decrypt call
The page decrypt calls in ecryptfs_write() are both pointless and buggy.
Pointless because ecryptfs_get_locked_page() has already brought the page
up to date, and buggy because prior mmap writes will just be blown away by
the decrypt call.
This patch also removes the declaration of a now-nonexistent function
ecryptfs_write_zeros().
Thanks to Eric Sandeen and David Kleikamp for helping to track this
down.
Eric said:
fsx w/ mmap dies quickly ( < 100 ops) without this, and survives
nicely (to millions of ops+) with it in place.
Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> Cc: Eric Sandeen <sandeen@redhat.com> Cc: Dave Kleikamp <shaggy@austin.ibm.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Andy Whitcroft [Fri, 6 Jun 2008 05:46:01 +0000 (22:46 -0700)]
update checkpatch.pl to version 0.19
This version is a bit of a whopper. This version brings a few new checks,
improvements to a number of checks mostly through modifications to the
way types are parsed, several fixes to quote/comment handling, as well as
the usual slew of fixes for false positives.
Of note:
- return is not a function and is now reported,
- preprocessor directive detection is loosened to match C99 standard,
- we now intuit new type modifiers, and
- comment handling is much improved
Andy Whitcroft (18):
Version: 0.19
fix up a couple of missing newlines in reports
colon to parenthesis spacing varies on asm
values: #include is a preprocessor statement
quotes: fix single character quotes at line end
add typedef exception for the non-pointer "function types"
kerneldoc parameters must be on one line, relax line length
types: word boundary is not always required
improved #define bracketing reports
uninitialized_var is an annotation not a function name
possible types: add possible modifier handling
possible types: fastcall is a type modifier
types: unsigned is not a modifier on all types
static/external initialisation to zero should allow modifiers
checkpatch: fix recognition of preprocessor directives -- part 2
comments: fix inter-hunk comment tracking
return is not a function
do not report include/asm/foo.h use in include/linux/foo.h
return is not a function -- tighten test
[jengelh@computergmbh.de: fix recognition of preprocessor directives] Signed-off-by: Andy Whitcroft <apw@shadowen.org> Cc: Jan Engelhardt <jengelh@computergmbh.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
^^ The board is using ucc_uart.c and 8250.c, both registered as
"serial".
This patch fixes two drivers that are using "serial" for driver_name and
not "ttyS" for dev_name. Drivers that are using "ttyS" for dev_name, will
conflict anyway, so we don't bother with these.
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Acked-by: Alan Cox <alan@redhat.com> Acked-By: Timur Tabi <timur@freescale.com> Acked-by: Maciej W. Rozycki <macro@linux-mips.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Fri, 6 Jun 2008 05:45:57 +0000 (22:45 -0700)]
hugetlb: fix lockdep error
=============================================
[ INFO: possible recursive locking detected ]
2.6.26-rc4 #30
---------------------------------------------
heap-overflow/2250 is trying to acquire lock:
(&mm->page_table_lock){--..}, at: [<c0000000000cf2e8>] .copy_hugetlb_page_range+0x108/0x280
but task is already holding lock:
(&mm->page_table_lock){--..}, at: [<c0000000000cf2dc>] .copy_hugetlb_page_range+0xfc/0x280
other info that might help us debug this:
3 locks held by heap-overflow/2250:
#0: (&mm->mmap_sem){----}, at: [<c000000000050e44>] .dup_mm+0x134/0x410
#1: (&mm->mmap_sem/1){--..}, at: [<c000000000050e54>] .dup_mm+0x144/0x410
#2: (&mm->page_table_lock){--..}, at: [<c0000000000cf2dc>] .copy_hugetlb_page_range+0xfc/0x280
Krzysztof Helt [Fri, 6 Jun 2008 05:45:56 +0000 (22:45 -0700)]
modedb: fix incorrect sync and vmode flags for CVT modes
The temporary structure for calculated CVT mode is not initialized. Few
fields have only bits or-ed or and-ed so they may be left in incorrect
(random) state.
Testing of the tridentfb seems like a good exercise for the fbdev layer.
Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Adrian Bunk [Fri, 6 Jun 2008 05:45:55 +0000 (22:45 -0700)]
frv: don't offer BINFMT_FLAT
Fix the following compile error:
CC fs/binfmt_flat.o
In file included from
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:36:
/home/bunk/linux/kernel-2.6/git/linux-2.6/include/linux/flat.h:14:22: error: asm/flat.h: No such file or directory
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c: In function 'create_flat_tables':
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:124: error: implicit declaration of function 'flat_stack_align'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:125: error: implicit declaration of function 'flat_argvp_envp_on_stack'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c: In function 'calc_reloc':
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:347: error: implicit declaration of function 'flat_reloc_valid'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c: In function 'load_flat_file':
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:479: error: implicit declaration of function 'flat_old_ram_flag'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:755: error: implicit declaration of function 'flat_set_persistent'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:757: error: implicit declaration of function 'flat_get_relocate_addr'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:765: error: implicit declaration of function 'flat_get_addr_from_rp'
/home/bunk/linux/kernel-2.6/git/linux-2.6/fs/binfmt_flat.c:781: error: implicit declaration of function 'flat_put_addr_at_rp'
Reported-by: Adrian Bunk <bunk@kernel.org> Signed-off-by: Adrian Bunk <bunk@kernel.org> Tested-by: David Howells <dhowells@redhat.com> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Miao Xie [Fri, 6 Jun 2008 05:45:54 +0000 (22:45 -0700)]
cpusets: fix and update Documentation
Make the doc consistent with current cpusets implementation.
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com> Acked-by: Paul Jackson <pj@sgi.com> Cc: David Rientjes <rientjes@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dan Williams [Fri, 6 Jun 2008 05:45:54 +0000 (22:45 -0700)]
md: do not compute parity unless it is on a failed drive
If a block is computed (rather than read) then a check/repair operation
may be lead to believe that the data on disk is correct, when infact it
isn't. So only compute blocks for failed devices.
This issue has been around since at least 2.6.12, but has become harder to
hit in recent kernels since most reads bypass the cache.
echo repair > /sys/block/mdN/md/sync_action will set the parity blocks to the
correct state.
Cc: <stable@kernel.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dan Williams [Fri, 6 Jun 2008 05:45:53 +0000 (22:45 -0700)]
md: fix uninitialized use of mddev->recovery_wait
If an array was created with --assume-clean we will oops when trying to
set ->resync_max.
Fix this by initializing ->recovery_wait in mddev_find.
Cc: <stable@kernel.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Dan Williams [Fri, 6 Jun 2008 05:45:52 +0000 (22:45 -0700)]
md: fix prexor vs sync_request race
During the initial array synchronization process there is a window between
when a prexor operation is scheduled to a specific stripe and when it
completes for a sync_request to be scheduled to the same stripe. When
this happens the prexor completes and the stripe is unconditionally marked
"insync", effectively canceling the sync_request for the stripe. Prior to
2.6.23 this was not a problem because the prexor operation was done under
sh->lock. The effect in older kernels being that the prexor would still
erroneously mark the stripe "insync", but sync_request would be held off
and re-mark the stripe as "!in_sync".
Change the write completion logic to not mark the stripe "in_sync" if a
prexor was performed. The effect of the change is to sometimes not set
STRIPE_INSYNC. The worst this can do is cause the resync to stall waiting
for STRIPE_INSYNC to be set. If this were happening, then STRIPE_SYNCING
would be set and handle_issuing_new_read_requests would cause all
available blocks to eventually be read, at which point prexor would never
be used on that stripe any more and STRIPE_INSYNC would eventually be set.
echo repair > /sys/block/mdN/md/sync_action will correct arrays that may
have lost this race.
Cc: <stable@kernel.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Brownell [Fri, 6 Jun 2008 05:45:50 +0000 (22:45 -0700)]
spi: fix refcount-related spidev oops-on-rmmod
This addresses other oopsing paths in "spidev" by changing how it manages
refcounting. It decouples the lifecycle of the per-device data from the
class device (not just the spi device):
- Use class_{create,destroy} not class_{register,unregister}.
- Use device_{create,destroy} not device_{register,unregister}.
- Free the per-device data only when TWO conditions are true:
* Driver is unbound from underlying SPI device, and
* Device is no longer open (new)
Also, spi_{get,set}_drvdata not dev_{get,set}_drvdata for simpler code.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Sebastian Siewior <bigeasy@tglx.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ben Collins [Thu, 5 Jun 2008 23:10:21 +0000 (19:10 -0400)]
mmc: Fix crash in mmc_block on 64-bit
Fairly simple. "dev_use" was being allocated as a zero length array
because of bad math on 64-bit systems, causing a crash in
find_first_zero_bit(). One-liner follows:
Signed-off-by: Ben Collins <ben.collins@canonical.com> Acked-by: Pierre Ossman <drzeus@drzeus.cx> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 5 Jun 2008 21:29:53 +0000 (14:29 -0700)]
Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
Fix divide by zero error in build_clear_page() and build_copy_page()
[MIPS] Fix typo in header guard
[MIPS] Fix build error - Delete debugging crap that crept in with CMP
[MIPS] Add accessors for random register.
[MIPS] IP27: misc fixes
[MIPS] IP27: Fix clockevent setup
[MIPS] IP27: Fix bootmem memory setup
[MIPS] remove CONFIG_CPU_R4000 line from Makefile
[MIPS] Fix check for valid stack pointer during backtrace
[MIPS] Add missing braces to pte_mkyoung
[MIPS] R4700: Fix build_tlb_probe_entry
[MIPS] Alchemy: dbdma: add API to delete custom DDMA device ids.
[MIPS] Alchemy: export get_au1x00_speed for modules
Chris Wright [Wed, 4 Jun 2008 16:16:33 +0000 (09:16 -0700)]
asn1: additional sanity checking during BER decoding
- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.
- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.
- A primitive encoding may not have an indefinite length.
Thanks to Wei Wang from McAfee for report.
Cc: Steven French <sfrench@us.ibm.com> Cc: stable@kernel.org Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Thu, 5 Jun 2008 16:07:35 +0000 (17:07 +0100)]
FRV: ip_fast_csum() requires a memory clobber on its inline asm
ip_fast_csum() requires a memory clobber on its inline asm as it accesses
memory in a fashion that gcc can't predict.
The GCC manual says:
If your assembler instructions access memory in an unpredictable
fashion, add `memory' to the list of clobbered registers. This will
cause GCC to not keep memory values cached in registers across the
assembler instruction and not optimize stores or loads to that memory.
The bug hasn't been noticed in FRV, but it has been seen in PA-RISC.
Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Changes in the generic bootmem code broke memory setup for IP27. This
patch fixes this by replacing lots of special IP27 code with generic
bootmon code. This has been tested only on a single node.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
[MIPS] Fix check for valid stack pointer during backtrace
The newly added check for valid stack pointer address breaks at least for
64bit kernels. Use __get_user() for accessing stack content to avoid crashes,
when doing the backtrace.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Ilpo Järvinen [Fri, 2 May 2008 11:08:20 +0000 (14:08 +0300)]
[MIPS] Add missing braces to pte_mkyoung
Only the version pte_mkyoung for 36-bit pagetables on 32-bit hw was
affected and with this bug being around since November 29, 2004 there
is evidence to suport the assumption it was benign ;-)
Hugh Dickins [Thu, 5 Jun 2008 13:44:39 +0000 (14:44 +0100)]
libata: fix G5 SATA broken on -rc5
Fix G5 SATA irq 18: nobody cared, reported on -rc5 by Olaf Hering:
fixlet to a57c1bade5a0ee5cd8b74502db9cbebb7f5780b2 libata-sff:
Fix oops reported in kerneloops.org for pnp devices with no ctl
Signed-off-by: Hugh Dickins <hugh@veritas.com> Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Tested-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Michael Krufky [Sat, 31 May 2008 21:18:55 +0000 (18:18 -0300)]
V4L/DVB (7983): tda18271_calc_rf_cal must return the return value of tda18271_lookup_map
On the TDA18271HD/C1, we perform RF tracking filter correction for VHF low
band, only. If supplied a frequency out of range, the error must be returned
to the caller (tda18271c1_rf_tracking_filter_calibration) so that it can
decide whether or not to write to register EB14, RFC_CPROG[7:0]
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
LD .tmp_vmlinux1
drivers/built-in.o: In function `generic_set_freq':
tuner-xc2028.c:(.text+0xbd896): undefined reference to `request_firmware'
tuner-xc2028.c:(.text+0xbdd7a): undefined reference to `release_firmware'
drivers/built-in.o: In function `xc_load_fw_and_init_tuner':
xc5000.c:(.text+0xc68e6): undefined reference to `request_firmware'
xc5000.c:(.text+0xc6abe): undefined reference to `release_firmware'
the reason is another kconfig tool bug that has to be worked around in
the driver's Kconfig file: if FW_LOADER is selected in a second
dependency, that is not properly propagated up the dependencies.
in this case, FW_LOADER is selected from MEDIA_TUNER_XC2028:
config MEDIA_TUNER_XC2028
tristate "XCeive xc2028/xc3028 tuners"
depends on VIDEO_MEDIA && I2C
depends on HOTPLUG
select FW_LOADER
which got selected by MEDIA_TUNER:
config MEDIA_TUNER
tristate
default VIDEO_MEDIA && I2C
depends on VIDEO_MEDIA && I2C
select FW_LOADER if !MEDIA_TUNER_CUSTOMIZE && HOTPLUG
but the kconfig tool did not pick up this second-order dependency and
allowed CONFIG_FW_LOADER=m to be selected - in which case the build
fails.
the workaround i found was to move the select of FW_LOADER one level up,
so that the buggy kconfig tool can notice it and can act appropriately.
This problem can probably be worked around in other ways as well, i went
for the minimal fix.
Obviously, the kconfig tool should be fixed, it is not reasonable to
expect driver authors to do manual dependency resolution (that kconfig
itself already does) and uglify the Kconfig files. The kconfig tool did
nothing to warn about this situation and did not prevent this faulty
.config from being constructed.
But there was no warning in Documentation/feature-removal-schedule.txt
and I'm receiving reports that it's breaking userspace apps (the
gstreamer-v4l2 plugin breaks in Fedora rawhide). You can't just pull
things from the published userspace API like that.
Please can we revert the addition of _DEPRECATED to these ioctl
definitions. Perhaps we can add a runtime warning if they actually get
used? Or a compile-time warning if we can manage that?
Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Create a macro to report the number of instances of the tuner driver
currently in use. This will allow drivers to perform specific cleanups
before destroying the last instance of a tuner.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Hans Verkuil [Sun, 25 May 2008 14:21:27 +0000 (11:21 -0300)]
V4L/DVB (7931): cx18: allow for simultaneous digital and analog capture
The HVR-1600 can do both analog and digital capture at the same time.
Due to a driver bug -EBUSY would be returned when attempting to setup an
analog capture while a digital capture was already in progress.
Separate the two internally.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Andy Walls [Mon, 26 May 2008 04:31:17 +0000 (01:31 -0300)]
V4L/DVB (7922): tuner-simple: fix tuner_warn() induced kernel oops in simple_tuner_attach()
The tuner_warn() macro relies on the local variable "priv" to be a valid
pointer. There was a case in simple_tuner_attach() where this cannot be the
case yet, so tuner_warn() would dereference a NULL "priv" pointer. Changed
the tuner_warn() to a printk() with the originally intended output format.
Signed-off-by: Andy Walls <awalls@radix.net> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Michael Krufky [Sun, 25 May 2008 02:48:16 +0000 (23:48 -0300)]
V4L/DVB (7918): au0828: remove irrelevent analog tuner standby code
This code is irrelevant to this driver and should be removed. This was
copied from a hack in cx88-dvb.c, which prevents noise coming from the
analog tuner (via an audio patch cable from the pci card to the sound
hardware) when in digital mode by muting the tda988x. This issue does
not apply to this USB hybrid chip design, where a single piece of
silicon handles both analog and digital demodulation.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Adrian Bunk [Mon, 26 May 2008 17:23:49 +0000 (14:23 -0300)]
V4L/DVB (7908): always enter drivers/media/video/
After commit 039d40019f3c5e26ea50ec5af4270189f63365e1
(V4L/DVB (7898): Fix VIDEO_MEDIA Kconfig logic)
VIDEO_MEDIA is no longer usable in Makefile's for deciding
which directories we enter, resulting in compile errors like the
following with CONFIG_VIDEO_DEV=y, CONFIG_DVB_CORE=m:
Andrew Morton [Thu, 15 May 2008 02:14:04 +0000 (23:14 -0300)]
V4L/DVB (7901): zoran: use correct type for CPU flags
locking-add-typecheck-on-irqsave-and-friends-for-correct-flags.patch will cause
drivers/media/video/zoran_driver.c: In function 'zoran_close_end_session':
drivers/media/video/zoran_driver.c:1172: warning: comparison of distinct pointer types lacks a cast
Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (56 commits)
l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
tcp: Increment OUTRSTS in tcp_send_active_reset()
raw: Raw socket leak.
lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
USB ID for Philips CPWUA054/00 Wireless USB Adapter 11g
ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
libertas: fix command size for CMD_802_11_SUBSCRIBE_EVENT
ipw2200: expire and use oldest BSS on adhoc create
airo warning fix
b43legacy: Fix controller restart crash
sctp: Fix ECN markings for IPv6
sctp: Flush the queue only once during fast retransmit.
sctp: Start T3-RTX timer when fast retransmitting lowest TSN
sctp: Correctly implement Fast Recovery cwnd manipulations.
sctp: Move sctp_v4_dst_saddr out of loop
sctp: retran_path update bug fix
tcp: fix skb vs fack_count out-of-sync condition
sunhme: Cleanup use of deprecated calls to save_and_cli and restore_flags.
xfrm: xfrm_algo: correct usage of RIPEMD-160
...
James Chapman [Wed, 4 Jun 2008 22:54:07 +0000 (15:54 -0700)]
l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
Some problems have been experienced in the field which cause an oops
in the pppol2tp driver if L2TP tunnels fail while passing data.
The pppol2tp driver uses private data that is referenced via the
sk->sk_user_data of its UDP and PPPoL2TP sockets. This patch makes
sure that the driver uses sock_hold() when it holds a reference to the
sk pointer. This affects its sendmsg(), recvmsg(), getname(),
[gs]etsockopt() and ioctl() handlers.
Tested by ISP where problem was seen. System has been up 10 days with
no oops since running this patch. Without the patch, an oops would
occur every 1-2 days.
Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
skb_splice_bits temporary drops the socket lock while iterating over
the socket queue in order to break a reverse locking condition which
happens with sendfile. This, however, opens a window of opportunity
for tcp_collapse() to aggregate skbs and thus potentially free the
current skb used in skb_splice_bits and tcp_read_sock.
This patch fixes the problem by (re-)getting the same "logical skb"
after the lock has been temporary dropped.
Based on idea and initial patch from Evgeniy Polyakov.
Signed-off-by: Octavian Purdila <opurdila@ixiacom.com> Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
Corked packet is allocated via sock_wmalloc which holds the owner socket,
so one should uncork it and flush all pending data on close. Do this in the
same way as in UDP.
Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
James Chapman [Wed, 4 Jun 2008 22:07:32 +0000 (15:07 -0700)]
lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
If an L2TP daemon closes a tunnel socket while packets are queued in
the tunnel's reorder queue, a kernel warning is logged because the
socket is closed while skbs are still referencing it. The fix is to
purge the queue in the socket's release handler.
projects / linux-2.6-omap-h63xx.git / log