Permalink
Commits on Dec 4, 2006
  1. Linux 2.6.16.35-rc1

    AdrianBunk committed Dec 4, 2006
  2. bridge: fix possible overflow in get_fdb_entries (CVE-2006-5751)

    Make sure to properly clamp maxnum to avoid overflow (CVE-2006-5751).
    
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Acked-by: Stephen Hemminger <shemminger@osdl.org>
    Acked-by: David Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    chriswright committed with AdrianBunk Dec 4, 2006
  3. fcntl(F_SETSIG) fix

    fcntl(F_SETSIG) no longer works on leases because
    lease_release_private_callback() gets called as the lease is copied in
    order to initialise it.
    
    The problem is that lease_alloc() performs an unnecessary initialisation,
    which sets the lease_manager_ops.  Avoid the problem by allocating the
    target lease structure using locks_alloc_lock().
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Trond Myklebust committed with AdrianBunk Dec 4, 2006
  4. cciss: fix iostat

    cciss needs to call disk_stat_add() for iostat to work.
    
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Jens Axboe committed with AdrianBunk Dec 4, 2006
  5. cpqarray: fix iostat

    cpqarray needs to call disk_stat_add() for iostat to work.
    
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Jens Axboe committed with AdrianBunk Dec 4, 2006
  6. alim15x3.c: M5229 (rev c8) support for DMA cd-writer

    Configuration bits are not set properly for DMA on some chipset revisions.
    It has already been corrected for M5229 (rev c7) but not for M5229 (rev
    c8).  This leads to the bug described at
    http://bugzilla.kernel.org/show_bug.cgi?id=5786 (lost interrupt + ide bus
    hangs).
    
    Signed-off-by: Michael De Backer <micdb@skynet.be>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Michael De Backer committed with AdrianBunk Dec 4, 2006
  7. alpha: Fix ALPHA_EV56 dependencies typo

    There appears to be a typo in the EV56 config option. NORITAKE and PRIMO are
    be able to set a variation of either.
    
    Signed-off-by: Daniel Drake <dsd@gentoo.org>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Fernando J. Pereda committed with AdrianBunk Dec 4, 2006
  8. Char: isicom, fix close bug

    port is dereferenced even if it is NULL.  Dereference it _after_ the
    check if (!port)...  Thanks Eric <ef87@yahoo.com> for reporting this.
    
    This fixes
    
            http://bugzilla.kernel.org/show_bug.cgi?id=7527
    
    Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    jirislaby committed with AdrianBunk Dec 4, 2006
  9. Input: logips2pp - fix button mapping for MX300

    MX300 does not have an EXTRA_BTN - it is a simple wheel mouse with
    an additional task-switcher button, which is reported as side button
    (and not task button).
    
    Signed-off-by: Daniel Drake <dsd@gentoo.org>
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    rcasta74 committed with AdrianBunk Dec 4, 2006
  10. Input: psmouse - add detection of Logitech TrackMan Wheel trackball

    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Zbigniew Luszpinski committed with AdrianBunk Dec 4, 2006
  11. Remove redundant up() in stop_machine()

    An up() is called in kernel/stop_machine.c on failure, and also in the
    caller (unconditionally).
    
    Signed-off-by: Zhou Yingchao <yingchao.zhou@gmail.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Zhou Yingchao committed with AdrianBunk Dec 4, 2006
  12. [EBTABLES]: Prevent wraparounds in checks for entry components' sizes.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Al Viro committed with AdrianBunk Dec 4, 2006
  13. [EBTABLES]: Deal with the worst-case behaviour in loop checks.

    No need to revisit a chain we'd already finished with during
    the check for current hook.  It's either instant loop (which
    we'd just detected) or a duplicate work.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Al Viro committed with AdrianBunk Dec 4, 2006
  14. [EBTABLES]: Verify that ebt_entries have zero ->distinguisher.

    We need that for iterator to work; existing check had been too weak.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Al Viro committed with AdrianBunk Dec 4, 2006
  15. [EBTABLES]: Fix wraparounds in ebt_entries verification.

    We need to verify that
        a) we are not too close to the end of buffer to dereference
        b) next entry we'll be checking won't be _before_ our
    
    While we are at it, don't subtract unrelated pointers...
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Al Viro committed with AdrianBunk Dec 4, 2006
  16. [NET_SCHED]: policer: restore compatibility with old iproute binaries

    The tc actions increased the size of struct tc_police, which broke
    compatibility with old iproute binaries since both the act_police
    and the old NET_CLS_POLICE code check for an exact size match.
    
    Since the new members are not even used, the simple fix is to also
    accept the size of the old structure. Dumping is not affected since
    old userspace will receive a bigger structure, which is handled fine.
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    kaber committed with AdrianBunk Dec 4, 2006
  17. [PKT_SCHED] act_gact: division by zero

    Not returning -EINVAL, because someone might want to use the value
    zero in some future gact_prob algorithm?
    
    Signed-off-by: Kim Nordlund <kim.nordlund@nokia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    kinordlu committed with AdrianBunk Dec 4, 2006
  18. JFS: pageno needs to be long

    diRead and diWrite are representing the page number as an unsigned int.
    This causes file system corruption on volumes larger than 16TB.
    
    Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Dave Kleikamp committed with AdrianBunk Dec 4, 2006
  19. [IPV6]: Fix address/interface handling in UDP and DCCP, according to …

    …the scoping architecture.
    
    TCP and RAW do not have this issue.  Closes Bug #7432.
    
    Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    YOSHIFUJI Hideaki committed with AdrianBunk Dec 4, 2006
  20. remove garbage the sneaked into the ext3 fix

    Spotted by Thomas Voegtle.
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    AdrianBunk committed Dec 4, 2006
Commits on Nov 29, 2006
  1. freevxfs: Add missing lock_kernel() to vxfs_readdir

    Commit 7b2fd697427e73c81d5fa659efd91bd07d303b0e in the historical GIT tree
    stopped calling the readdir member of a file_operations struct with the big
    kernel lock held, and fixed up all the readdir functions to do their own
    locking.  However, that change added calls to unlock_kernel() in
    vxfs_readdir, but no call to lock_kernel().  Fix this by adding a call to
    lock_kernel().
    
    Signed-off-by: Josh Triplett <josh@freedesktop.org>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    joshtriplett committed with AdrianBunk Nov 29, 2006
  2. Fix incorrent type of flags in <asm/semaphore.h>

    Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Kyle McMartin committed with AdrianBunk Nov 29, 2006
  3. sgiioc4: Disable module unload

    This patch removes a module_exit function that sgiioc4 should not have had.
    
    It seems that the IDE layer doesn't support submodule unloading. sgiioc4
    was the only driver in drivers/ide/pci that had an exit function.
    After an unload, the devices would stay around and the next attempt to
    reference would crash...
    
    Signed-off-by: Jeremy Higdon <jeremy@sgi.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Jeremy Higdon committed with AdrianBunk Nov 29, 2006
  4. proper flags type of spin_lock_irqsave()

    Convert various spin_lock_irqsave() callers to correctly use `unsigned long'
    
    Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Alexey Dobriyan committed with AdrianBunk Nov 29, 2006
  5. drivers/usb/input/ati_remote.c: fix cut'n'paste error

    Backported from a patch by Mariusz Kozlowski <m.kozlowski@tuxland.pl>
    in 2.6.19.
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    AdrianBunk committed Nov 29, 2006
  6. block layer: elv_iosched_show should get elv_list_lock

    elv_iosched_show function iterates other elv_list,
    hence elv_list_lock should be got.
    
    Also the question is: in elv_iosched_show, elv_iosched_store
    q->elevator->elevator_type construction is used without locking q->queue_lock.
    Is it expected?..
    
    Signed-off-by: Vasily Tarasov <vtaras@openvz.org>
    Acked-by: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Vasily Tarasov committed with AdrianBunk Nov 29, 2006
  7. block: Fix bad data direction in SG_IO

    Contrary to what the name misleads you to believe, SG_DXFER_TO_FROM_DEV
    is really just a normal read seen from the device side.
    
    This patch fixes http://lkml.org/lkml/2006/10/13/100
    
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Jens Axboe committed with AdrianBunk Nov 29, 2006
  8. USB: failure in usblp's error path

    if urb submission fails due to a transient error here eg. ENOMEM,
    the driver is dead. This fixes it.
    
    Signed-off-by: Oliver Neukum <oliver@neukum.name>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Oliver Neukum committed with AdrianBunk Nov 29, 2006
  9. nvidiafb: fix unreachable code in nv10GetConfig

    Fix binary/logical operator typo which leads to unreachable code.  Noticed
    while looking at other issues; I don't have the relevant hardware to test
    this.
    
    Signed-off-by: Nathan Lynch <ntl@pobox.com>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    nathanlynch committed with AdrianBunk Nov 29, 2006
  10. Fix divide by zero error for nvidia 7600 pci-express card

    The following patch resolves the divide by zero error I encountered on my
    system:
    
            http://marc.10east.com/?l=linux-fbdev-devel&m=116058257024413&w=2
    
    I accomplished this by merging what I thought was appropriate from:
    
            http://webcvs.freedesktop.org/xorg/driver/xf86-video-nv/src/
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    winksaville committed with AdrianBunk Nov 29, 2006
  11. MMC: Always use a sector size of 512 bytes

    Both MMC and SD specifications specify (although a bit unclearly in the MMC
    case) that a sector size of 512 bytes must always be supported by the card.
    
    Cards can report larger "native" size than this, and cards >= 2 GB even
    must do so. Most other readers use 512 bytes even for these cards. We should
    do the same to be compatible.
    
    Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Pierre Ossman committed with AdrianBunk Nov 29, 2006
  12. SCTP: Always linearise packet on input

    I was looking at a RHEL5 bug report involving Xen and SCTP
    (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550).
    It turns out that SCTP wasn't written to handle skb fragments at
    all.  The absence of any calls to skb_may_pull is testament to
    that.
    
    It just so happens that Xen creates fragmented packets more often
    than other scenarios (header & data split when going from domU to
    dom0).  That's what caused this bug to show up.
    
    Until someone has the time sits down and audits the entire net/sctp
    directory, here is a conservative and safe solution that simply
    linearises all packets on input.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    herbertx committed with AdrianBunk Nov 29, 2006
  13. add forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable)

    sbi->s_group_desc is an array of pointers to buffer_head.  memcpy() of
    buffer size from address of buffer_head is a bad idea - it will generate
    junk in any case, may oops if buffer_head is close to the end of slab
    page and next page is not mapped and isn't what was intended there.
    IOW, ->b_data is missing in that call.  Fortunately, result doesn't go
    into the primary on-disk data structures, so only backup ones get crap
    written to them; that had allowed this bug to remain unnoticed until
    now.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Al Viro committed with AdrianBunk Nov 29, 2006
  14. Fix a masking bug in the 6pack driver.

    Looks like a broken masking to me, binary not is used where bitwise
    not was intended.
    
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Jean Delvare committed with AdrianBunk Nov 29, 2006
  15. [UDP]: Make udp_encap_rcv use pskb_may_pull

    Make udp_encap_rcv use pskb_may_pull
    
    IPsec with NAT-T breaks on some notebooks using the latest e1000 chipset,
    when header split is enabled. When receiving sufficiently large packets, the
    driver puts everything up to and including the UDP header into the header
    portion of the skb, and the rest goes into the paged part. udp_encap_rcv
    forgets to use pskb_may_pull, and fails to decapsulate it. Instead, it
    passes it up it to the IKE daemon.
    
    Signed-off-by: Olaf Kirch <okir@suse.de>
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    okirch committed with AdrianBunk Nov 29, 2006