- 27 Jul, 2007 1 commit
-
-
Jesper Juhl authored
Hi, Coverity spotted a "use after free" bug in drivers/char/agp/ati-agp.c::ati_create_gatt_pages(). The same one that was in drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages() The problem is this: If "entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);" fails, then there's a loop in the function to free all entries allocated so far and break out of the allocation loop. That in itself is pretty sane, but then the (now freed) 'tables' is assigned to ati_generic_private.gatt_pages and 'retval' is set to -ENOMEM which causes ati_free_gatt_pages(); to be called at the end of the function. The problem with this is that ati_free_gatt_pages() will then loop 'ati_generic_private.num_tables' times and try to free each entry in tables[] - this is bad since tables has already been freed and furthermore it will call kfree(tables) at the end - a double free. This patch removes the freeing loop in ati_create_gatt_pages() and instead relies entirely on the call to ati_free_gatt_pages() to free everything we allocated in case of an error. It also sets ati_generic_private.num_tables to the actual number of entries allocated instead of just using the value passed in from the caller - this ensures that ati_free_gatt_pages() will only attempt to free stuff that was actually allocated. Note: I'm in no way intimate with this code and I have no way to actually test this patch (besides compile test it), so while I've tried to be careful in reading the code and make sure the patch does the right thing an ACK from someone who actually knows the code in-depth would be very much appreciated. Signed-off-by:Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by:
Dave Airlie <airlied@linux.ie>
-
- 26 Jul, 2007 39 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmcLinus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc: drivers/mmc/core/: make 3 functions static mmc: add missing printk levels mmc: remove redundant debug information from sdhci and wbsd mmc: proper debugging output in core mmc: be more verbose about card insertions/removal mmc: Don't hold lock when releasing an added card mmc: add a might_sleep() to mmc_claim_host() mmc: update kerneldoc mmc: update header file paths sdhci: add support to ENE-CB714 mmc: check error bits before command completion
-
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpcLinus Torvalds authored
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (21 commits) [POWERPC] spusched: Fix initial timeslice calculation [POWERPC] spufs: Fix incorrect initialization of cbe_spu_info.spus [POWERPC] Fix Maple platform ISA bus [POWERPC] Make pci_iounmap actually unmap things [POWERPC] Add function to check if address is an IO port [POWERPC] Fix Pegasos keyboard detection [POWERPC] iSeries: Fix section mismatch warning in lpevents [POWERPC] iSeries: Fix section mismatch warnings [POWERPC] iSeries: We need vio_enable_interrupts [POWERPC] Fix RTC and device tree on linkstation machines [POWERPC] Add of_register_i2c_devices() [POWERPC] Fix loop with unsigned long counter variable [POWERPC] Fix register labels on show_regs() message for 4xx/Book-E [POWERPC] Only allow building of BootX text support on PPC_MULTIPLATFORM [POWERPC] Fix the ability to reset on MPC8544 DS and MPC8568 MDS boards [POWERPC] Fix mpc7448hpc2 tsi108 device_type bug [POWREPC] Fixup a number of modpost warnings on ppc32 [POWERPC] Fix ethernet PHY support on MPC8544 DS [POWERPC] Don't try to allocate resources for a Freescale POWERPC PHB Revert "[POWERPC] Don't complain if size-cells == 0 in prom_parse()" ...
-
git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-schedLinus Torvalds authored
* git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched: [PATCH] sched: debug feature - make the sched-domains tree runtime-tweakable [PATCH] sched: add above_background_load() function [PATCH] sched: update Documentation/sched-stats.txt [PATCH] sched: mark sysrq_sched_debug_show() static [PATCH] sched: make cpu_clock() not use the rq clock [PATCH] sched: remove unused rq->load_balance_class [PATCH] sched: arch preempt notifier mechanism [PATCH] sched: increase SCHED_LOAD_SCALE_FUZZ
-
Linus Torvalds authored
It's a totally independent decision for the user whether he wants suspend and/or hibernation support, and ACPI shouldn't care. Signed-off-by:Linus Torvalds <torvalds@linux-foundation.org>
-
Rafael J. Wysocki authored
Commit bd804eba ("PM: Introduce pm_power_off_prepare") caused problems in the poweroff path, as reported by YOSHIFUJI Hideaki / 吉藤英明. Generally, sysdev_shutdown() should be called after the ACPI preparation for powering the system off. To make it happen, we can separate sysdev_shutdown() from device_shutdown() and call it directly wherever necessary. Signed-off-by:
Rafael J. Wysocki <rjw@sisk.pl> Tested-by:
YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> Signed-off-by:
-
Linus Torvalds authored
This reverts most of commit 19d36ccd. The way to DEBUG_RODATA interactions with KPROBES and CPU hotplug is to just not mark the text as being write-protected in the first place. Both of those facilities depend on rewriting instructions. Having "helpful" debug facilities that just cause more problem is not being helpful. It just adds complexity and bugs. Not worth it. Reported-by:
-
Bjorn Helgaas authored
These are manual fixups after running Lindent. No functional change. Signed-off-by:
Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Len Brown <lenb@kernel.org> Cc: Adam Belay <ambx1@neo.rr.com> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Bjorn Helgaas authored
Run Lindent on all PNP source files. Produced by: $ quilt new pnp-lindent $ find drivers/pnp -name \*.[ch] | xargs quilt add $ quilt add include/linux/{pnp.h,pnpbios.h} $ scripts/Lindent drivers/pnp/*.c drivers/pnp/*/*.c include/linux/pnp*.h $ quilt refresh --sort Signed-off-by: -
Thomas Gleixner authored
tsc_unstable is declared twice. Signed-off-by:
Thomas Gleixner <tglx@linutronix.de> Cc: Andi Kleen <ak@suse.de> Signed-off-by:
-
Hirokazu Takata authored
Change INT0 trigger mode from edge-sense mode to level-sense mode, in order to fix the following timeout error: 'NETDEV WATCHDOG: eth0: transmit timed out'. This patch is required only for the Mappi platform. Signed-off-by:
Hirokazu Takata <takata@linux-m32r.org> Cc: Hitoshi Yamamoto <hitoshiy@linux-m32r.org> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by:
-
Mel Gorman authored
With the introduction of kernelcore=, a configurable zone is created on request. In some cases, this value will be small enough that some nodes contain only ZONE_MOVABLE. On some NUMA configurations when this occurs, arch-independent zone-sizing will get the size of the memory holes within the node incorrect. The value of present_pages goes negative and the boot fails. This patch fixes the bug in the calculation of the size of the hole. The test case is to boot test a NUMA machine with a low value of kernelcore= before and after the patch is applied. While this bug exists in early kernel it cannot be triggered in practice. This patch has been boot-tested on a variety machines with and without kernelcore= set. Signed-off-by:
Mel Gorman <mel@csn.ul.ie> Signed-off-by:
-
Jiri Slaby authored
Fix link errors below by selecting FW_LOADER LD .tmp_vmlinux1 drivers/built-in.o: In function `cyz_load_fw': drivers/char/cyclades.c:4908: undefined reference to `request_firmware' drivers/char/cyclades.c:4979: undefined reference to `release_firmware' Cc: <toralf.foerster@gmx.de> Signed-off-by:
Jiri Slaby <jirislaby@gmail.com> Signed-off-by:
-
Sam Ravnborg authored
Fix the following two section mismatch warnings: WARNING: vmlinux.o(.text+0x1ce84): Section mismatch: reference to .init.text:free_bootmem (between 'free_tce_table' and 'build_tce_table') WARNING: vmlinux.o(.text+0x1d04d): Section mismatch: reference to .init.text:__alloc_bootmem_low (between 'alloc_tce_table' and 'kretprobe_trampoline_holder') In both cases the functions was used only from __init context so mark them __init. Signed-off-by:
Sam Ravnborg <sam@ravnborg.org> Cc: Andi Kleen <ak@suse.de> Signed-off-by:
-
Doug Thompson authored
Fixed 'depends on PPC_PASEMI' in EDAC Kconfig. Module PASEMI depends ONLY on the PASEMI on PPC. Was previously enabled for ALL PPC Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Egor N. Martovetsky <egor@pasemi.com> Signed-off-by:
Doug Thompson <dougthompson@xmission.com> Signed-off-by:
-
Doug Thompson authored
EDAC has a foundation to perform software memory scrubbing, but it requires a per architecture (atomic_scrub) function for performing an atomic update operation. Under X86, this is done with a lock: add [addr],0 in the file asm-x86/edac.h This patch provides the MIPS arch with that atomic function, atomic_scrub() in asm-mips/edac.h Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Doug Thompson authored
This patch fixes sysfs exit code for the EDAC PCI device in a similiar manner and the previous fixes for EDAC_MC and EDAC_DEVICE. It removes the old (and incorrect) completion model and uses reference counts on per instance kobjects and on the edac core module. This pattern was applied to the edac_mc and edac_device code, but the EDAC PCI code was missed. In addition, this fixes a system hang after a low level driver was unloaded. (A cleanup function was called twice, which really screwed things up) Cc: Greg KH <greg@kroah.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by:
-
Doug Thompson authored
This fixes a deadlock that could occur on a 'setup' and 'teardown' sequence of the workq for a edac_mc control structure instance. A similiar fix was previously implemented for the edac_device code. In addition, the edac_mc device code there was missing code to allow the workq period valu to be altered via sysfs control. This patch adds that fix on the code, and allows for the changing of the period value as well. Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by:
-
Sam Ravnborg authored
Nathan Lynch <ntl@pobox.com> reported: 2.6.23-rc1 breaks the build for 64-bit powerpc for me (using maple_defconfig): LD vmlinux.o powerpc64-unknown-linux-gnu-ld: dynreloc miscount for kernel/built-in.o, section .opd powerpc64-unknown-linux-gnu-ld: can not edit opd Bad value make: *** [vmlinux.o] Error 1 However, I see a possibly related binutils patch: http://article.gmane.org/gmane.comp.gnu.binutils/33650 It was tracked down to be caused by the weak prototype declaration in mm.h: __attribute__((weak)) const char *arch_vma_name(struct vm_area_struct *vma); But there is no need to make the declaration weak - only the definition needs to be marked weak. So drop the weak declaration. And in the process drop the duplicate definition in page.h for powerpc. Note: the arch_vma_name fix for x86_64 needs to be applied first to avoid breaking x86_64 Signed-off-by:
-
Roland McGrath authored
The function arch_vma_name() is declared weak and thus it was not noticed that x86_64 had two almost identical implementations. It was introduced in syscall32.c by: c633090e It was introduced in mm/init.c by: 2aae950bSigned-off-by:
Roland McGrath <roland@redhat.com> Acked-by:
-
Rafael J. Wysocki authored
chipsfb.c shouldn't use PM_SUSPEND_MEM in there, but PM_EVENT_SUSPEND. Cc: Cedric Le Goater <clg@fr.ibm.com> Cc: "Antonino A. Daplas" <adaplas@pol.net> Signed-off-by:
-
Eric Sandeen authored
ext[234]_check_descriptors sanity checks block group descriptor geometry at mount time, testing whether the block bitmap, inode bitmap, and inode table reside wholly within the blockgroup. However, the inode table test is off by one so that if the last block in the inode table resides on the last block of the block group, the test incorrectly fails. This is because it tests the last block as (start + length) rather than (start + length - 1). This can be seen by trying to mount a filesystem made such as: mkfs.ext2 -F -b 1024 -m 0 -g 256 -N 3744 fsfile 1024 which yields: EXT2-fs error (device loop0): ext2_check_descriptors: Inode table for group 0 not in group (block 101)! EXT2-fs: group descriptors corrupted! There is a similar bug in e2fsprogs, patch already sent for that. (I wonder if inside(), outside(), and/or in_range() should someday be used in this and other tests throughout the ext filesystems...) Signed-off-by:
Eric Sandeen <sandeen@redhat.com> Cc: <linux-ext4@vger.kernel.org> Signed-off-by:
-
Adrian Bunk authored
This patch fixes an obvious use-after-free spotted by the Coverity checker. Signed-off-by:
Adrian Bunk <bunk@stusta.de> Acked-by:
Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by:
-
Andrew Morton authored
drivers/edac/edac_stub.c:15:22: asm/edac.h: No such file or directory was it even supposed to work? Cc: Douglas Thompson <dougthompson@xmission.com> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
-
Andrew Morton authored
ia64: drivers/i2c/chips/ds1682.c: In function `ds1682_show': drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3) drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3) Cc: Jean Delvare <khali@linux-fr.org> Signed-off-by:
-
Alessandro Zummo authored
Alphabetic reordering of the drivers in the rtc subsys makefile. (akpm: merge this asap! Makefiles are the source of many patch conflicts..) Signed-off-by:
Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
KAMEZAWA Hiroyuki authored
release_pages() in mm/swap.c changes page_count() to be 0 without removing PageLRU flag... This means isolate_lru_page() can see a page, PageLRU() && page_count(page)==0.. This is BUG. (get_page() will be called against count=0 page.) Signed-off-by:
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by:
Christoph Lameter <clameter@sgi.com> Signed-off-by:
-
KAMEZAWA Hiroyuki authored
In usual, migrate_pages(page,,) is called with holding mm->sem by system call. (mm here is a mm_struct which maps the migration target page.) This semaphore helps avoiding some race conditions. But, if we want to migrate a page by some kernel codes, we have to avoid some races. This patch adds check code for following race condition. 1. A page which page->mapping==NULL can be target of migration. Then, we have to check page->mapping before calling try_to_unmap(). 2. anon_vma can be freed while page is unmapped, but page->mapping remains as it was. We drop page->mapcount to be 0. Then we cannot trust page->mapping. So, use rcu_read_lock() to prevent anon_vma pointed by page->mapping from being freed during migration. Signed-off-by:
-
Davide Libenzi authored
Davi fixed a missing cast in the __put_user(), that was making timerfd return a single byte instead of the full value. Talking with Michael about the timerfd man page, we think it'd be better to use a u64 for the returned value, to align it with the eventfd implementation. This is an ABI change. The timerfd code is new in 2.6.22 and if we merge this into 2.6.23 then we should also merge it into 2.6.22.x. That will leave a few early 2.6.22 kernels out in the wild which might misbehave when a future timerfd-enabled glibc is run on them. mtk says: The difference would be that read() will only return 4 bytes, while the application will expect 8. If the application is checking the size of returned value, as it should, then it will be able to detect the problem (it could even be sophisticated enough to know that if this is a 4-byte return, then it is running on an old 2.6.22 kernel). If the application is not checking the return from read(), then its 8-byte buffer will not be filled -- the contents of the last 4 bytes will be undefined, so the u64 value as a whole will be junk. Signed-off-by:
Davide Libenzi <davidel@xmailserver.org> Cc: Michael Kerrisk <mtk-manpages@gmx.net> Cc: Davi Arnaut <davi@haxent.com.br> Cc: <stable@kernel.org> Signed-off-by:
-
Adrian Bunk authored
This patch fixes the following compile error introduced by commit e8666b27 and reported by Alexey Dobriyan: <-- snip --> CC arch/i386/kernel/acpi/cstate.o In file included from arch/i386/kernel/acpi/cstate.c:17: include/acpi/processor.h:88: error: expected specifier-qualifier-list before 'acpi_integer' <-- snip --> If you select something you must ensure that the dependencies of what you are selecting are fulfilled. Signed-off-by:
-
Rusty Russell authored
Documentation: The FIXMEs Signed-off-by:
Rusty Russell <rusty@rustcorp.com.au> Signed-off-by:
-
Rusty Russell authored
Documentation: The Switcher Signed-off-by:
-
Rusty Russell authored
Documentation: The Host Signed-off-by:
-
Rusty Russell authored
Documentation: The Launcher Signed-off-by:
-
Rusty Russell authored
Documentation: The Drivers Signed-off-by:
-
Rusty Russell authored
Documentation: The Guest Signed-off-by:
-
Rusty Russell authored
The netfilter code had very good documentation: the Netfilter Hacking HOWTO. Noone ever read it. So this time I'm trying something different, using a bit of Knuthiness. Signed-off-by:
-
Jeremy Fitzhardinge authored
Fix: linux/include/xen/page.h: In function mfn_pte: linux/include/xen/page.h:149: error: __supported_pte_mask undeclared (first use in this function) linux/include/xen/page.h:149: error: (Each undeclared identifier is reported only once linux/include/xen/page.h:149: error: for each function it appears in.) Signed-off-by:
Jeremy Fitzhardinge <jeremy@xensource.com> Signed-off-by:
-
David Brownell authored
Fix a typo turned up by a Coverity check: referring to the wrong register, which could cause problems with DS1338 RTCs whose oscillators halted. Signed-off-by:
David Brownell <dbrownell@users.sourceforge.net> Signed-off-by:
-
Ben Dooks authored
Fix the include files moved around during the s3c24xx arch moves. Signed-off-by:
Ben Dooks <ben-linux@fluff.org> Signed-off-by:
-
