aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-12-31Broadcom CNIC core network driver: fix mem leak on allocation failures in ↵Jesper Juhl1-2/+8
cnic_alloc_uio_rings() We are leaking memory in drivers/net/cnic.c::cnic_alloc_uio_rings() if either of the calls to dma_alloc_coherent() fail. This patch fixes it by freeing both the memory allocated with kzalloc() and memory allocated with previous calls to dma_alloc_coherent() when there's a failure. Thanks to Joe Perches <[email protected]> for suggesting a better implementation than my initial version. Signed-off-by: Jesper Juhl <[email protected]> Acked-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-31ISDN, Gigaset: Fix memory leak in do_disconnect_req()Jesper Juhl1-0/+1
Hi, In drivers/isdn/gigaset/capi.c::do_disconnect_req() we will leak the memory allocated (with kmalloc) to 'b3cmsg' if the call to alloc_skb() fails. ... b3cmsg = kmalloc(sizeof(*b3cmsg), GFP_KERNEL); allocation here ------^ if (!b3cmsg) { dev_err(cs->dev, "%s: out of memory\n", __func__); send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR); return; } capi_cmsg_header(b3cmsg, ap->id, CAPI_DISCONNECT_B3, CAPI_IND, ap->nextMessageNumber++, cmsg->adr.adrPLCI | (1 << 16)); b3cmsg->Reason_B3 = CapiProtocolErrorLayer1; b3skb = alloc_skb(CAPI_DISCONNECT_B3_IND_BASELEN, GFP_KERNEL); if (b3skb == NULL) { dev_err(cs->dev, "%s: out of memory\n", __func__); send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR); return; leak here ------^ ... This leak is easily fixed by just kfree()'ing the memory allocated to 'b3cmsg' right before we return. The following patch does that. Signed-off-by: Jesper Juhl <[email protected]> Acked-by: Tilman Schmidt <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-31CAN: Use inode instead of kernel address for /proc fileDan Rosenberg1-2/+2
Since the socket address is just being used as a unique identifier, its inode number is an alternative that does not leak potentially sensitive information. CC-ing stable because MITRE has assigned CVE-2010-4565 to the issue. Signed-off-by: Dan Rosenberg <[email protected]> Acked-by: Oliver Hartkopp <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-30Merge branch 'drm-intel-fixes' of ↵Linus Torvalds8-7/+111
git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915/dvo: Report LVDS attached to ch701x as connected Revert "drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks" drm/i915: Verify Ironlake eDP presence on DP_A using the capability fuse drm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915. drm/i915/sdvo: Add hdmi connector properties after initing the connector drm/i915: Set the required VFMUNIT clock gating disable on Ironlake.
2010-12-30Revert "Staging: zram: work around oops due to startup ordering snafu"Nitin Gupta1-6/+0
This reverts commit 7e24cce38a99f373450db67bf576fe73e8168d66 because it was never appropriate for mainline. Do not check for init flag before starting I/O - zram module is unusable without this fix. The oops mentioned in the reverted commit message was actually a problem only with the zram version as present in project's own repository where we allocate struct zram_stats_cpu upon device initialization. OTOH, In mainline/staging version of zram, we allocate struct stats upfront, so this oops cannot happen in mainline version. Checking for init_done flag in zram_make_request() results in a *no-op* for any I/O operation since we simply always return success. This flag is actually set when the first write occurs on a zram disk which triggers its initialization. Bug report: https://bugzilla.kernel.org/show_bug.cgi?id=25722 Reported-by: Dennis Jansen <[email protected]> Signed-off-by: Nitin Gupta <[email protected]> Cc: Anton Blanchard <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-12-30Merge branch 'merge-spi' of git://git.secretlab.ca/git/linux-2.6Linus Torvalds2-1/+40
* 'merge-spi' of git://git.secretlab.ca/git/linux-2.6: spi/m68knommu: Coldfire QSPI platform support spi/omap2_mcspi.c: Force CS to be in inactive state after off-mode transition
2010-12-30memcg: fix wrong VM_BUG_ON() in try_charge()'s mm->owner checkKAMEZAWA Hiroyuki1-10/+9
At __mem_cgroup_try_charge(), VM_BUG_ON(!mm->owner) is checked. But as commented in mem_cgroup_from_task(), mm->owner can be NULL in some racy case. This check of VM_BUG_ON() is bad. A possible story to hit this is at swapoff()->try_to_unuse(). It passes mm_struct to mem_cgroup_try_charge_swapin() while mm->owner is NULL. If we can't get proper mem_cgroup from swap_cgroup information, mm->owner is used as charge target and we see NULL. Cc: Daisuke Nishimura <[email protected]> Cc: KOSAKI Motohiro <[email protected]> Reported-by: Hugh Dickins <[email protected]> Reported-by: Thomas Meyer <[email protected]> Signed-off-by: KAMEZAWA Hiroyuki <[email protected]> Reviewed-by: Balbir Singh <[email protected]> Signed-off-by: Hugh Dickins <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2010-12-30update Documentation/filesystems/LockingChristoph Hellwig1-112/+102
Mostly inspired by all the recent BKL removal changes, but a lot of older updates also weren't properly recorded. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-12-30drm/i915/dvo: Report LVDS attached to ch701x as connectedChris Wilson1-1/+1
As we have already detected something attached to the chip during initialisation, always report the LVDS connector status as connected during probing. Signed-off-by: Chris Wilson <[email protected]>
2010-12-30Revert "drm/i915/bios: Reverse order of 100/120 Mhz SSC clocks"Chris Wilson1-1/+1
As I feared, whilst this fixed the clocks for the Lenovo U160, it broke many other machines. So lets reverts commit 448f53a1ede54eb854d036abf and search for the real bug. Reported-and-tested-by: Travis Hume <[email protected]> [et al] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=25842 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=32698 Signed-off-by: Chris Wilson <[email protected]>
2010-12-30ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120Daniel T Chen1-0/+1
Sjoerd Simons reports that, without using position_fix=1, recording experiences overruns. Work around that by applying the LPIB quirk for his hardware. Reported-and-tested-by: Sjoerd Simons <[email protected]> Cc: <[email protected]> Signed-off-by: Daniel T Chen <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2010-12-30sound: Prevent buffer overflow in OSS load_mixer_volumesDan Rosenberg1-2/+2
The load_mixer_volumes() function, which can be triggered by unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to a buffer overflow. Because the provided "name" argument isn't guaranteed to be NULL terminated at the expected 32 bytes, it's possible to overflow past the end of the last element in the mixer_vols array. Further exploitation can result in an arbitrary kernel write (via subsequent calls to load_mixer_volumes()) leading to privilege escalation, or arbitrary kernel reads via get_mixer_levels(). In addition, the strcmp() may leak bytes beyond the mixer_vols array. Signed-off-by: Dan Rosenberg <[email protected]> Cc: stable <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2010-12-29spi/m68knommu: Coldfire QSPI platform supportJate Sujjavanich1-1/+1
After grabbing a msg from the msgq, the mcfqspi_work function calls list_del_init on the mcfqspi->msgq which unintentionally deletes the rest of the list before it can be processed. If qspi call was made using spi_sync, this can result in a process hang. Signed-off-by: Jate Sujjavanich <[email protected]> Acked-by: Steven King <[email protected]> Signed-off-by: Grant Likely <[email protected]>
2010-12-29kconfig: fix undesirable side effect of adding "visible" menu attributeJan Beulich1-0/+14
This lead to non-selected, non-user-selectable options to be written out to .config. This is not only pointless, but also preventing the user to be prompted should any of those options eventually become visible (e.g. by de-selecting the *_AUTO options the "visible" attribute was added for. Furthermore it is quite logical for the "visible" attribute of a menu to control the visibility of all contained prompts, which is what the patch does. Signed-off-by: Jan Beulich <[email protected]> Signed-off-by: Michal Marek <[email protected]>
2010-12-29spi/omap2_mcspi.c: Force CS to be in inactive state after off-mode transitionGregory CLEMENT1-0/+39
When SPI wake up from OFF mode, CS is in the wrong state: force it to the inactive state. During the system life, I monitored the CS behavior using a oscilloscope. I also activated debug in omap2_mcspi, so I saw when driver disable the clocks and restore context when device is not used.Each time the CS was in the correct state. It was only when system was put suspend to ram with off-mode activated that on resume the CS was in wrong state( ie activated). Changelog: * Change from v1 to v2: - Rebase on linus/master (after 2.6.37-rc1) - Do some clean-up and fix indentation on both patches - Add more explanations for patch 2 * Change from v2 to v3: - Use directly resume function of spi_master instead of using function - from spi_device as Grant Likely pointed it out. - Force this transition explicitly for each CS used by a device. * Change from v3 to v4: - Patch clean-up according to Kevin Hilman and checkpatch. - Now force CS to be in inactive state only if it was inactive when it was suspended. * Change from v4 to v5: - Rebase on linus/master (after 2.6.37-rc3) - Collapse some lines as pointed by Grant Likely - Fix a spelling * Change from v5 to v6: - Rebase on linus/master (after 2.6.37-rc7) - Use CONFIG_SUSPEND instead of CONFIG_PM - Didn't use legacy PM methods anymore. Instead, add a struct dev_pm_ops and add the resume method there. - Fix multi-line comment style * Change from v6 to v7: - Rebase on linus/master (after 2.6.37-rc8) - Drop an extra line Signed-off-by: Gregory CLEMENT <[email protected]> Acked-by: David Brownell <[email protected]> Reviewed-by: Kevin Hilman <[email protected]> Signed-off-by: Grant Likely <[email protected]>
2010-12-29fix freeing user_struct in user cacheHillf Danton1-0/+1
When racing on adding into user cache, the new allocated from mm slab is freed without putting user namespace. Since the user namespace is already operated by getting, putting has to be issued. Signed-off-by: Hillf Danton <[email protected]> Acked-by: Serge Hallyn <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2010-12-29KVM: MMU: Fix incorrect direct gfn for unpaged mode shadowAvi Kivity1-1/+2
We use the physical address instead of the base gfn for the four PAE page directories we use in unpaged mode. When the guest accesses an address above 1GB that is backed by a large host page, a BUG_ON() in kvm_mmu_set_gfn() triggers. Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=21962 Reported-and-tested-by: Nicolas Prochazka <[email protected]> KVM-Stable-Tag. Signed-off-by: Avi Kivity <[email protected]>
2010-12-28Linux 2.6.37-rc8Linus Torvalds1-1/+1
2010-12-28Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds1-1/+8
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: ring_buffer: Off-by-one and duplicate events in ring_buffer_read_page
2010-12-28Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds1-11/+5
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree()
2010-12-28ASoC: codecs: wm8753: Fix register cache incoherencyLars-Peter Clausen1-143/+83
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8753 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Furthermore the generic cache uses zero-based numbering while the wm8753 cache uses one-based numbering. Thus we end up with two from each other incoherent caches, which leads to undefined behaviour and crashes. This patch fixes the issue by changing the wm8753 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]>
2010-12-28ASoC: codecs: wm9090: Fix register cache incoherencyLars-Peter Clausen1-9/+9
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm9090 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm9090 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: wm8962: Fix register cache incoherencyLars-Peter Clausen1-25/+20
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8962 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm8962 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: wm8955: Fix register cache incoherencyLars-Peter Clausen1-15/+15
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8955 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm8955 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: wm8904: Fix register cache incoherencyLars-Peter Clausen1-19/+18
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8904 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm8904 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Cc: Ian Lartey <[email protected]> Cc: Dimitris Papastamos <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: wm8741: Fix register cache incoherencyLars-Peter Clausen1-5/+5
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8741 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm8741 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Cc: Ian Lartey <[email protected]> Cc: Dimitris Papastamos <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: wm8523: Fix register cache incoherencyLars-Peter Clausen1-4/+5
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the wm8523 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the wm8523 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Cc: Ian Lartey <[email protected]> Cc: Dimitris Papastamos <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: max98088: Fix register cache incoherencyLars-Peter Clausen1-6/+4
The multi-component patch(commit f0fba2ad1) moved the allocation of the register cache from the driver to the ASoC core. Most drivers where adjusted to this, but the max98088 driver still uses its own register cache for its private functions, while functions from the ASoC core use the generic cache. Thus we end up with two from each other incoherent caches, which can lead to undefined behaviour. This patch fixes the issue by changing the max98088 driver to use the generic register cache in its private functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Cc: Peter Hsiang <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28ASoC: codecs: Add missing control_type initializationLars-Peter Clausen5-0/+5
Some codec drivers do not initialize the control_type field in their private device struct, but still use it when calling snd_soc_codec_set_cache_io. This patch fixes the issue by properly initializing it in the drivers probe functions. Signed-off-by: Lars-Peter Clausen <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected] (for 2.6.37 only)
2010-12-28skfp: testing the wrong variable in skfp_driver_init()Dan Carpenter1-1/+1
The intent here was to test if the allocation failed but we tested "SharedMemSize" instead of "SharedMemAddr" by mistake. Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-28ppp: allow disabling multilink protocol ID compressionstephen hemminger1-2/+7
Linux would not connect to other router running old version Cisco IOS (12.0). This is most likely a bug in that version of IOS, since it is fixed in later versions. As a workaround this patch allows a module parameter to be set to disable compressing the protocol ID. See: https://bugzilla.vyatta.com/show_bug.cgi?id=3979 RFC 1990 allows an implementation to formulate MP fragments as if protocol compression had been negotiated. This allows us to always send compressed protocol IDs. But some implementations don't accept MP fragments with compressed protocol IDs. This parameter allows us to interoperate with them. The default value of the configurable parameter is the same as the current behavior: protocol compression is enabled. If protocol compression is disabled we will not send compressed protocol IDs. This is based on an earlier patch by Bob Gilligan (using a sysctl). Module parameter is writable to allow for enabling even if ppp is already loaded for other uses. Signed-off-by: Stephen Hemminger <[email protected]> Acked-by: Eric Dumazet <[email protected]> Acked-by: Paul Mackerras <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-28ehea: Avoid changing vlan flagsBreno Leitao1-0/+7
This patch avoids disabling the vlan flags using ethtool. Signed-off-by: Breno Leitao <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-28ueagle-atm: fix PHY signal initialization raceDan Williams1-3/+19
A race exists when initializing ueagle-atm devices where the generic atm device may not yet be created before the driver attempts to initialize it's PHY signal state, which checks whether the atm device has been created or not. This often causes the sysfs 'carrier' attribute to be '1' even though no signal has actually been found. uea_probe usbatm_usb_probe driver->bind (uea_bind) uea_boot kthread_run(uea_kthread) uea_kthread usbatm_atm_init uea_start_reset atm_dev_register UPDATE_ATM_SIGNAL UPDATE_ATM_SIGNAL checks whether the ATM device has been created and if not, will not update the PHY signal state. Because of the race that does not always happen in time, and the PHY signal state remains ATM_PHY_SIG_FOUND even though no signal exists. To fix the race, just create the kthread during initialization, and only after initialization is complete, start the thread that reboots the device and initializes PHY state. [ 3030.490931] uea_probe: calling usbatm_usb_probe [ 3030.490946] ueagle-atm 8-2:1.0: usbatm_usb_probe: trying driver ueagle-atm with vendor=1110, product=9031, ifnum 0 [ 3030.493691] uea_bind: setting usbatm [ 3030.496932] usb 8-2: [ueagle-atm] using iso mode [ 3030.497283] ueagle-atm 8-2:1.0: usbatm_usb_probe: using 3021 byte buffer for rx channel 0xffff880125953508 <kthread already started before usbatm_usb_probe() has returned> [ 3030.497292] usb 8-2: [ueagle-atm] (re)booting started <UPDATE_ATM_SIGNAL checks whether ATM device has been created yet before setting PHY state> [ 3030.497298] uea_start_reset: atm dev (null) <and since it hasn't been created yet PHY state is not set> [ 3030.497306] ueagle-atm 8-2:1.0: usbatm_usb_probe: using 3392 byte buffer for tx channel 0xffff8801259535b8 [ 3030.497374] usbatm_usb_probe: about to init [ 3030.497379] usbatm_usb_probe: calling usbatm_atm_init <atm device finally gets created> [ 3030.497384] usbatm_atm_init: creating atm device! Signed-off-by: Dan Williams <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-12-28Merge branch 'for-linus' of ↵Linus Torvalds1-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI hotplug: Fix unexpected driver unregister in pciehp_acpi.c
2010-12-28Merge branch 'v4l_for_linus' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] v4l: soc-camera: fix multiple simultaneous user case
2010-12-28Merge branch 'for-linus' of ↵Linus Torvalds4-10/+24
git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: Fix re-probing with PM_POST_RESTORE notification mmc: atmel-mci: fix multiblock SDIO transfers mmc: at91_mci: fix multiblock SDIO transfers
2010-12-28ARM: fix IXP4xx build failureImre Kaloz2-1/+2
arm: export dma_set_coherent_mask While a regression was fixed with commit 710224fa2750cf (arm: fix "arm: fix pci_set_consistent_dma_mask for dmabounce devices"), a new one was introduced as dma_set_coherent_mask wasn't exported for modules. This patch takes care for this issue. Signed-off-by: Imre Kaloz <[email protected]> Signed-off-by: Krzysztof Hałasa <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-12-28RAMOOPS: Don't overflow over non-allocated regionsAhmed S. Darwish1-5/+7
The current code mis-calculates the ramoops header size, leading to an overflow over the next record at best, or over a non-allocated region at worst. Fix that calculation. Signed-off-by: Ahmed S. Darwish <[email protected]> Acked-by: Marco Stornelli <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2010-12-27Merge branch 'nommu-fixes-for-linus' of ↵Linus Torvalds1-1/+27
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/nommu-2.6 * 'nommu-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/nommu-2.6: nommu: Provide stubbed alloc/free_vm_area() implementation. nommu: Fix up vmalloc_node() symbol export regression.
2010-12-27Merge branch 'sh-fixes-for-linus' of ↵Linus Torvalds4-4/+4
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: intc: Initialize radix tree gfp mask explicitly. sh: Fix up SH7201 clkfwk build. sh: mach-se: Fix up SE7206 build. sh: Fix up SH4-202 clkfwk build.
2010-12-27Merge branch 'fbdev-fixes-for-linus' of ↵Linus Torvalds4-29/+28
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6 * 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6: fbdev: sh_mobile_lcdc: increase maximum framebuffer size to support 1080p video: imxfb: Fix the maximum value for yres fb: fix overlapping test off-by-one. fbdev: sh-mobile: retrieve and propagate display sizes from EDID fbdev: sh-mobile: restore display size configuration
2010-12-27Merge branch 'upstream-linus' of ↵Linus Torvalds1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: pata_cs5536: avoid implicit MSR API inclusion on x86-64
2010-12-27fbdev: sh_mobile_lcdc: increase maximum framebuffer size to support 1080pGuennadi Liakhovetski1-18/+8
LCDC hardware can support 1920x1080 formats, adjust the driver to cover them. Besides, instead of guessing some "reasonable" validity checks, only verify values in .fb_check_var(), that we are sure, we cannot support. Signed-off-by: Guennadi Liakhovetski <[email protected]> Signed-off-by: Paul Mundt <[email protected]>
2010-12-27video: imxfb: Fix the maximum value for yresFabio Estevam1-6/+3
MX27 and MX25 have 10 bits in the YMAX field of LCDC Size Register. Fix the maximum value for yres. Signed-off-by: Fabio Estevam <[email protected]> Signed-off-by: Paul Mundt <[email protected]>
2010-12-27x86/microcode: Fix double vfree() and remove redundant pointer checks before ↵Jesper Juhl1-11/+5
vfree() In arch/x86/kernel/microcode_intel.c::generic_load_microcode() we have this: while (leftover) { ... if (get_ucode_data(mc, ucode_ptr, mc_size) || microcode_sanity_check(mc) < 0) { vfree(mc); break; } ... } if (mc) vfree(mc); This will cause a double free of 'mc'. This patch fixes that by just removing the vfree() call in the loop since 'mc' will be freed nicely just after we break out of the loop. There's also a second change in the patch. I noticed a lot of checks for pointers being NULL before passing them to vfree(). That's completely redundant since vfree() deals gracefully with being passed a NULL pointer. Removing the redundant checks yields a nice size decrease for the object file. Size before the patch: text data bss dec hex filename 4578 240 1032 5850 16da arch/x86/kernel/microcode_intel.o Size after the patch: text data bss dec hex filename 4489 240 984 5713 1651 arch/x86/kernel/microcode_intel.o Signed-off-by: Jesper Juhl <[email protected]> Acked-by: Tigran Aivazian <[email protected]> Cc: Shaohua Li <[email protected]> LKML-Reference: <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2010-12-26pata_cs5536: avoid implicit MSR API inclusion on x86-64Jeff Garzik1-0/+2
We don't need or want MSR usage here, on x86-64. x86-64 was disabled intentionally in Kconfig, but commit 9272dcc232b84ccb027d6861077934055d42764d changed that. drivers/ata/pata_cs5536.c:47:1: warning: "rdmsr" redefined In file included from arch/x86/include/asm/irqflags.h:60, from include/linux/irqflags.h:15, from arch/x86/include/asm/system.h:11, from arch/x86/include/asm/processor.h:17, from include/linux/prefetch.h:14, from include/linux/list.h:7, from include/linux/module.h:9, from drivers/ata/pata_cs5536.c:33: arch/x86/include/asm/paravirt.h:146:1: warning: this is the location of the previous definition drivers/ata/pata_cs5536.c:48:1: warning: "wrmsr" redefined arch/x86/include/asm/paravirt.h:154:1: warning: this is the location of the previous definition Reported-by: Stephen Rothwell <[email protected]> Signed-off-by: Jeff Garzik <[email protected]>
2010-12-26Merge branches 'bugzilla-25412' and 'bugzilla-25302' into releaseLen Brown3-42/+63
2010-12-26ACPI / ACPICA: Disable GPEs during initializationRafael J. Wysocki1-0/+3
GPEs with corresponding _Lxx/_Exx control methods need to be disabled during initialization in case they have been enabled by the BIOS, so that they don't fire up until they are enabled by acpi_update_gpes(). References: https://bugzilla.kernel.org/show_bug.cgi?id=25412 Signed-off-by: Rafael J. Wysocki <[email protected]> Signed-off-by: Len Brown <[email protected]>
2010-12-26Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds60-190/+413
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits) ipv4: dont create routes on down devices epic100: hamachi: yellowfin: Fix skb allocation size sundance: Fix oopses with corrupted skb_shared_info Revert "ipv4: Allow configuring subnets as local addresses" USB: mcs7830: return negative if auto negotiate fails irda: prevent integer underflow in IRLMP_ENUMDEVICES tcp: fix listening_get_next() atl1c: Do not use legacy PCI power management mac80211: fix mesh forwarding MAINTAINERS: email address change net: Fix range checks in tcf_valid_offset(). net_sched: sch_sfq: fix allot handling hostap: remove netif_stop_queue from init mac80211/rt2x00: add ieee80211_tx_status_ni() typhoon: memory corruption in typhoon_get_drvinfo() net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant net_sched: always clone skbs ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed. netlink: fix gcc -Wconversion compilation warning asix: add USB ID for Logitec LAN-GTJ U2A ...
2010-12-25ipv4: dont create routes on down devicesEric Dumazet1-3/+4
In ip_route_output_slow(), instead of allowing a route to be created on a not UPed device, report -ENETUNREACH immediately. # ip tunnel add mode ipip remote 10.16.0.164 local 10.16.0.72 dev eth0 # (Note : tunl1 is down) # ping -I tunl1 10.1.2.3 PING 10.1.2.3 (10.1.2.3) from 192.168.18.5 tunl1: 56(84) bytes of data. (nothing) # ./a.out tunl1 # ip tunnel del tunl1 Message from syslogd@shelby at Dec 22 10:12:08 ... kernel: unregister_netdevice: waiting for tunl1 to become free. Usage count = 3 After patch: # ping -I tunl1 10.1.2.3 connect: Network is unreachable Reported-by: Nicolas Dichtel <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Reviewed-by: Octavian Purdila <[email protected]> Signed-off-by: David S. Miller <[email protected]>