aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-09-27Merge branch 'master' of git://git.infradead.org/users/linville/wireless ↵John W. Linville10-30/+46
into for-davem
2011-09-26ath9k: Fix a dma warning/memory leakMohammed Shafi Shajakhan1-1/+9
proper dma_unmapping and freeing of skb's has to be done in the rx cleanup for EDMA chipsets when the device is unloaded and this also seems to address the following warning which shows up occasionally when the device is unloaded Call Trace: [<c0148cd2>] warn_slowpath_common+0x72/0xa0 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c03b669c>] ? dma_debug_device_change+0x19c/0x200 [<c0148da3>] warn_slowpath_fmt+0x33/0x40 [<c03b669c>] dma_debug_device_change+0x19c/0x200 [<c0657f12>] notifier_call_chain+0x82/0xb0 [<c0171370>] __blocking_notifier_call_chain+0x60/0x90 [<c01713bf>] blocking_notifier_call_chain+0x1f/0x30 [<c044f594>] __device_release_driver+0xa4/0xc0 [<c044f647>] driver_detach+0x97/0xa0 [<c044e65c>] bus_remove_driver+0x6c/0xe0 [<c029af0b>] ? sysfs_addrm_finish+0x4b/0x60 [<c0450109>] driver_unregister+0x49/0x80 [<c0299f54>] ? sysfs_remove_file+0x14/0x20 [<c03c3ab2>] pci_unregister_driver+0x32/0x80 [<f92c2162>] ath_pci_exit+0x12/0x20 [ath9k] [<f92c8467>] ath9k_exit+0x17/0x36 [ath9k] [<c06523cd>] ? mutex_unlock+0xd/0x10 [<c018e27f>] sys_delete_module+0x13f/0x200 [<c02139bb>] ? sys_munmap+0x4b/0x60 [<c06547c5>] ? restore_all+0xf/0xf [<c0657a20>] ? spurious_fault+0xe0/0xe0 [<c01832f4>] ? trace_hardirqs_on_caller+0xf4/0x180 [<c065b863>] sysenter_do_call+0x12/0x38 ---[ end trace 16e1c1521c06bcf9 ]--- Mapped at: [<c03b7938>] debug_dma_map_page+0x48/0x120 [<f92ba3e8>] ath_rx_init+0x3f8/0x4b0 [ath9k] [<f92b5ae4>] ath9k_init_device+0x4c4/0x7b0 [ath9k] [<f92c2813>] ath_pci_probe+0x263/0x330 [ath9k] Signed-off-by: Mohammed Shafi Shajakhan <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-26rtlwifi: rtl8192cu: Fix unitialized structLarry Finger1-0/+1
Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to clear it. Signed-off-by: Larry Finger <[email protected]> Cc: Stable <[email protected]> [2.6.39+] Signed-off-by: John W. Linville <[email protected]>
2011-09-26iwlagn: fix dangling scan requestJohannes Berg1-14/+16
If iwl_scan_initiate() fails for any reason, priv->scan_request and priv->scan_vif are left dangling. This can lead to a crash later when iwl_bg_scan_completed() tries to run a pending scan request. In practice, this seems to be very rare due to the STATUS_SCANNING check earlier. That check, however, is wrong -- it should allow a scan to be queued when a reset/roc scan is going on. When a normal scan is already going on, a new one can't be issued by mac80211, so that code can be removed completely. I introduced this bug when adding off-channel support in commit 266af4c745952e9bebf687dd68af58df553cb59d. Cc: [email protected] [3.0] Reported-by: Peng Yan <[email protected]> Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Wey-Yi Guy <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-21Linux 3.1-rc7Linus Torvalds1-1/+1
2011-09-21XZ: Fix incorrect XZ_BUF_ERRORLasse Collin1-7/+20
xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the following was true: - The caller knows how many bytes of output to expect and only provides that much output space. - When the last output bytes are decoded, the caller-provided input buffer ends right before the LZMA2 end of payload marker. So LZMA2 won't provide more output anymore, but it won't know it yet and thus won't return XZ_STREAM_END yet. - A BCJ filter is in use and it hasn't left any unfiltered bytes in the temp buffer. This can happen with any BCJ filter, but in practice it's more likely with filters other than the x86 BCJ. This fixes <https://bugzilla.redhat.com/show_bug.cgi?id=735408> where Squashfs thinks that a valid file system is corrupt. This also fixes a similar bug in single-call mode where the uncompressed size of a block using BCJ + LZMA2 was 0 bytes and caller provided no output space. Many empty .xz files don't contain any blocks and thus don't trigger this bug. This also tweaks a closely related detail: xz_dec_bcj_run() could call xz_dec_lzma2_run() to decode into temp buffer when it was known to be useless. This was harmless although it wasted a minuscule number of CPU cycles. Signed-off-by: Lasse Collin <[email protected]> Cc: stable <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-21Merge git://github.com/davem330/netLinus Torvalds22-80/+165
* git://github.com/davem330/net: (27 commits) xfrm: Perform a replay check after return from async codepaths fib:fix BUG_ON in fib_nl_newrule when add new fib rule ixgbe: fix possible null buffer error tg3: fix VLAN tagging regression net: pxa168: Fix build errors by including interrupt.h netconsole: switch init_netconsole() to late_initcall gianfar: Fix overflow check and return value for gfar_get_cls_all() ppp_generic: fix multilink fragment MTU calculation (again) GRETH: avoid overwrite IP-stack's IP-frags checksum GRETH: RX/TX bytes were never increased ipv6: fix a possible double free b43: Fix beacon problem in ad-hoc mode Bluetooth: add support for 2011 mac mini Bluetooth: Add MacBookAir4,1 support Bluetooth: Fixed BT ST Channel reg order r8169: do not enable the TBI for anything but the original 8169. r8169: remove erroneous processing of always set bit. r8169: fix WOL setting for 8105 and 8111evl r8169: add MODULE_FIRMWARE for the firmware of 8111evl r8169: fix the reset setting for 8111evl ...
2011-09-21Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds21-78/+92
* 'for-linus' of git://git.kernel.dk/linux-block: floppy: use del_timer_sync() in init cleanup blk-cgroup: be able to remove the record of unplugged device block: Don't check QUEUE_FLAG_SAME_COMP in __blk_complete_request mm: Add comment explaining task state setting in bdi_forker_thread() mm: Cleanup clearing of BDI_pending bit in bdi_forker_thread() block: simplify force plug flush code a little bit block: change force plug flush call order block: Fix queue_flag update when rq_affinity goes from 2 to 1 block: separate priority boosting from REQ_META block: remove READ_META and WRITE_META xen-blkback: fixed indentation and comments xen-blkback: Don't disconnect backend until state switched to XenbusStateClosed.
2011-09-21init: carefully handle loglevel option on kernel cmdline.Alexander Sverdlin1-2/+13
When a malformed loglevel value (for example "${abc}") is passed on the kernel cmdline, the loglevel itself is being set to 0. That then suppresses all following messages, including all the errors and crashes caused by other malformed cmdline options. This could make debugging process quite tricky. This patch leaves the previous value of loglevel if the new value is incorrect and reports an error code in this case. Signed-off-by: Alexander Sverdlin <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-21teach /proc/$pid/numa_maps about transparent hugepagesDave Hansen1-0/+20
This is modeled after the smaps code. It detects transparent hugepages and then does a single gather_stats() for the page as a whole. This has two benifits: 1. It is more efficient since it does many pages in a single shot. 2. It does not have to break down the huge page. Signed-off-by: Dave Hansen <[email protected]> Acked-by: Hugh Dickins <[email protected]> Acked-by: David Rientjes <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-21break out numa_maps gather_pte_stats() checksDave Hansen1-15/+24
gather_pte_stats() does a number of checks on a target page to see whether it should even be considered for statistics. This breaks that code out in to a separate function so that we can use it in the transparent hugepage case in the next patch. Signed-off-by: Dave Hansen <[email protected]> Acked-by: Hugh Dickins <[email protected]> Reviewed-by: Christoph Lameter <[email protected]> Acked-by: David Rientjes <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-21make /proc/$pid/numa_maps gather_stats() take variable page sizeDave Hansen1-10/+11
We need to teach the numa_maps code about transparent huge pages. The first step is to teach gather_stats() that the pte it is dealing with might represent more than one page. Note that will we use this in a moment for transparent huge pages since they have use a single pmd_t which _acts_ as a "surrogate" for a bunch of smaller pte_t's. I'm a _bit_ unhappy that this interface counts in hugetlbfs page sizes for hugetlbfs pages and PAGE_SIZE for normal pages. That means that to figure out how many _bytes_ "dirty=1" means, you must first know the hugetlbfs page size. That's easier said than done especially if you don't have visibility in to the mount. But, that's probably a discussion for another day especially since it would change behavior to fix it. But, just in case anyone wonders why this patch only passes a '1' in the hugetlb case... Signed-off-by: Dave Hansen <[email protected]> Acked-by: Hugh Dickins <[email protected]> Acked-by: David Rientjes <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-21cfg80211: Fix validation of AKM suitesJouni Malinen1-1/+4
Incorrect variable was used in validating the akm_suites array from NL80211_ATTR_AKM_SUITES. In addition, there was no explicit validation of the array length (we only have room for NL80211_MAX_NR_AKM_SUITES). This can result in a buffer write overflow for stack variables with arbitrary data from user space. The nl80211 commands using the affected functionality require GENL_ADMIN_PERM, so this is only exposed to admin users. Cc: [email protected] Signed-off-by: Jouni Malinen <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-21iwlegacy: do not use interruptible waitsStanislaw Gruszka5-13/+13
iwlegacy version of fix: commit effd4d9aece9184f526e6556786a94d335e38b71 Author: Johannes Berg <[email protected]> Date: Thu Sep 15 11:46:52 2011 -0700 iwlagn: do not use interruptible waits Since the dawn of its time, iwlwifi has used interruptible waits to wait for synchronous commands and firmware loading. This leads to "interesting" bugs, because it can't actually handle the interruptions; for example when a command sending is interrupted it will assume the command completed fully, and then leave it pending, which leads to all kinds of trouble when the command finishes later. Since there's no easy way to gracefully deal with interruptions, fix the driver to not use interruptible waits. This at least fixes the error iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD' I have seen in P2P testing, but it is likely that there are other errors caused by this. Cc: [email protected] # 2.6.39+ Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-21iwlegacy: fix command queue timeoutStanislaw Gruszka1-0/+2
iwlegacy version of fix: commit 282cdb325aea4ebbc42ce753b47cc96145eb54bc Author: Johannes Berg <[email protected]> Date: Mon Sep 12 12:09:10 2011 -0700 iwlagn: fix command queue timeout If the command queue is constantly busy, which can happen in P2P, the hangcheck timer will frequently find a command in it and will eventually reset the device because nothing sets the timestamp for this queue when commands are processed. Fix this by setting the timestamp when a command completes. iwlegacy does not support P2P, but this patch fix possible unneeded hardware resets, hence is needed. Cc: [email protected] # 2.6.39+ Signed-off-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-21ath9k_hw: Fix Rx DMA stuck for AR9003 chipsRajkumar Manoharan1-1/+1
During the endurance testing, rx frames are not getting DMAd from MAC whereas pcu rx frame counters are getting updated properly. As per systems team input updated the initval to fix rx dma stuck issue. Cc: [email protected] Signed-off-by: Rajkumar Manoharan <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2011-09-21xfrm: Perform a replay check after return from async codepathsSteffen Klassert1-0/+5
When asyncronous crypto algorithms are used, there might be many packets that passed the xfrm replay check, but the replay advance function is not called yet for these packets. So the replay check function would accept a replay of all of these packets. Also the system might crash if there are more packets in async processing than the size of the anti replay window, because the replay advance function would try to update the replay window beyond the bounds. This pach adds a second replay check after resuming from the async processing to fix these issues. Signed-off-by: Steffen Klassert <[email protected]> Acked-by: Herbert Xu <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-21fib:fix BUG_ON in fib_nl_newrule when add new fib ruleGao feng1-2/+2
add new fib rule can cause BUG_ON happen the reproduce shell is ip rule add pref 38 ip rule add pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule del pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule add pref 38 then the BUG_ON will happen del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolved Signed-off-by: Gao feng <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-21floppy: use del_timer_sync() in init cleanupCarsten Emde1-4/+4
When no floppy is found the module code can be released while a timer function is pending or about to be executed. CPU0 CPU1 floppy_init() timer_softirq() spin_lock_irq(&base->lock); detach_timer(); spin_unlock_irq(&base->lock); -> Interrupt del_timer(); return -ENODEV; module_cleanup(); <- EOI call_timer_fn(); OOPS Use del_timer_sync() to prevent this. Signed-off-by: Carsten Emde <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Cc: Jens Axboe <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2011-09-21blk-cgroup: be able to remove the record of unplugged deviceWanlong Gao1-21/+16
The bug is we're not able to remove the device from blkio cgroup's per-device control files if it gets unplugged. To reproduce the bug: # mount -t cgroup -o blkio xxx /cgroup # cd /cgroup # echo "8:0 1000" > blkio.throttle.read_bps_device # unplug the device # cat blkio.throttle.read_bps_device 8:0 1000 # echo "8:0 0" > blkio.throttle.read_bps_device -bash: echo: write error: No such device After patching, the device removal will succeed. Thanks for the comments of Paul, Zefan, and Vivek. Signed-off-by: Wanlong Gao <[email protected]> Cc: Li Zefan <[email protected]> Cc: Paul Menage <[email protected]> Acked-by: Vivek Goyal <[email protected]> Cc: Jens Axboe <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2011-09-21ixgbe: fix possible null buffer errorJesse Brandeburg1-2/+2
It seems that at least one PPC machine would occasionally give a (valid) 0 as the return value from dma_map, this caused the ixgbe code to not work correctly. A fix is pending in the PPC tree to not return 0 from dma map, but we can also fix the driver to make sure we don't mess up in other arches as well. This patch is applicable to all current stable kernels. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=683611 Reported-by: Neil Horman <[email protected]> Signed-off-by: Jesse Brandeburg <[email protected]> CC: Alexander Duyck <[email protected]> CC: [email protected] Tested-by: Thadeu Lima de Souza Cascardo <[email protected]> Tested-by: Phil Schmitt <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-21tg3: fix VLAN tagging regressionKasper Pedersen1-2/+0
commit 92cd3a17ce9c719abb4c28dee3438e0c641f8de4 tg3: Simplify tx bd assignments broke VLAN tagging on outbound packets. It ifdef'ed BCM_KERNEL_SUPPORTS_8021Q, but this is not set anywhere. So vlan never gets set, and all packets are sent with vlan=0. v2: We can just remove the test. vlan_tx_tag_present is valid regardless of whether the 802.1q module is built. Tested on BCM5721 rev 11. Signed-off-by: Kasper Pedersen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-socLinus Torvalds13-65/+52
* 'fixes' of git://git.linaro.org/people/arnd/arm-soc: mach-integrator: fix VGA base regression arm/dt: Tegra: Update SDHCI nodes to match bindings ARM: EXYNOS4: fix incorrect pad configuration for keypad row lines ARM: SAMSUNG: fix to prevent declaring duplicated ARM: SAMSUNG: fix watchdog reset issue with clk_get() ARM: S3C64XX: Remove un-used code backlight code on SMDK6410 ARM: EXYNOS4: restart clocksource while system resumes ARM: EXYNOS4: Fix routing timer interrupt to offline CPU ARM: EXYNOS4: Fix return type of local_timer_setup() ARM: EXYNOS4: Fix wrong pll type for vpll ARM: Dove: fix second SPI initialization call
2011-09-20Merge branch 'for-linus' of git://github.com/chrismason/linuxLinus Torvalds1-1/+6
* 'for-linus' of git://github.com/chrismason/linux: Btrfs: reserve sufficient space for ioctl clone
2011-09-20staging: zcache: fix cleancache crashSeth Jennings1-1/+1
After commit c5f5c4db3938 ("staging: zcache: fix crash on high memory swap") cleancache crashes on the first successful get. This was caused by a remaining virt_to_page() call in zcache_pampd_get_data_and_free() that only gets run in the cleancache path. The patch converts the virt_to_page() to struct page casting like was done for other instances in c5f5c4db3938. Signed-off-by: Seth Jennings <[email protected]> Tested-By: Valdis Kletnieks <[email protected]> Acked-by: Dan Magenheimer <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2011-09-20mach-integrator: fix VGA base regressionLinus Walleij2-2/+2
The changes introduced in commit cc22b4c18540e5e8bf55c7d124044f9317527d3c "ARM: set vga memory base at run-time" Makes the Integrator/AP freeze completely. I appears that this is due to the VGA base address being assigned at PCI init time, while this base is needed earlier than that. Moving the initialization of the base address to the .map_io function solves this problem. Cc: Rob Herring <[email protected]> Cc: Nicolas Pitre <[email protected]> Cc: Arnd Bergmann <[email protected]> Signed-off-by: Linus Walleij <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]>
2011-09-20arm/dt: Tegra: Update SDHCI nodes to match bindingsStephen Warren2-9/+9
The bindings were recently updated to have separate properties for each type of GPIO. Update the Device Tree source to match that. Signed-off-by: Stephen Warren <[email protected]> Acked-by: Olof Johansson <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]>
2011-09-20net: pxa168: Fix build errors by including interrupt.hTanmay Upadhyay1-0/+1
Commit a6b7a407865aab9f849dd99a71072b7cd1175116 removed linux/interrupt.h from netdevice.h. This fixes below build failure drivers/net/pxa168_eth.c: In function 'pxa168_eth_collect_events': drivers/net/pxa168_eth.c:866: error: 'IRQ_NONE' undeclared (first use in this function) drivers/net/pxa168_eth.c:866: error: (Each undeclared identifier is reported only once drivers/net/pxa168_eth.c:866: error: for each function it appears in.) drivers/net/pxa168_eth.c: At top level: drivers/net/pxa168_eth.c:913: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'pxa168_eth_int_handler' drivers/net/pxa168_eth.c: In function 'pxa168_eth_open': drivers/net/pxa168_eth.c:1133: error: implicit declaration of function 'request_irq' drivers/net/pxa168_eth.c:1133: error: 'pxa168_eth_int_handler' undeclared (first use in this function) drivers/net/pxa168_eth.c:1134: error: 'IRQF_DISABLED' undeclared (first use in this function) drivers/net/pxa168_eth.c:1160: error: implicit declaration of function 'free_irq' Signed-off-by: Tanmay Upadhyay <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20netconsole: switch init_netconsole() to late_initcallLin Ming1-1/+7
Commit 88491d8(drivers/net: Kconfig & Makefile cleanup) causes a regression that netconsole does not work if netconsole and network device driver are build into kernel, because netconsole is linked before network device driver. Andrew Morton suggested to fix this with initcall ordering. Fixes it by switching init_netconsole() to late_initcall. Signed-off-by: Lin Ming <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20gianfar: Fix overflow check and return value for gfar_get_cls_all()Ben Hutchings1-4/+4
This function may currently fill one entry beyond the end of the array it is given. It also doesn't return an error code in case it does detect overflow. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20ppp_generic: fix multilink fragment MTU calculation (again)Henry Wong1-1/+6
When using MLPPP, the maximum size of a fragment is incorrectly calculated with an offset of -2. This patch reverses the changes in the patch found here: http://marc.info/?l=linux-netdev&m=123541324010539&w=2 The value of hdrlen includes the size of both the 2-byte PPP protocol field and the 2- or 4-byte multilink header (2+4=6 for long sequence numbers, 2+2=4 for short sequence numbers). Section 2 of RFC1661 says that the MRU that is negotiated (i.e., the MTU of the sending system) includes only the PPP payload but not the protocol field, thus the correct MTU should be the link's MTU minus the multilink header (mtu - (hdrlen-2)). The incorrect calculation causes Linux to fragment packets to a size two bytes smaller than the allowed MTU. While not technically illegal, this behaviour confounds MRU-tuning to avoid PPP-layer fragmentation. Signed-off-by: Henry Wong <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20GRETH: avoid overwrite IP-stack's IP-frags checksumDaniel Hellstrom1-2/+5
The GRETH GBIT core does not do checksum offloading for IP segmentation. This patch adds a check in the xmit function to determine if the stack has calculated the checksum for us. Signed-off-by: Daniel Hellstrom <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20GRETH: RX/TX bytes were never increasedDaniel Hellstrom2-0/+6
Signed-off-by: Daniel Hellstrom <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20ipv6: fix a possible double freeRoy Li1-2/+2
When calling snmp6_alloc_dev fails, the snmp6 relevant memory are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy will free these memory twice. Double free will lead that undefined behavior occurs. Signed-off-by: Roy Li <[email protected]> Acked-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2011-09-20Merge branch 'btrfs-3.0' into for-linusChris Mason1-1/+6
2011-09-20Btrfs: reserve sufficient space for ioctl cloneSage Weil1-1/+6
Fix a crash/BUG_ON in the clone ioctl due to insufficient reservation. We need to reserve space for: - adjusting the old extent (possibly splitting it) - adding the new extent - updating the inode Signed-off-by: Sage Weil <[email protected]> Signed-off-by: Chris Mason <[email protected]>
2011-09-20Merge branch 'davem.r8169.fixes' of git://violet.fr.zoreil.com/romieu/linuxDavid S. Miller1-5/+27
2011-09-20Merge git://git.samba.org/sfrench/cifs-2.6Linus Torvalds4-50/+21
* git://git.samba.org/sfrench/cifs-2.6: cifs: Fix broken sec=ntlmv2/i sec option (try #2) Fix the conflict between rwpidforward and rw mount options CIFS: Fix ERR_PTR dereference in cifs_get_root cifs: fix possible memory corruption in CIFSFindNext
2011-09-20Merge git://www.linux-watchdog.org/linux-watchdogLinus Torvalds4-16/+17
* git://www.linux-watchdog.org/linux-watchdog: watchdog: Initconst section fixes for watchdog watchdog: lantiq: fix watchdogs timeout handling watchdog: hpwdt: prevent multiple "NMI occurred" messages watchdog: WatchDog Timer Driver Core - use passed watchdog_device
2011-09-20Merge branch 'for-linus' of git://github.com/tiwai/soundLinus Torvalds2-4/+6
* 'for-linus' of git://github.com/tiwai/sound: ALSA: HDA: Add support for IDT 92HD93 ALSA: hda/realtek - Fix auto-mute with HP+LO configuration
2011-09-20Merge branch 'master' of ssh://infradead/~/public_git/wireless into for-davemJohn W. Linville10-59/+98
2011-09-20watchdog: Initconst section fixes for watchdogAndi Kleen1-1/+1
Signed-off-by: Andi Kleen <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2011-09-20watchdog: lantiq: fix watchdogs timeout handlingJohn Crispin1-4/+4
The enable function was using the global timeout variable for local operations. This resulted in the value of the global variable being corrupted, thus breaking the code. Signed-off-by: John Crispin <[email protected]> Signed-off-by: Thomas Langer <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]> Cc: [email protected] Cc: [email protected]
2011-09-20watchdog: hpwdt: prevent multiple "NMI occurred" messagesNaga Chumbalkar1-4/+5
On platforms with no iCRU support don't print two, (possibly conflicting), "NMI occurred" messages when the firmware is unable to source the NMI. Please note that one of the enhancements to the v1.3.0 hpwdt driver is to panic and allow KDUMP to succeed even on NMIs that are unknown to the platform firmware. Signed-off-by: Naga Chumbalkar <[email protected]> Reviewed-by: Thomas Mingarelli <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2011-09-20watchdog: WatchDog Timer Driver Core - use passed watchdog_deviceH Hartley Sweeten1-7/+7
Use the passed watchdog_device instead of the static global variable when testing and setting the status in watchdog_ping, watchdog_start, and watchdog_stop. Note that the callers of these functions are actually passing the static global variable. Signed-off-by: H Hartley Sweeten <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2011-09-20ALSA: HDA: Add support for IDT 92HD93David Henningsson1-0/+1
Cc: [email protected] BugLink: http://bugs.launchpad.net/bugs/854468 Signed-off-by: David Henningsson <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2011-09-19cifs: Fix broken sec=ntlmv2/i sec option (try #2)Shirish Pargaonkar1-43/+11
Fix sec=ntlmv2/i authentication option during mount of Samba shares. cifs client was coding ntlmv2 response incorrectly. All that is needed in temp as specified in MS-NLMP seciton 3.3.2 "Define ComputeResponse(NegFlg, ResponseKeyNT, ResponseKeyLM, CHALLENGE_MESSAGE.ServerChallenge, ClientChallenge, Time, ServerName) as Set temp to ConcatenationOf(Responserversion, HiResponserversion, Z(6), Time, ClientChallenge, Z(4), ServerName, Z(4)" is MsvAvNbDomainName. For sec=ntlmsspi, build_av_pair is not used, a blob is plucked from type 2 response sent by the server to use in authentication. I tested sec=ntlmv2/i and sec=ntlmssp/i mount options against Samba (3.6) and Windows - XP, 2003 Server and 7. They all worked. Signed-off-by: Shirish Pargaonkar <[email protected]> Signed-off-by: Steve French <[email protected]>
2011-09-19Fix the conflict between rwpidforward and rw mount optionsSteve French1-2/+2
Both these options are started with "rw" - that's why the first one isn't switched on even if it is specified. Fix this by adding a length check for "rw" option check. Cc: <[email protected]> Signed-off-by: Pavel Shilovsky <[email protected]> Signed-off-by: Steve French <[email protected]>
2011-09-19CIFS: Fix ERR_PTR dereference in cifs_get_rootPavel Shilovsky1-4/+6
move it to the beginning of the loop. Signed-off-by: Pavel Shilovsky <[email protected]> Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
2011-09-19cifs: fix possible memory corruption in CIFSFindNextJeff Layton1-1/+2
The name_len variable in CIFSFindNext is a signed int that gets set to the resume_name_len in the cifs_search_info. The resume_name_len however is unsigned and for some infolevels is populated directly from a 32 bit value sent by the server. If the server sends a very large value for this, then that value could look negative when converted to a signed int. That would make that value pass the PATH_MAX check later in CIFSFindNext. The name_len would then be used as a length value for a memcpy. It would then be treated as unsigned again, and the memcpy scribbles over a ton of memory. Fix this by making the name_len an unsigned value in CIFSFindNext. Cc: <[email protected]> Reported-by: Darren Lavender <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Steve French <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.