linux-2.6.22-openvz
6 years agolinux-2.6.22-ovz005 released master ovz005
OpenVZ team [Fri, 16 Nov 2007 09:34:57 +0000]
linux-2.6.22-ovz005 released

6 years agoNETFILTER: check for valid VE conntrack structure in __nf_ct_l3proto_find()
Alexey Dobriyan [Thu, 15 Nov 2007 12:15:46 +0000]
NETFILTER: check for valid VE conntrack structure in __nf_ct_l3proto_find()

If VE is started with permissions to use iptables but not conntracking,
->nf_conntrack pointer will be NULL. However it will be NULL dereference
during the following codepath:

net/netfilter/xt_state.c:check()
nf_ct_l3proto_try_module_get
nf_ct_l3proto_find_get
__nf_ct_l3proto_find
ve_nf_ct_l3protos[l3proto] == dereference

Steps to reproduce:

iptables -A OUTPUT -m state  --state NEW -j ACCEPT

6 years agoNETFILTER: use module_init() for NAT initcalls
Alexey Dobriyan [Wed, 14 Nov 2007 13:41:23 +0000]
NETFILTER: use module_init() for NAT initcalls

If NAT is compiled in it will oops during init because VE0's ->nf_conntrack is
still NULL. So, let's initialize NAT after conntrack.

6 years agoia64: really do getpid(), getppid() by slow path
Alexey Dobriyan [Tue, 13 Nov 2007 11:17:58 +0000]
ia64: really do getpid(), getppid() by slow path

6 years agoia64: fix off-by-one in syscall table
Alexey Dobriyan [Mon, 12 Nov 2007 15:32:01 +0000]
ia64: fix off-by-one in syscall table

6 years agoMerge 2.6.22.10, 2.6.22.11, 2.6.22.12
Alexey Dobriyan [Fri, 9 Nov 2007 16:59:47 +0000]
Merge 2.6.22.10, 2.6.22.11, 2.6.22.12

6 years agoia64: compile fixes
Alexey Dobriyan [Fri, 9 Nov 2007 16:46:24 +0000]
ia64: compile fixes

6 years agopidns: ia64: don't do getpid() by fast path
Alexey Dobriyan [Fri, 9 Nov 2007 16:40:47 +0000]
pidns: ia64: don't do getpid() by fast path

With the introduction of pid namespaces simply grabbing value from task_struct
is wrong. One should do honest system call.

6 years agoUBC: fix compilation on ia64 re quicklist changes
Alexey Dobriyan [Fri, 9 Nov 2007 14:47:11 +0000]
UBC: fix compilation on ia64 re quicklist changes

6 years ago[PATCH] Stop tickless mode during stopmachine run
Alexey Dobriyan [Fri, 9 Nov 2007 13:13:47 +0000]
[PATCH] Stop tickless mode during stopmachine run

Fix unusable modprobe triggered by CONFIG_HIGH_RES_TIMES=y change.

Two stopmachine threads end up on two different VCPUs but one PCPU.
If scheduler tick is disabled on PCPU which haven't got stopmachine
thread, we will be waiting for ACK from corresponding thread for a
looong time. Idle cpu doesn't wake up and doesn't steal idle
stopmachine thread. Busy cpu is busy executing busy stopmachine thread.

The least evil, I believe, is to disable NOHZ mode for the duration of
stopmachine.

6 years agoVirtualize SIT (IPv6 over IPv4)
Evgeny Kravtsunov [Fri, 9 Nov 2007 10:46:53 +0000]
Virtualize SIT (IPv6 over IPv4)

6 years agoNETFILTER: de-virtualize log_invalid_proto_min_max
Alexey Dobriyan [Wed, 7 Nov 2007 16:00:15 +0000]
NETFILTER: de-virtualize log_invalid_proto_min_max

log_invalid_proto_min/max variables are just boundary values for
ip_conntrack_log_invalid sysctl. They never change.

6 years agoLinux 2.6.22.12
Greg Kroah-Hartman [Mon, 5 Nov 2007 17:59:33 +0000]
Linux 2.6.22.12

6 years agoRevert "x86_64: allocate sparsemem memmap above 4G"
Linus Torvalds [Mon, 29 Oct 2007 18:36:04 +0000]
Revert "x86_64: allocate sparsemem memmap above 4G"

patch 6a22c57b8d2a62dea7280a6b2ac807a539ef0716 in mainline.

This reverts commit 2e1c49db4c640b35df13889b86b9d62215ade4b6.

First off, testing in Fedora has shown it to cause boot failures,
bisected down by Martin Ebourne, and reported by Dave Jobes.  So the
commit will likely be reverted in the 2.6.23 stable kernels.

Secondly, in the 2.6.24 model, x86-64 has now grown support for
SPARSEMEM_VMEMMAP, which disables the relevant code anyway, so while the
bug is not visible any more, it's become invisible due to the code just
being irrelevant and no longer enabled on the only architecture that
this ever affected.

backported to 2.6.22 by Chuck Ebbert

Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Martin Ebourne <fedora@ebourne.me.uk>
Cc: Zou Nan hai <nanhai.zou@intel.com>
Cc: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agodm snapshot: fix invalidation deadlock
Milan Broz [Thu, 12 Jul 2007 16:28:00 +0000]
dm snapshot: fix invalidation deadlock

patch fcac03abd325e4f7a4cc8fe05fea2793b1c8eb75 in mainline

Process persistent exception store metadata IOs in a separate thread.

A snapshot may become invalid while inside generic_make_request().
A synchronous write is then needed to update the metadata while still
inside that function.  Since the introduction of
md-dm-reduce-stack-usage-with-stacked-block-devices.patch this has to
be performed by a separate thread to avoid deadlock.

Signed-off-by: Milan Broz <mbroz@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agox86: fix global_flush_tlb() bug
Ingo Molnar [Fri, 19 Oct 2007 10:19:26 +0000]
x86: fix global_flush_tlb() bug

patch 9a24d04a3c26c223f22493492c5c9085b8773d4a upstream

While we were reviewing pageattr_32/64.c for unification,
Thomas Gleixner noticed the following serious SMP bug in
global_flush_tlb():

down_read(&init_mm.mmap_sem);
list_replace_init(&deferred_pages, &l);
up_read(&init_mm.mmap_sem);

this is SMP-unsafe because list_replace_init() done on two CPUs in
parallel can corrupt the list.

This bug has been introduced about a year ago in the 64-bit tree:

       commit ea7322decb974a4a3e804f96a0201e893ff88ce3
       Author: Andi Kleen <ak@suse.de>
       Date:   Thu Dec 7 02:14:05 2006 +0100

       [PATCH] x86-64: Speed and clean up cache flushing in change_page_attr

                down_read(&init_mm.mmap_sem);
        -       dpage = xchg(&deferred_pages, NULL);
        +       list_replace_init(&deferred_pages, &l);
                up_read(&init_mm.mmap_sem);

the xchg() based version was SMP-safe, but list_replace_init() is not.
So this "cleanup" introduced a nasty bug.

why this bug never become prominent is a mystery - it can probably be
explained with the (still) relative obscurity of the x86_64 architecture.

the safe fix for now is to write-lock init_mm.mmap_sem.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andi Kleen <ak@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoparam_sysfs_builtin memchr argument fix
Dave Young [Thu, 18 Oct 2007 10:05:07 +0000]
param_sysfs_builtin memchr argument fix

patch faf8c714f4508207a9c81cc94dafc76ed6680b44 in mainline.

If memchr argument is longer than strlen(kp->name), there will be some
weird result.

It will casuse duplicate filenames in sysfs for the "nousb".  kernel
warning messages are as bellow:

sysfs: duplicate filename 'usbcore' can not be created
WARNING: at fs/sysfs/dir.c:416 sysfs_add_one()
 [<c01c4750>] sysfs_add_one+0xa0/0xe0
 [<c01c4ab8>] create_dir+0x48/0xb0
 [<c01c4b69>] sysfs_create_dir+0x29/0x50
 [<c024e0fb>] create_dir+0x1b/0x50
 [<c024e3b6>] kobject_add+0x46/0x150
 [<c024e2da>] kobject_init+0x3a/0x80
 [<c053b880>] kernel_param_sysfs_setup+0x50/0xb0
 [<c053b9ce>] param_sysfs_builtin+0xee/0x130
 [<c053ba33>] param_sysfs_init+0x23/0x60
 [<c024d062>] __next_cpu+0x12/0x20
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052a856>] do_initcalls+0x46/0x1e0
 [<c01bdb12>] create_proc_entry+0x52/0x90
 [<c0158d4c>] register_irq_proc+0x9c/0xc0
 [<c01bda94>] proc_mkdir_mode+0x34/0x50
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052aa92>] kernel_init+0x62/0xb0
 [<c0104f83>] kernel_thread_helper+0x7/0x14
 =======================
kobject_add failed for usbcore with -EEXIST, don't try to register things with the same name in the same directory.
 [<c024e466>] kobject_add+0xf6/0x150
 [<c053b880>] kernel_param_sysfs_setup+0x50/0xb0
 [<c053b9ce>] param_sysfs_builtin+0xee/0x130
 [<c053ba33>] param_sysfs_init+0x23/0x60
 [<c024d062>] __next_cpu+0x12/0x20
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052a856>] do_initcalls+0x46/0x1e0
 [<c01bdb12>] create_proc_entry+0x52/0x90
 [<c0158d4c>] register_irq_proc+0x9c/0xc0
 [<c01bda94>] proc_mkdir_mode+0x34/0x50
 [<c052aa30>] kernel_init+0x0/0xb0
 [<c052aa92>] kernel_init+0x62/0xb0
 [<c0104f83>] kernel_thread_helper+0x7/0x14
 =======================
Module 'usbcore' failed to be added to sysfs, error number -17
The system will be unstable now.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agominixfs: limit minixfs printks on corrupted dir i_size (CVE-2006-6058)
Eric Sandeen [Wed, 17 Oct 2007 06:27:15 +0000]
minixfs: limit minixfs printks on corrupted dir i_size (CVE-2006-6058)

patch 44ec6f3f89889a469773b1fd894f8fcc07c29cf in mainline

This attempts to address CVE-2006-6058
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6058

first reported at http://projects.info-pull.com/mokb/MOKB-17-11-2006.html

Essentially a corrupted minix dir inode reporting a very large
i_size will loop for a very long time in minix_readdir, minix_find_entry,
etc, because on EIO they just move on to try the next page.  This is
under the BKL, printk-storming as well.  This can lock up the machine
for a very long time.  Simply ratelimiting the printks gets things back
under control.  Make the message a bit more informative while we're here.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: Bodo Eggert <7eggert@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoIB/uverbs: Fix checking of userspace object ownership
Roland Dreier [Sun, 28 Oct 2007 17:14:32 +0000]
IB/uverbs: Fix checking of userspace object ownership

Upstream as cbfb50e6e2e9c580848c0f51d37c24cdfb1cb704

Commit 9ead190b ("IB/uverbs: Don't serialize with ib_uverbs_idr_mutex")
rewrote how userspace objects are looked up in the uverbs module's
idrs, and introduced a severe bug in the process: there is no checking
that an operation is being performed by the right process any more.
Fix this by adding the missing check of uobj->context in __idr_get_uobj().

Apparently everyone is being very careful to only touch their own
objects, because this bug was introduced in June 2006 in 2.6.18, and
has gone undetected until now.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agogenirq: mark io_apic level interrupts to avoid resend
Thomas Gleixner [Sun, 12 Aug 2007 15:46:36 +0000]
genirq: mark io_apic level interrupts to avoid resend

patch cc75b92d11384ba14f93828a2a0040344ae872e7 in mainline.

Level type interrupts do not need to be resent.  It was also found that
some chipsets get confused in case of the resend.

Mark the ioapic level type interrupts as such to avoid the resend
functionality in the generic irq code.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agogenirq: suppress resend of level interrupts
Thomas Gleixner [Sun, 12 Aug 2007 15:46:35 +0000]
genirq: suppress resend of level interrupts

patch 2464286ace55b3abddfb9cc30ab95e2dac1de9a6 in mainline.

Level type interrupts are resent by the interrupt hardware when they are
still active at irq_enable().

Suppress the resend mechanism for interrupts marked as level.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agogenirq: cleanup mismerge artifact
Thomas Gleixner [Sun, 12 Aug 2007 15:46:34 +0000]
genirq: cleanup mismerge artifact

patch 496634217e5671ed876a0348e9f5b7165e830b20 in mainline.

Commit 5a43a066b11ac2fe84cf67307f20b83bea390f83: "genirq: Allow fasteoi
handler to retrigger disabled interrupts" was erroneously applied to
handle_level_irq().  This added the irq retrigger / resend functionality
to the level irq handler.

Revert the offending bits.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoLinux 2.6.22.11
Greg Kroah-Hartman [Fri, 2 Nov 2007 15:48:19 +0000]
Linux 2.6.22.11

6 years agolockdep: fix mismatched lockdep_depth/curr_chain_hash
Gregory Haskins [Wed, 31 Oct 2007 15:44:05 +0000]
lockdep: fix mismatched lockdep_depth/curr_chain_hash

patch 3aa416b07f0adf01c090baab26fb70c35ec17623 in mainline.

lockdep: fix mismatched lockdep_depth/curr_chain_hash

It is possible for the current->curr_chain_key to become inconsistent with the
current index if the chain fails to validate.  The end result is that future
lock_acquire() operations may inadvertently fail to find a hit in the cache
resulting in a new node being added to the graph for every acquire.

[ peterz: this might explain some of the lockdep is so _slow_ complaints. ]
[ mingo: this does not impact the correctness of validation, but may slow
  down future operations significantly, if the chain gets very long. ]

Signed-off-by: Gregory Haskins <ghaskins@novell.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoPOWERPC: Fix handling of stfiwx math emulation
Kumar Gala [Thu, 11 Oct 2007 22:07:34 +0000]
POWERPC: Fix handling of stfiwx math emulation

patch ba02946a903015840ef672ccc9dc8620a7e83de6 in mainline

Its legal for the stfiwx instruction to have RA = 0 as part of its
effective address calculation.  This is illegal for all other XE
form instructions.

Add code to compute the proper effective address for stfiwx if
RA = 0 rather than treating it as illegal.

Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoi915: fix vbl swap allocation size.
Dave Airlie [Tue, 16 Oct 2007 00:05:49 +0000]
i915: fix vbl swap allocation size.

This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81

Oops...

Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agohwmon/w83627hf: Don't assume bank 0
Jean Delvare [Mon, 15 Oct 2007 13:02:42 +0000]
hwmon/w83627hf: Don't assume bank 0

Already in Linus' tree:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44

The bank switching code assumes that the bank selector is set to 0
when the driver is loaded. This might not be the case. This is exactly
the same bug as was fixed in the w83627ehf driver two months ago:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d

In practice, this bug was causing the sensor thermal types to be
improperly reported for my W83627THF the first time I was loading the
w83627hf driver. From the driver history, I'd say that it has been
broken since September 2005 (when we stopped resetting the chip by
default at driver load.)

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agohwmon/w83627hf: Fix setting fan min right after driver load
Jean Delvare [Mon, 15 Oct 2007 12:32:27 +0000]
hwmon/w83627hf: Fix setting fan min right after driver load

Already in Linus' tree:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd

We need to read the fan clock dividers at initialization time,
otherwise the code in store_fan_min() may use uninitialized values.
That's pretty much the same bug and same fix as for the w83627ehf
driver last month.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agohwmon/lm87: Disable VID when it should be
Jean Delvare [Mon, 15 Oct 2007 12:02:36 +0000]
hwmon/lm87: Disable VID when it should be

Already in Linus' tree:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8

A stupid bit shifting bug caused the VID value to be always exported
even when the hardware is configured for something different.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agohwmon/lm87: Fix a division by zero
Jean Delvare [Mon, 15 Oct 2007 11:49:50 +0000]
hwmon/lm87: Fix a division by zero

Already in Linus' tree:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2

Missing parentheses in the definition of FAN_FROM_REG cause a
division by zero for a specific register value.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Hans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoV4L: ivtv: fix udma yuv bug
Ian Armstrong [Sun, 14 Oct 2007 15:53:46 +0000]
V4L: ivtv: fix udma yuv bug

Based on cb50f548c0ee9b2aac39743fc4021a7188825a98 in mainline

[PATCH] V4L: ivtv: fix udma yuv bug

Using udma yuv causes the driver to become locked into that mode. This
prevents use of the mpeg decoder & non-udma yuv output.

This patch clears the operating mode when the device is closed.

Signed-off-by: Ian Armstrong <ian@iarmst.demon.co.uk>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agodm9601: Fix receive MTU
Peter Korsgaard [Fri, 12 Oct 2007 12:14:02 +0000]
dm9601: Fix receive MTU

patch f662fe5a0b144efadbfc00e8040e603ec318746e in mainline.

dm9601: Fix receive MTU

dm9601 didn't take the ethernet header into account when calculating
RX MTU, causing packets bigger than 1486 to fail.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agonetdrvr: natsemi: Fix device removal bug
Jeff Garzik [Tue, 17 Jul 2007 04:01:09 +0000]
netdrvr: natsemi: Fix device removal bug

This episode illustrates how an overused warning can train people to
ignore that warning, which winds up hiding bugs.

The warning

drivers/net/natsemi.c: In function ‘natsemi_remove1’:
drivers/net/natsemi.c:3222: warning: ignoring return value of
‘device_create_file’, declared with attribute warn_unused_result

is oft-ignored, even though at close inspection one notices this occurs
in the /remove/ function, not normally where creation occurs.  A quick
s/create/remove/ and we are fixed, with the warning gone.

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agofirewire: fix unloading of fw-ohci while devices are attached
Stefan Richter [Wed, 10 Oct 2007 20:37:25 +0000]
firewire: fix unloading of fw-ohci while devices are attached

Fix panic in run_timer_softirq right after "modprobe -r firewire-ohci"
if a FireWire disk was attached and firewire-sbp2 loaded.

Same as commit 8a2d9ed3210464d22fccb9834970629c1c36fa36.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoAdd get_unaligned to ieee80211_get_radiotap_len
Andy Green [Wed, 10 Oct 2007 02:46:33 +0000]
Add get_unaligned to ieee80211_get_radiotap_len

patch dfe6e81deaa79c85086c0cc8d85b229e444ab97f in mainline.

ieee80211_get_radiotap_len() tries to dereference radiotap length without
taking care that it is completely unaligned and get_unaligned()
is required.

Signed-off-by: Andy Green <andy@warmcat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agolibertas: more endianness breakage
Al Viro [Wed, 10 Oct 2007 02:46:37 +0000]
libertas: more endianness breakage

based on patch 8362cd413e8116306fafbaf414f0419db0595142 in mainline.

domain->header.len is le16 and has just been assigned
cpu_to_le16(arithmetical expression).  And all fields of adapter->logmsg
are __le32; not a single 16-bit among them...
That's incremental to the previous one

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agolibertas: fix endianness breakage
Al Viro [Wed, 10 Oct 2007 02:46:36 +0000]
libertas: fix endianness breakage

patch 5707708111ca6c4e9a1160acffdc98a98d95e462 in mainline.

wep->keytype[] is u8

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

6 years agomac80211: filter locally-originated multicast frames
John W. Linville [Wed, 10 Oct 2007 02:46:35 +0000]
mac80211: filter locally-originated multicast frames

patch b331615722779b078822988843ddffd4eaec9f83 in mainline.

In STA mode, the AP will echo our traffic.  This includes multicast
traffic.

Receiving these frames confuses some protocols and applications,
notably IPv6 Duplicate Address Detection.

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Michael Wu <flamingice@sourmilk.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix TCP initial sequence number selection.
Eric Dumazet [Wed, 10 Oct 2007 10:28:33 +0000]
Fix TCP initial sequence number selection.

changeset 162f6690a65075b49f242d3c8cdb5caaa959a060 in mainline.

TCP V4 sequence numbers are 32bits, and RFC 793 assumed a 250 KHz clock.
In order to follow network speed increase, we can use a faster clock, but
we should limit this clock so that the delay between two rollovers is
greater than MSL (TCP Maximum Segment Lifetime : 2 minutes)

Choosing a 64 nsec clock should be OK, since the rollovers occur every
274 seconds.

Problem spotted by Denys Fedoryshchenko

[ This bug was introduced by f85958151900f9d30fa5ff941b0ce71eaa45a7de ]

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix TCP MD5 on big-endian.
David Miller [Wed, 10 Oct 2007 10:27:19 +0000]
Fix TCP MD5 on big-endian.

changeset f8ab18d2d987a59ccbf0495032b2aef05b730037 in mainline.

Based upon a report and initial patch by Peter Lieven.

tcp4_md5sig_key and tcp6_md5sig_key need to start with
the exact same members as tcp_md5sig_key.  Because they
are both cast to that type by tcp_v{4,6}_md5_do_lookup().

Unfortunately tcp{4,6}_md5sig_key use a u16 for the key
length instead of a u8, which is what tcp_md5sig_key
uses.  This just so happens to work by accident on
little-endian, but on big-endian it doesn't.

Instead of casting, just place tcp_md5sig_key as the first member of
the address-family specific structures, adjust the access sites, and
kill off the ugly casts.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix TCP's ->fastpath_cnt_hit handling.
Ilpo Järvinen [Wed, 10 Oct 2007 10:25:53 +0000]
Fix TCP's ->fastpath_cnt_hit handling.

changeset 48611c47d09023d9356e78550d1cadb8d61da9c8 in mainline.

When only GSO skb was partially ACKed, no hints are reset,
therefore fastpath_cnt_hint must be tweaked too or else it can
corrupt fackets_out. The corruption to occur, one must have
non-trivial ACK/SACK sequence, so this bug is not very often
that harmful. There's a fackets_out state reset in TCP because
fackets_out is known to be inaccurate and that fixes the issue
eventually anyway.

In case there was also at least one skb that got fully ACKed,
the fastpath_skb_hint is set to NULL which causes a recount for
fastpath_cnt_hint (the old value won't be accessed anymore),
thus it can safely be decremented without additional checking.

Reported by Cedric Le Goater <clg@fr.ibm.com>

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix sys_ipc() SEMCTL on sparc64.
David S. Miller [Wed, 10 Oct 2007 10:22:30 +0000]
Fix sys_ipc() SEMCTL on sparc64.

changeset 6536a6b331d3225921c398eb7c6e4ecedb9b05e0 from mainline

Thanks to Tom Callaway for the excellent bug report and
test case.

sys_ipc() has several problems, most to due with semaphore
call handling:

1) 'err' return should be a 'long'
2) "union semun" is passed in a register on 64-bit compared
   to 32-bit which provides it on the stack and therefore
   by reference
3) Second and third arguments to SEMCTL are swapped compared
   to 32-bit.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix zero length socket write() semantics.
David S. Miller [Wed, 10 Oct 2007 10:21:37 +0000]
Fix zero length socket write() semantics.

changeset e79ad711a0108475c1b3a03815527e7237020b08 from mainline.

This fixes kernel bugzilla #5731

It should generate an empty packet for datagram protocols when the
socket is connected, for one.

The check is doubly-wrong because all that a write() can be is a
sendmsg() call with a NULL msg_control and a single entry iovec.  No
special semantics should be assigned to it, therefore the zero length
check should be removed entirely.

This matches the behavior of BSD and several other systems.

Alan Cox notes that SuSv3 says the behavior of a zero length write on
non-files is "unspecified", but that's kind of useless since BSD has
defined this behavior for a quarter century and BSD is essentially
what application folks code to.

Based upon a patch from Stephen Hemminger.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix ROSE module unload oops.
Alexey Dobriyan [Wed, 10 Oct 2007 10:20:01 +0000]
Fix ROSE module unload oops.

changeset 891e6a931255238dddd08a7b306871240961a27f from mainline.

Commit a3d384029aa304f8f3f5355d35f0ae274454f7cd aka
"[AX.25]: Fix unchecked rose_add_loopback_neigh uses"
transformed rose_loopback_neigh var into statically allocated one.
However, on unload it will be kfree's which can't work.

Steps to reproduce:

modprobe rose
rmmod rose

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008
 printing eip:
c014c664
*pde = 00000000
Oops: 0000 [#1]
PREEMPT DEBUG_PAGEALLOC
Modules linked in: rose ax25 fan ufs loop usbhid rtc snd_intel8x0 snd_ac97_codec ehci_hcd ac97_bus uhci_hcd thermal usbcore button processor evdev sr_mod cdrom
CPU:    0
EIP:    0060:[<c014c664>]    Not tainted VLI
EFLAGS: 00210086   (2.6.23-rc9 #3)
EIP is at kfree+0x48/0xa1
eax: 00000556   ebx: c1734aa0   ecx: f6a5e000   edx: f7082000
esi: 00000000   edi: f9a55d20   ebp: 00200287   esp: f6a5ef28
ds: 007b   es: 007b   fs: 0000  gs: 0033  ss: 0068
Process rmmod (pid: 1823, ti=f6a5e000 task=f7082000 task.ti=f6a5e000)
Stack: f9a55d20 f9a5200c 00000000 00000000 00000000 f6a5e000 f9a5200c f9a55a00
       00000000 bf818cf0 f9a51f3f f9a55a00 00000000 c0132c60 65736f72 00000000
       f69f9630 f69f9528 c014244a f6a4e900 00200246 f7082000 c01025e6 00000000
Call Trace:
 [<f9a5200c>] rose_rt_free+0x1d/0x49 [rose]
 [<f9a5200c>] rose_rt_free+0x1d/0x49 [rose]
 [<f9a51f3f>] rose_exit+0x4c/0xd5 [rose]
 [<c0132c60>] sys_delete_module+0x15e/0x186
 [<c014244a>] remove_vma+0x40/0x45
 [<c01025e6>] sysenter_past_esp+0x8f/0x99
 [<c012bacf>] trace_hardirqs_on+0x118/0x13b
 [<c01025b6>] sysenter_past_esp+0x5f/0x99
 =======================
Code: 05 03 1d 80 db 5b c0 8b 03 25 00 40 02 00 3d 00 40 02 00 75 03 8b 5b 0c 8b 73 10 8b 44 24 18 89 44 24 04 9c 5d fa e8 77 df fd ff <8b> 56 08 89 f8 e8 84 f4 fd ff e8 bd 32 06 00 3b 5c 86 60 75 0f
EIP: [<c014c664>] kfree+0x48/0xa1 SS:ESP 0068:f6a5ef28

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix ipv6 redirect processing, leads to TAHI failures.
Brian Haley [Wed, 10 Oct 2007 10:19:06 +0000]
Fix ipv6 redirect processing, leads to TAHI failures.

changeset bf0b48dfc368c07c42b5a3a5658c8ee81b4283ac from mainline.

When the ICMPv6 Target address is multicast, Linux processes the
redirect instead of dropping it.  The problem is in this code in
ndisc_redirect_rcv():

         if (ipv6_addr_equal(dest, target)) {
                 on_link = 1;
         } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: target address is not
link-local.\n");
                 return;
         }

This second check will succeed if the Target address is, for example,
FF02::1 because it has link-local scope.  Instead, it should be checking
if it's a unicast link-local address, as stated in RFC 2461/4861 Section
8.1:

       - The ICMP Target Address is either a link-local address (when
         redirected to a router) or the same as the ICMP Destination
         Address (when redirected to the on-link destination).

I know this doesn't explicitly say unicast link-local address, but it's
implied.

This bug is preventing Linux kernels from achieving IPv6 Logo Phase II
certification because of a recent error that was found in the TAHI test
suite - Neighbor Disovery suite test 206 (v6LC.2.3.6_G) had the
multicast address in the Destination field instead of Target field, so
we were passing the test.  This won't be the case anymore.

The patch below fixes this problem, and also fixes ndisc_send_redirect()
to not send an invalid redirect with a multicast address in the Target
field.  I re-ran the TAHI Neighbor Discovery section to make sure Linux
passes all 245 tests now.

Signed-off-by: Brian Haley <brian.haley@hp.com>
Acked-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix some cases of missed IPV6 DAD
Mitsuru Chinen [Wed, 10 Oct 2007 10:16:26 +0000]
Fix some cases of missed IPV6 DAD

changeset 0fcace22d38ce9216f5ba52f929a99d284aa7e49 from mainline

To judge the timing for DAD, netif_carrier_ok() is used. However,
there is a possibility that dev->qdisc stays noop_qdisc even if
netif_carrier_ok() returns true. In that case, DAD NS is not sent out.
We need to defer the IPv6 device initialization until a valid qdisc
is specified.

Signed-off-by: Mitsuru Chinen <mitch@linux.vnet.ibm.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix ieee80211 handling of bogus hdrlength field
John W. Linville [Wed, 10 Oct 2007 10:12:57 +0000]
Fix ieee80211 handling of bogus hdrlength field

changeset 04045f98e0457aba7d4e6736f37eed189c48a5f7 from mainline

Reported by Chris Evans <scarybeasts@gmail.com>:

> The summary is that an evil 80211 frame can crash out a victim's
> machine. It only applies to drivers using the 80211 wireless code, and
> only then to certain drivers (and even then depends on a card's
> firmware not dropping a dubious packet). I must confess I'm not
> keeping track of Linux wireless support, and the different protocol
> stacks etc.
>
> Details are as follows:
>
> ieee80211_rx() does not explicitly check that "skb->len >= hdrlen".
> There are other skb->len checks, but not enough to prevent a subtle
> off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag
> set.
>
> This leads to integer underflow and crash here:
>
> if (frag != 0)
>    flen -= hdrlen;
>
> (flen is subsequently used as a memcpy length parameter).

How about this?

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix cls_u32 error return handling.
Stephen Hemminger [Wed, 10 Oct 2007 10:10:39 +0000]
Fix cls_u32 error return handling.

changeset bf1b803b01b00c3801e0aa373ba0305f8278e260 from mainline.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix ESP host instance numbering.
David Miller [Wed, 10 Oct 2007 10:09:12 +0000]
Fix ESP host instance numbering.

changeset ff4abd6cfacf0bb23a077f615d3a5cd17359db1b in mainline.

The ESP scsi driver does not initialize the host controller
instance early enough, so the messages in the log confuse
users.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoACPI: disable lower idle C-states across suspend/resume
Thomas Gleixner [Sat, 22 Sep 2007 22:29:05 +0000]
ACPI: disable lower idle C-states across suspend/resume

changeset b04e7bdb984e3b7f62fb7f44146a529f88cc7639 from mainline.

device_suspend() calls ACPI suspend functions, which seems to have undesired
side effects on lower idle C-states. It took me some time to realize that
especially the VAIO BIOSes (both Andrews jinxed UP and my elfstruck SMP one)
show this effect. I'm quite sure that other bug reports against suspend/resume
about turning the system into a brick have the same root cause.

After fishing in the dark for quite some time, I realized that removing the ACPI
processor module before suspend (this removes the lower C-state functionality)
made the problem disappear. Interestingly enough the propability of having a
bricked box is influenced by various factors (interrupts, size of the ram image,
...). Even adding a bunch of printks in the wrong places made the problem go
away. The previous periodic tick implementation simply pampered over the
problem, which explains why the dyntick / clockevents changes made this more
prominent.

We avoid complex functionality during the boot process and we have to do the
same during suspend/resume. It is a similar scenario and equaly fragile.

Add suspend / resume functions to the ACPI processor code and disable the lower
idle C-states across suspend/resume. Fall back to the default idle
implementation (halt) instead.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Len Brown <lenb@kernel.org>
Cc: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoClone sysctl templates harder
Alexey Dobriyan [Wed, 31 Oct 2007 16:55:37 +0000]
Clone sysctl templates harder

In 2.6.22 it's legal to have sysctl with empty ->ctl_name, but valid ->procname.
Such sysctl will be in /proc/sys only. However, cloning template containing
such sysctl wouldn't work to the end, only to the first such proc-only sysctl.

6 years agoUBC: fix compilation with CONFIG_BEANCOUNTERS=n
Alexey Dobriyan [Wed, 31 Oct 2007 16:31:59 +0000]
UBC: fix compilation with CONFIG_BEANCOUNTERS=n

There is no struct page::bc if beancounters are off, so make dummy page_ub()

6 years agoveth, venet: compile fix if CONFIG_NETFILTER=y, but CONFIG_NF_CONNTRACK=n
Vitaliy Gusev [Wed, 31 Oct 2007 15:36:58 +0000]
veth, venet: compile fix if CONFIG_NETFILTER=y, but CONFIG_NF_CONNTRACK=n

6 years agoNETFILTER: restore back net.ipv4.ip_conntrack_max
Alexey Dobriyan [Wed, 31 Oct 2007 14:43:11 +0000]
NETFILTER: restore back net.ipv4.ip_conntrack_max

CONFIG_NF_CONNTRACK_PROC_COMPAT option doesn't fully restore ip_conntrack
compat sysctls leaving net.ipv4.ip_connrack_max. vzt-iptables test goes
postal because of this.

6 years agoNETFILTER: conntrack #ifdef redux
Alexey Dobriyan [Mon, 29 Oct 2007 15:58:28 +0000]
NETFILTER: conntrack #ifdef redux

The number of sysctl-related ifdefs and not only is truly mind-blogging.
Use dummy static inlines instead.

6 years agoNETFILTER: Sanitise nf_ct_proto_ipv4_sysctl_init()
Alexey Dobriyan [Mon, 29 Oct 2007 15:56:13 +0000]
NETFILTER: Sanitise nf_ct_proto_ipv4_sysctl_init()

It does more thatn just sysctl initialization, so move generic part
into own function.

6 years agoNETFILTER: don't call nf_conntrack_init_ve/cleanup_ve twice
Alexey Dobriyan [Fri, 26 Oct 2007 15:33:35 +0000]
NETFILTER: don't call nf_conntrack_init_ve/cleanup_ve twice

After
modprobe nf_conntrack
modprobe nf_conntrack_ipv4

we get two sets of nf_conntrack sysctls. In general, it wrong for
nf_conntrack_ipv4 module initialize core conntrack data structures and
adding !initialized checks is ugly.

Call nf_conntrack_init_ve() from nf_conntrack only.
During VE creation, call both generic and specific functions.

6 years agoNETFILTER: use common init/exit codepaths in standalone conntrack
Alexey Dobriyan [Thu, 25 Oct 2007 13:47:41 +0000]
NETFILTER: use common init/exit codepaths in standalone conntrack

Maintaining almost duplicate __init/__exit functions
wrt CONFIG_VE_IPTABLES=y/n is pain. It's next to impossible to follow and keep
differences in head.

Preparations for correct standalone conntrack init in VE.

6 years agoNEFILTER: correct ve_nf_ct_log_invalid_proto_min/max variables in CONFIG_VE_IPTABLES...
Alexey Dobriyan [Thu, 25 Oct 2007 13:43:16 +0000]
NEFILTER: correct ve_nf_ct_log_invalid_proto_min/max variables in CONFIG_VE_IPTABLES=n case

There are no such things as nf_ct_log_invalid_proto_min/max. Use correct variables instead.

6 years agoCreate /proc/net/stat in VE0 only
Alexey Dobriyan [Mon, 22 Oct 2007 14:41:59 +0000]
Create /proc/net/stat in VE0 only

This is debatable, we most certainly wait per VE entry. Despite all attempts
/proc/net/stat doesn't appear in VE. For now, stick to .18/-rhel5 branch
behaviour (and cleaner code!).

6 years agoNETFILTER: Buy, buy ip_conntrack et al
Alexey Dobriyan [Mon, 22 Oct 2007 14:37:05 +0000]
NETFILTER: Buy, buy ip_conntrack et al

6 years agoNETFILTER: update do_ve_iptables() following mainline netfilter consolidation
Evgeny Kravtsunov [Mon, 22 Oct 2007 14:35:59 +0000]
NETFILTER: update do_ve_iptables() following mainline netfilter consolidation

6 years agoNETFILTER: ressurect NAT
Evgeny Kravtsunov [Mon, 22 Oct 2007 14:33:47 +0000]
NETFILTER: ressurect NAT

6 years agoNETFILTER: ressurect netfilter/ipv6
Evgeny Kravtsunov [Mon, 22 Oct 2007 14:31:20 +0000]
NETFILTER: ressurect netfilter/ipv6

6 years agoNETFILTER: ressurect netfilter/ipv4
Evgeny Kravtsunov [Mon, 22 Oct 2007 14:29:31 +0000]
NETFILTER: ressurect netfilter/ipv4

6 years agoNETFILTER: ressurect core netfilter
Evgeny Kravtsunov [Mon, 22 Oct 2007 14:27:40 +0000]
NETFILTER: ressurect core netfilter

6 years agoNETFILTER: remove less NAT bits during VE start
Alexey Dobriyan [Mon, 22 Oct 2007 14:25:39 +0000]
NETFILTER: remove less NAT bits during VE start

Otherwise iptables inside VE can't work because VE_IP_IPTABLES is cleaned too.

6 years agoNETFILTER: fix compilation with CONFIG_NETFILTER_DEBUG=y
Alexey Dobriyan [Mon, 22 Oct 2007 14:21:26 +0000]
NETFILTER: fix compilation with CONFIG_NETFILTER_DEBUG=y

6 years agoNETFILTER: add forgotten expect_list changes
Evgeny Kravtsunov [Mon, 15 Oct 2007 13:10:40 +0000]
NETFILTER: add forgotten expect_list changes

6 years agoLinux 2.6.22.10
Greg Kroah-Hartman [Wed, 10 Oct 2007 17:50:35 +0000]
Linux 2.6.22.10

6 years agoNLM: Fix a memory leak in nlmsvc_testlock
Trond Myklebust [Tue, 9 Oct 2007 14:55:45 +0000]
NLM: Fix a memory leak in nlmsvc_testlock

changeset a6d85430424d44e946e0946bfaad607115510989 in upstream

The recent fix for a circular lock dependency unfortunately introduced a
potential memory leak in the event where the call to nlmsvc_lookup_host
fails for some reason.

Thanks to Roel Kluin for spotting this.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

6 years agoi386: Use global flag to disable broken local apic timer on AMD CPUs.
Andi Kleen [Fri, 10 Aug 2007 20:31:07 +0000]
i386: Use global flag to disable broken local apic timer on AMD CPUs.

commit d3f7eae182b04997be19343a23f7009170f4f7a5 upstream

The Averatec 2370 and some other Turion laptop BIOS seems to program the
ENABLE_C1E MSR inconsistently between cores. This confuses the lapic
use heuristics because when C1E is enabled anywhere it seems to affect
the complete chip.

Use a global flag instead of a per cpu flag to handle this.
If any CPU has C1E enabled disabled lapic use.

Thanks to Cal Peake for debugging.

Cc: tglx@linutronix.de
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoSELinux: clear parent death signal on SID transitions
Stephen Smalley [Wed, 29 Aug 2007 12:51:50 +0000]
SELinux: clear parent death signal on SID transitions

commit 4ac212ad4e8fafc22fa147fc255ff5fa5435cf33 upstream.

Clear parent death signal on SID transitions to prevent unauthorized
signaling between SIDs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Eric Paris <eparis@parisplace.org>
Signed-off-by: James Morris <jmorris@localhost.localdomain>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix timer_stats printout of events/sec
Anton Blanchard [Sun, 7 Oct 2007 07:24:31 +0000]
Fix timer_stats printout of events/sec

commit 74922be1485818ed368c4cf4f0b100f70bf01e08 upstream.

When using /proc/timer_stats on ppc64 I noticed the events/sec field wasnt
accurate.  Sometimes the integer part was incorrect due to rounding (we
werent taking the fractional seconds into consideration).

The fraction part is also wrong, we need to pad the printf statement and
take the bottom three digits of 1000 times the value.

Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

6 years agoFix SMP poweroff hangs
Mark Lord [Mon, 1 Oct 2007 08:20:10 +0000]
Fix SMP poweroff hangs

commit 4047727e5ae33f9b8d2b7766d1994ea6e5ec2991 from upstream

We need to disable all CPUs other than the boot CPU (usually 0) before
attempting to power-off modern SMP machines.  This fixes the
hang-on-poweroff issue on my MythTV SMP box, and also on Thomas Gleixner's
new toybox.

Signed-off-by: Mark Lord <mlord@pobox.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoNLM: Fix a circular lock dependency in lockd
Trond Myklebust [Tue, 25 Sep 2007 19:56:00 +0000]
NLM: Fix a circular lock dependency in lockd

commit 255129d1e9ca0ed3d69d5517fae3e03d7ab4b806 in upstream.

The problem is that the garbage collector for the 'host' structures
nlm_gc_hosts(), holds nlm_host_mutex while calling down to
nlmsvc_mark_resources, which, eventually takes the file->f_mutex.

We cannot therefore call nlmsvc_lookup_host() from within
nlmsvc_create_block, since the caller will already hold file->f_mutex, so
the attempt to grab nlm_host_mutex may deadlock.

Fix the problem by calling nlmsvc_lookup_host() outside the file->f_mutex.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoi2c-algo-bit: Read block data bugfix
David Brownell [Thu, 27 Sep 2007 13:17:25 +0000]
i2c-algo-bit: Read block data bugfix

In Linus tree already:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=939bc4943d0483961edc45b63a7d27b4ffe547e3

This fixes a bug in the way i2c-algo-bit handles I2C_M_RECV_LEN,
used to implement i2c_smbus_read_block_data().  Previously, in the
absence of PEC (rarely used!) it would NAK the "length" byte:

S addr Rd [A] [length] NA

That prevents the subsequent data bytes from being read:

S addr Rd [A] [length] { A [data] }* NA

The primary fix just reorders two code blocks, so the length used
in the "should I NAK now?" check incorporates the data which it
just read from the slave device.

However, that move also highlighted other fault handling glitches.
This fixes those by abstracting the RX path ack/nak logic, so it
can be used in more than one location.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix ppp_mppe kernel stack usage.
Michal Schmidt [Fri, 28 Sep 2007 22:52:46 +0000]
Fix ppp_mppe kernel stack usage.

commit 45dfd5b5dd20f17fe23dafc5cfe921474d27f849 from upstream

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agolibata: update drive blacklists
Chuck Ebbert [Fri, 28 Sep 2007 19:29:32 +0000]
libata: update drive blacklists

Update the libata drive blacklists to the latest in 2.6.23-rc8.

Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agosky2: fix transmit state on resume
Stephen Hemminger [Fri, 28 Sep 2007 16:48:14 +0000]
sky2: fix transmit state on resume

Already upstream.

After resume, driver has reset the chip so the current state
of transmit checksum offload state machine and DMA state machine
will be undefined.

The fix is to set the state so that first Tx will set MSS and offset
values.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agosky2: fix VLAN receive processing
Stephen Hemminger [Fri, 28 Sep 2007 16:48:13 +0000]
sky2: fix VLAN receive processing

Already upstream.

The length check for truncated frames was not correctly handling
the case where VLAN acceleration had already read the tag.
Also, the Yukon EX has some features that use high bit of status
as security tag.

Signed-off-by: Pierre-Yves Ritschard <pyr@spootnik.org>
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agosky2: reduce impact of watchdog timer
Stephen Hemminger [Fri, 28 Sep 2007 16:48:12 +0000]
sky2: reduce impact of watchdog timer

This is the 2.6.22 version of a regression fix that is already
in 2.6.23.  Change the watchdog timer form 10 per second all the time,
to 1 per second and only if interface is up.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoscsi_transport_spi: fix domain validation failure from incorrect width setting
James Bottomley [Thu, 27 Sep 2007 22:51:57 +0000]
scsi_transport_spi: fix domain validation failure from incorrect width setting

commit 2302827c95fe0f441025acd5133e532d2eef322b from upstream

Domain Validation in the SPI transport class is failing on boxes with
damaged cables (and failing to the extent that the box hangs).  The
problem is that the first test it does is a cable integrity test for
wide transfers and if this fails, it turns the wide bit off.  The
problem is that the next set of tests it does turns wide back on
again, with the result that it runs through the entirety of DV with a
known bad setting and then hangs the system.

The attached patch fixes the problem by physically nailing the wide
setting to what it deduces it should be for the whole of Domain
Validation.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoNETFILTER: move ve_nf_conntrack_expect_list definition to nf_conntrack_expect.h
Evgeny Kravtsunov [Tue, 9 Oct 2007 13:36:26 +0000]
NETFILTER: move ve_nf_conntrack_expect_list definition to nf_conntrack_expect.h

Cosmetical. Somewhat more logically follow header split in mainline.

6 years agoNETFILTER: remove split helpers infrastructure
Evgeny Kravtsunov [Tue, 9 Oct 2007 13:25:30 +0000]
NETFILTER: remove split helpers infrastructure

Now that IRC and FTP helper hooks are gone, noone is using it.

6 years agoNETFILTER: remove split IRC hooks
Evgeny Kravtsunov [Tue, 9 Oct 2007 13:12:52 +0000]
NETFILTER: remove split IRC hooks

6 years agoNETFILTER: remove split FTP hooks
Evgeny Kravtsunov [Tue, 9 Oct 2007 13:10:16 +0000]
NETFILTER: remove split FTP hooks

Those FTP helpers are code, not data structures.

6 years agolinux-2.6.22-ovz004 released ovz004
OpenVZ team [Tue, 2 Oct 2007 12:38:41 +0000]
linux-2.6.22-ovz004 released

6 years agoVE: remove set_user() leftovers during VE entering/creation
Alexey Dobriyan [Thu, 27 Sep 2007 14:43:02 +0000]
VE: remove set_user() leftovers during VE entering/creation

USERNS code handles namespace creation now.

6 years agoVZDQ: remove long unused ->quota_header, ->quota_table from ve_struct
Alexey Dobriyan [Thu, 27 Sep 2007 11:36:05 +0000]
VZDQ: remove long unused ->quota_header, ->quota_table from ve_struct

6 years agoMerge 2.6.22.7, 2.6.22.8, 2.6.22.9
Alexey Dobriyan [Thu, 27 Sep 2007 07:32:51 +0000]
Merge 2.6.22.7, 2.6.22.8, 2.6.22.9

6 years agoLinux 2.6.22.9
Greg Kroah-Hartman [Wed, 26 Sep 2007 18:03:01 +0000]
Linux 2.6.22.9

6 years agobcm43xx: Fix cancellation of work queue crashes
Larry Finger [Sat, 22 Sep 2007 00:20:01 +0000]
bcm43xx: Fix cancellation of work queue crashes

port of 3f7086978fc0193eff24a77d8b57ac4debc088fa from mainline.

A crash upon booting that is caused by bcm43xx has been reported [1] and
found to be due to a work queue being reinitialized while work on that
queue is still pending. This fix modifies the shutdown of work queues and
prevents periodic work from being requeued during shutdown. With this patch,
no more crashes on reboot were observed by the original reporter. I do not
get that particular failure on my system; however, when running a large
number of ifdown/ifup sequences, my system would kernel panic with the
'caps lock' light blinking at roughly a 1 Hz rate. In addition, there were
infrequent failures in the firmware that resulted in 'IRQ READY TIMEOUT'
errors. With this patch, no more of the first type of failure occur, and
incidence of the second type is greatly reduced.

[1] http://bugzilla.kernel.org/show_bug.cgi?id=8937

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Acked-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix sparc64 v100 platform booting.
David Miller [Thu, 20 Sep 2007 19:34:02 +0000]
Fix sparc64 v100 platform booting.

commit 2cc7345ff71b27b5ac99e49ad7de39360042f601 in mainline

Subject: [PATCH] [SPARC64]: Fix booting on V100 systems.

On the root PCI bus, the OBP device tree lists device 3 twice.
Once as 'pm' and once as 'lomp'.

Everything goes downhill from there.

Ignore the second instance to workaround this.

Thanks to Kövedi_Krisztián for the bug report and
testing the fix.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix pktgen src_mac handling.
Adit Ranadive [Thu, 20 Sep 2007 19:40:03 +0000]
Fix pktgen src_mac handling.

commit ce5d0b47f13f83dfb9fbb8ac91adad7120747aaf in mainline

Subject: [PATCH] [PKTGEN]: srcmac fix

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

6 years agoFix datagram recvmsg NULL iov handling regression.
Herbert Xu [Thu, 20 Sep 2007 19:41:36 +0000]
Fix datagram recvmsg NULL iov handling regression.

commit ef8aef55ce61fd0e2af798695f7386ac756ae1e7 in mainline

Subject: [PATCH] [NET]: Do not dereference iov if length is zero

When msg_iovlen is zero we shouldn't try to dereference
msg_iov.  Right now the only thing that tries to do so
is skb_copy_and_csum_datagram_iovec.  Since the total
length should also be zero if msg_iovlen is zero, it's
sufficient to check the total length there and simply
return if it's zero.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix TCP DSACK cwnd handling
Ilpo Järvinen [Thu, 20 Sep 2007 20:11:07 +0000]
Fix TCP DSACK cwnd handling

commit 49ff4bb4cd4c04acf8f9e3d3ec2148305a1db445 in mainline.

[TCP]: DSACK signals data receival, be conservative

In case a DSACK is received, it's better to lower cwnd as it's
a sign of data receival.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoHandle snd_una in tcp_cwnd_down()
Ilpo Järvinen [Thu, 20 Sep 2007 20:10:25 +0000]
Handle snd_una in tcp_cwnd_down()

commit 6ee8009e38006da81d2a53da1aaa27365552553e in mainline

Subject: [PATCH 1/1] [TCP]: Also handle snd_una changes in tcp_cwnd_down

tcp_cwnd_down must check for it too as it should be conservative
in case of collapse stuff and also when receiver is trying to
lie (though it wouldn't be successful anyway).

Note:
- Separated also is_dupack and do_lost in fast_retransalert
* Much cleaner look-and-feel now
* This time it really fixes cumulative ACK + many new
  SACK blocks recovery entry (I claimed this fixes with
  last patch but it wasn't). TCP will now call
  tcp_update_scoreboard regardless of is_dupack when
  in recovery as long as there is enough fackets_out.
- Introduce FLAG_SND_UNA_ADVANCED
* Some prior_snd_una arguments are unnecessary after it
- Added helper FLAG_ANY_PROGRESS to avoid long FLAG...|FLAG...
  constructs

This is a reduced version of a mainline patch.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix tc_ematch kbuild
Stephen Hemminger [Thu, 20 Sep 2007 20:04:12 +0000]
Fix tc_ematch kbuild

commit 09d74cdd88a59a18f2ad7cfa0b6045ed1817b632 in mainline.

Subject: [PATCH] [KBUILD]: Sanitize tc_ematch headers.

The headers in tc_ematch are used by iproute2, so these headers should
be processed.

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

6 years agoFix oops in vlan and bridging code
Evgeniy Polyakov [Thu, 20 Sep 2007 20:02:32 +0000]
Fix oops in vlan and bridging code

commit 8c7b43a2e58baa24002fa2b266d9a5007bc52a40 in mainline

I tried to preserve bridging code as it was before, but logic is quite
strange - I think we should free skb on error, since it is already
unshared and thus will just leak.

Herbert Xu states:

> + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
> + goto out;

If this happens it'll be a double-free on skb since we'll
return NF_DROP which makes the caller free it too.

We could return NF_STOLEN to prevent that but I'm not sure
whether that's correct netfilter semantics.  Patrick, could
you please make a call on this?

Patrick McHardy states:

NF_STOLEN should work fine here.

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>