summaryrefslogtreecommitdiffstats
path: root/drivers/net/ioc3-eth.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2009-01-30gianfar: Fix Wake-on-LAN supportAnton Vorontsov1-0/+2
commit 0f0ca340e57bd7446855fefd07a64249acf81223 ("phy: power management support") caused a regression in the gianfar driver. Now phylib turns off PHY power during suspend, and thus WOL doesn't work anymore. This patch workarounds the issue by enabling wakeup in the MDIO device, i.e. just restores the old behaviour for the gianfar driver. Note that this way all PHYs on a given MDIO bus won't be turned off during suspend, which isn't good from the power saving point of view. A proper, per netdevice wakeup management support will need a bit reworked phylib suspend/resume logic. Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30smsc911x: timeout reaches -1Roel Kluin1-1/+1
With a postfix decrement the timeout will reach -1 rather than 0, so the warning will not be issued. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30smsc9420: fix interrupt signalling test failuresSteve Glendinning1-2/+1
smsc9420 performs an interrupt signalling test when the interface is brought up. The current code mistakenly sets its test flag to false AFTER enabling the software interrupt source, making failure quite likely. This patch changes the code to set the test flag BEFORE enabling interrupts. I've also removed an smp_wmb because the following spinlock provides an implicit memory barrier. Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30ucc_geth: Change uec phy id to the same format as gianfar'sHaiying Wang4-3/+32
The commit b31a1d8b41513b96e9c7ec2f68c5734cef0b26a4 ("gianfar: Convert gianfar to an of_platform_driver") changes the gianfar's phy id to the format like "mdio@xxxx:xx", but uec still uses the old format like "xxxxxxxx:xx". For the board whose UEC uses gianfar-mdio like MPC8568MDS, the phy can not be attached because of the incompatible phy id format. This patch changes uec's phy id to the same format as gianfar's. Signed-off-by: Haiying Wang <Haiying.Wang@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30wimax: fix build issue when debugfs is disabledInaky Perez-Gonzalez4-25/+29
As reported by Toralf Förster and Randy Dunlap. - http://linuxwimax.org/pipermail/wimax/2009-January/000460.html - http://lkml.org/lkml/2009/1/29/279 The definitions needed for the wimax stack and i2400m driver debug infrastructure was, by mistake, compiled depending on CONFIG_DEBUG_FS (by them being placed in the debugfs.c files); thus the build broke in 2.6.29-rc3 when debugging was enabled (CONFIG_WIMAX_DEBUG) and DEBUG_FS was disabled. These definitions are always needed if debug is enabled at compile time (independently of DEBUG_FS being or not enabled), so moving them to a file that is always compiled fixes the issue. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30netxen: fix memory leak in drivers/net/netxen_nic_init.cDaniel Marjamäki1-1/+3
For kernel bugzilla #12537: http://bugzilla.kernel.org/show_bug.cgi?id=12537 Free memory. Signed-off-by: Daniel Marjamäki <danielm77@spray.se> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30tun: Add some missing TUN compat ioctl translations.David S. Miller1-0/+7
Based upon a report from Michael Tokarev <mjt@tls.msk.ru>: Just saw in dmesg: ioctl32(kvm:4408): Unknown cmd fd(9) cmd(800454cf){t:'T';sz:4} arg(ffc668e4) on /dev/net/tun Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30ipv4: fix infinite retry loop in IP-ConfigBenjamin Zores1-3/+3
Signed-off-by: Benjamin Zores <benjamin.zores@alcatel-lucent.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30net: update documentation ip aliasesStephen Hemminger1-19/+6
This documentation is old. Add a short note to describe why aliases are no long necessary, and remove the old contact/edit info. Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30net: Fix OOPS in skb_seq_read().Shyam Iyer1-5/+5
It oopsd for me in skb_seq_read. addr2line said it was linux-2.6/net/core/skbuff.c:2228, which is this line: while (st->frag_idx < skb_shinfo(st->cur_skb)->nr_frags) { I added some printks in there and it looks like we hit this: } else if (st->root_skb == st->cur_skb && skb_shinfo(st->root_skb)->frag_list) { st->cur_skb = skb_shinfo(st->root_skb)->frag_list; st->frag_idx = 0; goto next_skb; } Actually I did some testing and added a few printks and found that the st->cur_skb->data was 0 and hence the ptr used by iscsi_tcp was null. This caused the kernel panic. if (abs_offset < block_limit) { - *data = st->cur_skb->data + abs_offset; + *data = st->cur_skb->data + (abs_offset - st->stepped_offset); I enabled the debug_tcp and with a few printks found that the code did not go to the next_skb label and could find that the sequence being followed was this - It hit this if condition - if (st->cur_skb->next) { st->cur_skb = st->cur_skb->next; st->frag_idx = 0; goto next_skb; And so, now the st pointer is shifted to the next skb whereas actually it should have hit the second else if first since the data is in the frag_list. else if (st->root_skb == st->cur_skb && skb_shinfo(st->root_skb)->frag_list) { st->cur_skb = skb_shinfo(st->root_skb)->frag_list; goto next_skb; } Reversing the two conditions the attached patch fixes the issue for me on top of Herbert's patches. Signed-off-by: Shyam Iyer <shyam_iyer@dell.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30net: Fix frag_list handling in skb_seq_readHerbert Xu1-2/+3
The frag_list handling was broken in skb_seq_read: 1) We didn't add the stepped offset when looking at the head are of fragments other than the first. 2) We didn't take the stepped offset away when setting the data pointer in the head area. 3) The frag index wasn't reset. This patch fixes both issues. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-30netxen: revert jumbo ringsizeDhananjay Phadke1-1/+1
Reducing jumbo ring size below 1024 reduces throughput for old firmwares (3.4.216 and older) running on older (NX2031) chip, so restore it back to 1024. This was reduced in commit 32ec803348b4d5f1353e1d7feae30880b8b3e342 ("netxen: reduce memory footprint"). Raising jumbo ring size from 512 to 1024, adds ~4MB per port, but there's still big saving because of original patch (~20MB per port). Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-29ath5k: fix locking in ath5k_configBob Copeland1-1/+9
ath5k_config updates the software context without taking sc->lock. Changes-licensed-under: 3-Clause-BSD Signed-off-by: Bob Copeland <me@bobcopeland.com> Acked-by: Nick Kossifidis <mickflemm@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29cfg80211: print correct intersected regulatory domainLuis R. Rodriguez1-1/+1
When CONFIG_CFG80211_REG_DEBUG is enabled and an intersection occurs we are printing the regulatory domain passed by CRDA and indicating its the intersected regulatory domain. Lets fix this and print the intersection as originally intended. Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29cfg80211: Fix sanity check on 5 GHz when processing country IELuis R. Rodriguez1-11/+19
This fixes two issues with the sanity check loop when processing the country IE: 1. Do not use frequency for the current subband channel check, this was a big fat typo. 2. Apply the 5 GHz 4-channel steps when considering max channel on each subband as was done with a recent patch. Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29iwlwifi: fix kernel oops when ucode DMA memory allocation failureZhu, Yi1-0/+4
The patch fixes memcpy to NULL address when the ucode DMA allocation failure. This is a fix to bug http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1861 Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29rtl8187: Fix error in setting OFDM power settings for RTL8187LLarry Finger1-2/+8
After reports of poor performance, a review of the latest vendor driver (rtl8187_linux_26.1025.0328.2007) for RTL8187L devices was undertaken. A difference was found in the code used to index the OFDM power tables. When the Linux driver was changed, my unit works at a much greater range than before. I think this fixes Bugzilla #12380 and has been tested by at least two other users. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Tested-by: Martín Ernesto Barreyro <barreyromartin@gmail.com> Cc: Stable <stable@kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-29mac80211: remove Michael Wu as maintainerJohannes Berg1-2/+0
His email address keeps bouncing, and he's not interested in mac80211 patches etc. anyway. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-28ipv6: Make mc_forwarding sysctl read-only.David S. Miller1-1/+1
The kernel manages this value internally, as necessary, as VIFs are added/removed and as multicast routers are registered and deregistered. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-28IPv6: Fix multicast routing bugs.Thomas Goff3-7/+20
This patch addresses the IPv6 multicast routing issues described below. It was tested with XORP 1.4/1.5 as the IPv6 PIM-SM routing daemon against FreeBSD peers. net/ipv6/ip6_input.c: - Don't try to forward link-local multicast packets. - Don't reset skb2->dev before calling ip6_mr_input() so packets can be identified as coming from the PIM register vif properly. net/ipv6/ip6mr.c: - Fix incoming PIM register messages processing: * The IPv6 pseudo-header should be included when checksumming PIM messages (RFC 4601 section 4.9; RFC 3973 section 4.7.1). * Packets decapsulated from PIM register messages should have skb->protocol ETH_P_IPV6. - Enable/disable IPv6 multicast forwarding on the corresponding interface when a routing daemon adds/removes a multicast virtual interface. - Remove incorrect skb_pull() to fix userspace signaling. - Enable/disable global IPv6 multicast forwarding when an IPv6 multicast routing socket is opened/closed. net/ipv6/route.c: - Don't use strict routing logic for packets decapsulated from PIM register messages (similar to disabling rp_filter for the IPv4 case). Signed-off-by: Thomas Goff <thomas.goff@boeing.com> Reviewed-by: Fred Templin <fred.l.templin@boeing.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-28net: fix xfrm reverse flow lookup for icmp6Jiri Pirko1-2/+2
This patch fixes the xfrm reverse flow lookup for icmp6 so that icmp6 packets don't get lost over ipsec tunnels. Similar patch is in RHEL5 kernel for a quite long time and I do not see why it isn't in mainline. Signed-off-by: Jiri Pirko <jpirko@redhat.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-28net: wrong test in inet_ehash_locks_alloc()Eric Dumazet1-1/+1
In commit 9db66bdcc83749affe61c61eb8ff3cf08f42afec (net: convert TCP/DCCP ehash rwlocks to spinlocks), I forgot to change one occurrence of rwlock_t to spinlock_t I believe sizeof(raw_spinlock_t) might be > 0 on !CONFIG_SMP if CONFIG_DEBUG_SPINLOCK while sizeof(raw_rwlock_t) should be 0 in this case. Fortunatly, CONFIG_DEBUG_SPINLOCK adds fields to both spinlock_t and rwlock_t, but at this might change in the future (being able to debug spinlocks but not rwlocks for example), better to be safe. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-28e1000: fix bug with shared interrupt during resetJesse Brandeburg1-2/+2
A nasty bug was found where an MTU change (or anything else that caused a reset) could race with the interrupt code. The interrupt code was entered by a shared interrupt during the MTU change. This change prevents the interrupt code from running while the driver is in the middle of its reset path. Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-27tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits.Dimitris Michailidis1-1/+2
tcp_splice_data_recv has two lengths to consider: the len parameter it gets from tcp_read_sock, which specifies the amount of data in the skb, and rd_desc->count, which is the amount of data the splice caller still wants. Currently it passes just the latter to skb_splice_bits, which then splices min(rd_desc->count, skb->len - offset) bytes. Most of the time this is fine, except when the skb contains urgent data. In that case len goes only up to the urgent byte and is less than skb->len - offset. By ignoring len tcp_splice_data_recv may a) splice data tcp_read_sock told it not to, b) return to tcp_read_sock a value > len. Now, tcp_read_sock doesn't handle used > len and leaves the socket in a bad state (both sk_receive_queue and copied_seq are bad at that point) resulting in duplicated data and corruption. Fix by passing min(rd_desc->count, len) to skb_splice_bits. Signed-off-by: Dimitris Michailidis <dm@chelsio.com> Acked-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-27r6040: Remove unused variable pdev from drivers/net/r6040.cManish Katiyar1-1/+0
drivers/net/r6040.c:441: warning: unused variable 'pdev' Signed-off-by: Manish Katiyar <mkatiyar@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-27udp: optimize bind(0) if many ports are in useEric Dumazet1-16/+39
commit 9088c5609584684149f3fb5b065aa7f18dcb03ff (udp: Improve port randomization) introduced a regression for UDP bind() syscall to null port (getting a random port) in case lot of ports are already in use. This is because we do about 28000 scans of very long chains (220 sockets per chain), with many spin_lock_bh()/spin_unlock_bh() calls. Fix this using a bitmap (64 bytes for current value of UDP_HTABLE_SIZE) so that we scan chains at most once. Instead of 250 ms per bind() call, we get after patch a time of 2.9 ms Based on a report from Vitaly Mayatskikh Reported-by: Vitaly Mayatskikh <v.mayatskih@gmail.com> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Tested-by: Vitaly Mayatskikh <v.mayatskih@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-27virtio_net: use correct accessors for scatterlistsIra W. Snyder1-3/+3
Without this fix, virtio_net makes incorrect usage of scatterlists. It sets the end of the scatterlist chain after the first element, despite the fact that more entries come after it. If you try to run dma_map_sg() on one of the scatterlists given to you by add_buf(), you will get a null pointer oops. Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26gianfar: Revive VLAN supportAnton Vorontsov1-5/+1
commit 77ecaf2d5a8bfd548eed3f05c1c2e6573d5de4ba ("gianfar: Fix VLAN HW feature related frame/buffer size calculation") wrongly removed priv->vlgrp assignment, and now priv->vlgrp is always NULL. This patch fixes the issue, plus fixes following sparse warning introduced by the same commit: gianfar.c:1406:13: warning: context imbalance in 'gfar_vlan_rx_register' - wrong count at exit gfar_vlan_rx_register() checks for "if (old_grp == grp)" and tries to return w/o dropping the lock. According to net/8021q/vlan.c VLAN core issues rx_register() callback: 1. In register_vlan_dev() only on a newly created group; 2. In unregister_vlan_dev() only if the group becomes empty. Thus the check in the gianfar driver isn't needed. Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Acked-by: Andy Fleming <afleming@freescale.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26vlan: Export symbols as non GPL symbols.Ben Greear1-2/+2
In previous kernels, any kernel module could get access to the 'real-device' and the VLAN-ID for a particular VLAN. In more recent kernels, the code was restructured such that this is hard to do without accessing private .h files for any module that cannot use GPL-only symbols. Attached is a patch to once again allow non-GPL modules the ability to access the real-device and VLAN id for VLANs. Signed-off-by: Ben Greear <greearb@candelatech.com> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26bnx2x: tx_has_work should not wait for FWVladislav Zolotarov1-5/+12
The current tx_has_work waited until all packets sent by the driver are marked as completed by the FW. This is too greedy and it causes the bnx2x_poll to spin in vain. The driver should only check that all packets FW already completed are freed - only in unload flow the driver should make sure that transmit queue is empty Signed-off-by: Vladislav Zolotarov <vladz@broadcom.com> Signed-off-by: Eilon Greenstein <eilong@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26netxen: reduce memory footprintDhananjay Phadke2-7/+10
o reduce rx ring size from 8192 to 4096. o cut down old huge lro buffers. Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26netxen: fix vlan tso/checksum offloadDhananjay Phadke1-11/+20
o set netdev->vlan_features appropriately. o fix tso descriptor initialization for vlan case. Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26net: Fix linux/if_frad.h's suitability for userspace.Krzysztof Hałasa1-6/+4
The userspace interfaces are protected by CONFIG_* ifdefs and that of course can't work. Reported by Jaswinder Singh Rajput. Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26net: Move config NET_NS to from net/Kconfig to init/KconfigMatt Helsley2-8/+8
Make NET_NS available underneath the generic Namespaces config option since all of the other namespace options are there. Signed-off-by: Matt Helsley <matthltc@us.ibm.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26isdn: Fix missing ifdef in isdn_pppDaniele Venzano1-0/+2
The following patch fixes a warning caused by a missing ifdef in isdn_ppp.c. A function was defined, but never used if CONFIG_IPPP_FILTER was not defined. The warning was: 'get_filter' defined but not used Patch is against 2.6.28.1 Signed-off-by: Daniele Venzano <venza@brownhat.org> Acked-by: Karsten Keil <kkeil@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26i2c: Warn on deprecated binding model useJean Delvare1-3/+5
Let the kernel developers know that i2c_attach_client() and i2c_detach_client() are deprecated and should no longer be used. Drivers using these should be converted to the standard device driver binding model (probe and remove methods.) Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Ben Dooks <ben-linux@fluff.org>
2009-01-26eeprom: More consistent symbol namesJean Delvare176-326/+326
Now that all EEPROM drivers live in the same place, let's harmonize their symbol names. Also fix eeprom's dependencies, it definitely needs sysfs, and is no longer experimental after many years in the kernel tree. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Wolfram Sang <w.sang@pengutronix.de> Cc: David Brownell <dbrownell@users.sourceforge.net>
2009-01-26eeprom: Move 93cx6 eeprom driver to /drivers/misc/eepromWolfram Sang5-9/+9
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26spi: Move at25 (for SPI eeproms) to /drivers/misc/eepromWolfram Sang5-12/+12
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26i2c: Move old eeprom driver to /drivers/misc/eepromWolfram Sang5-12/+12
Update Kconfig text to specify this driver as I2C. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26i2c: Move at24 to drivers/misc/eepromWolfram Sang7-27/+32
As drivers/i2c/chips is going to go away, move the driver to drivers/misc/eeprom. Other eeprom drivers may be moved here later, too. Update Kconfig text to specify this driver as I2C. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26i2c: Quilt tree has movedJean Delvare1-1/+2
My i2c quilt tree will now be hosted on kernel.org, because I can conveniently use rsync there. Also list the new i2c wiki. Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26i2c: Delete many unused adapter IDsJean Delvare38-93/+0
Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26i2c: Delete 10 unused driver IDsJean Delvare1-10/+0
Signed-off-by: Jean Delvare <khali@linux-fr.org>
2009-01-26networking: document "nc" in addition to "netcat" in netconsole.txtJesse Barnes1-1/+2
It always annoyed me that the netconsole documentation didn't give me the correct command for my distro. Update it with a command line that actually works on my Fedora install. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Matt Mackall <mpm@selenic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26e1000e: workaround hw errataJesse Brandeburg2-1/+6
There is a hardware errata in some revisions of the 82574 that needs to be worked around in the driver by setting a register bit at init. If this bit is not set A0 versions of the 82574 can generate tx hangs. Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-01-26m68k{nommu}: fixups after the header moveHarvey Harrison4-17/+11
swab.h seems to have been missed during the header merge. Add conditionals similar to byteorder.h and remove the now unnecessary byteorder_no/mm.h Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-26inotify: clean up inotify_read and fix locking problemsVegard Nossum1-61/+74
If userspace supplies an invalid pointer to a read() of an inotify instance, the inotify device's event list mutex is unlocked twice. This causes an unbalance which effectively leaves the data structure unprotected, and we can trigger oopses by accessing the inotify instance from different tasks concurrently. The best fix (contributed largely by Linus) is a total rewrite of the function in question: On Thu, Jan 22, 2009 at 7:05 AM, Linus Torvalds wrote: > The thing to notice is that: > > - locking is done in just one place, and there is no question about it > not having an unlock. > > - that whole double-while(1)-loop thing is gone. > > - use multiple functions to make nesting and error handling sane > > - do error testing after doing the things you always need to do, ie do > this: > > mutex_lock(..) > ret = function_call(); > mutex_unlock(..) > > .. test ret here .. > > instead of doing conditional exits with unlocking or freeing. > > So if the code is written in this way, it may still be buggy, but at least > it's not buggy because of subtle "forgot to unlock" or "forgot to free" > issues. > > This _always_ unlocks if it locked, and it always frees if it got a > non-error kevent. Cc: John McCutchan <ttb@tentacle.dhs.org> Cc: Robert Love <rlove@google.com> Cc: <stable@kernel.org> Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-26Fix annoying DRM_ERROR() string warningLinus Torvalds1-1/+1
Use '%zu' to print out a size_t variable, not '%d'. Another case of the "let's keep at least Linus' defconfig compile warningless" rule. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-01-26fuse: fix poll notifyMiklos Szeredi1-4/+9
Move fuse_copy_finish() to before calling fuse_notify_poll_wakeup(). This is not a big issue because fuse_notify_poll_wakeup() should be atomic, but it's cleaner this way, and later uses of notification will need to be able to finish the copying before performing some actions. Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>