11 years agoLinux
Adrian Bunk [Fri, 25 Aug 2006 20:51:14 +0000 (22:51 +0200)]

11 years agoLinux
Adrian Bunk [Wed, 23 Aug 2006 17:29:05 +0000 (19:29 +0200)]

11 years ago1394: fix for recently added firewire patch that breaks things on ppc
Danny Tholen [Wed, 23 Aug 2006 17:28:41 +0000 (19:28 +0200)]
1394: fix for recently added firewire patch that breaks things on ppc

Recently a patch was added for preliminary suspend/resume handling on
!PPC_PMAC.  However, this broke both suspend and firewire on powerpc
because it saves the pci state after the device has already been disabled.

This moves the save state to before the pmac specific code.

Signed-off-by: Danny Tholen <>
Acked-by: Benjamin Herrenschmidt <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Stefan Richter <>
Signed-off-by: Adrian Bunk <>
11 years agoFix sctp privilege elevation (CVE-2006-3745)
Sridhar Samudrala [Wed, 23 Aug 2006 16:01:55 +0000 (18:01 +0200)]
Fix sctp privilege elevation (CVE-2006-3745)

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.

Signed-off-by: Sridhar Samudrala <>
Acked-by: David Miller <>
Signed-off-by: Adrian Bunk <>
11 years agoFix possible UDF deadlock and memory corruption (CVE-2006-4145)
Jan Kara [Wed, 23 Aug 2006 16:00:30 +0000 (18:00 +0200)]
Fix possible UDF deadlock and memory corruption (CVE-2006-4145)

UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.

Signed-off-by: Jan Kara <>
Signed-off-by: Adrian Bunk <>
11 years agoLinux
Adrian Bunk [Tue, 22 Aug 2006 15:48:30 +0000 (17:48 +0200)]

12 years agopowerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)
Olof Johansson [Fri, 18 Aug 2006 19:44:57 +0000 (21:44 +0200)]
powerpc: Clear HID0 attention enable on PPC970 at boot time (CVE-2006-4093)

Clear HID0[en_attn] at CPU init time on PPC970.  Closes CVE-2006-4093.

Signed-off-by: Olof Johansson <>
Signed-off-by: Paul Mackerras <>
Signed-off-by: Adrian Bunk <>
12 years agocdrom: fix bad cgc.buflen assignment (CVE-2006-2935)
Jens Axboe [Fri, 18 Aug 2006 19:42:43 +0000 (21:42 +0200)]
cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)

The code really means to mask off the high bits, not assign 0xff.

Reported by Marcus Meissner <>.

Signed-off-by: Jens Axboe <>
Signed-off-by: Adrian Bunk <>
12 years agoide-io: increase timeout value to allow for slave wakeup
Al Boldi [Fri, 18 Aug 2006 19:30:53 +0000 (21:30 +0200)]
ide-io: increase timeout value to allow for slave wakeup

During an STR resume cycle, the ide master disk times-out when there is
also a slave present (especially CD).  Increasing the timeout in ide-io
from 10,000 to 100,000 fixes this problem.

Acked-by: Alan Cox <>
Signed-off-by: Adrian Bunk <>
12 years agoSPARC64: Fix quad-float multiply emulation.
David S. Miller [Fri, 18 Aug 2006 19:28:03 +0000 (21:28 +0200)]
SPARC64: Fix quad-float multiply emulation.

Something is wrong with the 3-multiply (vs. 4-multiply) optimized
version of _FP_MUL_MEAT_2_*(), so just use the slower version
which actually computes correct values.

Noticed by Rene Rebe

Signed-off-by: David S. Miller <>
Signed-off-by: Adrian Bunk <>
12 years agoSPARC32: Fix iommu_flush_iotlb end address
Bob Breuer [Fri, 18 Aug 2006 19:26:56 +0000 (21:26 +0200)]
SPARC32: Fix iommu_flush_iotlb end address

Fix the calculation of the end address when flushing iotlb entries to
ram.  This bug has been a cause of esp dma errors, and it affects
HyperSPARC systems much worse than SuperSPARC systems.

Signed-off-by: Bob Breuer <>
Signed-off-by: David S. Miller <>
Acked-by: William Lee Irwin III <>
Signed-off-by: Adrian Bunk <>
12 years agoLinux
Adrian Bunk [Sat, 12 Aug 2006 17:00:06 +0000 (19:00 +0200)]

12 years agoupdate the i386 defconfig
Adrian Bunk [Sat, 12 Aug 2006 16:59:17 +0000 (18:59 +0200)]
update the i386 defconfig

The i386 defconfig wasn't updated for ages.

Instead of running "make oldconfig" on the old defconfig and trying to
give reasonable answers at all new options, this patch replaces it with
the one I'm using in 2.6.16-rc1.

This way, it's a .config that is confirmed to work on at least one
computer in the world.  ;-)

Signed-off-by: Adrian Bunk <>
12 years agoieee1394: sbp2: enable auto spin-up for Maxtor disks
Stefan Richter [Fri, 11 Aug 2006 21:42:30 +0000 (23:42 +0200)]
ieee1394: sbp2: enable auto spin-up for Maxtor disks

At least Maxtor OneTouch III require a "start stop unit" command after
auto spin-down before the next access can proceed.  This patch activates
the responsible code in scsi_mod for all Maxtor SBP-2 disks.

Maybe that should be done for all SBP-2 disks, but better be cautious.

Signed-off-by: Stefan Richter <>
Signed-off-by: Adrian Bunk <>
12 years agoFix broken suspend/resume in ohci1394
Robert Hancock [Fri, 11 Aug 2006 21:41:52 +0000 (23:41 +0200)]
Fix broken suspend/resume in ohci1394

I've been experimenting to track down the cause of suspend/resume problems
on my Compaq Presario X1050 laptop:

Essentially the ACPI Embedded Controller and keyboard controller would
get into a bizarre, confused state after resume.

I found that unloading the ohci1394 module before suspend and reloading it
after resume made the problem go away.  Diffing the dmesg output from
resume, with and without the module loaded, I found that with the module
loaded I was missing these:

PM: Writing back config space on device 0000:02:00.0 at offset 1. (Was 2100080, writing 2100007)
PM: Writing back config space on device 0000:02:00.0 at offset 3. (Was 0, writing 8008)
PM: Writing back config space on device 0000:02:00.0 at offset 4. (Was 0, writing 90200000)
PM: Writing back config space on device 0000:02:00.0 at offset 5. (Was 1, writing 2401)
PM: Writing back config space on device 0000:02:00.0 at offset f. (Was 20000100, writing 2000010a)

The default PCI driver performs the pci_restore_state when no driver is
loaded for the device.  When the ohci1394 driver is loaded, it is supposed
to do this, however it appears not to do so.

I created the patch below and tested it, and it appears to resolve the
suspend problems I was having with the module loaded.  I only added in the
pci_save_state and pci_restore_state - however, though I know little of
this hardware, surely the driver should really be doing more than this when
suspending and resuming?  Currently it does almost nothing, what if there
are commands in progress, etc?

Signed-off-by: Robert Hancock <>
Signed-off-by: Stefan Richter <>
Signed-off-by: Adrian Bunk <>
12 years agofix debugfs inode leak
Jens Axboe [Fri, 11 Aug 2006 20:43:42 +0000 (22:43 +0200)]
fix debugfs inode leak

Looking at the reiser4 crash, I found a leak in debugfs. In
debugfs_mknod(), we create the inode before checking if the dentry
already has one attached. We don't free it if that is the case.

Signed-off-by: Jens Axboe <>
Signed-off-by: Adrian Bunk <>
12 years agoFix missing ret assignment in __bio_map_user() error path
Jens Axboe [Fri, 11 Aug 2006 20:29:11 +0000 (22:29 +0200)]
Fix missing ret assignment in __bio_map_user() error path

If get_user_pages() returns less pages than what we asked for, we
jump to out_unmap which will return ERR_PTR(ret). But ret can contain
a positive number just smaller than local_nr_pages, so be sure to set
it to -EFAULT always.

Problem found and diagnosed by Damien Le Moal <>

Signed-off-by: Jens Axboe <>
Signed-off-by: Adrian Bunk <>
12 years ago[AGPGART] Fix Nforce3 suspend on amd64.
Dave Jones [Wed, 9 Aug 2006 22:03:27 +0000 (00:03 +0200)]
[AGPGART] Fix Nforce3 suspend on amd64. bugzilla #6206

Based on patch from Serge Belyshev <>

Signed-off-by: Dave Jones <>
Signed-off-by: Adrian Bunk <>
12 years agoSOUND_SSCAPE shouldn't depend on OBSOLETE_OSS_DRIVER
Adrian Bunk [Wed, 9 Aug 2006 21:26:03 +0000 (23:26 +0200)]

Due to a regression in the correcponding ALSA driver (ALSA #2234), the
OSS driver should stay until it's fixed.

Signed-off-by: Adrian Bunk <>
12 years agoieee80211: TKIP requires CRC32
Chuck Ebbert [Tue, 8 Aug 2006 21:23:12 +0000 (23:23 +0200)]
ieee80211: TKIP requires CRC32

ieee80211_crypt_tkip will not work without CRC32.

  LD      .tmp_vmlinux1
net/built-in.o: In function `ieee80211_tkip_encrypt':
net/ieee80211/ieee80211_crypt_tkip.c:349: undefined reference to `crc32_le'

Reported by Toralf Foerster <>

Signed-off-by: Chuck Ebbert <>
Signed-off-by: Adrian Bunk <>
12 years agomemory hotplug: solve config broken: undefined reference to `online_page'
Yasunori Goto [Tue, 8 Aug 2006 15:35:33 +0000 (17:35 +0200)]
memory hotplug: solve config broken: undefined reference to `online_page'

Memory hotplug code of i386 adds memory to only highmem.  So, if
CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set.
Otherwise, it causes compile error.

In addition, many architecture can't use memory hotplug feature yet.  So, I

Signed-off-by: Yasunori Goto <>
Signed-off-by: Adrian Bunk <>
12 years agopdflush: handle resume wakeups
Pavel Machek [Tue, 8 Aug 2006 09:58:01 +0000 (11:58 +0200)]
pdflush: handle resume wakeups

2.6.16 needs this. It was merged into 2.6.18-rc1.

pdflush is carefully designed to ensure that all wakeups have some
corresponding work to do - if a woken-up pdflush thread discovers that
it hasn't been given any work to do then this is considered an error.

That all broke when swsusp came along - because a timer-delivered
wakeup to a frozen pdflush thread will just get lost.  This causes the
pdflush thread to get lost as well: the writeback timer is supposed to
be re-armed by pdflush in process context, but pdflush doesn't execute
the callout which does this.

Fix that up by ignoring the return value from try_to_freeze(): jsut
proceed, see if we have any work pending and only go back to sleep if
that is not the case.

Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Pavel Machek <>
Signed-off-by: Adrian Bunk <>
12 years agoBLOCK: Fix bounce limit address check
Andi Kleen [Mon, 7 Aug 2006 19:26:18 +0000 (21:26 +0200)]
BLOCK: Fix bounce limit address check

This fixes some OOMs on 64bit systems with <4GB of RAM when accessing
the cdrom.

Do a safer check for when to enable DMA. Currently we enable ISA DMA
for cases that do not need it, resulting in OOM conditions when ZONE_DMA
runs out of space.

Signed-off-by: Andi Kleen <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Adrian Bunk <>
12 years agoIB/mthca: restore missing PCI registers after reset
Michael S. Tsirkin [Mon, 7 Aug 2006 17:04:22 +0000 (19:04 +0200)]
IB/mthca: restore missing PCI registers after reset

mthca does not restore the following PCI-X/PCI Express registers after reset:
  PCI-X device: PCI-X command register
  PCI-X bridge: upstream and downstream split transaction registers
  PCI Express : PCI Express device control and link control registers

This causes instability and/or bad performance on systems where one of
these registers is set to a non-default value by BIOS.

Signed-off-by: Michael S. Tsirkin <>
Signed-off-by: Adrian Bunk <>
12 years agofix the SND_FM801_TEA575X dependencies
Adrian Bunk [Thu, 3 Aug 2006 19:58:11 +0000 (21:58 +0200)]
fix the SND_FM801_TEA575X dependencies

CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:

<--  snip  -->

  LD      vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1

<--  snip  -->

This patch fixes kernel Bugzilla #6458.

Signed-off-by: Adrian Bunk <>
12 years agoremove obsolete swsusp_encrypt
Pavel Machek [Thu, 3 Aug 2006 19:56:53 +0000 (21:56 +0200)]
remove obsolete swsusp_encrypt

Remove SWSUSP_ENCRYPT config option; it is no longer implemented.

Signed-off-by: Pavel Machek <>
Signed-off-by: Adrian Bunk <>
12 years agoLinux
Greg Kroah-Hartman [Mon, 17 Jul 2006 13:58:58 +0000 (06:58 -0700)]

12 years ago[PATCH] USB serial ftdi_sio: Prevent userspace DoS (CVE-2006-2936)
Ian Abbott [Mon, 26 Jun 2006 11:59:17 +0000 (12:59 +0100)]
[PATCH] USB serial ftdi_sio: Prevent userspace DoS (CVE-2006-2936)

This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.

Signed-off-by: Ian Abbott <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY
YOSHIFUJI Hideaki [Thu, 22 Jun 2006 08:42:13 +0000 (01:42 -0700)]
[PATCH] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY

We need to update hiscore.rule even if we don't enable CONFIG_IPV6_PRIVACY,
because we have more less significant rule; longest match.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] IPV6: Fix source address selection.
$,1 aukasz Stelmach [Thu, 22 Jun 2006 08:39:05 +0000 (01:39 -0700)]
[PATCH] IPV6: Fix source address selection.

Two additional labels (RFC 3484, sec. 10.3) for IPv6 addreses
are defined to make a distinction between global unicast
addresses and Unique Local Addresses (fc00::/7, RFC 4193) and
Teredo (2001::/32, RFC 4380). It is necessary to avoid attempts
of connection that would either fail (eg. fec0:: to 2001:feed::)
or be sub-optimal (2001:0:: to 2001:feed::).

Signed-off-by: \e$,1 aukasz Stelmach <>
Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoLinux
Greg Kroah-Hartman [Sat, 15 Jul 2006 19:45:58 +0000 (12:45 -0700)]

12 years ago[PATCH] Relax /proc fix a bit
Linus Torvalds [Sat, 15 Jul 2006 05:59:19 +0000 (05:59 +0000)]
[PATCH] Relax /proc fix a bit

Relax /proc fix a bit

Clearign all of i_mode was a bit draconian. We only really care about
S_ISUID/ISGID, after all.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoLinux
Greg Kroah-Hartman [Sat, 15 Jul 2006 02:33:41 +0000 (19:33 -0700)]

12 years ago[PATCH] Fix nasty /proc vulnerability (CVE-2006-3626)
Linus Torvalds [Fri, 14 Jul 2006 23:59:02 +0000 (23:59 +0000)]
[PATCH] Fix nasty /proc vulnerability (CVE-2006-3626)

Fix nasty /proc vulnerability

We have a bad interaction with both the kernel and user space being able
to change some of the /proc file status.  This fixes the most obvious
part of it, but I expect we'll also make it harder for users to modify
even their "own" files in /proc.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoLinux
Greg Kroah-Hartman [Thu, 6 Jul 2006 20:06:01 +0000 (13:06 -0700)]

12 years agofix prctl privilege escalation and suid_dumpable (CVE-2006-2451)
Greg Kroah-Hartman [Thu, 6 Jul 2006 20:05:42 +0000 (13:05 -0700)]
fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)

Based on a patch from Ernie Petrides

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.

Signed-off-by: Greg Kroah-Hartman <>
12 years agoLinux
Greg Kroah-Hartman [Fri, 30 Jun 2006 21:17:30 +0000 (14:17 -0700)]

12 years ago[PATCH] revert PARPORT_SERIAL should depend on SERIAL_8250_PCI patch
Chris Wright [Fri, 30 Jun 2006 21:06:52 +0000 (14:06 -0700)]
[PATCH] revert PARPORT_SERIAL should depend on SERIAL_8250_PCI patch

Should have not been applied to 2.6.16

Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks ...
Patrick McHardy [Fri, 30 Jun 2006 03:33:12 +0000 (05:33 +0200)]
[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall <>

Signed-off-by: Patrick McHardy <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoLinux
Chris Wright [Thu, 22 Jun 2006 19:16:21 +0000 (12:16 -0700)]

12 years ago[PATCH] NTFS: Critical bug fix (affects MIPS and possibly others)
Anton Altaparmakov [Tue, 20 Jun 2006 07:29:41 +0000 (00:29 -0700)]
[PATCH] NTFS: Critical bug fix (affects MIPS and possibly others)

It fixes a crash in NTFS on architectures where flush_dcache_page()
is a real function.  I never noticed this as all my testing is done on
i386 where flush_dcache_page() is NULL.

Many thanks to Pauline Ng for the detailed bug report and analysis!

Signed-off-by: Anton Altaparmakov <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] powernow-k8 crash workaround
Andrew Morton [Sat, 10 Jun 2006 18:59:23 +0000 (18:59 +0000)]
[PATCH] powernow-k8 crash workaround

Work around the oops reported in

Thanks to Ralf Hildebrandt <> for testing and

Acked-by: Dave Jones <>
Cc: "Brown, Len" <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] I2O: Bugfixes to get I2O working again
Markus Lidel [Sat, 10 Jun 2006 16:54:14 +0000 (09:54 -0700)]
[PATCH] I2O: Bugfixes to get I2O working again

- Fixed locking of struct i2o_exec_wait in Executive-OSM

- Removed LCT Notify in i2o_exec_probe() which caused freeing memory and
  accessing freed memory during first enumeration of I2O devices

- Added missing locking in i2o_exec_lct_notify()

- removed put_device() of I2O controller in i2o_iop_remove() which caused
  the controller structure get freed to early

- Fixed size of mempool in i2o_iop_alloc()

- Fixed access to freed memory in i2o_msg_get()


Signed-off-by: Markus Lidel <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] scsi_lib.c: properly count the number of pages in scsi_req_map_sg()
James Bottomley [Thu, 8 Jun 2006 04:03:28 +0000 (00:03 -0400)]
[PATCH] scsi_lib.c: properly count the number of pages in scsi_req_map_sg()

The calculation of nr_pages in scsi_req_map_sg() doesn't account for
the fact that the first page could have an offset that pushes the end
of the buffer onto a new page.

Signed-off-by: Bryan Holty <>
Signed-off-by: James Bottomley <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] JFS: Fix multiple errors in metapage_releasepage
Dave Kleikamp [Wed, 7 Jun 2006 02:54:44 +0000 (22:54 -0400)]
[PATCH] JFS: Fix multiple errors in metapage_releasepage

It looks like metapage_releasepage was making in invalid assumption that
the releasepage method would not be called on a dirty page.  Instead of
issuing a warning and releasing the metapage, it should return 0, indicating
that the private data for the page cannot be released.

I also realized that metapage_releasepage had the return code all wrong.  If
it is successful in releasing the private data, it should return 1, otherwise
it needs to return 0.

Lastly, there is no need to call wait_on_page_writeback, since
try_to_release_page will not call us with a page in writback state.

Signed-off-by: Dave Kleikamp <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] fs/namei.c: Call to file_permission() under a spinlock in do_lookup_path()
Trond Myklebust [Tue, 6 Jun 2006 15:19:35 +0000 (11:19 -0400)]
[PATCH] fs/namei.c: Call to file_permission() under a spinlock in do_lookup_path()

We're presently running lock_kernel() under fs_lock via nfs's ->permission
handler.  That's a ranking bug and sometimes a sleep-in-spinlock bug.  This
problem was introduced in the openat() patchset.

We should not need to hold the current->fs->lock for a codepath that doesn't
use current->fs.

[ fix error path]
Signed-off-by: Trond Myklebust <>
Cc: Al Viro <>
Signed-off-by: Sergey Vlasov <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] tmpfs: time granularity fix for [acm]time going backwards
Robin H. Johnson [Tue, 13 Jun 2006 17:06:11 +0000 (18:06 +0100)]
[PATCH] tmpfs: time granularity fix for [acm]time going backwards

I noticed a strange behavior in a tmpfs file system the other day, while
building packages - occasionally, and seemingly at random, make decided to
rebuild a target. However, only on tmpfs.

A file would be created, and if checked, it had a sub-second timestamp.
However, after an utimes related call where sub-seconds should be set, they
were zeroed instead. In the case that a file was created, and utimes(...,NULL)
was used on it in the same second, the timestamp on the file moved backwards.

After some digging, I found that this was being caused by tmpfs not having a
time granularity set, thus inheriting the default 1 second granularity.

Hugh adds: yes, we missed tmpfs when the s_time_gran mods went into 2.6.11.
Unfortunately, the granularity of CURRENT_TIME, often used in filesystems,
does not match the default granularity set by alloc_super.  A few more such
discrepancies have been found, but this is the most important to fix now.

Signed-off-by: Robin H. Johnson <>
Acked-by: Andi Kleen <>
Signed-off-by: Hugh Dickins <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Missed error checking for intent's filp in open_namei().
Oleg Drokin [Sat, 25 Mar 2006 11:06:54 +0000 (03:06 -0800)]
[PATCH] Missed error checking for intent's filp in open_namei().

It seems there is error check missing in open_namei for errors returned
through (from lookup_instantiate_filp).

If there is plain open performed, then such a check done inside
__path_lookup_intent_open called from path_lookup_open(), but when the open
is performed with O_CREAT flag set, then __path_lookup_intent_open is only
called with LOOKUP_PARENT set where no file opening can occur yet.

Later on lookup_hash is called where exact opening might take place and may be filled.  If it is filled with error value of some
sort, then we get kernel attempting to dereference this error value as
address (and corresponding oops) in nameidata_to_filp() called from

While this is relatively simple to workaround in ->lookup() method by just
checking lookup_instantiate_filp() return value and returning error as
needed, this is not so easy in ->d_revalidate(), where we can only return
"yes, dentry is valid" or "no, dentry is invalid, perform full lookup
again", and just returning 0 on error would cause extra lookup (with
potential extra costly RPCs).

So in short, I believe that there should be no difference in error handling
for opening a file and creating a file in open_namei() and propose this
simple patch as a solution.

Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] SPARC64: Fix missing fold at end of checksums.
David Miller [Mon, 5 Jun 2006 18:27:10 +0000 (11:27 -0700)]
[PATCH] SPARC64: Fix missing fold at end of checksums.

Both csum_partial() and the csum_partial_copy*() family of routines
forget to do a final fold on the computed checksum value on sparc64.
So do the standard Sparc "add + set condition codes, add carry"
sequence, then make sure the high 32-bits of the return value are

Based upon some excellent detective work and debugging done by
Richard Braun and Samuel Thibault.

Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] SPARC64: Respect gfp_t argument to dma_alloc_coherent().
David Miller [Mon, 5 Jun 2006 03:41:00 +0000 (20:41 -0700)]
[PATCH] SPARC64: Respect gfp_t argument to dma_alloc_coherent().

Using asm-generic/dma-mapping.h does not work because pushing
the call down to pci_alloc_coherent() causes the gfp_t argument
of dma_alloc_coherent() to be ignored.

Fix this by implementing things directly, and adding a gfp_t
argument we can use in the internal call down to the PCI DMA
implementation of pci_alloc_coherent().

This fixes massive memory corruption when using the sound driver
layer, which passes things like __GFP_COMP down into these
routines and (correctly) expects that to work.

This is a disk eater when sound is used, so it's pretty critical.

Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] SPARC64: Fix D-cache corruption in mremap
David Miller [Sat, 3 Jun 2006 01:30:58 +0000 (18:30 -0700)]
[PATCH] SPARC64: Fix D-cache corruption in mremap

If we move a mapping from one virtual address to another,
and this changes the virtual color of the mapping to those
pages, we can see corrupt data due to D-cache aliasing.

Check for and deal with this by overriding the move_pte()
macro.  Set things up so that other platforms can cleanly
override the move_pte() macro too.

This long standing bug corrupts user memory, and in particular
has been notorious for corrupting Debian package database
files on sparc64 boxes.

Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] USB: Whiteheat: fix firmware spurious errors
Stuart MacDonald [Wed, 31 May 2006 17:28:40 +0000 (13:28 -0400)]
[PATCH] USB: Whiteheat: fix firmware spurious errors

Attached patch fixes spurious errors during firmware load.

Signed-off-by: Stuart MacDonald <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Tue, 20 Jun 2006 08:55:00 +0000 (01:55 -0700)]

12 years ago[PATCH] xt_sctp: fix endless loop caused by 0 chunk length (CVE-2006-3085)
Patrick McHardy [Mon, 19 Jun 2006 17:14:21 +0000 (19:14 +0200)]
[PATCH] xt_sctp: fix endless loop caused by 0 chunk length (CVE-2006-3085)

Fix endless loop in the SCTP match similar to those already fixed in the
SCTP conntrack helper (was CVE-2006-1527).

Signed-off-by: Patrick McHardy <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)
Oleg Nesterov [Thu, 15 Jun 2006 16:11:43 +0000 (20:11 +0400)]
[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)

do_exit() clears ->it_##clock##_expires, but nothing prevents
another cpu to attach the timer to exiting process after that.
arm_timer() tries to protect against this race, but the check
is racy.

After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
before do_exit() calls 'schedule() local timer interrupt can find
tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
does sys_wait4) interrupted task has ->signal == NULL.

At this moment exiting task has no pending cpu timers, they were
cleanuped in __exit_signal()->posix_cpu_timers_exit{,_group}(),
so we can just return from irq.

John Stultz recently confirmed this bug, see

Signed-off-by: Oleg Nesterov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] check_process_timers: fix possible lockup
Oleg Nesterov [Thu, 15 Jun 2006 16:11:15 +0000 (20:11 +0400)]
[PATCH] check_process_timers: fix possible lockup

If the local timer interrupt happens just after do_exit() sets PF_EXITING
(and before it clears ->it_xxx_expires) run_posix_cpu_timers() will call
check_process_timers() with tasklist_lock + ->siglock held and


t = tsk;
do {

do {
t = next_thread(t);
} while (unlikely(t->flags & PF_EXITING));
} while (t != tsk);

the outer loop will never stop.

Actually, the window is bigger.  Another process can attach the timer
after ->it_xxx_expires was cleared (see the next commit) and the 'if
(PF_EXITING)' check in arm_timer() is racy (see the one after that).

Signed-off-by: Oleg Nesterov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] powerpc: Fix machine check problem on 32-bit kernels (CVE-2006-2448)
Paul Mackerras [Fri, 9 Jun 2006 03:02:59 +0000 (13:02 +1000)]
[PATCH] powerpc: Fix machine check problem on 32-bit kernels (CVE-2006-2448)

This fixes a bug found by Dave Jones that means that it is possible
for userspace to provoke a machine check on 32-bit kernels.  This
also fixes a couple of other places where I found similar problems
by inspection.

Signed-off-by: Paul Mackerras <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Mon, 5 Jun 2006 17:18:23 +0000 (10:18 -0700)]

12 years ago[PATCH] sbp2: fix check of return value of hpsb_allocate_and_register_addrspace
Stefan Richter [Sat, 3 Jun 2006 00:00:33 +0000 (02:00 +0200)]
[PATCH] sbp2: fix check of return value of hpsb_allocate_and_register_addrspace

I added a failure check in patch "sbp2: variable status FIFO address
(fix login timeout)" --- alas for a wrong error value.  This is a bug
since Linux 2.6.16.  Leads to NULL pointer dereference if the call
failed, and bogus failure handling if call succeeded.

Signed-off-by: Stefan Richter <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] sbp2: backport read_capacity workaround for iPod
Stefan Richter [Fri, 2 Jun 2006 17:34:30 +0000 (19:34 +0200)]
[PATCH] sbp2: backport read_capacity workaround for iPod

There is a firmware bug in several Apple iPods which prevents access to
these iPods under certain conditions. The disk size reported by the iPod
is one sector too big. Once access to the end of the disk is attempted,
the iPod becomes inaccessible. This problem has been known for USB iPods
for some time and has recently been discovered to exist with
FireWire/USB combo iPods too.

This patch is derived from the fix in Linux 2.6.17, commit
e9a1c52c7b19d10342226c12f170d7ab644427e2, to be applicable to 2.6.16.x
without prerequisite patches. It hard-wires a workaround for three known
affected model numbers (those of 4th generation iPod, iPod Photo, iPod

Note: This patch lacks Linux 2.6.17's ability to enable and disable the
workaround via a module parameter.

Signed-off-by: Stefan Richter <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] x86_64: Don't do syscall exit tracing twice
Andi Kleen [Thu, 1 Jun 2006 01:26:58 +0000 (03:26 +0200)]
[PATCH] x86_64: Don't do syscall exit tracing twice

This fixes a regression from the earlier DOS fix for non canonical
IRET addresses. It broke UML.

int_ret_from_syscall already does syscall exit tracing, so
no need to do it again in the caller.

This caused problems for UML and some other special programs doing
syscall interception.

Signed-off-by: Andi Kleen <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] x86_64: x86_64 add crashdump trigger points
Vivek Goyal [Tue, 18 Apr 2006 10:35:13 +0000 (12:35 +0200)]
[PATCH] x86_64: x86_64 add crashdump trigger points

o Start booting into the capture kernel after an Oops if system is in a
  unrecoverable state. System will boot into the capture kernel, if one is
  pre-loaded by the user, and capture the kernel core dump.

o One of the following conditions should be true to trigger the booting of
  capture kernel.
        - panic_on_oops is set.
        - pid of current thread is 0
        - pid of current thread is 1
        - Oops happened inside interrupt context.

Signed-off-by: Vivek Goyal <>
Signed-off-by: Andi Kleen <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] ipw2200: Filter unsupported channels out in ad-hoc mode
Zhu Yi [Wed, 1 Mar 2006 21:55:51 +0000 (05:55 +0800)]
[PATCH] ipw2200: Filter unsupported channels out in ad-hoc mode

Currently iwlist ethX freq[uency]/channel lists all the channels the card
supported for the current region, which includes some channels can only
be used in infrastructure mode. This patch filters these channels out if
the card is currently in ad-hoc mode.

Signed-off-by: Zhu Yi <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] the latest consensus libata resume fix
Mark Lord [Sun, 28 May 2006 15:28:00 +0000 (11:28 -0400)]
[PATCH] the latest consensus libata resume fix

Okay, just to sum things up.

This forces libata to wait for up to 2 seconds for BUSY|DRQ to clear
on resume before continuing.

[jgarzik adds...]  During testing we never saw DRQ asserted, but
nonetheless (a) this works and (b) testing for DRQ won't hurt.

Signed-off-by: Mark Lord <>
Acked-by: Jens Axboe <>
Signed-off-by: Jeff Garzik <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] ohci1394, sbp2: fix "scsi_add_device failed" with PL-3507 based devices
Stefan Richter [Sat, 27 May 2006 12:11:18 +0000 (14:11 +0200)]
[PATCH] ohci1394, sbp2: fix "scsi_add_device failed" with PL-3507 based devices

Re-enable posted writes for status FIFO.
Besides bringing back a very minor bandwidth tweak from Linux 2.6.15.x
and older, this also fixes an interoperability regression since 2.6.16:
(sbp2: scsi_add_device failed. IEEE1394 HD is not working anymore.)

Signed-off-by: Stefan Richter <>
Tested-by: Vanei Heidemann <>
Tested-by: Martin Putzlocher <> (chip type unconfirmed)
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Input: psmouse - fix new device detection logic
Dmitry Torokhov [Sat, 29 Apr 2006 09:12:44 +0000 (05:12 -0400)]
[PATCH] Input: psmouse - fix new device detection logic

Input: psmouse - fix new device detection logic

Reported to fix

Signed-off-by: Dmitry Torokhov <>
Cc: Daniel Drake <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] PowerMac: force only suspend-to-disk to be valid
Johannes Berg [Fri, 26 May 2006 01:44:24 +0000 (18:44 -0700)]
[PATCH] PowerMac: force only suspend-to-disk to be valid

For a very long time, echoing 'standby' or 'mem' into /sys/power/state has
killed the machine on powerpc.  This patch fixes that.

This patch adds the .valid callback to pm_ops on PowerMac so that only the
suspend to disk state can be entered.  Note that just returning 0 would
suffice since the upper layers don't pass PM_SUSPEND_DISK down, but we
handle it there regardless just in case that changes.

Acked-by: Benjamin Herrenschmidt <>
Signed-off-by: Johannes Berg <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Cpuset: might sleep checking zones allowed fix
Paul Jackson [Tue, 23 May 2006 00:56:07 +0000 (17:56 -0700)]
[PATCH] Cpuset: might sleep checking zones allowed fix

Fix an infrequently encountered 'sleeping function called
from invalid context' in the cpuset hooks in __alloc_pages.
Could sleep while interrupts disabled.

The routine cpuset_zone_allowed() is called by code in
mm/page_alloc.c __alloc_pages() to determine if a zone is
allowed in the current tasks cpuset.  This routine can sleep,
for certain GFP_KERNEL allocations, if the zone is on a memory
node not allowed in the current cpuset, but might be allowed
in a parent cpuset.

But we can't sleep in __alloc_pages() if in interrupt, nor
if called for a GFP_ATOMIC request (__GFP_WAIT not set in

The rule was intended to be:
  Don't call cpuset_zone_allowed() if you can't sleep, unless you
  pass in the __GFP_HARDWALL flag set in gfp_flag, which disables
  the code that might scan up ancestor cpusets and sleep.

This rule was being violated due to a bogus change made (by myself,
pj) to __alloc_pages() as part of the November 2005 effort to
cleanup its logic.

The bogus change can be seen at:
  [PATCH 01/05] mm fix __alloc_pages cpuset ALLOC_* flags

This was first noticed on a tight memory system, in code that
was disabling interrupts and doing allocation requests with
__GFP_WAIT not set, which resulted in __might_sleep() writing
complaints to the log "Debug: sleeping function called ...",
when the code in cpuset_zone_allowed() tried to take the
callback_sem cpuset semaphore.

Special thanks to Dave Chinner, for figuring this out,
and a tip of the hat to Nick Piggin who warned me of this
back in Nov 2005, before I was ready to listen.

Signed-off-by: Paul Jackson <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Altix: correct ioc3 port order
Pat Gefre [Mon, 1 May 2006 19:16:08 +0000 (12:16 -0700)]
[PATCH] Altix: correct ioc3 port order

Currently loading the ioc3 as a module will cause the ports to be numbered
in reverse order.  This mod maintains the proper order of cards for port

Signed-off-by: Patrick Gefre <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] Altix: correct ioc4 port order
Brent Casavant [Thu, 4 May 2006 02:55:10 +0000 (19:55 -0700)]
[PATCH] Altix: correct ioc4 port order

Currently loading the ioc4 as a module will cause the ports to be numbered
in reverse order.  This mod maintains the proper order of cards for port

Signed-off-by: Brent Casavant <>
Cc: Pat Gefre <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Wed, 31 May 2006 00:31:44 +0000 (17:31 -0700)]

12 years ago[PATCH] NETFILTER: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343)
Marcel Holtmann [Fri, 26 May 2006 11:50:46 +0000 (13:50 +0200)]
[PATCH] NETFILTER: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343)

It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak (CVE-2006-1343).

Signed-off-by: Marcel Holtmann <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Mon, 22 May 2006 18:04:35 +0000 (11:04 -0700)]

12 years ago[PATCH] NETFILTER: SNMP NAT: fix memory corruption (CVE-2006-2444)
Patrick McHardy [Sat, 20 May 2006 07:31:26 +0000 (09:31 +0200)]
[PATCH] NETFILTER: SNMP NAT: fix memory corruption (CVE-2006-2444)

CVE-2006-2444 - Potential remote DoS in SNMP NAT helper.

Fix memory corruption caused by snmp_trap_decode:

- When snmp_trap_decode fails before the id and address are allocated,
  the pointers contain random memory, but are freed by the caller

- When snmp_trap_decode fails after allocating just the ID, it tries
  to free both address and ID, but the address pointer still contains
  random memory. The caller frees both ID and random memory again.

- When snmp_trap_decode fails after allocating both, it frees both,
  and the callers frees both again.

The corruption can be triggered remotely when the ip_nat_snmp_basic
module is loaded and traffic on port 161 or 162 is NATed.

Found by multiple testcases of the trap-app and trap-enc groups of the
PROTOS c06-snmpv1 testsuite.

Signed-off-by: Patrick McHardy <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Sat, 20 May 2006 22:00:46 +0000 (15:00 -0700)]

12 years ago[PATCH] SCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)
Vladislav Yasevich [Fri, 19 May 2006 21:25:53 +0000 (14:25 -0700)]
[PATCH] SCTP: Validate the parameter length in HB-ACK chunk (CVE-2006-1857)

If SCTP receives a badly formatted HB-ACK chunk, it is possible
that we may access invalid memory and potentially have a buffer
overflow.  We should really make sure that the chunk format is
what we expect, before attempting to touch the data.

Signed-off-by: Vlad Yasevich <>
Signed-off-by: Sridhar Samudrala <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] SCTP: Respect the real chunk length when walking parameters (CVE-2006-1858)
Vladislav Yasevich [Fri, 19 May 2006 18:52:20 +0000 (11:52 -0700)]
[PATCH] SCTP: Respect the real chunk length when walking parameters (CVE-2006-1858)

When performing bound checks during the parameter processing, we
want to use the real chunk and paramter lengths for bounds instead
of the rounded ones.  This prevents us from potentially walking of
the end if the chunk length was miscalculated.  We still use rounded
lengths when advancing the pointer. This was found during a
conformance test that changed the chunk length without modifying

(Vlad noted elsewhere: the most you'd overflow is 3 bytes, so problem
is parameter dependent).

Signed-off-by: Vlad Yasevich <>
Signed-off-by: Sridhar Samudrala <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] ptrace_attach: fix possible deadlock schenario with irqs
Linus Torvalds [Thu, 11 May 2006 18:08:49 +0000 (11:08 -0700)]
[PATCH] ptrace_attach: fix possible deadlock schenario with irqs

Eric Biederman points out that we can't take the task_lock while holding
tasklist_lock for writing, because another CPU that holds the task lock
might take an interrupt that then tries to take tasklist_lock for writing.

Which would be a nasty deadlock, with one CPU spinning forever in an
interrupt handler (although admittedly you need to really work at
triggering it ;)

Since the ptrace_attach() code is special and very unusual, just make it
be extra careful, and use trylock+repeat to avoid the possible deadlock.

Cc: Oleg Nesterov <>
Cc: Eric W. Biederman <>
Cc: Roland McGrath <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Fix ptrace_attach()/ptrace_traceme()/de_thread() race
Linus Torvalds [Sun, 7 May 2006 17:49:33 +0000 (10:49 -0700)]
[PATCH] Fix ptrace_attach()/ptrace_traceme()/de_thread() race

This holds the task lock (and, for ptrace_attach, the tasklist_lock)
over the actual attach event, which closes a race between attacking to a
thread that is either doing a PTRACE_TRACEME or getting de-threaded.

Thanks to Oleg Nesterov for reminding me about this, and Chris Wright
for noticing a lost return value in my first version.

Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] page migration: Fix fallback behavior for dirty pages
Christoph Lameter [Mon, 1 May 2006 19:16:08 +0000 (12:16 -0700)]
[PATCH] page migration: Fix fallback behavior for dirty pages

Currently we check PageDirty() in order to make the decision to swap out
the page.  However, the dirty information may be only be contained in the
ptes pointing to the page.  We need to first unmap the ptes before checking
for PageDirty().  If unmap is successful then the page count of the page
will also be decreased so that pageout() works properly.

This is a fix necessary for 2.6.17.  Without this fix we may migrate dirty
pages for filesystems without migration functions.  Filesystems may keep
pointers to dirty pages.  Migration of dirty pages can result in the
filesystem keeping pointers to freed pages.

Unmapping is currently not be separated out from removing all the
references to a page and moving the mapping.  Therefore try_to_unmap will
be called again in migrate_page() if the writeout is successful.  However,
it wont do anything since the ptes are already removed.

The coming updates to the page migration code will restructure the code
so that this is no longer necessary.

Signed-off-by: Christoph Lameter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] add migratepage address space op to shmem
Lee Schermerhorn [Sat, 22 Apr 2006 09:35:48 +0000 (02:35 -0700)]
[PATCH] add migratepage address space op to shmem

Basic problem: pages of a shared memory segment can only be migrated once.

In 2.6.16 through 2.6.17-rc1, shared memory mappings do not have a
migratepage address space op.  Therefore, migrate_pages() falls back to
default processing.  In this path, it will try to pageout() dirty pages.
Once a shared memory page has been migrated it becomes dirty, so
migrate_pages() will try to page it out.  However, because the page count
is 3 [cache + current + pte], pageout() will return PAGE_KEEP because
is_page_cache_freeable() returns false.  This will abort all subsequent

This patch adds a migratepage address space op to shared memory segments to
avoid taking the default path.  We use the "migrate_page()" function
because it knows how to migrate dirty pages.  This allows shared memory
segment pages to migrate, subject to other conditions such as # pte's
referencing the page [page_mapcount(page)], when requested.

I think this is safe.  If we're migrating a shared memory page, then we
found the page via a page table, so it must be in memory.

Can be verified with memtoy and the shmem-mbind-test script, both
available at:

Signed-off-by: Lee Schermerhorn <>
Acked-by: Christoph Lameter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] Remove cond_resched in gather_stats()
Christoph Lameter [Thu, 20 Apr 2006 09:43:12 +0000 (02:43 -0700)]
[PATCH] Remove cond_resched in gather_stats()

gather_stats() is called with a spinlock held from check_pte_range.  We
cannot reschedule with a lock held.

Signed-off-by: Christoph Lameter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] VIA quirk fixup, additional PCI IDs
Chris Wedgwood [Mon, 15 May 2006 16:43:55 +0000 (09:43 -0700)]
[PATCH] VIA quirk fixup, additional PCI IDs

An earlier commit (75cf7456dd87335f574dcd53c4ae616a2ad71a11) changed an
overly-zealous PCI quirk to only poke those VIA devices that need it.
However, some PCI devices were not included in what I hope is now the full
list.  Consequently we're failing to run the quirk on all machines which need
it, causing IRQ routing failures.

This should I hope correct this.

Thanks to Masoud Sharbiani <> for pointing this out
and testing the fix.

Signed-off-by: Chris Wedgwood <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] PCI quirk: VIA IRQ fixup should only run for VIA southbridges
Chris Wedgwood [Wed, 19 Apr 2006 06:57:09 +0000 (23:57 -0700)]
[PATCH] PCI quirk: VIA IRQ fixup should only run for VIA southbridges

Alan Cox pointed out that the VIA 'IRQ fixup' was erroneously running
on my system which has no VIA southbridge (but I do have a VIA IEEE
1394 device).

This should address that.  I also changed "Via IRQ" to "VIA IRQ"
(initially I read Via as a capitalized via (by way/means of).

Signed-off-by: Chris Wedgwood <>
Acked-by: Jeff Garzik <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] Fix udev device creation
Harald Welte [Wed, 10 May 2006 11:28:52 +0000 (13:28 +0200)]
[PATCH] Fix udev device creation

This patch corrects the order of the calls to register_chrdev() and
pcmcia_register_driver().  Now udev correctly creates userspace device
files /dev/cmmN and /dev/cmxN respectively.

Based on an earlier patch by Jan Niehusmann <>.

Signed-off-by: Harald Welte <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] limit request_fn recursion
Jens Axboe [Thu, 11 May 2006 06:20:16 +0000 (08:20 +0200)]
[PATCH] limit request_fn recursion

Don't recurse back into the driver even if the unplug threshold is met,
when the driver asks for a requeue. This is both silly from a logical
point of view (requeues typically happen due to driver/hardware
shortage), and also dangerous since we could hit an endless request_fn
-> requeue -> unplug -> request_fn loop and crash on stack overrun.

Also limit blk_run_queue() to one level of recursion, similar to how
blk_start_queue() works.

This patch fixed a real problem with SLES10 and lpfc, and it could hit
any SCSI lld that returns non-zero from it's ->queuecommand() handler.

Signed-off-by: Jens Axboe <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] PCI: correctly allocate return buffers for osc calls
Kristen Accardi [Wed, 17 May 2006 18:13:37 +0000 (11:13 -0700)]
[PATCH] PCI: correctly allocate return buffers for osc calls

The OSC set and query functions do not allocate enough space for return values,
and set the output buffer length to a false, too large value.  This causes the
acpi-ca code to assume that the output buffer is larger than it actually is,
and overwrite memory when copying acpi return buffers into this caller provided
buffer.  In some cases this can cause kernel oops if the memory that is
overwritten is a pointer.  This patch will change these calls to use a
dynamically allocated output buffer, thus allowing the acpi-ca code to decide
how much space is needed.

Signed-off-by: Kristen Carlson Accardi <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] selinux: check for failed kmalloc in security_sid_to_context()
Serge E. Hallyn [Mon, 15 May 2006 16:43:48 +0000 (09:43 -0700)]
[PATCH] selinux: check for failed kmalloc in security_sid_to_context()

Check for NULL kmalloc return value before writing to it.

Signed-off-by: Serge E. Hallyn <>
Acked-by: James Morris <>
Cc: Stephen Smalley <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] TG3: ethtool always report port is TP.
Karsten Keil [Fri, 12 May 2006 19:49:08 +0000 (12:49 -0700)]
[PATCH] TG3: ethtool always report port is TP.

Even with fiber cards ethtool reports that the connected port is TP,
the patch fix this.

Signed-off-by: Karsten Keil <>
Acked-by: Michael Chan <>
Signed-off-by: David S. Miller <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] Netfilter: do_add_counters race, possible oops or info leak (CVE-2006-0039)
Chris Wright [Tue, 16 May 2006 19:07:20 +0000 (12:07 -0700)]
[PATCH] Netfilter: do_add_counters race, possible oops or info leak (CVE-2006-0039)

Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments.  This requires CAP_NET_ADMIN.

Cc: Solar Designer <>
Cc: Kirill Korotaev <>
Cc: Patrick McHardy <>
(chrisw: rebase of Kirill's patch to
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] scx200_acb: Fix resource name use after free
Jean Delvare [Sat, 13 May 2006 09:17:37 +0000 (11:17 +0200)]
[PATCH] scx200_acb: Fix resource name use after free

We can't pass a string on the stack to request_region. As soon as we
leave the function that stack is gone and the string is lost. Let's
use the same string we identify the i2c_adapter with instead, it's
more simple, more consistent, and just works.

This is the second half of fix to bug #6445.

Signed-off-by: Jean Delvare <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] smbus unhiding kills thermal management
Carl-Daniel Hailfinger [Mon, 15 May 2006 16:44:33 +0000 (09:44 -0700)]
[PATCH] smbus unhiding kills thermal management

Do not enable the SMBus device on Asus boards if suspend is used.  We do
not reenable the device on resume, leading to all sorts of undesirable
effects, the worst being a total fan failure after resume on Samsung P35

This fixes bug #6449 at

Signed-off-by: Carl-Daniel Hailfinger <>
Signed-off-by: Pavel Machek <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Jean Delvare <>
12 years ago[PATCH] fs/compat.c: fix 'if (a |= b )' typo
Alexey Dobriyan [Mon, 15 May 2006 16:44:27 +0000 (09:44 -0700)]
[PATCH] fs/compat.c: fix 'if (a |= b )' typo

Mentioned by Mark Armbrust somewhere on Usenet.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David Woodhouse <>
Cc: Ulrich Drepper <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] smbfs: Fix slab corruption in samba error path
Jan Niehusmann [Mon, 15 May 2006 16:44:12 +0000 (09:44 -0700)]
[PATCH] smbfs: Fix slab corruption in samba error path

Yesterday, I got the following error with during a file copy from
a smb filesystem over a wireless link.  I guess there was some error on the
wireless link, which in turn caused an error condition for the smb

In the log, smb_file_read reports error=4294966784 (0xfffffe00), which also
shows up in the slab dumps, and also is -ERESTARTSYS.  Error code 27499
corresponds to 0x6b6b, so the rq_errno field seems to be the only one being
set after freeing the slab.

In smb_add_request (which is the only place in smbfs where I found
ERESTARTSYS), I found the following:

        if (!timeleft || signal_pending(current)) {
                 * On timeout or on interrupt we want to try and remove the
                 * request from the recvq/xmitq.
                if (!(req->rq_flags & SMB_REQ_RECEIVED)) {
        if (signal_pending(current))
                req->rq_errno = -ERESTARTSYS;

I guess that some codepath like smbiod_flush() caused the request to be
removed from the queue, and smb_rput(req) be called, without
SMB_REQ_RECEIVED being set.  This violates an asumption made by the quoted

Then, the above code calls smb_rput(req) again, the req gets freed, and
req->rq_errno = -ERESTARTSYS writes into the already freed slab.  As
list_del_init doesn't cause an error if called multiple times, that does
cause the observed behaviour (freed slab with rq_errno=-ERESTARTSYS).

If this observation is correct, the following patch should fix it.

I wonder why the smb code uses list_del_init everywhere - using list_del
instead would catch such situations by poisoning the next and prev

May  4 23:29:21 knautsch kernel: [17180085.456000] ipw2200: Firmware error detected.  Restarting.
May  4 23:29:21 knautsch kernel: [17180085.456000] ipw2200: Sysfs 'error' log captured.
May  4 23:33:02 knautsch kernel: [17180306.316000] ipw2200: Firmware error detected.  Restarting.
May  4 23:33:02 knautsch kernel: [17180306.316000] ipw2200: Sysfs 'error' log already exists.
May  4 23:33:02 knautsch kernel: [17180306.968000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:34:18 knautsch kernel: [17180383.256000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:34:18 knautsch kernel: [17180383.284000] SMB connection re-established (-5)
May  4 23:37:19 knautsch kernel: [17180563.956000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:40:09 knautsch kernel: [17180733.636000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:40:26 knautsch kernel: [17180750.700000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:02 knautsch kernel: [17180907.304000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:08 knautsch kernel: [17180912.324000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:43:34 knautsch kernel: [17180938.416000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:43:34 knautsch kernel: [17180938.416000] Slab corruption: start=c4ebe09c, len=244
May  4 23:43:34 knautsch kernel: [17180938.416000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:43:34 knautsch kernel: [17180938.416000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:43:34 knautsch kernel: [17180938.416000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.416000] 0f0: 00 fe ff ff
May  4 23:43:34 knautsch kernel: [17180938.416000] Next obj: start=c4ebe19c, len=244
May  4 23:43:34 knautsch kernel: [17180938.416000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:43:34 knautsch kernel: [17180938.416000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:43:34 knautsch kernel: [17180938.416000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.416000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:43:34 knautsch kernel: [17180938.460000] SMB connection re-established (-5)
May  4 23:43:42 knautsch kernel: [17180946.292000] ipw2200: Firmware error detected.  Restarting.
May  4 23:43:42 knautsch kernel: [17180946.292000] ipw2200: Sysfs 'error' log already exists.
May  4 23:45:04 knautsch kernel: [17181028.752000] ipw2200: Firmware error detected.  Restarting.
May  4 23:45:04 knautsch kernel: [17181028.752000] ipw2200: Sysfs 'error' log already exists.
May  4 23:45:05 knautsch kernel: [17181029.868000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:45:36 knautsch kernel: [17181060.984000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:45:36 knautsch kernel: [17181060.984000] Slab corruption: start=c4ebe09c, len=244
May  4 23:45:36 knautsch kernel: [17181060.984000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:45:36 knautsch kernel: [17181060.984000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:45:36 knautsch kernel: [17181060.984000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181060.984000] 0f0: 00 fe ff ff
May  4 23:45:36 knautsch kernel: [17181060.984000] Next obj: start=c4ebe19c, len=244
May  4 23:45:36 knautsch kernel: [17181060.984000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:45:36 knautsch kernel: [17181060.984000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:45:36 knautsch kernel: [17181060.984000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181060.984000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:45:36 knautsch kernel: [17181061.024000] SMB connection re-established (-5)
May  4 23:46:17 knautsch kernel: [17181102.132000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:47:46 knautsch kernel: [17181190.468000] smb_errno: class Unknown, code 27499 from command 0x6b
May  4 23:47:46 knautsch kernel: [17181190.468000] Slab corruption: start=c4ebe09c, len=244
May  4 23:47:46 knautsch kernel: [17181190.468000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:47:46 knautsch kernel: [17181190.468000] Last user: [<e087b903>](smb_rput+0x53/0x90 [smbfs])
May  4 23:47:46 knautsch kernel: [17181190.468000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.468000] 0f0: 00 fe ff ff
May  4 23:47:46 knautsch kernel: [17181190.468000] Next obj: start=c4ebe19c, len=244
May  4 23:47:46 knautsch kernel: [17181190.468000] Redzone: 0x5a2cf071/0x5a2cf071.
May  4 23:47:46 knautsch kernel: [17181190.468000] Last user: [<00000000>](_stext+0x3feffde0/0x30)
May  4 23:47:46 knautsch kernel: [17181190.468000] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.468000] 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
May  4 23:47:46 knautsch kernel: [17181190.492000] SMB connection re-established (-5)
May  4 23:49:20 knautsch kernel: [17181284.828000] smb_file_read: //some_file validation failed, error=4294966784
May  4 23:49:39 knautsch kernel: [17181303.896000] smb_file_read: //some_file validation failed, error=4294966784

Signed-off-by: Jan Niehusmann <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>
12 years ago[PATCH] fs/locks.c: Fix sys_flock() race
Trond Myklebust [Fri, 31 Mar 2006 10:30:55 +0000 (02:30 -0800)]
[PATCH] fs/locks.c: Fix sys_flock() race

sys_flock() currently has a race which can result in a double free in the
multi-thread case.

Thread 1 Thread 2

sys_flock(file, LOCK_EX)
sys_flock(file, LOCK_UN)

If Thread 2 removes the lock from inode->i_lock before Thread 1 tests for
list_empty(&lock->fl_link) at the end of sys_flock, then both threads will
end up calling locks_free_lock for the same lock.

Fix is to make flock_lock_file() do the same as posix_lock_file(), namely
to make a copy of the request, so that the caller can always free the lock.

This also has the side-effect of fixing up a reference problem in the
lockd handling of flock.

Signed-off-by: Trond Myklebust <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] USB: ub oops in block_uevent
Pete Zaitcev [Wed, 3 May 2006 07:16:00 +0000 (00:16 -0700)]
[PATCH] USB: ub oops in block_uevent

In kernel 2.6.16, if a mounted storage device is removed, an oops happens
because ub supplies an interface device (and kobject) to the block layer,
but neglects to pin it. And apparently, the block layer expects its users
to pin device structures.

The code in ub was broken this way for years. But the bug was exposed only
by 2.6.16 when it started to call block_uevent on close, which traverses
device structures (kobjects actually).

Signed-off-by: Pete Zaitcev <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] via-rhine: zero pad short packets on Rhine I ethernet cards
Craig Brind [Tue, 2 May 2006 19:59:21 +0000 (19:59 +0000)]
[PATCH] via-rhine: zero pad short packets on Rhine I ethernet cards

Fixes Rhine I cards disclosing fragments of previously transmitted frames
in new transmissions.

Before transmission, any socket buffer (skb) shorter than the ethernet
minimum length of 60 bytes was zero-padded.  On Rhine I cards the data can
later be copied into an aligned transmission buffer without copying this
padding.  This resulted in the transmission of the frame with the extra
bytes beyond the provided content leaking the previous contents of this
buffer on to the network.

Now zero-padding is repeated in the local aligned buffer if one is used.

Following a suggestion from the via-rhine maintainer, no attempt is made
here to avoid the duplicated effort of padding the skb if it is known that
an aligned buffer will definitely be used.  This is to make the change
"obviously correct" and allow it to be applied to a stable kernel if
necessary.  There is no change to the flow of control and the changes are
only to the Rhine I code path.

The patch has run on an in-service Rhine-I host without incident.  Frames
shorter than 60 bytes are now correctly zero-padded when captured on a
separate host.  I see no unusual stats reported by ifconfig, and no unusual
log messages.

Signed-off-by: Craig Brind <>
Signed-off-by: Roger Luethi <>
Cc: Jeff Garzik <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Jeff Garzik <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years ago[PATCH] md: Avoid oops when attempting to fix read errors on raid10
NeilBrown [Mon, 1 May 2006 19:15:44 +0000 (12:15 -0700)]
[PATCH] md: Avoid oops when attempting to fix read errors on raid10

We should add to the counter for the rdev *after* checking if the rdev is

Signed-off-by: Neil Brown <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Chris Wright <>
12 years agoLinux
Chris Wright [Thu, 11 May 2006 01:56:24 +0000 (18:56 -0700)]

12 years ago[PATCH] fs/locks.c: Fix lease_init (CVE-2006-1860)
Trond Myklebust [Mon, 8 May 2006 03:02:42 +0000 (23:02 -0400)]
[PATCH] fs/locks.c: Fix lease_init (CVE-2006-1860)

It is insane to be giving lease_init() the task of freeing the lock it is
supposed to initialise, given that the lock is not guaranteed to be
allocated on the stack. This causes lockups in fcntl_setlease().
Problem diagnosed by Daniel Hokka Zakrisson <>

Also fix a slab leak in __setlease() due to an uninitialised return value.
Problem diagnosed by Björn Steinbrink.

Signed-off-by: Trond Myklebust <>
Tested-by: Daniel Hokka Zakrisson <>
Signed-off-by: Linus Torvalds <>
Cc: Björn Steinbrink <>
Signed-off-by: Chris Wright <>