* [patch 01/22] 3ware: kmap_atomic() fix
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
@ 2006-04-21 4:37 ` Greg KH
2006-04-21 4:37 ` [patch 02/22] 3ware 9000 disable local irqs during kmap_atomic Greg KH
` (20 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:37 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, James Bottomley,
linuxraid, Greg Kroah-Hartman
[-- Attachment #1: 3ware-kmap_atomic-fix.patch --]
[-- Type: text/plain, Size: 1275 bytes --]
From: Andrew Morton <akpm@osdl.org>
We must disable local IRQs while holding KM_IRQ0 or KM_IRQ1. Otherwise, an
IRQ handler could use those kmap slots while this code is using them,
resulting in memory corruption.
Thanks to Nick Orlov <bugfixer@list.ru> for reporting.
Cc: <linuxraid@amcc.com>
Cc: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/scsi/3w-xxxx.c | 3 +++
1 file changed, 3 insertions(+)
--- linux-2.6.16.9.orig/drivers/scsi/3w-xxxx.c
+++ linux-2.6.16.9/drivers/scsi/3w-xxxx.c
@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Devi
struct scsi_cmnd *cmd = tw_dev->srb[request_id];
void *buf;
unsigned int transfer_len;
+ unsigned long flags = 0;
if (cmd->use_sg) {
struct scatterlist *sg =
(struct scatterlist *)cmd->request_buffer;
+ local_irq_save(flags);
buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
transfer_len = min(sg->length, len);
} else {
@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Devi
sg = (struct scatterlist *)cmd->request_buffer;
kunmap_atomic(buf - sg->offset, KM_IRQ0);
+ local_irq_restore(flags);
}
}
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 02/22] 3ware 9000 disable local irqs during kmap_atomic
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
2006-04-21 4:37 ` [patch 01/22] 3ware: kmap_atomic() fix Greg KH
@ 2006-04-21 4:37 ` Greg KH
2006-04-21 4:37 ` [patch 03/22] efficeon-agp: Add missing memory mask Greg KH
` (19 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:37 UTC (permalink / raw)
To: linux-kernel, stable, James Bottomley
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Adam Radford,
Greg Kroah-Hartman
[-- Attachment #1: 3ware-9000-disable-local-irqs-during-kmap_atomic.patch --]
[-- Type: text/plain, Size: 1294 bytes --]
The attached patch for 2.6.17-rc2 updates the 3ware 9000 driver:
- Disable local interrupts during kmap/unmap_atomic().
Signed-off-by: Adam Radford <linuxraid@amcc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/scsi/3w-9xxx.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- linux-2.6.16.9.orig/drivers/scsi/3w-9xxx.c
+++ linux-2.6.16.9/drivers/scsi/3w-9xxx.c
@@ -85,7 +85,7 @@
#include "3w-9xxx.h"
/* Globals */
-#define TW_DRIVER_VERSION "2.26.02.005"
+#define TW_DRIVER_VERSION "2.26.02.007"
static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
static unsigned int twa_device_extension_count;
static int twa_major = -1;
@@ -1944,9 +1944,13 @@ static void twa_scsiop_execute_scsi_comp
}
if (tw_dev->srb[request_id]->use_sg == 1) {
struct scatterlist *sg = (struct scatterlist *)tw_dev->srb[request_id]->request_buffer;
- char *buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
+ char *buf;
+ unsigned long flags = 0;
+ local_irq_save(flags);
+ buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
memcpy(buf, tw_dev->generic_buffer_virt[request_id], sg->length);
kunmap_atomic(buf - sg->offset, KM_IRQ0);
+ local_irq_restore(flags);
}
}
} /* End twa_scsiop_execute_scsi_complete() */
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 03/22] efficeon-agp: Add missing memory mask
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
2006-04-21 4:37 ` [patch 01/22] 3ware: kmap_atomic() fix Greg KH
2006-04-21 4:37 ` [patch 02/22] 3ware 9000 disable local irqs during kmap_atomic Greg KH
@ 2006-04-21 4:37 ` Greg KH
2006-04-21 4:37 ` [patch 04/22] : Fix truesize underflow Greg KH
` (18 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:37 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Benjamin Herrenschmidt, Brian Hinz, H Peter Anvin,
Greg Kroah-Hartman
[-- Attachment #1: efficeon-agp-add-missing-memory-mask.patch --]
[-- Type: text/plain, Size: 1161 bytes --]
Original patch by Benjamin Herrenschmidt after debugging by Brian Hinz.
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Brian Hinz <bphinz@hotmail.com>
Signed-off-by: H Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/agp/efficeon-agp.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- linux-2.6.16.9.orig/drivers/char/agp/efficeon-agp.c
+++ linux-2.6.16.9/drivers/char/agp/efficeon-agp.c
@@ -64,6 +64,12 @@ static struct gatt_mask efficeon_generic
{.mask = 0x00000001, .type = 0}
};
+/* This function does the same thing as mask_memory() for this chipset... */
+static inline unsigned long efficeon_mask_memory(unsigned long addr)
+{
+ return addr | 0x00000001;
+}
+
static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
{
{256, 65536, 0},
@@ -251,7 +257,7 @@ static int efficeon_insert_memory(struct
last_page = NULL;
for (i = 0; i < count; i++) {
int index = pg_start + i;
- unsigned long insert = mem->memory[i];
+ unsigned long insert = efficeon_mask_memory(mem->memory[i]);
page = (unsigned int *) efficeon_private.l1_table[index >> 10];
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 04/22] : Fix truesize underflow
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (2 preceding siblings ...)
2006-04-21 4:37 ` [patch 03/22] efficeon-agp: Add missing memory mask Greg KH
@ 2006-04-21 4:37 ` Greg KH
2006-04-21 4:37 ` [patch 05/22] : Fix hotplug race during device registration Greg KH
` (17 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:37 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Herbert Xu,
David Miller, Greg Kroah-Hartman
[-- Attachment #1: fix-bug.patch --]
[-- Type: text/plain, Size: 1357 bytes --]
From: Herbert Xu <herbert@gondor.apana.org.au>
[TCP]: Fix truesize underflow
There is a problem with the TSO packet trimming code. The cause of
this lies in the tcp_fragment() function.
When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero. This means that
truesize could in fact be less than the real payload length.
When that happens the TSO packet trimming can cause truesize to become
negative. This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.
I've copied the code DaveM used in tso_fragment which should work here.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv4/tcp_output.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- linux-2.6.16.9.orig/net/ipv4/tcp_output.c
+++ linux-2.6.16.9/net/ipv4/tcp_output.c
@@ -537,7 +537,9 @@ int tcp_fragment(struct sock *sk, struct
buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
if (buff == NULL)
return -ENOMEM; /* We'll just try again later. */
- sk_charge_skb(sk, buff);
+
+ buff->truesize = skb->len - len;
+ skb->truesize -= buff->truesize;
/* Correct the sequence numbers. */
TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 05/22] : Fix hotplug race during device registration
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (3 preceding siblings ...)
2006-04-21 4:37 ` [patch 04/22] : Fix truesize underflow Greg KH
@ 2006-04-21 4:37 ` Greg KH
2006-04-21 4:38 ` [patch 06/22] i2c-i801: Fix resume when PEC is used Greg KH
` (16 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:37 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Alexander Patrakov, David Miller, Greg Kroah-Hartman
[-- Attachment #1: fix-hotplug-race-during-device-registration.patch --]
[-- Type: text/plain, Size: 1289 bytes --]
From: Thomas de Grenier de Latour <degrenier@easyconnect.fr>
On Sun, 9 Apr 2006 21:56:59 +0400,
Sergey Vlasov <vsu@altlinux.ru> wrote:
> However, show_address() does not output anything unless
> dev->reg_state == NETREG_REGISTERED - and this state is set by
> netdev_run_todo() only after netdev_register_sysfs() returns, so in
> the meantime (while netdev_register_sysfs() is busy adding the
> "statistics" attribute group) some process may see an empty "address"
> attribute.
I've tried the attached patch, suggested by Sergey Vlasov on
hotplug-devel@, and as far as i can test it works just fine.
Signed-off-by: Alexander Patrakov <patrakov@ums.usu.ru>
Signed-off-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/core/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.9.orig/net/core/dev.c
+++ linux-2.6.16.9/net/core/dev.c
@@ -2932,11 +2932,11 @@ void netdev_run_todo(void)
switch(dev->reg_state) {
case NETREG_REGISTERING:
+ dev->reg_state = NETREG_REGISTERED;
err = netdev_register_sysfs(dev);
if (err)
printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
dev->name, err);
- dev->reg_state = NETREG_REGISTERED;
break;
case NETREG_UNREGISTERING:
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 06/22] i2c-i801: Fix resume when PEC is used
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (4 preceding siblings ...)
2006-04-21 4:37 ` [patch 05/22] : Fix hotplug race during device registration Greg KH
@ 2006-04-21 4:38 ` Greg KH
2006-04-21 4:38 ` [patch 07/22] MTD_NAND_SHARPSL and MTD_NAND_NANDSIM should be tristates Greg KH
` (15 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Jean Delvare,
Greg Kroah-Hartman
[-- Attachment #1: i2c-i801-fix-resume-when-pec-is-used.patch --]
[-- Type: text/plain, Size: 1025 bytes --]
Fix for bug #6395:
Fail to resume on Tecra M2 with ADM1032 and Intel 82801DBM
The BIOS of the Tecra M2 doesn't like it when it has to reboot or
resume after the i2c-i801 driver has left the SMBus in PEC mode.
I have a more complete fix for 2.6.17 but the simple approach of
leaving the SMBus in non-PEC mode after every transaction should do
for -stable. That's what the i2c-i801 driver was doing up to 2.6.15
(inclusive).
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/i2c/busses/i2c-i801.c | 5 +++++
1 file changed, 5 insertions(+)
--- linux-2.6.16.9.orig/drivers/i2c/busses/i2c-i801.c
+++ linux-2.6.16.9/drivers/i2c/busses/i2c-i801.c
@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapte
ret = i801_transaction();
}
+ /* Some BIOSes don't like it when PEC is enabled at reboot or resume
+ time, so we forcibly disable it after every transaction. */
+ if (hwpec)
+ outb_p(0, SMBAUXCTL);
+
if(block)
return ret;
if(ret)
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 07/22] MTD_NAND_SHARPSL and MTD_NAND_NANDSIM should be tristates
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (5 preceding siblings ...)
2006-04-21 4:38 ` [patch 06/22] i2c-i801: Fix resume when PEC is used Greg KH
@ 2006-04-21 4:38 ` Greg KH
2006-04-21 4:38 ` [patch 08/22] PPC: fix oops in alsa powermac driver Greg KH
` (14 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Artem B. Bityutskiy, dwmw2, Adrian Bunk, Greg Kroah-Hartman
[-- Attachment #1: mtd_nand_sharpsl-and-mtd_nand_nandsim-should-be-tristate-s.patch --]
[-- Type: text/plain, Size: 1444 bytes --]
MTD_NAND=m and MTD_NAND_SHARPSL=y or MTD_NAND_NANDSIM=y are illegal
combinations that mustn't be allowed.
This patch fixes this bug by making MTD_NAND_SHARPSL and MTD_NAND_NANDSIM
tristate's.
Additionally, it fixes some whitespace damage at these options.
This patch was already included in Linus' tree.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/mtd/nand/Kconfig | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- linux-2.6.16.9.orig/drivers/mtd/nand/Kconfig
+++ linux-2.6.16.9/drivers/mtd/nand/Kconfig
@@ -178,17 +178,16 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
Even if you leave this disabled, you can enable BBT writes at module
load time (assuming you build diskonchip as a module) with the module
parameter "inftl_bbt_write=1".
-
- config MTD_NAND_SHARPSL
- bool "Support for NAND Flash on Sharp SL Series (C7xx + others)"
- depends on MTD_NAND && ARCH_PXA
-
- config MTD_NAND_NANDSIM
- bool "Support for NAND Flash Simulator"
- depends on MTD_NAND && MTD_PARTITIONS
+config MTD_NAND_SHARPSL
+ tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
+ depends on MTD_NAND && ARCH_PXA
+
+config MTD_NAND_NANDSIM
+ tristate "Support for NAND Flash Simulator"
+ depends on MTD_NAND && MTD_PARTITIONS
help
The simulator may simulate verious NAND flash chips for the
MTD nand layer.
-
+
endmenu
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 08/22] PPC: fix oops in alsa powermac driver
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (6 preceding siblings ...)
2006-04-21 4:38 ` [patch 07/22] MTD_NAND_SHARPSL and MTD_NAND_NANDSIM should be tristates Greg KH
@ 2006-04-21 4:38 ` Greg KH
2006-04-21 4:38 ` [patch 09/22] selinux: Fix MLS compatibility off-by-one bug Greg KH
` (13 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, benh,
Guido Guenther, Greg Kroah-Hartman
[-- Attachment #1: re-ppc-fix-oops-in-alsa-powermac-driver.patch --]
[-- Type: text/plain, Size: 2095 bytes --]
this fixes an oops in 2.6.16.X when loading the snd_powermac module. The
name of the requested module changed during the 2.6.16 development cycle
from i2c-keylargo to i2c-powermac:
Signed-off-by: Guido Guenther <agx@sigxcpu.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/macintosh/therm_adt746x.c | 4 ++--
sound/oss/dmasound/tas_common.c | 4 ++--
sound/ppc/daca.c | 2 +-
sound/ppc/tumbler.c | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)
--- linux-2.6.16.9.orig/drivers/macintosh/therm_adt746x.c
+++ linux-2.6.16.9/drivers/macintosh/therm_adt746x.c
@@ -627,8 +627,8 @@ thermostat_init(void)
if(therm_type == ADT7460)
device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
-#ifndef CONFIG_I2C_KEYWEST
- request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+ request_module("i2c-powermac");
#endif
return i2c_add_driver(&thermostat_driver);
--- linux-2.6.16.9.orig/sound/oss/dmasound/tas_common.c
+++ linux-2.6.16.9/sound/oss/dmasound/tas_common.c
@@ -195,8 +195,8 @@ tas_init(int driver_id, const char *driv
printk(KERN_INFO "tas driver [%s])\n", driver_name);
-#ifndef CONFIG_I2C_KEYWEST
- request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+ request_module("i2c-powermac");
#endif
tas_node = find_devices("deq");
if (tas_node == NULL)
--- linux-2.6.16.9.orig/sound/ppc/daca.c
+++ linux-2.6.16.9/sound/ppc/daca.c
@@ -256,7 +256,7 @@ int __init snd_pmac_daca_init(struct snd
#ifdef CONFIG_KMOD
if (current->fs->root)
- request_module("i2c-keywest");
+ request_module("i2c-powermac");
#endif /* CONFIG_KMOD */
mix = kmalloc(sizeof(*mix), GFP_KERNEL);
--- linux-2.6.16.9.orig/sound/ppc/tumbler.c
+++ linux-2.6.16.9/sound/ppc/tumbler.c
@@ -1314,7 +1314,7 @@ int __init snd_pmac_tumbler_init(struct
#ifdef CONFIG_KMOD
if (current->fs->root)
- request_module("i2c-keywest");
+ request_module("i2c-powermac");
#endif /* CONFIG_KMOD */
mix = kmalloc(sizeof(*mix), GFP_KERNEL);
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 09/22] selinux: Fix MLS compatibility off-by-one bug
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (7 preceding siblings ...)
2006-04-21 4:38 ` [patch 08/22] PPC: fix oops in alsa powermac driver Greg KH
@ 2006-04-21 4:38 ` Greg KH
2006-04-21 4:38 ` [patch 10/22] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff Greg KH
` (12 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:38 UTC (permalink / raw)
To: linux-kernel, stable, torvalds
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, akpm, alan, jmorris, sds,
Greg Kroah-Hartman
[-- Attachment #1: selinux-fix-mls-compatibility-off-by-one-bug.patch --]
[-- Type: text/plain, Size: 881 bytes --]
From: Ron Yorston <rmy@tigress.co.uk>
Fix an off-by-one error in the MLS compatibility code that was causing
contexts with a MLS suffix to be rejected, preventing sharing partitions
between FC4 and FC5. Bug reported in
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188068
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
security/selinux/ss/mls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.9.orig/security/selinux/ss/mls.c
+++ linux-2.6.16.9/security/selinux/ss/mls.c
@@ -264,7 +264,7 @@ int mls_context_to_sid(char oldc,
if (!selinux_mls_enabled) {
if (def_sid != SECSID_NULL && oldc)
- *scontext += strlen(*scontext);
+ *scontext += strlen(*scontext)+1;
return 0;
}
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 10/22] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff.
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (8 preceding siblings ...)
2006-04-21 4:38 ` [patch 09/22] selinux: Fix MLS compatibility off-by-one bug Greg KH
@ 2006-04-21 4:38 ` Greg KH
2006-04-21 4:39 ` [patch 11/22] IPV6: XFRM: Dont use old copy of pointer after pskb_may_pull() Greg KH
` (11 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, netdev-core,
yoshfuji, Greg Kroah-Hartman
[-- Attachment #1: ipv6-ensure-to-have-hop-by-hop-options-in-our-header-of-sk_buff.patch --]
[-- Type: text/plain, Size: 935 bytes --]
[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
---
net/ipv6/exthdrs.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- linux-2.6.16.9.orig/net/ipv6/exthdrs.c
+++ linux-2.6.16.9/net/ipv6/exthdrs.c
@@ -489,6 +489,18 @@ int ipv6_parse_hopopts(struct sk_buff *s
{
struct inet6_skb_parm *opt = IP6CB(skb);
+ /*
+ * skb->nh.raw is equal to skb->data, and
+ * skb->h.raw - skb->nh.raw is always equal to
+ * sizeof(struct ipv6hdr) by definition of
+ * hop-by-hop options.
+ */
+ if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
+ !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
+ kfree_skb(skb);
+ return -1;
+ }
+
opt->hop = sizeof(struct ipv6hdr);
if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
skb->h.raw += (skb->h.raw[1]+1)<<3;
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 11/22] IPV6: XFRM: Dont use old copy of pointer after pskb_may_pull().
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (9 preceding siblings ...)
2006-04-21 4:38 ` [patch 10/22] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 12/22] IPV6: XFRM: Fix decoding session with preceding extension header(s) Greg KH
` (10 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, netdev-core,
yoshfuji, Greg Kroah-Hartman
[-- Attachment #1: ipv6-xfrm-don-t-use-old-copy-of-pointer-after-pskb_may_pull.patch --]
[-- Type: text/plain, Size: 1005 bytes --]
[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
---
net/ipv6/xfrm6_policy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- linux-2.6.16.9.orig/net/ipv6/xfrm6_policy.c
+++ linux-2.6.16.9/net/ipv6/xfrm6_policy.c
@@ -193,7 +193,7 @@ _decode_session6(struct sk_buff *skb, st
{
u16 offset = sizeof(struct ipv6hdr);
struct ipv6hdr *hdr = skb->nh.ipv6h;
- struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+ struct ipv6_opt_hdr *exthdr;
u8 nexthdr = skb->nh.ipv6h->nexthdr;
memset(fl, 0, sizeof(struct flowi));
@@ -201,6 +201,8 @@ _decode_session6(struct sk_buff *skb, st
ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
+ exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+
switch (nexthdr) {
case NEXTHDR_ROUTING:
case NEXTHDR_HOP:
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 12/22] IPV6: XFRM: Fix decoding session with preceding extension header(s).
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (10 preceding siblings ...)
2006-04-21 4:39 ` [patch 11/22] IPV6: XFRM: Dont use old copy of pointer after pskb_may_pull() Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 13/22] x86: dont allow tail-calls in sys_ftruncate() Greg KH
` (9 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, netdev-core,
yoshfuji, Greg Kroah-Hartman
[-- Attachment #1: ipv6-xfrm-fix-decoding-session-with-preceding-extension-header.patch --]
[-- Type: text/plain, Size: 1246 bytes --]
[IPV6] XFRM: Fix decoding session with preceding extension header(s).
We did not correctly decode session with preceding extension
header(s). This was because we had already pulled preceding
headers, skb->nh.raw + 40 + 1 - skb->data was minus, and
pskb_may_pull() failed.
We now have IP6CB(skb)->nhoff and skb->h.raw, and we can
start parsing / decoding upper layer protocol from current
position.
Tracked down by Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
and tested by Kazunori Miyazawa <kazunori@miyazawa.org>.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/ipv6/xfrm6_policy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linux-2.6.16.9.orig/net/ipv6/xfrm6_policy.c
+++ linux-2.6.16.9/net/ipv6/xfrm6_policy.c
@@ -191,10 +191,10 @@ error:
static inline void
_decode_session6(struct sk_buff *skb, struct flowi *fl)
{
- u16 offset = sizeof(struct ipv6hdr);
+ u16 offset = skb->h.raw - skb->nh.raw;
struct ipv6hdr *hdr = skb->nh.ipv6h;
struct ipv6_opt_hdr *exthdr;
- u8 nexthdr = skb->nh.ipv6h->nexthdr;
+ u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
memset(fl, 0, sizeof(struct flowi));
ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 13/22] x86: dont allow tail-calls in sys_ftruncate()
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (11 preceding siblings ...)
2006-04-21 4:39 ` [patch 12/22] IPV6: XFRM: Fix decoding session with preceding extension header(s) Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 18/22] Fix file lookup without ref Greg KH
` (8 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Greg Kroah-Hartman
[-- Attachment #1: x86-don-t-allow-tail-calls-in-sys_ftruncate.patch --]
[-- Type: text/plain, Size: 1669 bytes --]
From: Linus Torvalds <torvalds@osdl.org>
x86: don't allow tail-calls in sys_ftruncate[64]()
Gcc thinks it owns the incoming argument stack, but that's not true for
"asmlinkage" functions, and it corrupts the caller-set-up argument stack
when it pushes the third argument onto the stack. Which can result in
%ebx getting corrupted in user space.
Now, normally nobody sane would ever notice, since libc will save and
restore %ebx anyway over the system call, but it's still wrong.
I'd much rather have "asmlinkage" tell gcc directly that it doesn't own
the stack, but no such attribute exists, so we're stuck with our hacky
manual "prevent_tail_call()" macro once more (we've had the same issue
before with sys_waitpid() and sys_wait4()).
Thanks to Hans-Werner Hilse <hilse@sub.uni-goettingen.de> for reporting
the issue and testing the fix.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/open.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- linux-2.6.16.9.orig/fs/open.c
+++ linux-2.6.16.9/fs/open.c
@@ -330,7 +330,9 @@ out:
asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
{
- return do_sys_ftruncate(fd, length, 1);
+ long ret = do_sys_ftruncate(fd, length, 1);
+ prevent_tail_call(ret);
+ return ret;
}
/* LFS versions of truncate are only needed on 32 bit machines */
@@ -342,7 +344,9 @@ asmlinkage long sys_truncate64(const cha
asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
{
- return do_sys_ftruncate(fd, length, 0);
+ long ret = do_sys_ftruncate(fd, length, 0);
+ prevent_tail_call(ret);
+ return ret;
}
#endif
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 18/22] Fix file lookup without ref
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (12 preceding siblings ...)
2006-04-21 4:39 ` [patch 13/22] x86: dont allow tail-calls in sys_ftruncate() Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 17/22] IPC: access to unmapped vmalloc area in grow_ary() Greg KH
` (7 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Dipankar Sarma,
Paul E. McKenney, Greg Kroah-Hartman
[-- Attachment #1: fix-file-lookup-without-ref.patch --]
[-- Type: text/plain, Size: 3707 bytes --]
From: Dipankar Sarma <dipankar@in.ibm.com>
[PATCH] Fix file lookup without ref
There are places in the kernel where we look up files in fd tables and
access the file structure without holding refereces to the file. So, we
need special care to avoid the race between looking up files in the fd
table and tearing down of the file in another CPU. Otherwise, one might
see a NULL f_dentry or such torn down version of the file. This patch
fixes those special places where such a race may happen.
Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Acked-by: "Paul E. McKenney" <paulmck@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/tty_io.c | 8 ++++++--
fs/locks.c | 9 +++++++--
fs/proc/base.c | 21 +++++++++++++++------
3 files changed, 28 insertions(+), 10 deletions(-)
--- linux-2.6.16.9.orig/drivers/char/tty_io.c
+++ linux-2.6.16.9/drivers/char/tty_io.c
@@ -2706,7 +2706,11 @@ static void __do_SAK(void *arg)
}
task_lock(p);
if (p->files) {
- rcu_read_lock();
+ /*
+ * We don't take a ref to the file, so we must
+ * hold ->file_lock instead.
+ */
+ spin_lock(&p->files->file_lock);
fdt = files_fdtable(p->files);
for (i=0; i < fdt->max_fds; i++) {
filp = fcheck_files(p->files, i);
@@ -2721,7 +2725,7 @@ static void __do_SAK(void *arg)
break;
}
}
- rcu_read_unlock();
+ spin_unlock(&p->files->file_lock);
}
task_unlock(p);
} while_each_task_pid(session, PIDTYPE_SID, p);
--- linux-2.6.16.9.orig/fs/locks.c
+++ linux-2.6.16.9/fs/locks.c
@@ -2212,7 +2212,12 @@ void steal_locks(fl_owner_t from)
lock_kernel();
j = 0;
- rcu_read_lock();
+
+ /*
+ * We are not taking a ref to the file structures, so
+ * we need to acquire ->file_lock.
+ */
+ spin_lock(&files->file_lock);
fdt = files_fdtable(files);
for (;;) {
unsigned long set;
@@ -2230,7 +2235,7 @@ void steal_locks(fl_owner_t from)
set >>= 1;
}
}
- rcu_read_unlock();
+ spin_unlock(&files->file_lock);
unlock_kernel();
}
EXPORT_SYMBOL(steal_locks);
--- linux-2.6.16.9.orig/fs/proc/base.c
+++ linux-2.6.16.9/fs/proc/base.c
@@ -294,16 +294,20 @@ static int proc_fd_link(struct inode *in
files = get_files_struct(task);
if (files) {
- rcu_read_lock();
+ /*
+ * We are not taking a ref to the file structure, so we must
+ * hold ->file_lock.
+ */
+ spin_lock(&files->file_lock);
file = fcheck_files(files, fd);
if (file) {
*mnt = mntget(file->f_vfsmnt);
*dentry = dget(file->f_dentry);
- rcu_read_unlock();
+ spin_unlock(&files->file_lock);
put_files_struct(files);
return 0;
}
- rcu_read_unlock();
+ spin_unlock(&files->file_lock);
put_files_struct(files);
}
return -ENOENT;
@@ -1485,7 +1489,12 @@ static struct dentry *proc_lookupfd(stru
if (!files)
goto out_unlock;
inode->i_mode = S_IFLNK;
- rcu_read_lock();
+
+ /*
+ * We are not taking a ref to the file structure, so we must
+ * hold ->file_lock.
+ */
+ spin_lock(&files->file_lock);
file = fcheck_files(files, fd);
if (!file)
goto out_unlock2;
@@ -1493,7 +1502,7 @@ static struct dentry *proc_lookupfd(stru
inode->i_mode |= S_IRUSR | S_IXUSR;
if (file->f_mode & 2)
inode->i_mode |= S_IWUSR | S_IXUSR;
- rcu_read_unlock();
+ spin_unlock(&files->file_lock);
put_files_struct(files);
inode->i_op = &proc_pid_link_inode_operations;
inode->i_size = 64;
@@ -1503,7 +1512,7 @@ static struct dentry *proc_lookupfd(stru
return NULL;
out_unlock2:
- rcu_read_unlock();
+ spin_unlock(&files->file_lock);
put_files_struct(files);
out_unlock:
iput(inode);
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 17/22] IPC: access to unmapped vmalloc area in grow_ary()
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (13 preceding siblings ...)
2006-04-21 4:39 ` [patch 18/22] Fix file lookup without ref Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 16/22] m41t00: fix bitmasks when writing to chip Greg KH
` (6 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Alexey Kuznetsov,
Kirill Korotaev, Greg Kroah-Hartman
[-- Attachment #1: ipc-access-to-unmapped-vmalloc-area-in-grow_ary.patch --]
[-- Type: text/plain, Size: 1010 bytes --]
>From Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
[PATCH] IPC: access to unmapped vmalloc area in grow_ary()
grow_ary() should not copy struct ipc_id_ary (it copies new->p, not
new). Due to this, memcpy() src pointer could hit unmapped vmalloc page
when near page boundary.
Found during OpenVZ stress testing
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
ipc/util.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- linux-2.6.16.9.orig/ipc/util.c
+++ linux-2.6.16.9/ipc/util.c
@@ -182,8 +182,7 @@ static int grow_ary(struct ipc_ids* ids,
if(new == NULL)
return size;
new->size = newsize;
- memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
- sizeof(struct ipc_id_ary));
+ memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
for(i=size;i<newsize;i++) {
new->p[i] = NULL;
}
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 16/22] m41t00: fix bitmasks when writing to chip
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (14 preceding siblings ...)
2006-04-21 4:39 ` [patch 17/22] IPC: access to unmapped vmalloc area in grow_ary() Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 15/22] Open IPMI BT overflow Greg KH
` (5 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, David Barksdale,
Jean Delvare, Greg Kroah-Hartman
[-- Attachment #1: m41t00-fix-bitmasks-when-writing-to-chip.patch --]
[-- Type: text/plain, Size: 1649 bytes --]
From: David Barksdale <amatus@ocgnet.org>
[PATCH] m41t00: fix bitmasks when writing to chip
Fix the bitmasks used when writing to the M41T00 registers.
The original code used a mask of 0x7f when writing to each register,
this is incorrect and probably the result of a copy-paste error. As a
result years from 1980 to 1999 will be read back as 2000 to 2019.
Signed-off-by: David Barksdale <amatus@ocgnet.org>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/i2c/chips/m41t00.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- linux-2.6.16.9.orig/drivers/i2c/chips/m41t00.c
+++ linux-2.6.16.9/drivers/i2c/chips/m41t00.c
@@ -129,13 +129,13 @@ m41t00_set_tlet(ulong arg)
if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
|| (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
< 0)
- || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
+ || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
< 0)
- || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
+ || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
< 0)
- || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
+ || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
< 0)
- || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
+ || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
< 0))
dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 15/22] Open IPMI BT overflow
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (15 preceding siblings ...)
2006-04-21 4:39 ` [patch 16/22] m41t00: fix bitmasks when writing to chip Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 14/22] x86: be careful about tailcall breakage for sys_opentoo Greg KH
` (4 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Corey Minyard,
Greg Kroah-Hartman
[-- Attachment #1: open-ipmi-bt-overflow.patch --]
[-- Type: text/plain, Size: 1188 bytes --]
From: Heikki Orsila <shd@jolt.modeemi.cs.tut.fi>
[PATCH] Open IPMI BT overflow
I was looking into random driver code and found a suspicious looking
memcpy() in drivers/char/ipmi/ipmi_bt_sm.c on 2.6.17-rc1:
if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
return -1;
...
memcpy(bt->write_data + 3, data + 1, size - 1);
where sizeof bt->write_data is IPMI_MAX_MSG_LENGTH. It looks like the
memcpy would overflow by 2 bytes if size == IPMI_MAX_MSG_LENGTH. A patch
attached to limit size to (IPMI_MAX_LENGTH - 2).
Cc: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/ipmi/ipmi_bt_sm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.9.orig/drivers/char/ipmi/ipmi_bt_sm.c
+++ linux-2.6.16.9/drivers/char/ipmi/ipmi_bt_sm.c
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct s
{
unsigned int i;
- if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+ if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
return -1;
if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 14/22] x86: be careful about tailcall breakage for sys_opentoo
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (16 preceding siblings ...)
2006-04-21 4:39 ` [patch 15/22] Open IPMI BT overflow Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 22/22] Add more prevent_tail_call() Greg KH
` (3 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Greg Kroah-Hartman
[-- Attachment #1: x86-be-careful-about-tailcall-breakage-for-sys_open-too.patch --]
[-- Type: text/plain, Size: 2045 bytes --]
From: Linus Torvalds <torvalds@osdl.org>
x86: be careful about tailcall breakage for sys_open[at] too
Came up through a quick grep for other cases similar to the ftruncate()
one in commit 0a489cb3b6a7b277030cdbc97c2c65905db94536.
Also, add a comment, so that people who read the code understand why we
do what looks like a no-op.
(Again, this won't actually matter to any sane user, since libc will
save and restore the register gcc stomps on, but it's still wrong to
stomp on it)
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/open.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- linux-2.6.16.9.orig/fs/open.c
+++ linux-2.6.16.9/fs/open.c
@@ -331,6 +331,7 @@ out:
asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
{
long ret = do_sys_ftruncate(fd, length, 1);
+ /* avoid REGPARM breakage on x86: */
prevent_tail_call(ret);
return ret;
}
@@ -345,6 +346,7 @@ asmlinkage long sys_truncate64(const cha
asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
{
long ret = do_sys_ftruncate(fd, length, 0);
+ /* avoid REGPARM breakage on x86: */
prevent_tail_call(ret);
return ret;
}
@@ -1087,20 +1089,30 @@ long do_sys_open(int dfd, const char __u
asmlinkage long sys_open(const char __user *filename, int flags, int mode)
{
+ long ret;
+
if (force_o_largefile())
flags |= O_LARGEFILE;
- return do_sys_open(AT_FDCWD, filename, flags, mode);
+ ret = do_sys_open(AT_FDCWD, filename, flags, mode);
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
EXPORT_SYMBOL_GPL(sys_open);
asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
int mode)
{
+ long ret;
+
if (force_o_largefile())
flags |= O_LARGEFILE;
- return do_sys_open(dfd, filename, flags, mode);
+ ret = do_sys_open(dfd, filename, flags, mode);
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
EXPORT_SYMBOL_GPL(sys_openat);
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 22/22] Add more prevent_tail_call()
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (17 preceding siblings ...)
2006-04-21 4:39 ` [patch 14/22] x86: be careful about tailcall breakage for sys_opentoo Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:39 ` [patch 21/22] alim15x3: ULI M-1573 south Bridge support Greg KH
` (2 subsequent siblings)
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, OGAWA Hirofumi,
Greg Kroah-Hartman
[-- Attachment #1: add-more-prevent_tail_call.patch --]
[-- Type: text/plain, Size: 4609 bytes --]
From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[PATCH] Add more prevent_tail_call()
Those also break userland regs like following.
00000000 <sys_chown16>:
0: 0f b7 44 24 0c movzwl 0xc(%esp),%eax
5: 83 ca ff or $0xffffffff,%edx
8: 0f b7 4c 24 08 movzwl 0x8(%esp),%ecx
d: 66 83 f8 ff cmp $0xffffffff,%ax
11: 0f 44 c2 cmove %edx,%eax
14: 66 83 f9 ff cmp $0xffffffff,%cx
18: 0f 45 d1 cmovne %ecx,%edx
1b: 89 44 24 0c mov %eax,0xc(%esp)
1f: 89 54 24 08 mov %edx,0x8(%esp)
23: e9 fc ff ff ff jmp 24 <sys_chown16+0x24>
where the tailcall at the end overwrites the incoming stack-frame.
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/uid16.c | 59 ++++++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 46 insertions(+), 13 deletions(-)
--- linux-2.6.16.9.orig/kernel/uid16.c
+++ linux-2.6.16.9/kernel/uid16.c
@@ -20,43 +20,67 @@
asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gid_t group)
{
- return sys_chown(filename, low2highuid(user), low2highgid(group));
+ long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_gid_t group)
{
- return sys_lchown(filename, low2highuid(user), low2highgid(group));
+ long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
{
- return sys_fchown(fd, low2highuid(user), low2highgid(group));
+ long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
{
- return sys_setregid(low2highgid(rgid), low2highgid(egid));
+ long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setgid16(old_gid_t gid)
{
- return sys_setgid(low2highgid(gid));
+ long ret = sys_setgid(low2highgid(gid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
{
- return sys_setreuid(low2highuid(ruid), low2highuid(euid));
+ long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setuid16(old_uid_t uid)
{
- return sys_setuid(low2highuid(uid));
+ long ret = sys_setuid(low2highuid(uid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
{
- return sys_setresuid(low2highuid(ruid), low2highuid(euid),
- low2highuid(suid));
+ long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
+ low2highuid(suid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user *euid, old_uid_t __user *suid)
@@ -72,8 +96,11 @@ asmlinkage long sys_getresuid16(old_uid_
asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
{
- return sys_setresgid(low2highgid(rgid), low2highgid(egid),
- low2highgid(sgid));
+ long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
+ low2highgid(sgid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user *egid, old_gid_t __user *sgid)
@@ -89,12 +116,18 @@ asmlinkage long sys_getresgid16(old_gid_
asmlinkage long sys_setfsuid16(old_uid_t uid)
{
- return sys_setfsuid(low2highuid(uid));
+ long ret = sys_setfsuid(low2highuid(uid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
asmlinkage long sys_setfsgid16(old_gid_t gid)
{
- return sys_setfsgid(low2highgid(gid));
+ long ret = sys_setfsgid(low2highgid(gid));
+ /* avoid REGPARM breakage on x86: */
+ prevent_tail_call(ret);
+ return ret;
}
static int groups16_to_user(old_gid_t __user *grouplist,
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 21/22] alim15x3: ULI M-1573 south Bridge support
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (18 preceding siblings ...)
2006-04-21 4:39 ` [patch 22/22] Add more prevent_tail_call() Greg KH
@ 2006-04-21 4:39 ` Greg KH
2006-04-21 4:40 ` [patch 20/22] apm: fix Armada laptops again Greg KH
2006-04-21 4:40 ` [patch 19/22] fbdev: Fix return error of fb_write Greg KH
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan,
Bartlomiej Zolnierkiewicz, Greg Kroah-Hartman
[-- Attachment #1: alim15x3-uli-m-1573-south-bridge-support.patch --]
[-- Type: text/plain, Size: 1181 bytes --]
From: KAI.HSU <windsboy@gmail.com>
[PATCH] alim15x3: ULI M-1573 south Bridge support
>From http://bugzilla.kernel.org/show_bug.cgi?id=6358
The alim15x3.c havn't been update for 3 years. Recently when we use this
"ULI M1573" south bridge chip found that can't mount CDROM(VCD) smoothly,
must waiting for a long time. After I check the "ULI M1573" south bridge
datasheet, I found the reason. The reason is the "ULI M1573" version in
the Linux is "0xC7" not "0xC4" anymore So I was modified the source than it
was successed.
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/ide/pci/alim15x3.c | 2 ++
1 file changed, 2 insertions(+)
--- linux-2.6.16.9.orig/drivers/ide/pci/alim15x3.c
+++ linux-2.6.16.9/drivers/ide/pci/alim15x3.c
@@ -731,6 +731,8 @@ static unsigned int __devinit ata66_ali1
if(m5229_revision <= 0x20)
tmpbyte = (tmpbyte & (~0x02)) | 0x01;
+ else if (m5229_revision == 0xc7)
+ tmpbyte |= 0x03;
else
tmpbyte |= 0x01;
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 20/22] apm: fix Armada laptops again
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (19 preceding siblings ...)
2006-04-21 4:39 ` [patch 21/22] alim15x3: ULI M-1573 south Bridge support Greg KH
@ 2006-04-21 4:40 ` Greg KH
2006-04-21 4:40 ` [patch 19/22] fbdev: Fix return error of fb_write Greg KH
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Samuel Thibault,
Jordan Crouse, Zachary Amsden, Greg Kroah-Hartman
[-- Attachment #1: apm-fix-armada-laptops-again.patch --]
[-- Type: text/plain, Size: 1228 bytes --]
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
[PATCH] apm: fix Armada laptops again
Fix the "apm: set display: Interface not engaged" error on Armada laptops
again.
Jordan said:
I think this is fine. It seems to me that this may be the fault of one or
both of the APM solutions handling this situation in a non-standard way, but
since APM is used very little on the Geode, and I have direct access to our
BIOS folks, if this problem comes up with a customer again, we'll solve it
from the firmware.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: "Jordan Crouse" <jordan.crouse@amd.com>
Cc: Zachary Amsden <zach@vmware.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/i386/kernel/apm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.9.orig/arch/i386/kernel/apm.c
+++ linux-2.6.16.9/arch/i386/kernel/apm.c
@@ -1081,7 +1081,7 @@ static int apm_console_blank(int blank)
break;
}
- if (error == APM_NOT_ENGAGED && state != APM_STATE_READY) {
+ if (error == APM_NOT_ENGAGED) {
static int tried;
int eng_error;
if (tried++ == 0) {
--
^ permalink raw reply [flat|nested] 23+ messages in thread* [patch 19/22] fbdev: Fix return error of fb_write
2006-04-21 4:37 ` [patch 00/22] 2.6.16-stable review cycle Greg KH
` (20 preceding siblings ...)
2006-04-21 4:40 ` [patch 20/22] apm: fix Armada laptops again Greg KH
@ 2006-04-21 4:40 ` Greg KH
21 siblings, 0 replies; 23+ messages in thread
From: Greg KH @ 2006-04-21 4:40 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Forbes, Zwane Mwaikambo, Theodore Ts'o, Randy Dunlap,
Dave Jones, Chuck Wolber, torvalds, akpm, alan, Antonino Daplas,
Greg Kroah-Hartman
[-- Attachment #1: fbdev-fix-return-error-of-fb_write.patch --]
[-- Type: text/plain, Size: 1422 bytes --]
From: Antonino A. Daplas <adaplas@gmail.com>
[PATCH] fbdev: Fix return error of fb_write
Fix return code of fb_write():
If at least 1 byte was transferred to the device, return number of bytes,
otherwise:
- return -EFBIG - if file offset is past the maximum allowable offset or
size is greater than framebuffer length
- return -ENOSPC - if size is greater than framebuffer length - offset
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/video/fbmem.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- linux-2.6.16.9.orig/drivers/video/fbmem.c
+++ linux-2.6.16.9/drivers/video/fbmem.c
@@ -669,13 +669,19 @@ fb_write(struct file *file, const char _
total_size = info->fix.smem_len;
if (p > total_size)
- return 0;
+ return -EFBIG;
- if (count >= total_size)
+ if (count > total_size) {
+ err = -EFBIG;
count = total_size;
+ }
+
+ if (count + p > total_size) {
+ if (!err)
+ err = -ENOSPC;
- if (count + p > total_size)
count = total_size - p;
+ }
buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
GFP_KERNEL);
@@ -717,7 +723,7 @@ fb_write(struct file *file, const char _
kfree(buffer);
- return (err) ? err : cnt;
+ return (cnt) ? cnt : err;
}
#ifdef CONFIG_KMOD
--
^ permalink raw reply [flat|nested] 23+ messages in thread