Fix a use-after-free bug in userspace verbs cleanup: we can't touch
mr->device after we free mr by calling ib_dereg_mr().
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This patch fixes several instances of hwmon drivers kfree'ing the "wrong"
pointer; the existing code works somewhat by accident.
(akpm: plucked from Greg's queue based on lkml discussion. Finishes off the
patch from Jon Corbet)
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Coverity uncovered an off-by-one error in the fscpos driver, in function
set_temp_reset(). Writing to the temp3_reset sysfs file will lead to an
array overrun, in turn causing an I2C write to a random register of the
FSC Poseidon chip. Additionally, writing to temp1_reset and temp2_reset
will not work as expected. The fix is straightforward.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
spinlock used in irq handler should be initialized before registering
irq, even if we know that our device has interrupts disabled; handler
is registered shared and taking spinlock is done unconditionally. As
it is, we can and do get oopsen on boot for some configuration, depending
on irq routing - I've got a reproducer.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Ben Collins <bcollins@debian.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
In qdio_get_micros() volatile in return type is plain noise (even with old
gccisms it would make no sense - noreturn function returning __u64 is a
bit odd ;-)
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
The adm9240 driver, in adm9240_detect(), allocates a structure. The
error path attempts to kfree() ->client field of it (second one),
resulting in an oops (or slab corruption) if the hardware is not present.
->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in
${HWMON}_data structure, but fix them too.
Signed-off-by: Jonathan Corbet <corbet@lwn.net
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
You spelt heuristic wrongly. Also reformatted to 80 columns,
ignore the diff and fix the typo if you prefer that.
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Writing even a disabled value seems to mess up some matrox graphics
cards. It may be a card-related issue, but we may also be writing
reserved low bits in the result.
This was a fall-out of switching x86 over to the generic PCI resource
allocation code, and needs more debugging. In particular, the old x86
code defaulted to not doing any resource allocations at all for ROM
resources.
In the meantime, this has been reported to make X happier by Helge
Hafting <helgehaf@aitel.hist.no>.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
It may seem small, but most cards need much less, if any, and this not
only makes the code adhere to the comment, it seems to fix a boot-time
lockup on a ThinkPad 380XD laptop reported by Tero Roponen <teanropo@cc.jyu.fi>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
The tg3_abort_hw() call in tg3_test_loopback() is causing lockups on
some devices. tg3_abort_hw() disables the memory arbiter, causing
tg3_reset_hw() to hang when it tries to write the pre-reset signature.
tg3_abort_hw() should only be called after the pre-reset signature has
been written. This is all done in tg3_reset_hw() so the tg3_abort_hw()
call is unnecessary and can be removed.
[ Also bump driver version and release date. -DaveM ]
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
One critical fix and two minor fixes for 2.6.13-rc7:
- Max depth must currently be 2 to allow barriers to function on SCSI
- Prefer sync request over async in choosing the next request
- Never allow async request to preempt or disturb the "anticipation" for
a single cfq process context. This is as-designed, the code right now
is buggy in that area.
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
There's a "return the wrong SKB" error in the GL620A cable minidriver
(for "usbnet") which can oops. This would not appear when talking
Linux-to-Linux, only Linux-to-Windows (for recent Linuxes).
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
remove the bogus games with explicit ifdefs on __CHECKER__
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
extern declaration followed by static in drivers/serial/m32r_sio.c
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
since sparc32 Kconfig includes drivers/char/Kconfig (instead of duplicating
its parts) we need several new dependencies there to exclude the stuff
broken on sparc32 and not excluded by existing dependencies.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
AMBA_PL010 is broken on arm/versatile; marked as such
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
acornscsi had been broken for a long time; marked as such
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
parport_pc shouldn't be picked on m32r (no asm/parport.h, for starters)
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
airo_cs is broken on m32r; marked as such. [Proper fix would involve
separating PCI-dependent parts and making sure they don't get in the
way _and_ arranging for asm/scatterlist.h getting picked on m32r]
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
ISA parts of tms380tr are using ISA DMA helpers and should depend on
ISA_DMA_API.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
arv uses constants provided only by include/asm-m32r/m32700ut/m32700ut_lan.h
It won't build for any subarchitecture other than M32700UT; marked as such.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
infiniband uses PCI helpers all over the place (including the core parts) and
won't build without PCI.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
PMAC_BACKLIGHT is broken on ppc64; marked as such
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
HISAX_FRITZPCI is broken on ppc64; marked as such
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
genrtc is not for m32r; marked as such. Probably ought to put that into
arch/* - list of "don't build it on <platform>" is getting too long.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
epca is broken on 64bit; marked as such
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Noticed by Coverity checker.
(akpm: I stole this from Greg's tree and used the (IMO) tidier sizeof(*p)
construct).
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
We weren't actually waking up the md thread after setting
MD_RECOVERY_NEEDED when assembling an array, so it is possible to lose a
race and not actually start resync.
So add a call to md_wakeup_thread, and while we are at it, remove all the
"if (mddev->thread)" guards as md_wake_thread does its own checking.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
The purpose of this patch:
- Adopt the DMA API (jazzsonic, macsonic & core driver).
- Adopt the driver model (macsonic).
This part was cribbed from jazzsonic. As a consequence, macsonic once
again works as a module. Driver model is also used by the DMA calls.
- Support 16 bit cards (macsonic & core driver, also affects jazzsonic)
This code was adapted from the mac68k linux 2.2 kernel, where it has
languished for a long time.
- Support more 32-bit mac cards (macsonic)
Also from mac68k repo.
- Zero-copy buffer handling (core driver)
Provides a nice performance improvement. The new algorithm incidentally
helped to replace the old Jazz DMA code.
The patch was tested on a variety of macs (several 32-bit quadra built-in
NICs, a 16-bit LC PDS NIC and a 16-bit comm-slot NIC), and also on MIPS
Jazz.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
As SII reports that only original 3112's are affected by M15W quirk,
This patch adds SIL_FLAG_MOD15WRITE to selectively apply M15W quirk
depending on chipsets. As of yet, we don't know exactly which PCI IDs
are for original 3112, so M15W quirk is applied to all except for 3512
and 3124. Once more info is avaliable, we can change some of these
sil_3112_m15w's to sil_3112.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
[PATCH libata-dev-2.6:upstream] implement ata_poll_qc_complete and use it in polling functions
Previously, libata polling functions turned irq back on and completed
qc commands without holding host lock. This creates a race condition
between the polling task and interrupts from other ports on the same
host set or spurious interrupt from itself.
This patch implements ata_poll_qc_complete which enables irq and
completes qc atomically and convert all polling functions.
Note: atapi_packet_task() didn't use to turn irq back on or clear
ATA_FLAG_NOINTR on error exits. This patch makes it use
ata_poll_qc_complete which does both.
Note: With this change, ALL invocations of ata_qc_complete() are now
done under host_set lock.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Interrupts from devices sharing the same IRQ could cause
ata_host_intr to finish commands being processed by atapi_packet_task
if the commands are using ATA_PROT_ATAPI_NODATA or ATA_PROT_ATAPI_DMA
protocol. This is because libata interrupt handler is unaware that
interrupts are not expected during that period. This patch adds
ATA_FLAG_NOINTR flag to tell the interrupt handler that we're not
expecting interrupts.
Note that once proper HSM is implemented for interrupt-driven PIO,
this should be merged into it and this flag will be removed.
ahci.c is a different kind of beast, so it's left alone.
* The following drivers use ata_qc_issue_prot and ata_interrupt, so
changes in libata core will do.
ata_piix sata_sil sata_svw sata_via sata_sis sata_uli
* The following drivers use ata_qc_issue_prot and custom intr handler.
They need this change to work correctly.
sata_nv sata_vsc
* The following drivers use custom issue function and intr handler.
Currently all custom issue functions don't support ATAPI, so this
change is irrelevant, updated for consistency and to avoid later
mistakes.
sata_promise sata_qstor sata_sx4
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Patch: fix wrong HD activity control by ahci driver
The ahci driver 1.0 sets the SActive bit on every transaction,
causing the LED to light up. The SActive bit is used only for
native command queuing (NCQ) which the current driver version
doesn't implement. Resetting the SActive bit is the device's
responsibility (by sending a "Set Device Bits FIS" to the
host adapter) but this is not required in response to
non-NCQ commands, and (most) devices don't. Thus the LED
stays always on. This patch fixes the LED behavior.
Spec references:
http://www.intel.com/technology/serialata/pdf/rev1_1.pdf, sec. 3.3.13, 5.5.1
http://www.serialata.org/docs/serialata10a.pdfhttp://www.intel.com/design/storage/papers/25266401.pdf
Signed-off-by: Martin.Wilck@fujitsu-siemens.com
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
The Promise TX4200 is a 4-port SATA controller based on the PDC40519 chip. It
meets the description of the 20319, so just a simple ID needs to be added to
support this hardware. Thanks to Martin Povolný for testing.
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Otto Meier recently submitted a patch to support the PDC40718 chip (marketed
as SATA300 TX4, a 4-port SATA controller).
Signed-off-by: Otto Meier <gf435@gmx.net>
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Description:
After calling the completion callback, the libata error handler might be
running and getting atapi sense data. Clearing the ATA_QCFLAG_ACTIVE flag
at this point might interfere with the libata error handler.
Changes:
- Clear the ATA_QCFLAG_ACTIVE flag before calling the completion callback
(and also before the error handler)
- Add some comment
Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
[PATCH] [NET] mv643xx: add workaround for HW checksum generation bug
The hardware checksum generator on the mv64xxx occasionally generates
an incorrect checksum. This patch works around the issue and enables
hardware checksum generation.
Signed-off-by: Dale Farnsworth <dale@farnsworth.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Roland Dreier