aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* [NETLINK]: Fix use-after-free in netlink_recvmsgPatrick McHardy2006-03-121-2/+3
| | | | | | | | | | The skb given to netlink_cmsg_recv_pktinfo is already freed, move it up a few lines. Coverity #948 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [XFRM]: Fix leak in ah6_inputPatrick McHardy2006-03-121-1/+1
| | | | | | | | | tmp_hdr is not freed when ipv6_clear_mutable_options fails. Coverity #650 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NET_SCHED]: act_api: fix skb leak in error pathPatrick McHardy2006-03-121-1/+1
| | | | | | | | | | The skb is allocated by the function, so it needs to be freed instead of trimmed on overrun. Coverity #614 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* [NETFILTER]: nfnetlink_queue: fix possible NULL-ptr dereferencePatrick McHardy2006-03-121-1/+5
| | | | | | | | | | Fix NULL-ptr dereference when a config message for a non-existant queue containing only an NFQA_CFG_PARAMS attribute is received. Coverity #433 Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'upstream-fixes' of ↵Linus Torvalds2006-03-121-10/+4
|\ | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev: [PATCH] ahci: fix NULL pointer dereference detected by Coverity
| * Merge branch 'master'Jeff Garzik2006-03-118-43/+62
| |\
| * | [PATCH] ahci: fix NULL pointer dereference detected by CoverityTejun Heo2006-03-111-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix NULL pointer dereference detected by the Coverity checker. Kill dev -> pdev -> dev conversion while at it. Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Adrian Bunk <bunk@stusta.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds2006-03-1210-23/+27
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] iwmmxt thread state alignment [ARM] 3350/1: Enable 1-wire on ARM [ARM] 3356/1: Workaround for the ARM1136 I-cache invalidation problem [ARM] 3355/1: NSLU2: remove propmt depends [ARM] 3354/1: NAS100d: fix power led handling [ARM] Fix muldi3.S
| * | | [ARM] iwmmxt thread state alignmentRussell King2006-03-124-13/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the reliance of iwmmxt on hand coded alignments. Since thread_info is always 8K aligned, specifying that fpstate is 8-byte aligned achieves the same effect without needing to resort to hand coded alignments. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | | [ARM] 3350/1: Enable 1-wire on ARMAlessandro Zummo2006-03-101-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Alessandro Zummo This patches add the 1-wire drivers to the ARM Kconfig. Signed-off-by: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | | [ARM] 3356/1: Workaround for the ARM1136 I-cache invalidation problemCatalin Marinas2006-03-102-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Catalin Marinas ARM1136 erratum 371025 (category 2) specifies that, under rare conditions, an invalidate I-cache by MVA (line or range) operation can fail to invalidate a cache line. The recommended workaround is to either invalidate the entire I-cache or invalidate the range by set/way rather than MVA. Note that for a 16K cache size, invalidating a 4K page by set/way is equivalent to invalidating the entire I-cache. Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | | [ARM] 3355/1: NSLU2: remove propmt dependsAlessandro Zummo2006-03-081-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Alessandro Zummo The patch that would have made the NSLU2 kernel non compatible with other ixp4xx machs never entered the kernel. So it is actually safe to remove the prompt dependencies. Signed-off-by: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | | [ARM] 3354/1: NAS100d: fix power led handlingAlessandro Zummo2006-03-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Alessandro Zummo Disable GPIO clocks to allow the power led to work properly. Signed-off-by: Alessandro Zummo <a.zummo@towertech.it> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | | [ARM] Fix muldi3.SRussell King2006-03-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When shifting the low-parts of signed numbers, a logical shift should be used to avoid sign-extending a bit which isn't a sign bit. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* | | | [TCP]: Fix tcp_tso_should_defer() when limit>=65536David S. Miller2006-03-111-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | That's >= a full sized TSO frame, so we should always return 0 in that case. Based upon a report and initial patch from Lachlan Andrew, final patch suggested by Herbert Xu. Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | [NETFILTER]: Fix wrong option spelling in Makefile for CONFIG_BRIDGE_EBT_ULOGGregor Maier2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Gregor Maier <gregor@net.in.tum.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | [IPV6]: fix ipv6_saddr_score struct elementBrian Haley2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The scope element in the ipv6_saddr_score struct used in ipv6_dev_get_saddr() is an unsigned integer, but __ipv6_addr_src_scope() returns a signed integer (and can return -1). Signed-off-by: Brian Haley <brian.haley@hp.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | [TG3] tg3_bus_string(): remove dead codeAdrian Bunk2006-03-111-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Coverity checker spotted this dead code (note that (clock_ctrl == 7) is already handled above). Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | [TUN]: Fix leak in tun_get_user()Dave Jones2006-03-111-1/+4
| |_|/ |/| | | | | | | | | | | | | | | | | | | | We're leaking an skb in a failure path in this function. Coverity #632 Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | Linux 2.6.16-rc6Linus Torvalds2006-03-111-1/+1
| | | | | | | | | | | | Gaah. Delayed. But all the better for it!
* | | [PATCH] 3c509: bus registration fixAndrew Morton2006-03-111-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Don't call eisa_driver_unregister() if eisa_driver_register() failed. - Properly propagate error values. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | [PATCH] de620: fix section mismatch warningSam Ravnborg2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In latest -mm de620 gave following warning: WARNING: drivers/net/de620.o - Section mismatch: reference to \ .init.text:de620_probe from .text between 'init_module' (at offset \ 0x1682) and 'cleanup_module' init_module() call de620_probe() which is declared __init. Fix is to declare init_module() __init too. Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | [PATCH] NE2000 Kconfig help entry improvementJesper Juhl2006-03-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Improve reference to PCI NE2K support in ISA NE2K documentation. Original 2.4 patch From: Ged Haywood <ged@jubileegroup.co.uk> Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | [PATCH] dl2k: DMA freeing errorJon Mason2006-03-111-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes an error in the dl2k driver's DMA mapping/unmapping. The adapter uses the upper 16bits of the DMA address for the buffer size. However, this is not masked off when referencing the DMA address, and can lead to errors by trying to free a DMA address out of range. Thanks, Jon Signed-off-by: Jon Mason <jdmason@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | [PATCH] Wrong return value corrupts free object in e1000 driverDavid S. Miller2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT instead of one of the NETDEV_TX_* error codes. In fact, it frees up the SKB before returning this. This makes the queueing layer think the packet should be requeued and subsequently we corrupt a freed object. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | Merge branch 'for-jeff' of ↵Jeff Garzik2006-03-112-24/+34
|\ \ \ | |_|/ |/| | | | | git://electric-eye.fr.zoreil.com/home/romieu/linux-2.6
| * | sky2: truncate oversize packetsStephen Hemminger2006-03-091-5/+11
| | | | | | | | | | | | | | | | | | | | | Turn on truncation to prevent getting choked by frames larger than expected. Without this fix, driver hangs after receiving an oversize packet. Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
| * | sky2: force early transmit interruptsStephen Hemminger2006-03-091-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid premature transmit ring full conditions. Force a transmit status interrupt if transmit ring gets nearly full and after a TSO send. Allow more entries in transmit ring to be used if dma_addr is 32 bits Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
| * | sky2: not random enoughStephen Hemminger2006-03-091-2/+1
| | | | | | | | | | | | | | | | | | | | | Don't use sky2 to seed random pool beacause the network packet arrival time will not be truly random due to NAPI and interrupt mitigation. Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
| * | de2104x: fix the TX watchdogFrancois Romieu2006-03-091-0/+2
| | | | | | | | | | | | | | | | | | | | | Insert de_init_rings() to reinit the rings before de_init_hw() tries to access them again. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
| * | de2104x: prevent interrupt before the interrupt handler is registeredFrancois Romieu2006-03-091-13/+11
| | | | | | | | | | | | | | | | | | | | | de_init_hw enables the irq thus it must be issued after request_irq. Signed-off-by: Martin Michlmayr <tbm@cyrius.com> Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
* | | [PATCH] radeonfb: Fix static array overrunAntonino A. Daplas2006-03-111-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | radeonfb_parse_monitor_layout() will produce an array overrun if passed with a substring of length higher than 4 (ie, "XXXXX,YYYYYY"). Coverity Bug 494 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] aty128fb: Fix array overrunAntonino A. Daplas2006-03-111-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix static array overrun Coverity Bug 556 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] tdfxfb: Fix buffer overrunAntonino A. Daplas2006-03-111-19/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pseudo_palette has room only for 16 entries, but tdfxfb_setcolreg may attempt to write more. Coverity Bug 557 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] intelfb: Fix buffer overrunAntonino A. Daplas2006-03-111-24/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will attempt to write more. Coverity Bug 558 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] savagefb: Fix kfree before useAntonino A. Daplas2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | par->edid is kfree'd before using in fb_edid_to_monspecs() Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] imsttfb: Fix resource leakAntonino A. Daplas2006-03-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The struct info and device resource may not be released in the driver's error path. Fix. Coverity Bug 671 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] s1d13xxxfb: Fix resource leakAntonino A. Daplas2006-03-111-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct info may not be released in the driver's error path. Coverity Bug 672 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] arcfb: Fix dereference before NULL checkAntonino A. Daplas2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | info->par is dereferenced before info is checked for NULL. Fix. Coverity Bug 833 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] kyrofb: Fix uninitialized valueAntonino A. Daplas2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initialize Variable 'count' in DisableVGA to zero. Coverity Bug 874 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] arcfb: Fix uninitialized valueAntonino A. Daplas2006-03-111-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove insignificant and uninitialized variable "count" from arcfb_lcd_update_page. Coverity Bug 894 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] neofb: Fix uninitialized valueAntonino A. Daplas2006-03-111-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove insignificant and unitialized variable "waitcycles" from neo2200_sync. Coverity Bug 895 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] LSM mail list has movedChris Wright2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | LSM mail list has moved. Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] update email addressChris Wright2006-03-112-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | Update email address. Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] remove __put_task_struct_cb export againChristoph Hellwig2006-03-113-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch '[PATCH] RCU signal handling' [1] added an export for __put_task_struct_cb, a put_task_struct helper newly introduced in that patch. But the put_task_struct couldn't be used modular previously as __put_task_struct wasn't exported. There are not callers of it in modular code, and it shouldn't be exported because we don't want drivers to hold references to task_structs. This patch removes the export and folds __put_task_struct into __put_task_struct_cb as there's no other caller. [1] http://www2.kernel.org/git/gitweb.cgi?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e56d090310d7625ecb43a1eeebd479f04affb48b Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Paul E. McKenney <paulmck@us.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] Altix: small ioc4 oversightPat Gefre2006-03-111-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | Get rid of the local 'flip' variable and no need to 'trim' the buffer. Signed-off-by: Patrick Gefre <pfg@sgi.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] selinux: tracer SID fixStephen Smalley2006-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix SELinux to not reset the tracer SID when the child is already being traced, since selinux_ptrace is also called by proc for access checking outside of the context of a ptrace attach. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: James Morris <jmorris@namei.org> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] edac: disable a few sysfs files to avoid them becoming an ABIArjan van de Ven2006-03-111-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Disable (via ugly #if 0's) the 3 sysfs files that I think by now we all agree are very much wrong. These files shouldn't become part of the ABI by the 2.6.16 release, so I rather have this minimal patch merged to disable them for now, the real fix can then come during the 2.6.17 devel window. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] ext3: fix nobh mode for chattr +j inodesBadari Pulavarty2006-03-111-9/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One can do "chattr +j" on a file to change its journalling mode. Fix writeback mode with "nobh" handling for it. Even though, we mount ext3 filesystem in writeback mode with "nobh" option, some one can do "chattr +j" on a single file to force it to do journalled mode. In order to do journaling, ext3_block_truncate_page() need to fallback to default case of creating buffers and adding them to transaction etc. Signed-off-by: Badari Pulavarty <pbadari@us.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] ext3: ext3_symlink should use GFP_NOFS allocations insideKirill Korotaev2006-03-113-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes illegal __GFP_FS allocation inside ext3 transaction in ext3_symlink(). Such allocation may re-enter ext3 code from try_to_free_pages. But JBD/ext3 code keeps a pointer to current journal handle in task_struct and, hence, is not reentrable. This bug led to "Assertion failure in journal_dirty_metadata()" messages. http://bugzilla.openvz.org/show_bug.cgi?id=115 Signed-off-by: Andrey Savochkin <saw@saw.sw.com.sg> Signed-off-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
generated by cgit v1.1 at 2024-07-06 14:18:04 +0000