summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2006-01-07Linux 2.6.14.6v2.6.14.6Chris Wright
2006-01-07[PATCH] Fix onboard video on SPARC Blade 100 for 2.6.{13,14,15}Luis F. Ortiz
I have recently been switching from using 2.4.32 on my trusty old Sparc Blade 100 to using 2.6.15 . Some of the problems I ran into were distorted video when the console was active (missing first character, skipped dots) and when running X windows (colored snow, stripes, missing pixels). A quick examination of the 2.6 versus 2.4 source for the ATY driver revealed alot of changes. A closer look at the code/data for the 64GR/XL chip revealed two minor "typos" that the rewriter(s) of the code made. The first is a incorrect clock value (230 .vs. 235) and the second is a missing flag (M64F_SDRAM_MAGIC_PLL). Making both these changes seems to have fixed my problem. I tend to think the 235 value is the correct one, as there is a 29.4 Mhz clock crystal close to the video chip and 235.2 (29.4*8) is too close to 235 to make it a coincidence. The flag for M64F_SDRAM_MAGIC_PLL was dropped during the changes made by adaplas in file revision 1.72 on the old bitkeeper repository. The change relating to the clock rate has been there forever, at least in the 2.6 tree. I'm not sure where to look for the old 2.5 tree or if anyone cares when it happened. On SPARC Blades 100's, which use the ATY MACH64GR video chipset, the clock crystal frequency is 235.2 Mhz, not 230 Mhz. The chipset also requires the use of M64F_SDRAM_MAGIC_PLL in order to setup the PLL properly for the DRAM. Signed-off-by: Luis F. Ortiz <lfo@Polyad.Org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2006-01-07[PATCH] UFS: inode->i_sem is not released in error pathEvgeniy Polyakov
Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Cc: <stable@kernel.org> akpm: obviously correct, OK for -stable immediately. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-01-07[PATCH] sysctl: make sure to terminate strings with a NULLinus Torvalds
This is a slightly more complete fix for the previous minimal sysctl string fix. It always terminates the returned string with a NUL, even if the full result wouldn't fit in the user-supplied buffer. The returned length is the full untruncated length, so that you can tell when truncation has occurred. Signed-off-by: Linus Torvalds <torvalds@osdl.org> [chrisw: inclusive of minimal fix so it's same as upstream] Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2006-01-07[PATCH] Insanity avoidance in /proc (CVE-2005-4605)Linus Torvalds
Insanity avoidance in /proc The old /proc interfaces were never updated to use loff_t, and are just generally broken. Now, we should be using the seq_file interface for all of the proc files, but converting the legacy functions is more work than most people care for and has little upside.. But at least we can make the non-LFS rules explicit, rather than just insanely wrapping the offset or something. Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-01-07[PATCH] ieee80211_crypt_tkip depends on NET_RADIOOlaf Hering
*** Warning: ".wireless_send_event" [net/ieee80211/ieee80211_crypt_tkip.ko] This bug was also reported as kerenl Bugzilla #5551. Signed-off-by: Olaf Hering <olh@suse.de> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-01-07[PATCH] drivers/net/sungem.c: gem_remove_one mustn't be __devexitAdrian Bunk
gem_remove_one() is called from the __devinit gem_init_one(). Therefore, gem_remove_one() mustn't be __devexit. This patch was already included in 2.6.15-rc7. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26Linux 2.6.14.5v2.6.14.5Greg Kroah-Hartman
2005-12-26[PATCH] setting ACLs on readonly mounted NFS filesystems (CVE-2005-3623)Andreas Gruenbacher
We must check for MAY_SATTR before setting acls, which includes checking for read-only exports: the lower-level setxattr operation that eventually sets the acl cannot check export-level restrictions. Bug reported by Martin Walter <mawa@uni-freiburg.de>. Signed-off-by: Andreas Gruenbacher <agruen@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] SCSI: fix transfer direction in scsi_lib and stStefan Richter
SCSI: fix transfer direction in scsi_lib and st scsi_prep_fn and st_init_command could issue WRITE requests with zero buffer length. This may lead to kernel panic or oops with some SCSI low-level drivers. Derived from -rc patches from Jens Axboe and James Bottomley. Patch is reassembled for -stable from patches: [SCSI] fix panic when ejecting ieee1394 ipod [SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic) Depends on patch "SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)". Also modifies the already correct sr_init_command to fully match the corresponding -rc patch. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)Stefan Richter
SCSI: fix transfer direction in sd (kernel panic when ejecting iPod) sd_init_command could issue WRITE requests with zero buffer length. This may lead to kernel panic or oops with some SCSI low-level drivers. Seen with the command "eject /dev/sdX" when disconnecting an iPod: http://marc.theaimsgroup.com/?l=linux1394-devel&m=113399994920181 http://marc.theaimsgroup.com/?l=linux1394-user&m=112152701817435 Derived from -rc patches from Jens Axboe and James Bottomley. Patch is reassembled for -stable from patches: [SCSI] fix panic when ejecting ieee1394 ipod [SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic) Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] kernel/params.c: fix sysfs access with CONFIG_MODULES=nJason Wessel
All the work was done to setup the file and maintain the file handles but the access functions were zeroed out due to the #ifdef. Removing the #ifdef allows full access to all the parameters when CONFIG_MODULES=n. akpm: put it back again, but use CONFIG_SYSFS instead. This patch has already been included in Linus' tree. Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Input: fix an OOPS in HID driverDmitry Torokhov
This patch fixes an OOPS in HID driver when connecting simulation devices generating unknown simulation events. Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Acked-by: Vojtech Pavlik <vojtech@suse.cz> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Perform SA switchover immediately.David S. Miller
When we insert a new xfrm_state which potentially subsumes an existing one, make sure all cached bundles are flushed so that the new SA is used immediately. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix route lifetime.YOSHIFUJI Hideaki
The route expiration time is stored in rt6i_expires in jiffies. The argument of rt6_route_add() for adding a route is not the expiration time in jiffies nor in clock_t, but the lifetime (or time left before expiration) in clock_t. Because of the confusion, we sometimes saw several strange errors (FAILs) in TAHI IPv6 Ready Logo Phase-2 Self Test. The symptoms were analyzed by Mitsuru Chinen <CHINEN@jp.ibm.com>. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix bridge-nf ipv6 length checkBart De Schuymer
A typo caused some bridged IPv6 packets to get dropped randomly, as reported by Sebastien Chaumontet. The patch below fixes this (using skb->nh.raw instead of raw) and also makes the jumbo packet length checking up-to-date with the code in net/ipv6/exthdrs.c::ipv6_hop_jumbo. Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix RTNLGRP definitions in rtnetlink.hKristian Slavov
I reported a problem and gave hints to the solution, but nobody seemed to react. So I prepared a patch against 2.6.14.4. Tested on 2.6.14.4 with "ip monitor addr" and with the program attached, while adding and removing IPv6 address. Both programs didn't receive any messages. Tested 2.6.14.4 + this patch, and both programs received add and remove messages. Signed-off-by: Kristian Slavov <kristian.slavov@nomadiclab.com> Acked-by: Jamal Hadi salim <hadi@cyberus.ca> ACKed-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix incorrect dependency for IP6_NF_TARGET_NFQUEUEPatrick McHardy
IP6_NF_TARGET_NFQUEUE depends on IP6_NF_IPTABLES, not IP_NF_IPTABLES. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix NAT init orderPatrick McHardy
As noticed by Phil Oester, the GRE NAT protocol helper is initialized before the NAT core, which makes registration fail. Change the linking order to make NAT be initialized first. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix hardware rx csum errorsStephen Hemminger
Receiving VLAN packets over a device (without VLAN assist) that is doing hardware checksumming (CHECKSUM_HW), causes errors because the VLAN code forgets to adjust the hardware checksum. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix hardware checksum modificationHerbert Xu
The skb_postpull_rcsum introduced a bug to the checksum modification. Although the length pulled is offset bytes, the origin of the pulling is the GRE header, not the IP header. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] dpt_i2o fix for deadlock conditionSalyzyn, Mark
Miquel van Smoorenburg <miquels@cistron.nl> forwarded me this fix to resolve a deadlock condition that occurs due to the API change in 2.6.13+ kernels dropping the host locking when entering the error handling. They all end up calling adpt_i2o_post_wait(), which if you call it unlocked, might return with host_lock locked anyway and that causes a deadlock. Signed-off-by: Mark Salyzyn <aacraid@adaptec.com> Cc: James Bottomley <James.Bottomley@steeleye.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] apci: fix NULL deref in video/lcd/brightnessYu Luming
Fix Null pointer deref in video/lcd/brightness http://bugzilla.kernel.org/show_bug.cgi?id=5571 Signed-off-by: Yu Luming <luming.yu@gmail.com> Cc: "Brown, Len" <len.brown@intel.com> Signed-off-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@redhat.com>
2005-12-26[PATCH] Fix unbalanced read_unlock_bh in ctnetlinkPatrick McHardy
NFA_NEST calls NFA_PUT which jumps to nfattr_failure if the skb has no room left. We call read_unlock_bh at nfattr_failure for the NFA_PUT inside the locked section, so move NFA_NEST inside the locked section too. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-26[PATCH] Fix CTA_PROTO_NUM attribute size in ctnetlinkKrzysztof Oledzki
CTA_PROTO_NUM is a u_int8_t. Based on oryginal patch by Patrick McHardy <kaber@trash.net> Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14Linux 2.6.14.4v2.6.14.4Greg Kroah-Hartman
2005-12-14[PATCH] Add try_to_freeze to kauditdPierre Ossman
kauditd was causing suspends to fail because it refused to freeze. Adding a try_to_freeze() to its sleep loop solves the issue. Signed-off-by: Pierre Ossman <drzeus@drzeus.cx> Acked-by: Pavel Machek <pavel@suse.cz> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] cciss: bug fix for BIG_PASS_THRUJens Axboe
Applications using CCISS_BIG_PASSTHRU complained that the data written was zeros. The problem is that the buffer is being cleared after the user copy, unless the user copy has failed... Correct that logic. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <axboe@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] cciss: bug fix for hpacucliLinux Kernel Mailing List
From Mike Miller <mikem@beardog.cca.cpqcorp.net> This patch fixes a bug that breaks hpacucli, a command line interface for the HP Array Config Utility. Without this fix the utility will not detect any controllers in the system. I thought I had already fixed this, but I guess not. Thanks to all who reported the issue. Please consider this this inclusion. Signed-off-by: Mike Miller <mikem@beardog.cca.cpqcorp.net> Signed-off-by: Jens Axboe <axboe@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] ide-floppy: software eject not working with LS-120 driveOndrej Zary
The problem (eject not working on ATAPI LS-120 drive) is caused by idefloppy_ioctl() function which *first* tries generic_ide_ioctl() and *only* if it fails with -EINVAL, proceeds with the specific ioctls. The generic eject command fails with something other than -EINVAL and the specific one is never executed. This patch fixes it by first going through the internal ioctls and only trying generic_ide_ioctl() if none of them matches. Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] I8K: fix /proc reporting of blank service tagsDmitry Torokhov
Make /proc/i8k display '?' when service tag is blank in BIOS. This fixes segfault in i8k gkrellm plugin. Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] libata: locking rewrite (== fix)Jeff Garzik
[libata] locking rewrite (== fix) A lot of power packed into a little patch. This change eliminates the sharing between our controller-wide spinlock and the SCSI core's Scsi_Host lock. As the locking in libata was already highly compartmentalized, always referencing our own lock, and never scsi_host::host_lock. As a side effect, this change eliminates a deadlock from calling scsi_finish_command() while inside our spinlock. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] BRIDGE: recompute features when adding a new deviceOlaf Rempel
[BRIDGE]: recompute features when adding a new device We must recompute bridge features everytime the list of underlying devices changes, or we might end up with features that are not supported by all devices (eg. NETIF_F_TSO) This patch adds the missing recompute when adding a device to the bridge. Signed-off-by: Olaf Rempel <razzor@kopf-tisch.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] bonding: fix feature consolidationJay Vosburgh
This should resolve http://bugzilla.kernel.org/show_bug.cgi?id=5519 The current feature computation loses bits that it doesn't know about, resulting in an inability to add VLANs and possibly other havoc. Rewrote function to preserve bits it doesn't know about, remove an unneeded state variable, and simplify the code. Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] AGPGART: Fix serverworks TLB flush.Dave Jones
[AGPGART] Fix serverworks TLB flush. Go back to what 2.4 kernels used to do here, as if this hits, the kernel just hangs indefinitly. Actually an improvement over 2.4 - we now break; out of the loop instead of just printing messages on timeouts. Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] i82365: release all resources if no devices are foundIgor Popik
The i82365 driver does not release all the resources when the device is not found. This can cause an oops when reading /proc/ioports after module unload (e.g. bug #5657). Signed-off-by: Igor Popik <igor.popik@gmail.com> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] ALSA: nm256: reset workaround for Latitude CSxJohn W. Linville
Modules: NM256 driver The current snd-nm256 driver can cause Dell Latitude CSx laptops to lock-up during module (un)load. I have isolated this to the writes to the control port register at offset 0x6cc which were not already protected by the existing reset_workaround. I tried grouping these writes with the existing reset_workaround clause, but that caused the driver to have (un)load problems on the Dell Latitude LS laptops. So, I have implemented a reset_workaround_2 clause (please feel free to suggest a better name!) to cover this situation and added a quirk entry for the CSx laptops. Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] V4L/DVB: Fix analog NTSC for Thomson DTT 761X hybrid tunerMichael Krufky
- Enable tda9887 on the following cx88 boards: pcHDTV 3000 FusionHDTV3 Gold-T - This ensures that analog NTSC video will function properly, without this patch, the tuner may appear to be broken. Signed-off-by: Michael Krufky <mkrufky@m1k.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] V4L/DVB (3135) Fix tuner init for Pinnacle PCTV StereoRicardo Cerqueira
- The Pinnacle PCTV Stereo needs tda9887 port2 set to 1 - Without this patch, mt20xx tuner is not detected and the board doesn't tune. Signed-off-by: Ricardo Cerqueira <v4l@cerqueira.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] 32bit integer overflow in invalidate_inode_pages2()Oleg Drokin
Fix a 32 bit integer overflow in invalidate_inode_pages2_range. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] ACPI: fix HP nx8220 boot hang regressionThomas Renninger
[ACPI] fix HP nx8220 boot hang regression This patch reverts the acpi_bus_find_driver() return value check that came in via the PCI tree via 3fb02738b0fd36f47710a2bf207129efd2f5daa2 [PATCH] acpi bridge hotadd: Allow ACPI .add and .start operations to be done independently This particular change broke booting of some HP/Compaq laptops unless acpi=noirq is used. http://bugzilla.kernel.org/show_bug.cgi?id=5221 https://bugzilla.novell.com/show_bug.cgi?id=116763 Signed-off-by: Thomas Renninger <trenn@suse.de> Cc: Rajesh Shah <rajesh.shah@intel.com> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] DVB: BUDGET CI card depends on STV0297 demodulatorCarlos Silva
BUDGET_CI card depends on STV0297 demodulator. This patch solves a DVB driver compile error introduced in 2.6.14 Signed-off-by: Johannes Stezenbach <js@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] Fix listxattr() for generic security attributesDaniel Drake
Commit f549d6c18c0e8e6cf1bf0e7a47acc1daf7e2cec1 introduced a generic fallback for security xattrs, but appears to include a subtle bug. Gentoo users with kernels with selinux compiled in, and coreutils compiled with acl support, noticed that they could not copy files on tmpfs using 'cp'. cp (compiled with acl support) copies the file, lists the extended attributes on the old file, copies them all to the new file, and then exits. However the listxattr() calls were failing with this odd behaviour: llistxattr("a.out", (nil), 0) = 17 llistxattr("a.out", 0x7fffff8c6cb0, 17) = -1 ERANGE (Numerical result out of range) I believe this is a simple problem in the logic used to check the buffer sizes; if the user sends a buffer the exact size of the data, then its ok :) This change solves the problem. More info can be found at http://bugs.gentoo.org/113138 Signed-off-by: Daniel Drake <dsd@gentoo.org> Acked-by: James Morris <jmorris@namei.org> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] NETLINK: Fix processing of fib_lookup netlink messagesThomas Graf
The receive path for fib_lookup netlink messages is lacking sanity checks for header and payload and is thus vulnerable to malformed netlink messages causing illegal memory references. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] setkeys needs rootDaniel Drake
This patch combines commit 0b360adbdb54d5b98b78d57ba0916bc4b8871968 (make setkeys root-only) and commit e3f17f0f6e98f58edb13cb38810d93e6d4808e68 (only disallow setting by users) Because people can play games reprogramming keys and leaving traps for the next user of the console. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] USB: Adapt microtek driver to new scsi featuresOliver Neukum
the scsi layer now uses very short sg lists. This breaks the microtek driver. Here is a patch fixes this and some other issues. Signed-off-by: Oliver Neukum <oliver@neukum.name> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-12-14[PATCH] Fix crash when ptrace poking hugepage areasDavid Gibson
set_page_dirty() will not cope with being handed a page * which is part of a compound page, but not the master page in that compound page. This case can occur via access_process_vm() if you attemp to write to another process's hugepage memory area using ptrace() (causing an oops or hang). This patch fixes the bug by only calling set_page_dirty() from access_process_vm() if the page is not a compound page. We already use a similar fix in bio_set_pages_dirty() for the case of direct io to hugepages. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: William Irwin <wli@holomorphy.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] drivers/infiniband/core/mad.c: fix a use-after-freeAdrian Bunk
The Coverity checker spotted this obvious use-after-free caused by a wrong order of the cleanups. Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] drivers/message/i2o/pci.c: fix a use-after-freeAdrian Bunk
The Coverity checker spotted this obvious use-after-free Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Markus Lidel <Markus.Lidel@shadowconnect.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-12-14[PATCH] drivers/scsi/dpt_i2o.c: fix a user-after-freeAdrian Bunk
The Coverity checker spotted this obvious use-after-free Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: Mark Salyzyn <mark_salyzyn@adaptec.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>