summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2011-09-23Merge branch 'for-linus' of git://github.com/tiwai/soundLinus Torvalds
* 'for-linus' of git://github.com/tiwai/sound: ALSA: usb-audio - clear chip->probing on error exit ALSA: fm801: Gracefully handle failure of tuner auto-detect ALSA: fm801: Fix double free in case of error in tuner detection ASoC: Ensure we generate a driver name ASoC: Remove bitrotted wm8962_resume() ASoC: bf5xx-ad73311: Fix prototype for bf5xx_probe
2011-09-23Merge branch 'fix/asoc' into for-linusTakashi Iwai
2011-09-23ALSA: usb-audio - clear chip->probing on error exitThomas Pfaff
The Terratec Aureon 5.1 USB sound card support is broken since kernel 2.6.39. 2.6.39 introduced power management support for USB sound cards that added a probing flag in struct snd_usb_audio. During the probe of the card it gives following error message : usb 7-2: new full speed USB device number 2 using uhci_hcd cannot find UAC_HEADER snd-usb-audio: probe of 7-2:1.3 failed with error -5 input: USB Audio as /devices/pci0000:00/0000:00:1d.1/usb7/7-2/7-2:1.3/input/input6 generic-usb 0003:0CCD:0028.0001: input: USB HID v1.00 Device [USB Audio] on usb-0000:00:1d.1-2/input3 I can not comment about that "cannot find UAC_HEADER" error, but until 2.6.38 the card worked anyway. With 2.6.39 chip->probing remains 1 on error exit, and any later ioctl stops in snd_usb_autoresume with -ENODEV. Signed-off-by: Thomas Pfaff <tpfaff@gmx.net> Cc: <stable@kernel.org> [2.6.39+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-09-22Merge branch 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-securityLinus Torvalds
* 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security: TPM: Zero buffer after copying to userspace TPM: Call tpm_transmit with correct size TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc TPM: TCG_ATMEL should depend on HAS_IOPORT
2011-09-23TPM: Zero buffer after copying to userspacePeter Huewe
Since the buffer might contain security related data it might be a good idea to zero the buffer after we have copied it to userspace. This got assigned CVE-2011-1162. Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Cc: Stable Kernel <stable@kernel.org> Signed-off-by: James Morris <jmorris@namei.org>
2011-09-23TPM: Call tpm_transmit with correct sizePeter Huewe
This patch changes the call of tpm_transmit by supplying the size of the userspace buffer instead of TPM_BUFSIZE. This got assigned CVE-2011-1161. [The first hunk didn't make sense given one could expect way less data than TPM_BUFSIZE, so added tpm_transmit boundary check over bufsiz instead The last parameter of tpm_transmit() reflects the amount of data expected from the device, and not the buffer size being supplied to it. It isn't ideal to parse it directly, so we just set it to the maximum the input buffer can handle and let the userspace API to do such job.] Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Cc: Stable Kernel <stable@kernel.org> Signed-off-by: James Morris <jmorris@namei.org>
2011-09-23TPM: tpm_nsc: Fix a double free of pdev in cleanup_nscAxel Lin
platform_device_unregister() will release all resources and remove it from the subsystem, then drop reference count by calling platform_device_put(). We should not call kfree(pdev) after platform_device_unregister(pdev). Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Signed-off-by: James Morris <jmorris@namei.org>
2011-09-23TPM: TCG_ATMEL should depend on HAS_IOPORTGeert Uytterhoeven
On m68k, I get: drivers/char/tpm/tpm_atmel.h: In function ‘atmel_get_base_addr’: drivers/char/tpm/tpm_atmel.h:129: error: implicit declaration of function ‘ioport_map’ drivers/char/tpm/tpm_atmel.h:129: warning: return makes pointer from integer without a cast The code in tpm_atmel.h supports PPC64 (using the device tree and ioremap()) and "anything else" (using ioport_map()). However, ioportmap() is only available on platforms that set HAS_IOPORT. Although PC64 seems to have HAS_IOPORT, a "depends on HAS_IOPORT" should work, but I think it's better to expose the special PPC64 handling explicit using "depends on PPC64 || HAS_IOPORT". Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Signed-off-by: James Morris <jmorris@namei.org>
2011-09-22thp: fix khugepaged defrag tunable documentationDavid Rientjes
Commit e27e6151b154 ("mm/thp: use conventional format for boolean attributes") changed /sys/kernel/mm/transparent_hugepage/khugepaged/defrag to be tuned by using 1 (enabled) or 0 (disabled) instead of "yes" and "no", respectively. Update the documentation. Signed-off-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-22zorro: Defer device_register() until all devices have been identifiedGeert Uytterhoeven
As the Amiga Zorro II address space is limited to 8.5 MiB and Zorro devices can contain only one BAR, several Amiga Zorro II expansion boards (mainly graphics cards) contain multiple Zorro devices: a small one for the control registers and one (or more) for the graphics memory. The conversion of cirrusfb to the new driver framework introduced a regression: the driver contains a zorro_driver for the first Zorro device, and uses the (old) zorro_find_device() call to find the second Zorro device. However, as the Zorro core calls device_register() as soon as a Zorro device is identified, it may not have identified the second Zorro device belonging to the same physical Zorro expansion card. Hence cirrusfb could no longer find the second part of the Picasso II graphics card, causing a NULL pointer dereference. Defer the registration of Zorro devices with the driver framework until all Zorro devices have been identified to fix this. Note that the alternative solution (modifying cirrusfb to register a zorro_driver for all Zorro devices belonging to a graphics card, instead of only for the first one, and adding a synchronization mechanism to defer initialization until all have been found), is not an option, as on some cards one device may be optional (e.g. the second bank of 2 MiB of graphics memory on the Picasso IV in Zorro II mode). Reported-by: Ingo Jürgensmann <ij@2011.bluespice.org> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-22Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6Linus Torvalds
* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] kvm: extension capability for new address space layout [S390] kvm: fix address mode switching
2011-09-22ALSA: fm801: Gracefully handle failure of tuner auto-detectBen Hutchings
Commit 9676001559fce06e37c7dc230ab275f605556176 ("ALSA: fm801: add error handling if auto-detect fails") seems to break systems that were previously working without a tuner. As a bonus, this should fix init and cleanup for the case where the tuner is explicitly disabled. Reported-and-tested-by: Hor Jiun Shyong <jiunshyong@gmail.com> References: http://bugs.debian.org/641946 Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Cc: stable@kernel.org [v3.0+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-09-22ALSA: fm801: Fix double free in case of error in tuner detectionBen Hutchings
Commit 9676001559fce06e37c7dc230ab275f605556176 ("ALSA: fm801: add error handling if auto-detect fails") added incorrect error handling. Once we have successfully called snd_device_new(), the cleanup function fm801_free() will automatically be called by snd_card_free() and we must *not* also call fm801_free() directly. Reported-by: Hor Jiun Shyong <jiunshyong@gmail.com> References: http://bugs.debian.org/641946 Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Cc: stable@kernel.org [v3.0+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-09-21Linux 3.1-rc7v3.1-rc7Linus Torvalds
2011-09-21XZ: Fix incorrect XZ_BUF_ERRORLasse Collin
xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the following was true: - The caller knows how many bytes of output to expect and only provides that much output space. - When the last output bytes are decoded, the caller-provided input buffer ends right before the LZMA2 end of payload marker. So LZMA2 won't provide more output anymore, but it won't know it yet and thus won't return XZ_STREAM_END yet. - A BCJ filter is in use and it hasn't left any unfiltered bytes in the temp buffer. This can happen with any BCJ filter, but in practice it's more likely with filters other than the x86 BCJ. This fixes <https://bugzilla.redhat.com/show_bug.cgi?id=735408> where Squashfs thinks that a valid file system is corrupt. This also fixes a similar bug in single-call mode where the uncompressed size of a block using BCJ + LZMA2 was 0 bytes and caller provided no output space. Many empty .xz files don't contain any blocks and thus don't trigger this bug. This also tweaks a closely related detail: xz_dec_bcj_run() could call xz_dec_lzma2_run() to decode into temp buffer when it was known to be useless. This was harmless although it wasted a minuscule number of CPU cycles. Signed-off-by: Lasse Collin <lasse.collin@tukaani.org> Cc: stable <stable@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-21Merge git://github.com/davem330/netLinus Torvalds
* git://github.com/davem330/net: (27 commits) xfrm: Perform a replay check after return from async codepaths fib:fix BUG_ON in fib_nl_newrule when add new fib rule ixgbe: fix possible null buffer error tg3: fix VLAN tagging regression net: pxa168: Fix build errors by including interrupt.h netconsole: switch init_netconsole() to late_initcall gianfar: Fix overflow check and return value for gfar_get_cls_all() ppp_generic: fix multilink fragment MTU calculation (again) GRETH: avoid overwrite IP-stack's IP-frags checksum GRETH: RX/TX bytes were never increased ipv6: fix a possible double free b43: Fix beacon problem in ad-hoc mode Bluetooth: add support for 2011 mac mini Bluetooth: Add MacBookAir4,1 support Bluetooth: Fixed BT ST Channel reg order r8169: do not enable the TBI for anything but the original 8169. r8169: remove erroneous processing of always set bit. r8169: fix WOL setting for 8105 and 8111evl r8169: add MODULE_FIRMWARE for the firmware of 8111evl r8169: fix the reset setting for 8111evl ...
2011-09-21Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds
* 'for-linus' of git://git.kernel.dk/linux-block: floppy: use del_timer_sync() in init cleanup blk-cgroup: be able to remove the record of unplugged device block: Don't check QUEUE_FLAG_SAME_COMP in __blk_complete_request mm: Add comment explaining task state setting in bdi_forker_thread() mm: Cleanup clearing of BDI_pending bit in bdi_forker_thread() block: simplify force plug flush code a little bit block: change force plug flush call order block: Fix queue_flag update when rq_affinity goes from 2 to 1 block: separate priority boosting from REQ_META block: remove READ_META and WRITE_META xen-blkback: fixed indentation and comments xen-blkback: Don't disconnect backend until state switched to XenbusStateClosed.
2011-09-21init: carefully handle loglevel option on kernel cmdline.Alexander Sverdlin
When a malformed loglevel value (for example "${abc}") is passed on the kernel cmdline, the loglevel itself is being set to 0. That then suppresses all following messages, including all the errors and crashes caused by other malformed cmdline options. This could make debugging process quite tricky. This patch leaves the previous value of loglevel if the new value is incorrect and reports an error code in this case. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@sysgo.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-21teach /proc/$pid/numa_maps about transparent hugepagesDave Hansen
This is modeled after the smaps code. It detects transparent hugepages and then does a single gather_stats() for the page as a whole. This has two benifits: 1. It is more efficient since it does many pages in a single shot. 2. It does not have to break down the huge page. Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com> Acked-by: Hugh Dickins <hughd@google.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-21break out numa_maps gather_pte_stats() checksDave Hansen
gather_pte_stats() does a number of checks on a target page to see whether it should even be considered for statistics. This breaks that code out in to a separate function so that we can use it in the transparent hugepage case in the next patch. Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com> Acked-by: Hugh Dickins <hughd@google.com> Reviewed-by: Christoph Lameter <cl@gentwo.org> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-21make /proc/$pid/numa_maps gather_stats() take variable page sizeDave Hansen
We need to teach the numa_maps code about transparent huge pages. The first step is to teach gather_stats() that the pte it is dealing with might represent more than one page. Note that will we use this in a moment for transparent huge pages since they have use a single pmd_t which _acts_ as a "surrogate" for a bunch of smaller pte_t's. I'm a _bit_ unhappy that this interface counts in hugetlbfs page sizes for hugetlbfs pages and PAGE_SIZE for normal pages. That means that to figure out how many _bytes_ "dirty=1" means, you must first know the hugetlbfs page size. That's easier said than done especially if you don't have visibility in to the mount. But, that's probably a discussion for another day especially since it would change behavior to fix it. But, just in case anyone wonders why this patch only passes a '1' in the hugetlb case... Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com> Acked-by: Hugh Dickins <hughd@google.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-21xfrm: Perform a replay check after return from async codepathsSteffen Klassert
When asyncronous crypto algorithms are used, there might be many packets that passed the xfrm replay check, but the replay advance function is not called yet for these packets. So the replay check function would accept a replay of all of these packets. Also the system might crash if there are more packets in async processing than the size of the anti replay window, because the replay advance function would try to update the replay window beyond the bounds. This pach adds a second replay check after resuming from the async processing to fix these issues. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-21fib:fix BUG_ON in fib_nl_newrule when add new fib ruleGao feng
add new fib rule can cause BUG_ON happen the reproduce shell is ip rule add pref 38 ip rule add pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule del pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule add pref 38 then the BUG_ON will happen del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolved Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-21ASoC: Ensure we generate a driver nameMark Brown
Commit 873bd4c (ASoC: Don't set invalid name string to snd_card->driver field) broke generation of a driver name for all ASoC cards relying on the automatic generation of one. Fix this by using the old default with spaces replaced by underscores. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Takashi Iwai <tiwai@suse.de>
2011-09-21floppy: use del_timer_sync() in init cleanupCarsten Emde
When no floppy is found the module code can be released while a timer function is pending or about to be executed. CPU0 CPU1 floppy_init() timer_softirq() spin_lock_irq(&base->lock); detach_timer(); spin_unlock_irq(&base->lock); -> Interrupt del_timer(); return -ENODEV; module_cleanup(); <- EOI call_timer_fn(); OOPS Use del_timer_sync() to prevent this. Signed-off-by: Carsten Emde <C.Emde@osadl.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Jens Axboe <axboe@kernel.dk> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-09-21blk-cgroup: be able to remove the record of unplugged deviceWanlong Gao
The bug is we're not able to remove the device from blkio cgroup's per-device control files if it gets unplugged. To reproduce the bug: # mount -t cgroup -o blkio xxx /cgroup # cd /cgroup # echo "8:0 1000" > blkio.throttle.read_bps_device # unplug the device # cat blkio.throttle.read_bps_device 8:0 1000 # echo "8:0 0" > blkio.throttle.read_bps_device -bash: echo: write error: No such device After patching, the device removal will succeed. Thanks for the comments of Paul, Zefan, and Vivek. Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Cc: Li Zefan <lizf@cn.fujitsu.com> Cc: Paul Menage <paul@paulmenage.org> Acked-by: Vivek Goyal <vgoyal@redhat.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-09-21ixgbe: fix possible null buffer errorJesse Brandeburg
It seems that at least one PPC machine would occasionally give a (valid) 0 as the return value from dma_map, this caused the ixgbe code to not work correctly. A fix is pending in the PPC tree to not return 0 from dma map, but we can also fix the driver to make sure we don't mess up in other arches as well. This patch is applicable to all current stable kernels. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=683611 Reported-by: Neil Horman <nhorman@redhat.com> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> CC: Alexander Duyck <alexander.h.duyck@intel.com> CC: stable@kernel.org Tested-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-21tg3: fix VLAN tagging regressionKasper Pedersen
commit 92cd3a17ce9c719abb4c28dee3438e0c641f8de4 tg3: Simplify tx bd assignments broke VLAN tagging on outbound packets. It ifdef'ed BCM_KERNEL_SUPPORTS_8021Q, but this is not set anywhere. So vlan never gets set, and all packets are sent with vlan=0. v2: We can just remove the test. vlan_tx_tag_present is valid regardless of whether the 802.1q module is built. Tested on BCM5721 rev 11. Signed-off-by: Kasper Pedersen <kernel@kasperkp.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-socLinus Torvalds
* 'fixes' of git://git.linaro.org/people/arnd/arm-soc: mach-integrator: fix VGA base regression arm/dt: Tegra: Update SDHCI nodes to match bindings ARM: EXYNOS4: fix incorrect pad configuration for keypad row lines ARM: SAMSUNG: fix to prevent declaring duplicated ARM: SAMSUNG: fix watchdog reset issue with clk_get() ARM: S3C64XX: Remove un-used code backlight code on SMDK6410 ARM: EXYNOS4: restart clocksource while system resumes ARM: EXYNOS4: Fix routing timer interrupt to offline CPU ARM: EXYNOS4: Fix return type of local_timer_setup() ARM: EXYNOS4: Fix wrong pll type for vpll ARM: Dove: fix second SPI initialization call
2011-09-20Merge branch 'for-linus' of git://github.com/chrismason/linuxLinus Torvalds
* 'for-linus' of git://github.com/chrismason/linux: Btrfs: reserve sufficient space for ioctl clone
2011-09-20staging: zcache: fix cleancache crashSeth Jennings
After commit c5f5c4db3938 ("staging: zcache: fix crash on high memory swap") cleancache crashes on the first successful get. This was caused by a remaining virt_to_page() call in zcache_pampd_get_data_and_free() that only gets run in the cleancache path. The patch converts the virt_to_page() to struct page casting like was done for other instances in c5f5c4db3938. Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com> Tested-By: Valdis Kletnieks <valdis.kletnieks@vt.edu> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-09-20mach-integrator: fix VGA base regressionLinus Walleij
The changes introduced in commit cc22b4c18540e5e8bf55c7d124044f9317527d3c "ARM: set vga memory base at run-time" Makes the Integrator/AP freeze completely. I appears that this is due to the VGA base address being assigned at PCI init time, while this base is needed earlier than that. Moving the initialization of the base address to the .map_io function solves this problem. Cc: Rob Herring <rob.herring@calxeda.com> Cc: Nicolas Pitre <nicolas.pitre@linaro.org> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Linus Walleij <linus.walleij@stericsson.com> Acked-by: Rob Herring <rob.herring@calxeda.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-09-20arm/dt: Tegra: Update SDHCI nodes to match bindingsStephen Warren
The bindings were recently updated to have separate properties for each type of GPIO. Update the Device Tree source to match that. Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-09-20net: pxa168: Fix build errors by including interrupt.hTanmay Upadhyay
Commit a6b7a407865aab9f849dd99a71072b7cd1175116 removed linux/interrupt.h from netdevice.h. This fixes below build failure drivers/net/pxa168_eth.c: In function 'pxa168_eth_collect_events': drivers/net/pxa168_eth.c:866: error: 'IRQ_NONE' undeclared (first use in this function) drivers/net/pxa168_eth.c:866: error: (Each undeclared identifier is reported only once drivers/net/pxa168_eth.c:866: error: for each function it appears in.) drivers/net/pxa168_eth.c: At top level: drivers/net/pxa168_eth.c:913: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'pxa168_eth_int_handler' drivers/net/pxa168_eth.c: In function 'pxa168_eth_open': drivers/net/pxa168_eth.c:1133: error: implicit declaration of function 'request_irq' drivers/net/pxa168_eth.c:1133: error: 'pxa168_eth_int_handler' undeclared (first use in this function) drivers/net/pxa168_eth.c:1134: error: 'IRQF_DISABLED' undeclared (first use in this function) drivers/net/pxa168_eth.c:1160: error: implicit declaration of function 'free_irq' Signed-off-by: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20netconsole: switch init_netconsole() to late_initcallLin Ming
Commit 88491d8(drivers/net: Kconfig & Makefile cleanup) causes a regression that netconsole does not work if netconsole and network device driver are build into kernel, because netconsole is linked before network device driver. Andrew Morton suggested to fix this with initcall ordering. Fixes it by switching init_netconsole() to late_initcall. Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20gianfar: Fix overflow check and return value for gfar_get_cls_all()Ben Hutchings
This function may currently fill one entry beyond the end of the array it is given. It also doesn't return an error code in case it does detect overflow. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20ppp_generic: fix multilink fragment MTU calculation (again)Henry Wong
When using MLPPP, the maximum size of a fragment is incorrectly calculated with an offset of -2. This patch reverses the changes in the patch found here: http://marc.info/?l=linux-netdev&m=123541324010539&w=2 The value of hdrlen includes the size of both the 2-byte PPP protocol field and the 2- or 4-byte multilink header (2+4=6 for long sequence numbers, 2+2=4 for short sequence numbers). Section 2 of RFC1661 says that the MRU that is negotiated (i.e., the MTU of the sending system) includes only the PPP payload but not the protocol field, thus the correct MTU should be the link's MTU minus the multilink header (mtu - (hdrlen-2)). The incorrect calculation causes Linux to fragment packets to a size two bytes smaller than the allowed MTU. While not technically illegal, this behaviour confounds MRU-tuning to avoid PPP-layer fragmentation. Signed-off-by: Henry Wong <henry@stuffedcow.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20GRETH: avoid overwrite IP-stack's IP-frags checksumDaniel Hellstrom
The GRETH GBIT core does not do checksum offloading for IP segmentation. This patch adds a check in the xmit function to determine if the stack has calculated the checksum for us. Signed-off-by: Daniel Hellstrom <daniel@gaisler.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20GRETH: RX/TX bytes were never increasedDaniel Hellstrom
Signed-off-by: Daniel Hellstrom <daniel@gaisler.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20ipv6: fix a possible double freeRoy Li
When calling snmp6_alloc_dev fails, the snmp6 relevant memory are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy will free these memory twice. Double free will lead that undefined behavior occurs. Signed-off-by: Roy Li <rongqing.li@windriver.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-09-20Merge branch 'btrfs-3.0' into for-linusChris Mason
2011-09-20Btrfs: reserve sufficient space for ioctl cloneSage Weil
Fix a crash/BUG_ON in the clone ioctl due to insufficient reservation. We need to reserve space for: - adjusting the old extent (possibly splitting it) - adding the new extent - updating the inode Signed-off-by: Sage Weil <sage@newdream.net> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-09-20Merge branch 'davem.r8169.fixes' of git://violet.fr.zoreil.com/romieu/linuxDavid S. Miller
2011-09-20Merge git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
* git://git.samba.org/sfrench/cifs-2.6: cifs: Fix broken sec=ntlmv2/i sec option (try #2) Fix the conflict between rwpidforward and rw mount options CIFS: Fix ERR_PTR dereference in cifs_get_root cifs: fix possible memory corruption in CIFSFindNext
2011-09-20Merge git://www.linux-watchdog.org/linux-watchdogLinus Torvalds
* git://www.linux-watchdog.org/linux-watchdog: watchdog: Initconst section fixes for watchdog watchdog: lantiq: fix watchdogs timeout handling watchdog: hpwdt: prevent multiple "NMI occurred" messages watchdog: WatchDog Timer Driver Core - use passed watchdog_device
2011-09-20Merge branch 'for-linus' of git://github.com/tiwai/soundLinus Torvalds
* 'for-linus' of git://github.com/tiwai/sound: ALSA: HDA: Add support for IDT 92HD93 ALSA: hda/realtek - Fix auto-mute with HP+LO configuration
2011-09-20[S390] kvm: extension capability for new address space layoutChristian Borntraeger
598841ca9919d008b520114d8a4378c4ce4e40a1 ([S390] use gmap address spaces for kvm guest images) changed kvm on s390 to use a separate address space for kvm guests. We can now put KVM guests anywhere in the user address mode with a size up to 8PB - as long as the memory is 1MB-aligned. This change was done without KVM extension capability bit. The change was added after 3.0, but we still have a chance to add a feature bit before 3.1 (keeping the releases in a sane state). We use number 71 to avoid collisions with other pending kvm patches as requested by Alexander Graf. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Avi Kivity <avi@redhat.com> Cc: Alexander Graf <agraf@suse.de> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2011-09-20[S390] kvm: fix address mode switchingChristian Borntraeger
598841ca9919d008b520114d8a4378c4ce4e40a1 ([S390] use gmap address spaces for kvm guest images) changed kvm to use a separate address space for kvm guests. This address space was switched in __vcpu_run In some cases (preemption, page fault) there is the possibility that this address space switch is lost. The typical symptom was a huge amount of validity intercepts or random guest addressing exceptions. Fix this by doing the switch in sie_loop and sie_exit and saving the address space in the gmap structure itself. Also use the preempt notifier. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Acked-by: Avi Kivity <avi@redhat.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
2011-09-20Merge branch 'master' of ssh://infradead/~/public_git/wireless into for-davemJohn W. Linville
2011-09-20watchdog: Initconst section fixes for watchdogAndi Kleen
Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>