AgeCommit message (Collapse)Author
2008-06-30mac80211: don't accept WEP keys other than WEP40 and WEP104Emmanuel Grumbach
This patch makes mac80211 refuse a WEP key whose length is not WEP40 nor WEP104. Signed-off-by: Emmanuel Grumbach <> Signed-off-by: Tomas Winkler <> Signed-off-by: John W. Linville <>
2008-06-30hostap: fix sparse warningsPavel Roskin
Rewrite AID calculation in handle_pspoll() to avoid truncating bits. Make hostap_80211_header_parse() static, don't export it. Avoid shadowing variables. Signed-off-by: Pavel Roskin <> Signed-off-by: John W. Linville <>
2008-06-30hostap: don't report useless WDS frames by defaultPavel Roskin
DEBUG_EXTRA is reported to the kernel log by default, but DEBUG_EXTRA2 is not. Unrelated WDS frames pollute the log unnecessarily. Signed-off-by: Pavel Roskin <> Signed-off-by: John W. Linville <>
2008-06-30textsearch: fix Boyer-Moore text search bugJoonwoo Park
The current logic has a bug which cannot find matching pattern, if the pattern is matched from the first character of target string. for example: pattern=abc, string=abcdefg pattern=a, string=abcdefg Searching algorithm should return 0 for those things. Signed-off-by: Joonwoo Park <> Signed-off-by: Patrick McHardy <> Signed-off-by: David S. Miller <>
2008-06-30netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid ACKJozsef Kadlecsik
Lost connections was reported by Thomas Bätzler (running 2.6.25 kernel) on the netfilter mailing list (see the thread "Weird nat/conntrack Problem with PASV FTP upload"). He provided tcpdump recordings which helped to find a long lingering bug in conntrack. In TCP connection tracking, checking the lower bound of valid ACK could lead to mark valid packets as INVALID because: - We have got a "higher or equal" inequality, but the test checked the "higher" condition only; fixed. - If the packet contains a SACK option, it could occur that the ACK value was before the left edge of our (S)ACK "window": if a previous packet from the other party intersected the right edge of the window of the receiver, we could move forward the window parameters beyond accepting a valid ack. Therefore in this patch we check the rightmost SACK edge instead of the ACK value in the lower bound of valid (S)ACK test. Signed-off-by: Jozsef Kadlecsik <> Signed-off-by: Patrick McHardy <> Signed-off-by: David S. Miller <>
2008-06-30ide: fix /proc/ide/ide?/mate reportingBartlomiej Zolnierkiewicz
Now that we support warm-plug mate port will be registered even if there are no devices attached to it. Signed-off-by: Bartlomiej Zolnierkiewicz <>
2008-06-30Revert "BAST: Remove old IDE driver"Bartlomiej Zolnierkiewicz
This reverts commit ac1623625c5818bbdf5c68973098ba386ba7a004. It was premature to remove it now, we will do it post-2.6.26. Thanks to Russell King for noticing the issue. Signed-off-by: Bartlomiej Zolnierkiewicz <>
2008-06-30[ARM] 5131/1: Annotate platform_secondary_init with trace_hardirqs_offCatalin Marinas
This patch annotates the platform_secondary_init function in arch/arm/mach-realview/platsmp.c with trace_hardirqs_off to avoid a warning when LOCKDEP and TRACE_IRQFLAGS are enabled. Signed-off-by: Catalin Marinas <> Signed-off-by: Russell King <>
2008-06-30Merge branch 'for-linus' of ↵Linus Torvalds
git:// * 'for-linus' of git:// Input: fix locking in force-feedback core Input: add KEY_MEDIA_REPEAT definition
2008-06-30Merge branch 'core-fixes-for-linus' of ↵Linus Torvalds
git:// * 'core-fixes-for-linus' of git:// debugobjects: fix lockdep warning
2008-06-30Merge branch 'sched-fixes-for-linus' of ↵Linus Torvalds
git:// * 'sched-fixes-for-linus' of git:// sched: fix cpu hotplug
2008-06-30Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds
git:// * 'x86-fixes-for-linus' of git:// ptrace GET/SET FPXREGS broken x86: fix cpu hotplug crash x86: section/warning fixes x86: shift bits the right way in native_read_tscp
2008-06-30Input: fix locking in force-feedback coreDmitry Torokhov
The newly added event_lock spinlock in the input core disallows sleeping and therefore using mutexes in event handlers. Convert force-feedback core to rely on event_lock instead of mutex to protect slots allocated for fore-feedback effects. The original mutex is still used to serialize uploading and erasing of effects. Reported-by: Anssi Hannula <> Signed-off-by: Dmitry Torokhov <>
2008-06-30Input: add KEY_MEDIA_REPEAT definitionBastien Nocera
This patch adds the Repeat key to the input layer. The usage in the HUT is 0xBC (listed under "15.7 Transport Controls"). Signed-off-by: Dmitry Torokhov <>
2008-06-30ptrace GET/SET FPXREGS brokenTAKADA Yoshihito
When I update kernel 2.6.25 from 2.6.24, gdb does not work. On 2.6.25, ptrace(PTRACE_GETFPXREGS, ...) returns ENODEV. But 2.6.24 kernel's ptrace() returns EIO. It is issue of compatibility. I attached test program as pt.c and patch for fix it. #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <signal.h> #include <errno.h> #include <sys/ptrace.h> #include <sys/types.h> struct user_fxsr_struct { unsigned short cwd; unsigned short swd; unsigned short twd; unsigned short fop; long fip; long fcs; long foo; long fos; long mxcsr; long reserved; long st_space[32]; /* 8*16 bytes for each FP-reg = 128 bytes */ long xmm_space[32]; /* 8*16 bytes for each XMM-reg = 128 bytes */ long padding[56]; }; int main(void) { pid_t pid; pid = fork(); switch(pid){ case -1:/* error */ break; case 0:/* child */ child(); break; default: parent(pid); break; } return 0; } int child(void) { ptrace(PTRACE_TRACEME); kill(getpid(), SIGSTOP); sleep(10); return 0; } int parent(pid_t pid) { int ret; struct user_fxsr_struct fpxregs; ret = ptrace(PTRACE_GETFPXREGS, pid, 0, &fpxregs); if(ret < 0){ printf("%d: %s.\n", errno, strerror(errno)); } kill(pid, SIGCONT); wait(pid); return 0; } /* in the kerel, at kernel/i387.c get_fpxregs() */ Signed-off-by: Ingo Molnar <>
2008-06-30x86: fix cpu hotplug crashZhang, Yanmin
Vegard Nossum reported crashes during cpu hotplug tests: In function _cpu_up, the panic happens when calling __raw_notifier_call_chain at the second time. Kernel doesn't panic when calling it at the first time. If just say because of nr_cpu_ids, that's not right. By checking the source code, I found that function do_boot_cpu is the culprit. Consider below call chain: _cpu_up=>__cpu_up=>smp_ops.cpu_up=>native_cpu_up=>do_boot_cpu. So do_boot_cpu is called in the end. In do_boot_cpu, if boot_error==true, cpu_clear(cpu, cpu_possible_map) is executed. So later on, when _cpu_up calls __raw_notifier_call_chain at the second time to report CPU_UP_CANCELED, because this cpu is already cleared from cpu_possible_map, get_cpu_sysdev returns NULL. Many resources are related to cpu_possible_map, so it's better not to change it. Below patch against 2.6.26-rc7 fixes it by removing the bit clearing in cpu_possible_map. Signed-off-by: Zhang Yanmin <> Tested-by: Vegard Nossum <> Acked-by: Rusty Russell <> Signed-off-by: Ingo Molnar <>
2008-06-29Merge git:// Torvalds
* git:// (42 commits) V4L/DVB (8108): Fix open/close race in saa7134 V4L/DVB (8100): V4L/vivi: fix possible memory leak in vivi_fillbuff V4L/DVB (8097): xc5000: check device hardware state to determine if firmware download is needed V4L/DVB (8096): au8522: prevent false-positive lock status V4L/DVB (8092): videodev: simplify and fix standard enumeration V4L/DVB (8075): stv0299: Uncorrected block count and bit error rate fixed V4L/DVB (8074): av7110: OSD transfers should not be interrupted V4L/DVB (8073): av7110: Catch another type of ARM crash V4L/DVB (8071): tda10023: Fix possible kernel oops during initialisation V4L/DVB (8069): cx18: Fix S-Video and Compsite inputs for the Yuan MPC718 and enable card entry V4L/DVB (8068): cx18: Add I2C slave reset via GPIO upon initialization V4L/DVB (8067): cx18: Fix firmware load for case when digital capture happens first V4L/DVB (8066): cx18: Fix audio mux input definitions for HVR-1600 Line In 2 and FM radio V4L/DVB (8063): cx18: Fix unintended auto configurations in cx18-av-core V4L/DVB (8061): cx18: only select tuner / frontend modules if !DVB_FE_CUSTOMISE V4L/DVB (8048): saa7134: Fix entries for Avermedia A16d and Avermedia E506 V4L/DVB (8044): au8522: tuning optimizations V4L/DVB (8043): au0828: add support for additional USB device id's V4L/DVB (8042): DVB-USB UMT-010 channel scan oops V4L/DVB (8040): soc-camera: remove soc_camera_host_class class ...
2008-06-29Merge branch 'release' of ↵Linus Torvalds
git:// * 'release' of git:// dock: bay: Don't call acpi_walk_namespace() when ACPI is disabled. ACPI: don't walk tables if ACPI was disabled thermal: Create CONFIG_THERMAL_HWMON=n
2008-06-29Merge git:// Torvalds
* git:// kbuild: fix a.out.h export to userspace with O= build.
2008-06-29Merge branch 'for-linus' of ↵Linus Torvalds
git:// * 'for-linus' of git:// firewire: fw-sbp2: fix parsing of logical unit directories
2008-06-29Merge branch 'for_linus' of ↵Linus Torvalds
git:// * 'for_linus' of git:// udf: Fix regression in UDF anchor block detection
2008-06-29Fix and clean top .gitignoreEduard - Gabriel Munteanu
Removed vmlinux* rule because it matches too many useful files, replacing it with rules matching filetype by filename (e.g. *.gz). Also unignored .mailmap from the top directory. Added a comment telling the user how to check for tracked files being ignored. Signed-off-by: Eduard - Gabriel Munteanu <> Signed-off-by: Linus Torvalds <>
2008-06-29Merge branch 'for-linus' of ↵Linus Torvalds
git:// * 'for-linus' of git:// Blackfin arch: fix up section mismatch warning Blackfin arch: fix bug - kernel boot fails when Spinlock and rw-lock debugging enabled
2008-06-29Merge branch 'audit.b52' of ↵Linus Torvalds
git:// * 'audit.b52' of git:// [PATCH] remove useless argument type in audit_filter_user() [PATCH] audit: fix kernel-doc parameter notation [PATCH] kernel/audit.c: nlh->nlmsg_type is gotten more than once
2008-06-29Merge branch 'for-linus' of ↵Linus Torvalds
git:// * 'for-linus' of git:// [patch 2/3] vfs: dcache cleanups [patch 1/3] vfs: dcache sparse fixes [patch 3/3] vfs: make d_path() consistent across mount operations [patch 4/4] flock: remove unused fields from file_lock_operations [patch 3/4] vfs: fix ERR_PTR abuse in generic_readlink [patch 2/4] fs: make struct file arg to d_path const [patch 1/4] vfs: path_{get,put}() cleanups [patch for 2.6.26 4/4] vfs: utimensat(): fix write access check for futimens() [patch for 2.6.26 3/4] vfs: utimensat(): fix error checking for {UTIME_NOW,UTIME_OMIT} case [patch for 2.6.26 1/4] vfs: utimensat(): ignore tv_sec if tv_nsec == UTIME_OMIT or UTIME_NOW [patch for 2.6.26 2/4] vfs: utimensat(): be consistent with utime() for immutable and append-only files [PATCH] fix cgroup-inflicted breakage in block_dev.c
2008-06-29sched: fix cpu hotplugDmitry Adamushko
the CPU hotplug problems (crashes under high-volume unplug+replug tests) seem to be related to migrate_dead_tasks(). Firstly I added traces to see all tasks being migrated with migrate_live_tasks() and migrate_dead_tasks(). On my setup the problem pops up (the one with "se == NULL" in the loop of pick_next_task_fair()) shortly after the traces indicate that some has been migrated with migrate_dead_tasks()). btw., I can reproduce it much faster now with just a plain cpu down/up loop. [disclaimer] Well, unless I'm really missing something important in this late hour [/desclaimer] pick_next_task() is not something appropriate for migrate_dead_tasks() :-) the following change seems to eliminate the problem on my setup (although, I kept it running only for a few minutes to get a few messages indicating migrate_dead_tasks() does move tasks and the system is still ok) Signed-off-by: Ingo Molnar <>
2008-06-27ipv6 route: Convert rt6_device_match() to use RT6_LOOKUP_F_xxx flags.YOSHIFUJI Hideaki
The commit 77d16f450ae0452d7d4b009f78debb1294fb435c ("[IPV6] ROUTE: Unify RT6_F_xxx and RT6_SELECT_F_xxx flags") intended to pass various routing lookup hints around RT6_LOOKUP_F_xxx flags, but conversion was missing for rt6_device_match(). Signed-off-by: YOSHIFUJI Hideaki <> Signed-off-by: David S. Miller <>
2008-06-27netlabel: Fix a problem when dumping the default IPv6 static labelsPaul Moore
There is a missing "!" in a conditional statement which is causing entries to be skipped when dumping the default IPv6 static label entries. This can be demonstrated by running the following: # netlabelctl unlbl add default address:::1 \ label:system_u:object_r:unlabeled_t:s0 # netlabelctl -p unlbl list ... you will notice that the entry for the IPv6 localhost address is not displayed but does exist (works correctly, causes collisions when attempting to add duplicate entries, etc.). Signed-off-by: Paul Moore <> Signed-off-by: David S. Miller <>
2008-06-27net/inet_lro: remove setting skb->ip_summed when not LRO-ableEli Cohen
When an SKB cannot be chained to a session, the current code attempts to "restore" its ip_summed field from lro_mgr->ip_summed. However, lro_mgr->ip_summed does not hold the original value; in fact, we'd better not touch skb->ip_summed since it is not modified by the code in the path leading to a failure to chain it. Also use a cleaer comment to the describe the ip_summed field of struct net_lro_mgr. Issue raised by Or Gerlitz <> Signed-off-by: Eli Cohen <> Signed-off-by: David S. Miller <>
2008-06-27inet fragments: fix race between inet_frag_find and inet_frag_secret_rebuildPavel Emelyanov
The problem is that while we work w/o the inet_frags.lock even read-locked the secret rebuild timer may occur (on another CPU, since BHs are still disabled in the inet_frag_find) and change the rnd seed for ipv4/6 fragments. It was caused by my patch fd9e63544cac30a34c951f0ec958038f0529e244 ([INET]: Omit double hash calculations in xxx_frag_intern) late in the 2.6.24 kernel, so this should probably be queued to -stable. Signed-off-by: Pavel Emelyanov <> Signed-off-by: David S. Miller <>
2008-06-27CONNECTOR: add a proc entry to list connectorsLi Zefan
I got a problem when I wanted to check if the kernel supports process event connector, and It seems there's no way to do this check. At best I can check if the kernel supports connector or not, by looking into /proc/net/netlink, or maybe checking the return value of bind() to see if it's ENOENT. So it would be useful to add /proc/net/connector to list all supported connectors: # cat /proc/net/connector Name ID connector 4294967295:4294967295 cn_proc 1:1 w1 3:1 Changelog: - fix memory leak: s/seq_release/single_release - use spin_lock_bh instead of spin_lock_irqsave Signed-off-by: Li Zefan <> Acked-by: Evgeniy Polyakov <> Signed-off-by: David S. Miller <>
2008-06-27netlink: Fix some doc comments in net/netlink/attr.cJulius Volz
Fix some doc comments to match function and attribute names in net/netlink/attr.c. Signed-off-by: Julius Volz <> Signed-off-by: David S. Miller <>
2008-06-27tcp: /proc/net/tcp rto,ato values not scaled properly (v2)Stephen Hemminger
I found another case where we are sending information to userspace in the wrong HZ scale. This should have been fixed back in 2.5 :-( This means an ABI change but as it stands there is no way for an application like ss to get the right value. Signed-off-by: Stephen Hemminger <> Signed-off-by: David S. Miller <>
2008-06-27include/linux/netdevice.h: don't export MAX_HEADER to userspaceAdrian Bunk
Due to the CONFIG_'s the value is anyway not correct in userspace. Signed-off-by: Adrian Bunk <> Signed-off-by: David S. Miller <>
2008-06-27pkt_sched: Remove CONFIG_NET_SCH_RRAdrian Bunk
Commit d62733c8e437fdb58325617c4b3331769ba82d70 ([SCHED]: Qdisc changes and sch_rr added for multiqueue) added a NET_SCH_RR option that was unused since the code went unconditionally into sch_prio. Reported-by: Robert P. J. Day <> Signed-off-by: Adrian Bunk <> Signed-off-by: David S. Miller <>
2008-06-27pkt_sched: ERR_PTR() ususally encodes an negative errno, not positive.WANG Cong
Note, in the following patch, 'err' is initialized as: int err = -ENOBUFS; Signed-off-by: WANG Cong <> Signed-off-by: David S. Miller <>
2008-06-27netdevice: Fix typo of dev_unicast_add() commentWang Chen
Signed-off-by: Wang Chen <> Signed-off-by: David S. Miller <>
2008-06-27af_unix: fix 'poll for write'/connected DGRAM socketsRainer Weikusat
For n:1 'datagram connections' (eg /dev/log), the unix_dgram_sendmsg routine implements a form of receiver-imposed flow control by comparing the length of the receive queue of the 'peer socket' with the max_ack_backlog value stored in the corresponding sock structure, either blocking the thread which caused the send-routine to be called or returning EAGAIN. This routine is used by both SOCK_DGRAM and SOCK_SEQPACKET sockets. The poll-implementation for these socket types is datagram_poll from core/datagram.c. A socket is deemed to be writeable by this routine when the memory presently consumed by datagrams owned by it is less than the configured socket send buffer size. This is always wrong for PF_UNIX non-stream sockets connected to server sockets dealing with (potentially) multiple clients if the abovementioned receive queue is currently considered to be full. 'poll' will then return, indicating that the socket is writeable, but a subsequent write result in EAGAIN, effectively causing an (usual) application to 'poll for writeability by repeated send request with O_NONBLOCK set' until it has consumed its time quantum. The change below uses a suitably modified variant of the datagram_poll routines for both type of PF_UNIX sockets, which tests if the recv-queue of the peer a socket is connected to is presently considered to be 'full' as part of the 'is this socket writeable'-checking code. The socket being polled is additionally put onto the peer_wait wait queue associated with its peer, because the unix_dgram_recvmsg routine does a wake up on this queue after a datagram was received and the 'other wakeup call' is done implicitly as part of skb destruction, meaning, a process blocked in poll because of a full peer receive queue could otherwise sleep forever if no datagram owned by its socket was already sitting on this queue. Among this change is a small (inline) helper routine named 'unix_recvq_full', which consolidates the actual testing code (in three different places) into a single location. Signed-off-by: Rainer Weikusat <> Signed-off-by: David S. Miller <>
2008-06-27tcp: fix for splice receive when used with software LROOctavian Purdila
If an skb has nr_frags set to zero but its frag_list is not empty (as it can happen if software LRO is enabled), and a previous tcp_read_sock has consumed the linear part of the skb, then __skb_splice_bits: (a) incorrectly reports an error and (b) forgets to update the offset to account for the linear part Any of the two problems will cause the subsequent __skb_splice_bits call (the one that handles the frag_list skbs) to either skip data, or, if the unadjusted offset is greater then the size of the next skb in the frag_list, make tcp_splice_read loop forever. Signed-off-by: Octavian Purdila <> Signed-off-by: David S. Miller <>
2008-06-27tcp: calculate tcp_mem based on low memory instead of all memoryMiquel van Smoorenburg
The tcp_mem array which contains limits on the total amount of memory used by TCP sockets is calculated based on nr_all_pages. On a 32 bits x86 system, we should base this on the number of lowmem pages. Signed-off-by: Miquel van Smoorenburg <> Signed-off-by: David S. Miller <>
2008-06-27hamradio: remove unused variableAndre Haupt
Signed-off-by: Andre Haupt <> Signed-off-by: David S. Miller <>
2008-06-28Fix error paths if md_probe fails.Neil Brown
md_probe can fail (e.g. alloc_disk could fail) without returning an error (as it alway returns NULL). So when we call mddev_find immediately afterwards, we need to check that md_probe actually succeeded. This means checking that mdev->gendisk is non-NULL. cc: <> Cc: Dave Jones <> Signed-off-by: Neil Brown <>
2008-06-28Don't acknowlege that stripe-expand is complete until it really is.Neil Brown
We shouldn't acknowledge that a stripe has been expanded (When reshaping a raid5 by adding a device) until the moved data has actually been written out. However we are currently acknowledging (by calling md_done_sync) when the POST_XOR is complete and before the write. So track in s.locked whether there are pending writes, and don't call md_done_sync yet if there are. Note: we all set R5_LOCKED on devices which are are about to read from. This probably isn't technically necessary, but is usually done when writing a block, and justifies the use of s.locked here. This bug can lead to a crash if an array is stopped while an reshape is in progress. Cc: <> Signed-off-by: Neil Brown <>
2008-06-28Ensure interrupted recovery completed properly (v1 metadata plus bitmap)Neil Brown
If, while assembling an array, we find a device which is not fully in-sync with the array, it is important to set the "fullsync" flags. This is an exact analog to the setting of this flag in hot_add_disk methods. Currently, only v1.x metadata supports having devices in an array which are not fully in-sync (it keep track of how in sync they are). The 'fullsync' flag only makes a difference when a write-intent bitmap is being used. In this case it tells recovery to ignore the bitmap and recovery all blocks. This fix is already in place for raid1, but not raid5/6 or raid10. So without this fix, a raid1 ir raid4/5/6 array with version 1.x metadata and a write intent bitmaps, that is stopped in the middle of a recovery, will appear to complete the recovery instantly after it is reassembled, but the recovery will not be correct. If you might have an array like that, issueing echo repair > /sys/block/mdXX/md/sync_action will make sure recovery completes properly. Cc: <> Signed-off-by: Neil Brown <>
2008-06-27kbuild: fix a.out.h export to userspace with O= build.David Woodhouse
We need to check for existence of the a.out.h header in the source tree, not the object tree, if we want it to get the right answer with O=. Signed-off-by: David Woodhouse <> Signed-off-by: Sam Ravnborg <>
2008-06-27firewire: fw-sbp2: fix parsing of logical unit directoriesRichard Sharpe
There is a small off-by-one bug in firewire-sbp2. This causes problems when a device exports multiple LUN Directories. I found it when trying to talk to a SONY DVD Jukebox. Signed-off-by: Richard Sharpe <> Acked-by: Kristian Høgsberg <> Signed-off-by: Stefan Richter <> (op. order, changelog)
2008-06-27mac80211: fix an oops in several failure paths in key allocationEmmanuel Grumbach
This patch fixes an oops in several failure paths in key allocation. This Oops occurs when freeing a key that has not been linked yet, so the key->sdata is not set. Signed-off-by: Emmanuel Grumbach <> Signed-off-by: Tomas Winkler <> Acked-by: Johannes Berg <> Signed-off-by: John W. Linville <>
2008-06-27prism: islpci_eth.c endianness fixHarvey Harrison
clock is already cpu-endian (see le32_to_cpu slightly before), so le64_to_cpu doesn't make much sense. Signed-off-by: Harvey Harrison <> Signed-off-by: John W. Linville <>
2008-06-27rt2x00: Fix lock dependency errrorIvo van Doorn
This fixes a circular locking dependency in the workqueue handling. The interface work task uses the mac80211 function ieee80211_iterate_active_interfaces() which grabs the RTNL lock. However when the interface is brough down, this happens under the RTNL lock as well, this causes problems because mac80211 will flush the workqueue during the ifdown event. This causes mac80211 to wait until the driver has completed all work which can't finish because it is waiting on the RTNL lock. This is fixed by moving rt2x00 workqueue tasks on a different workqueue, this workqueue can be flushed when the ieee80211_hw structure is removed by the driver (when the driver is unloaded) which does not happen under the RTNL lock. Signed-off-by: Ivo van Doorn <> Signed-off-by: John W. Linville <>
2008-06-27Merge branch 'master' of ↵David S. Miller