Eric Lee / smarc-fsl-linux-kernel

05 Jun, 2009

25 commits

03 Jun, 2009

6 commits

02 Jun, 2009

9 commits

  • 12186be7d   net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic… ... Browse Code »

    … when we use cls_cgroup

    This patch fixes a bug which unconfigured struct tcf_proto keeps
    chaining in tc_ctl_tfilter(), and avoids kernel panic in
    cls_cgroup_classify() when we use cls_cgroup.

    When we execute 'tc filter add', tcf_proto is allocated, initialized
    by classifier's init(), and chained. After it's chained,
    tc_ctl_tfilter() calls classifier's change(). When classifier's
    change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

    In addition, cls_cgroup is initialized in change() not in init(). It
    accesses unconfigured struct tcf_proto which is chained before
    change(), then hits Oops.

    Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
    Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
    Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
    Tested-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
    Signed-off-by: David S. Miller <davem@davemloft.net>

    Minoru Usui
     
  • ea30e1197   e1000: add missing length check to e1000 receive routine ... Browse Code »

    Patch to fix bad length checking in e1000. E1000 by default does two
    things:

    1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
    2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
    doing an skb_put

    Since the e1000 driver isn't written to support receiving packets that span
    multiple rx buffers, it checks the End of Packet bit of every frame, and
    discards it if its not set. This places us in a situation where, if we have a
    spanning packet, the first part is discarded, but the second part is not (since
    it is the end of packet, and it passes the EOP bit test). If the second part of
    the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
    underflow the length, and wind up in skb_over_panic, when we try to skb_put a
    huge number of bytes into the skb. This amounts to a remote DOS attack through
    careful selection of frame size in relation to interface MTU. The fix for this
    is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
    one ever pushed it to e1000. This is lifted straight from e1000e, and prevents
    small frames from causing the underflow described above

    Signed-off-by: Neil Horman
    Tested-by: Andy Gospodarek
    Signed-off-by: David S. Miller

    Neil Horman
     
  • 5a9a8e32e   forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) ... Browse Code »

    Add a phy_power_down parameter to forcedeth: set to 1 to power down the
    phy and disable the link when an interface goes down; set to 0 to always
    leave the phy powered up.

    The phy power state persists across reboots; Windows, some BIOSes, and
    older versions of Linux don't bother to power up the phy again, forcing
    users to remove all power to get the interface working (see
    http://bugzilla.kernel.org/show_bug.cgi?id=13072). Leaving the phy
    powered on is the safest default behavior. Users accustomed to seeing
    the link state reflect the interface state and/or wanting to minimize
    power consumption can set phy_power_down=1 if compatibility with other
    OSes is not an issue.

    Signed-off-by: Ed Swierk
    Signed-off-by: David S. Miller

    Ed Swierk
     
  • 1b17d7664   xfs: prevent deadlock in xfs_qm_shake() ... Browse Code »

    It's possible to recurse into filesystem from the memory
    allocation, which deadlocks in xfs_qm_shake(). Add check
    for __GFP_FS, and bail out if it is not set.

    Signed-off-by: Felix Blyakher
    Signed-off-by: Hedi Berriche
    Reviewed-by: Christoph Hellwig
    Reviewed-by: Andi Kleen
    Signed-off-by: Felix Blyakher

    Felix Blyakher
     
  • e6da7c9fe   xfs: fix overflow in xfs_growfs_data_private ... Browse Code »

    In the case where growing a filesystem would leave the last AG
    too small, the fixup code has an overflow in the calculation
    of the new size with one fewer ag, because "nagcount" is a 32
    bit number. If the new filesystem has > 2^32 blocks in it
    this causes a problem resulting in an EINVAL return from growfs:

    # xfs_io -f -c "truncate 19998630180864" fsfile
    # mkfs.xfs -f -bsize=4096 -dagsize=76288719b,size=3905982455b fsfile
    # mount -o loop fsfile /mnt
    # xfs_growfs /mnt

    meta-data=/dev/loop0 isize=256 agcount=52,
    agsize=76288719 blks
    = sectsz=512 attr=2
    data = bsize=4096 blocks=3905982455, imaxpct=5
    = sunit=0 swidth=0 blks
    naming =version 2 bsize=4096 ascii-ci=0
    log =internal bsize=4096 blocks=32768, version=2
    = sectsz=512 sunit=0 blks, lazy-count=0
    realtime =none extsz=4096 blocks=0, rtextents=0
    xfs_growfs: XFS_IOC_FSGROWFSDATA xfsctl failed: Invalid argument

    Reported-by: richard.ems@cape-horn-eng.com
    Signed-off-by: Eric Sandeen
    Reviewed-by: Christoph Hellwig
    Reviewed-by: Felix Blyakher
    Signed-off-by: Felix Blyakher

    Eric Sandeen
     
  • 1f23920db   xfs: fix double unlock in xfs_swap_extents() ... Browse Code »

    Regreesion from commit ef8f7fc, which rearranged the code in
    xfs_swap_extents() leading to double unlock of xfs inode ilock.
    That resulted in xfs_fsr deadlocking itself on platforms, which
    don't handle double unlock of rw_semaphore nicely. It caused the
    count go negative, which represents the write holder, without
    really having one. ia64 is one of the platforms where deadlock
    was easily reproduced and the fix was tested.

    Signed-off-by: Eric Sandeen
    Reviewed-by: Eric Sandeen
    Signed-off-by: Felix Blyakher

    Felix Blyakher
     
  • 60e59f688   powerpc/pmac: Update PowerMac 32-bit defconfig ... Browse Code »

    This mostly adds back AppleTouch support and adds CONFIG_HIGHMEM
    by default.

    Signed-off-by: Benjamin Herrenschmidt

    Benjamin Herrenschmidt
     
  • fc23ffe07   Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6 Browse Code »
    David S. Miller
     
  • e7c4f03b8   Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    crypto: hash - Fix handling of sg entry that crosses page boundary

    Linus Torvalds