The vma_data structure may be shared by vma's from multiple tasks, with no
way of knowing which areas are shared or not shared, so release/clear pages
only when the refcount (of vma's) goes to zero.
Signed-off-by: Cliff Wickman <cpw@sgi.com>
Cc: Jes Sorensen <jes@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The mask on i830 should be 0x70 always, later chips 0xF0 should be okay.
Signed-off-by: Dave Airlie <airlied@linux.ie>
Acked-by: Zhenyu Wang <zhenyu.z.wang@intel.com>
Cc: Michael Haas <laga@laga.ath.cx>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix a couple drivers that do not correctly terminate their pci_device_id
lists. This results in garbage being spewed into modules.pcimap when the
module happens to not have 28 NULL bytes following the table, and/or the
last PCI ID is actually truncated from the table when calculating the
modules.alias PCI aliases, cause those unfortunate device IDs to not
auto-load.
Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-by: Corey Minyard <minyard@acm.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Acked-by: Jeff Garzik <jeff@garzik.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The shrinking of a virtual memory area that is mmap(2)'d to a memory
special file (device drivers/char/mspec.c) can cause a panic.
If the mapped size of the vma (vm_area_struct) is very large, mspec allocates
a large vma_data structure with vmalloc(). But such a vma can be shrunk by
an munmap(2). The current driver uses the current size of each vma to
deduce whether its vma_data structure was allocated by kmalloc() or vmalloc().
So if the vma was shrunk it appears to have been allocated by kmalloc(),
and mspec attempts to free it with kfree(). This results in a panic.
This patch avoids the panic (by preserving the type of the allocation) and
also makes mspec work correctly as the vma is split into pieces by the
munmap(2)'s.
All vma's derived from such a split vma share the same vma_data structure that
represents all the pages mapped into this set of vma's. The mpec driver
must be made capable of using the right portion of the structure for each
member vma. In other words, it must index into the array of page addresses
using the portion of the array that represents the current vma. This is
enabled by storing the vma group's vm_start in the vma_data structure.
The shared vma_data's are not protected by mm->mmap_sem in the fork() case
so the reference count is left as atomic_t.
Signed-off-by: Cliff Wickman <cpw@sgi.com>
Acked-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Add Guards around TIOCSLCKTRMIOS and TIOCGLCKTRMIOS.
Several architectures are still broken. Put temporary-for-2.6.23 ifdef guards
around the offending code.
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by:: Linus Torvalds <torvalds@linux-foundation.org>
G33 has 1MB GTT table range. Fix GTT mapping in case like 512MB aperture
size.
Signed-off-by: Zhenyu Wang <zhenyu.z.wang@intel.com>
Acked-by: Dave Airlie <airlied@linux.ie>
Cc: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
G33 GTT stolen memory is below graphics data stolen memory and be seperate,
so don't subtract it in stolen mem counting.
Signed-off-by: Zhenyu Wang <zhenyu.z.wang@intel.com>
Acked-by: Dave Airlie <airlied@linux.ie>
Cc: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
I ran into a few problems.
n_tty_ioctl() for instance:
drivers/char/tty_ioctl.c:799: error: $,1rxstruct termios$,1ry has no
member named $,1rxc_ispeed$,1ry
This is calling the copy interface that is supposed to be using
a termios2 when the new interfaces are defined, however:
case TIOCGLCKTRMIOS:
if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
return -EFAULT;
return 0;
This is going to write over the end of the userspace
structure by a few bytes, and wasn't caught by you yet
because the i386 implementation is simply copy_to_user()
which does zero type checking.
Signed-off-by: Alan Cox <alan@redhat.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The HPET clocksource in drivers/char/hpet.c was written as generic code
for ia64, but it is not yet ready to replace the native HPET clocksource
implementations that the i386/x86-64 architectures use.
On x86[-64], trying to register this clocksource results in potentially
multiple hpet-based clocksources being registered, and if the ia64 one
is chosen on x86_64 some users have experienced hangs.
Eventually all three architectures may end up using the same code, but
that is not the case right now.
Cc: John Stultz <johnstul@us.ibm.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Paolo Ornati <ornati@fastwebnet.it>
Cc: Bob Picco <bob.picco@hp.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* 'agp-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6:
agp: balance ioremap checks
agp: Add device id for P4M900 to via-agp module
efficeon-agp leaks 'struct agp_bridge_data' in error paths of agp_efficeon_probe()
* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm: ioremap return value checks
drm/via: Fix dmablit when blit queue is full
drm_rmmap_ioctl(): remove dead code
patchset against 2.6.23-rc3.
corrects missing ioremap return checks and balancing on iounmap calls, integrated changes per list
recommendations on the original set of patches..
Signed-off-by: Scott Thompson <postfail <at> hushmail.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
kmalloc() hands us a void pointer, we don't need to cast it.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Schedule /proc/acpi/event for removal in 6 months.
Re-name acpi_bus_generate_event() to acpi_bus_generate_proc_event()
to make sure there is no confusion that it is for /proc/acpi/event only.
Add CONFIG_ACPI_PROC_EVENT to allow removal of /proc/acpi/event.
There is no functional change if CONFIG_ACPI_PROC_EVENT=y
Signed-off-by: Len Brown <len.brown@intel.com>
Get module reference on open() by generic HDLC to prevent module from
unloading while interface is active.
Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
m68k/mac: Make mac_hid_mouse_emulate_buttons() declaration visible
drivers/char/keyboard.c: In function 'kbd_keycode':
drivers/char/keyboard.c:1142: error: implicit declaration of function 'mac_hid_mouse_emulate_buttons'
The forward declaration of mac_hid_mouse_emulate_buttons() is not visible on
m68k because it's hidden in the middle of a big #ifdef block.
Move it to <linux/kbd_kern.h>, correct the type of the second parameter, and
include <linux/kbd_kern.h> where needed.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix up the maintainers info in the tpm drivers. Kylene will be out for
some time, so copying the sourceforge list is the best way to get some
attention.
Cc: Marcel Selhorst <tpm@selhorst.net>
Cc: Kylene Jo Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
From: Andrey Borzenkov <arvidjaar@mail.ru>
They are apparently pretty close (even lspci combines them). The patch
adds support for 0x1533 bridge in addition to 0x1535.
Tested on Toshiba Portege 4000 with
00:07.0 ISA bridge [0601]: ALi Corporation M1533/M1535 PCI to ISA Bridge
[Aladdin IV/V/V+] [10b9:1533]
00:08.0 Bridge [0680]: ALi Corporation M7101 Power Management Controller
[PMU] [10b9:7101]
with result
[ 2090.906736] PCI: Enabling device 0000:00:08.0 (0000 -> 0001)
[ 2090.914034] ALi_M1535: initialized. timeout=3D60 sec (nowayout=3D0)
Signed-off-by: Andrey Borzenkov <arvidjaar@mail.ru>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Clean-up history and add a comment about the fact that
the watchdog is actually part of the SMSC FDC 37B782
super I/O chipset.
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Files using bits from paravirt.h should explicitly include it rather than
relying on it being pulled in by something else.
Signed-off-by: Jes Sorensen <jes@sgi.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Patch c5c34d4862 (tty: flush flip buffer on
ldisc input queue flush) introduces a race condition which can lead to memory
leaks.
The problem can be triggered when tcflush() is called when data are being
pushed to the line discipline driver by flush_to_ldisc().
flush_to_ldisc() releases tty->buf.lock when calling the line discipline
receive_buf function. At that poing tty_buffer_flush() kicks in and sets both
tty->buf.head and tty->buf.tail to NULL. When flush_to_ldisc() finishes, it
restores tty->buf.head but doesn't touch tty->buf.tail. This corrups the
buffer queue, and the next call to tty_buffer_request_room() will allocate a
new buffer and overwrite tty->buf.head. The previous buffer is then lost
forever without being released.
(Thanks to Laurent for the above text, for finding, disgnosing and reporting
the bug)
- Use tty->flags bits for the flush status.
- Wait for the flag to clear again before returning
- Fix the doc error noted
- Fix flush of empty queue leaving stale flushpending
[akpm@linux-foundation.org: cleanup]
Signed-off-by: Alan Cox <alan@redhat.com>
Acked-by: Paul Fulghum <paulkf@microgate.com>
Cc: Laurent Pinchart <laurentp@cse-semaphore.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
cm4000_cs.c and cm4040_cs.c call the internal release function with
an argument of wrong type. this fixes bug #8485
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Cc: Bill McConnaughey <mcconnau@biochem.wustl.edu>
Cc: Natalie Protasevich <protasnb@gmail.com>
Cc: Harald Welte <laforge@gnumonks.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This 965G and above chipsets moved the batch buffer non-secure bits to
another place. This means that previous drm's allowed in-secure batchbuffers
to be submitted to the hardware from non-privileged users who are logged
into X and and have access to direct rendering.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(This is a resend of a patch originally submitted on 24-Jul-2007 00:14)
Ok, this is something the coverity checker found (CID: 1813).
I'm not at all intimate with this code, so I'm not sure if this
attempt at a fix is correct (but at least it compiles).
Please look it over and NACK if bad or merge if good ;-)
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
ids member of struct acpi_driver is of type struct acpi_device_id, not a
character array.
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: Mattia Dongili <malattia@linux.it>
Signed-off-by: Len Brown <len.brown@intel.com>
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: (28 commits)
[WATCHDOG] Fix pcwd_init_module crash
[WATCHDOG] ICH9 support for iTCO_wdt
[WATCHDOG] 631xESB/632xESB support for iTCO_wdt - add all LPC bridges
[WATCHDOG] 631xESB/632xESB support for iTCO_wdt
[WATCHDOG] omap_wdt.c - default error for IOCTL is -ENOTTY
[WATCHDOG] Return value of nonseekable_open
[WATCHDOG] mv64x60_wdt: Rework the timeout register manipulation
[WATCHDOG] mv64x60_wdt: disable watchdog timer when driver is probed
[WATCHDOG] mv64x60_wdt: Support the WDIOF_MAGICCLOSE feature
[WATCHDOG] mv64x60_wdt: Add a module parameter to change nowayout setting
[WATCHDOG] mv64x60_wdt: Add WDIOC_SETOPTIONS ioctl support
[WATCHDOG] mv64x60_wdt: Support for WDIOC_SETTIMEOUT ioctl
[WATCHDOG] mv64x60_wdt: Fix WDIOC_GETTIMEOUT return value
[WATCHDOG] mv64x60_wdt: Check return value of nonseekable_open
[WATCHDOG] mv64x60_wdt: Add arch/powerpc platform support
[WATCHDOG] mv64x60_wdt: Get register address from platform data
[WATCHDOG] mv64x60_wdt: set up platform_device in platform code
[WATCHDOG] ensure mouse and keyboard ignored in w83627hf_wdt
[WATCHDOG] s3c2410_wdt: fixup after arch include moves
[WATCHDOG] git-watchdog-typo
...
This is only called at init time and only happens if the BIOS screws
something up, so the leak is slight and it is probably not worth sending to
2.6.22.x. The driver would not initialize the interface in the case, and I
have no reports of this happening. I have booted and run tests on a system
with this patch. Note that the original patch was munged by the mailer,
here's a new one.
If we ever hit the "default:" case in the switch in try_init_dmi(),
then we'll leak the storage allocated with kzalloc() and assigned
to 'info'.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix transmit DMA stall when write() called in window after previous
transmit DMA completes but before previous serial transmission completes.
Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix for the problem detected by Ingo Molnar:
enabling CONFIG_PCWATCHDOG=y crashes bzImage bootup.
The reason for this can be found in drivers/makefile
We first do:
obj-y += char/
and later we do:
obj-y += base/ block/ misc/ mfd/ net/ media/
So if we put a platform or isa or usb bus driver in char/watchdog
(which is called from the Makefile in drivers/char/Makefile)
then we didn't have the different device drivers initialized yet
(they are in drivers/base and drivers/usb and ...)
This fix makes sure that we compile the watchdog drivers after
drivers/base, drivers/misc, drivers/pci and drivers/usb.
We also do the compile after hwmon because in the future the
watchdog temperature support will use the hwmon system.
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Fix some missing places to check with device id info, which
should probe the device gart correctly.
Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
AGP should not need to lock pages. They are not protecting any race
because there is no lock_page calls, only SetPageLocked.
This is causing hangs with d00806b183.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Hi,
Coverity spotted a "use after free" bug in
drivers/char/agp/ati-agp.c::ati_create_gatt_pages().
The same one that was in
drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages()
The problem is this:
If "entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);"
fails, then there's a loop in the function to free all entries
allocated so far and break out of the allocation loop. That in itself
is pretty sane, but then the (now freed) 'tables' is assigned to
ati_generic_private.gatt_pages and 'retval' is set to -ENOMEM which
causes ati_free_gatt_pages(); to be called at the end of the function.
The problem with this is that ati_free_gatt_pages() will then loop
'ati_generic_private.num_tables' times and try to free each entry in
tables[] - this is bad since tables has already been freed and
furthermore it will call kfree(tables) at the end - a double free.
This patch removes the freeing loop in ati_create_gatt_pages() and
instead relies entirely on the call to ati_free_gatt_pages() to free
everything we allocated in case of an error. It also sets
ati_generic_private.num_tables to the actual number of entries
allocated instead of just using the value passed in from the caller -
this ensures that ati_free_gatt_pages() will only attempt to free
stuff that was actually allocated.
Note: I'm in no way intimate with this code and I have no way to
actually test this patch (besides compile test it), so while I've
tried to be careful in reading the code and make sure the patch
does the right thing an ACK from someone who actually knows the
code in-depth would be very much appreciated.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Add all LPC bridges for the 631xESB/632xESB I/O chipset.
The datasheet says:
* Device Function = B0:D31:FO
* Function Description = LPC interface
* DEV ID = 267xh
* Comment = 2670h-267Fh
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Add 631xESB/632xESB support to the iTCO_wdt driver.
Signed-off-by: Sergey Kononenko <sergk@sergk.org.ua>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Documentation: The FIXMEs
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Documentation: The Drivers
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
ACPI: Kconfig: remove CONFIG_ACPI_SLEEP from source
ACPI: quiet ACPI Exceptions due to no _PTC or _TSS
ACPI: Remove references to ACPI_STATE_S2 from acpi_pm_enter
ACPI: Kconfig: always enable CONFIG_ACPI_SLEEP on X86
ACPI: Kconfig: fold /proc/acpi/sleep under CONFIG_ACPI_PROCFS
ACPI: Kconfig: CONFIG_ACPI_PROCFS now defaults to N
ACPI: autoload modules - Create __mod_acpi_device_table symbol for all ACPI drivers
ACPI: autoload modules - Create ACPI alias interface
ACPI: autoload modules - ACPICA modifications
ACPI: asus-laptop: Fix failure exits
ACPI: fix oops due to typo in new throttling code
ACPI: ignore _PSx method for hotplugable PCI devices
ACPI: Use ACPI methods to select PCI device suspend state
ACPI, PNP: hook ACPI D-state to PNP suspend/resume
ACPI: Add acpi_pm_device_sleep_state helper routine
ACPI: Implement the set_target() callback from pm_ops
