Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 16 5月, 2006 14 次提交
  3. 13 5月, 2006 11 次提交
  5. 11 5月, 2006 6 次提交
  7. 10 5月, 2006 9 次提交
    • M
      [SCSI] mptfc: race between mptfc_register_dev and mptfc_target_alloc · 6dd727da
      由 mdr@sgi.com 提交于 
      A race condition exists in mptfc between the thread registering a device
with the fc transport and the scan work generated by the transport.
This race existed prior to the application of the mptfc bug fix patch.

mptfc_register_dev() calls fc_remote_port_add() with the FC_RPORT_ROLE_TARGET
bit set in the rport ids passed to the function.  Having this bit set causes
fc_remote_port_add() to schedule a scan of the device.

This scan can execute before mptfc_register_dev() can fill in the dd_data
in the rport structure.  When this happens, mptfc_target_alloc() will fail
because dd_data is null.

Attached is a patch which fixes the problem.  The patch changes the rport ids
passed to fc_remote_port_add() to not have the TARGET bit set.  This prevents
the scan from being scheduled.  After mptfc_register_dev() fills in the rport
dd_data field, fc_remote_port_rolechg() is called, changing the role of the
rport to TARGET.  Thus, the scan is scheduled after dd_data is filled
in which prevents the failure in mptfc_target_alloc().
Signed-off-by: NMichael Reed <mdr@sgi.com>
Signed-off-by: NEric Moore <Eric.Moore@lsil.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>
      6dd727da
    • J
      [TG3]: Fix possible NULL deref in tg3_run_loopback(). · a50bb7b9
      由 Jesper Juhl 提交于 
      tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.

Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer.  Much
better to fail gracefully by returning -ENOMEM than crashing here.
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a50bb7b9
    • R
      IPoIB: Free child interfaces properly · 5941d079
      由 Roland Dreier 提交于 
      When deleting a child interface with a non-default P_Key via
/sys/class/net/ibX/delete_child, the interface must be freed with
free_netdev() (rather than kfree() on the private data).
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      5941d079
    • C
      [IRDA]: Switching to a workqueue for the SIR work · 788252e6
      由 Christoph Hellwig 提交于 
      Since sir_kthread.c pretty much duplicates the workqueue
functionality, we'd better switch.  The SIR fsm has been merged into
sir_dev.c and thus sir_kthread.c is deleted.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NSamuel Ortiz <samuel.ortiz@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      788252e6
    • D
      [IRDA]: smsc-ircc: Minimal hotplug support. · d94c77b9
      由 David Brownell 提交于 
      Minimal PNP hotplug support for the smsc-ircc2 driver.  A modular
driver will be modprobed via hotplug, but still bypasses driver model
probing.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NSamuel Ortiz <samuel.ortiz@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d94c77b9
    • J
      [PATCH] scx200_acb: Fix for the CS5535 errata · 95563d34
      由 Jordan Crouse 提交于 
      This is a fix for the CS5535 errata 111:

When the SMBus controller tries to access a non-existing device, it sets
the NEGACK bit, SMBus I/O offset 01h[4], to 1 after it detects no
acknowledge at the ninth clock.  The specification states that the bit
can be cleared by writing a 1 to it, but under certain circumstances it
is possible for this bit to not clear.

Writing a 0 to the bit resets the internal state machine and clears the
issue.

Since all writable bits in ACBST are W1C bits (write-one-to-clear) the
second write doesn't affect any other logic except the buggy NEGACK
state machine. The second write clears an internal register which is
responsible for "overwriting" the NEGACK bit in ACBST.
Signed-off-by: NJordan Crouse <jordan.crouse@amd.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      95563d34
    • J
      [PATCH] scx200_acb: Fix resource name use after free · b33d0798
      由 Jean Delvare 提交于 
      We can't pass a string on the stack to request_region. As soon as we
leave the function that stack is gone and the string is lost. Let's
use the same string we identify the i2c_adapter with instead, it's
more simple, more consistent, and just works.

This is the second half of fix to bug #6445.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      b33d0798
    • J
      [PATCH] scx200_acb: Fix return on init error · 6f9c2963
      由 Jean Delvare 提交于 
      The scx200_acb driver shouldn't return failure after initialization
if it successfully registered at least one i2c_adapter, else we are
leaking resources. The driver was OK in that respect up to 2.6.16, a
recent change broke it.

This is part of the fix to bug #6445.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Cc: Ben Gardner <bgardner@wabtec.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      6f9c2963
    • R
      IB/mthca: Fix race in reference counting · a3285aa4
      由 Roland Dreier 提交于 
      Fix races in in destroying various objects.  If a destroy routine
waits for an object to become free by doing

	wait_event(&obj->wait, !atomic_read(&obj->refcount));
	/* now clean up and destroy the object */

and another place drops a reference to the object by doing

	if (atomic_dec_and_test(&obj->refcount))
		wake_up(&obj->wait);

then this is susceptible to a race where the wait_event() and final
freeing of the object occur between the atomic_dec_and_test() and the
wake_up().  And this is a use-after-free, since wake_up() will be
called on part of the already-freed object.

Fix this in mthca by replacing the atomic_t refcounts with plain old
integers protected by a spinlock.  This makes it possible to do the
decrement of the reference count and the wake_up() so that it appears
as a single atomic operation to the code waiting on the wait queue.

While touching this code, also simplify mthca_cq_clean(): the CQ being
cleaned cannot go away, because it still has a QP attached to it.  So
there's no reason to be paranoid and look up the CQ by number; it's
perfectly safe to use the pointer that the callers already have.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      a3285aa4