Commit Graph

63294 Commits

Author SHA1 Message Date
Prakash, Sathya
09120a8cd3 [SCSI] mpt fusion: Changes in mptctl.c for logging support
This patch contains changes in mptctl.c to support logging in MPT fusion drivers

The changes are majorly in debug printks, the existing debugprintk are
modified accroding to new debug macros defined in the file mptbdebug.h

signed-off-by: Sathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 11:33:45 -04:00
Prakash, Sathya
d6ecdd638a [SCSI] mpt fusion: Changes in mptfc.c mptlan.c mptsas.c and mptspi.c for logging support
This patch contains changes in mptfc.c, mptlan.c, mptsas.c and mptspi.c to
support logging in MPT fusion drivers.

The changes are majorly in debug printks, the existing debugprintk are
modified accroding to new debug macros defined in the file mptbdebug.h

signed-off-by: Sathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 11:31:54 -04:00
Jack Morgenstein
0172e2e14c mlx4_core: Remove kfree() in mlx4_mr_alloc() error flow
mlx4_mr_alloc() doesn't actually allocate mr (it just initializes the
pointer that the caller passes in), so it shouldn't free it if an
error occurs.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-07-28 08:30:45 -07:00
Prakash, Sathya
6757d6b4c0 [SCSI] mpt fusion: Changes in mptscsih.c for logging support
This patch contains changes in mptscsih.c to support logging in MPT fusion
drivers.

The changes are majorly in debug printks, the existing debugprintk are
modified accroding to new debug macros defined in the file mptbdebug.h

A new sysfs attribute is added to retrieve and modify the debug level.

signed-off-by: Sathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 11:30:27 -04:00
Prakash, Sathya
436ace725f [SCSI] mpt fusion: Changes in mptbase.c for logging support
This patch contains changes in mptbase.c to support logging in MPT fusion
drivers.

The changes are majorly in debug printks, the existing debugprintk are
modified accroding to new debug macros defined in the file mptbdebug.h

A new module parameter mpt_debug_level is added to pass the debug level as
module parameter.

signed-off-by: Sathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 11:26:12 -04:00
Prakash, Sathya
5c1b91b992 [SCSI] mpt fusion: logging support in Kconfig, Makefile, mptbase.h and addition of mptdebug.h
This patch adds a new file mptdebug.h in the fusion source directory,
which contains different debug macros.  The existing debug macros and
flags are removed from the mptbase.h and Makefile In Kconfig a new
configuration parameter FUSION_LOGGING is added to enable/disable the
logging support during compile time.

signed-off-by: Sathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 11:25:35 -04:00
Tom Tucker
4e8e6ee380 RDMA/amso1100: Initialize the wait_queue_head_t in the c2_qp structure
Fix a crash if the driver has to wait for a QP reference to be dropped
when destroying the QP.

Signed-off-by: Ethan Burns <eaburns@iol.unh.edu>
Acked-by: Tom Tucker <tom@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
2007-07-28 08:06:40 -07:00
Jesper Juhl
92631fa4d0 [SCSI] libsas: Fix potential NULL dereference in sas_smp_get_phy_events()
In sas_smp_get_phy_events() we never test if the call to
alloc_smp_req(RPEL_REQ_SIZE) succeeds or fails. That means we run
the risk of dereferencing a NULL pointer if it does fail. Far
better to test if we got NULL back and in that case return -ENOMEM
just as we already do for the other memory allocation in that
function.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 10:58:28 -04:00
Paul Mundt
99d4d0a9f2 [SCSI] bsg: Fix build for CONFIG_BLOCK=n
BLK_DEV_BSG was added outside of the if BLOCK check, which allows it to
be enabled when CONFIG_BLOCK=n. This leads to many screenlengths of
errors, starting with a parse error on the request_queue_t definition.
Obviously this wasn't intended for CONFIG_BLOCK=n usage, so just move the
option back in to the block.

Caught with a randconfig on sh.

Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Acked-by: Jens Axboe <jens.axboe@oracle.com>
Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 10:56:06 -04:00
Salyzyn, Mark
9859c1aa7e [SCSI] aacraid: fix Sunrise Lake reset handling
The patch is *much* smaller than the description. I am attempting to
answer to those that want to understand an issue that was reported in
May this year.

If a Sunrise Lake based card that requires an alternate reset mechanism
is set up to ignore the commanded IOP_RESET it reports 0x00000010
(IOP_RESET ignored) instead of 0x3803000F (use alternate reset mechanism
to reset all cores), and thus the reset platform function decides to
switch to IOP_RESET_ALWAYS because the reset platform function
parameters indicate that we *need* to reset the card. IOP_RESET_ALWAYS
then responds with the 0x3803000F return code, but alas we treat this as
an error instead of using the alternate reset mechanism (put a 0x03 into
the register offset 0x38). The reset fails, but the fact that the
IOP_RESET_ALWAYS command was issued has put the card in a purposeful
shutdown state in preparation for the alternate hardware reset to be
applied. Yuck.

IOP_RESET is ignored in internal production cards, typically to ensure
that we catch all adapter lockup issues without the driver progressing
further, so this would not appear to be a field issue and thus this
patch was destined to be only in the internal Adaptec source tree.
IOP_RESET_ALWAYS is reserved for
kexec/kdump/FirmwareUpdate/AutomatedTestFrames so we did not function as
expected in any case. Also in the past we have had OEMs specifically
request that cards not be resetable after a BlinkLED/FirmwareAssert for
one reason or another and To head off the possibility that the Sunrise
Lake based cards would suffer a similar fate, we propose the enclosed
fix.

Yinghai Lu of SUN had a pre-production card with IOP_RESET disabled when
he reported an issue to the linux kernel list back in May regarding a
kexec problem resulting from this reset being ignore. His fix was to
update the Firmware to one that did not ignore the IOP_RESET. Previous
kernels did not attempt to reset the adapter and that is why it surfaced
as a regression in his hands.

The current list of aacraid based cards that use Sunrise Lake:

9005:0285:9005:02b5     Adaptec 5445
9005:0285:9005:02b6     Adaptec 5805
9005:0285:9005:02b7     Adaptec 5085
9005:0285:9005:02c3     Adaptec 51205
9005:0285:9005:02c4     Adaptec 51605
9005:0285:9005:02ce     Adaptec 51245
9005:0285:9005:02cf     Adaptec 51645
9005:0285:9005:02d0     Adaptec 52445
9005:0285:9005:02d1     Adaptec 5405
9005:0285:9005:02b8     ICP     ICP5445SL
9005:0285:9005:02b9     ICP     ICP5085SL
9005:0285:9005:02ba     ICP     ICP5805SL
9005:0285:9005:02c5     ICP     ICP5125SL
9005:0285:9005:02c6     ICP     ICP5165SL
9005:0285:108e:7aac     SUN     STK RAID REM
9005:0285:108e:0286     SUN     STK RAID INT
9005:0285:108e:0287     SUN     STK RAID EXT
9005:0285:108e:7aae     SUN     STK RAID EM

All of these are publicly released with IOP_RESET enabled. So there is
no immediate need for this patch.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 10:11:32 -04:00
Salyzyn, Mark
b90f90d230 [SCSI] aacraid: add SCSI SYNCHONIZE_CACHE range checking
Customer running an application that issues SYNCHRONIZE_CACHE calls
directly noticed the broad stroke of the current implementation in the
aacraid driver resulting in multiple applications feeding I/O to the
storage causing the issuing application to stall for long periods of
time. By only waiting for the current WRITE commands, rather than all
commands, to complete; and those that are in range of the
SYNCHRONIZE_CACHE call that would associate more tightly with the
issuing application before telling the Firmware to flush it's dirty
cache, we managed to reduce the stalling. The Firmware itself still
flushes all the dirty cache associated with the array ignoring the
range, it just does so in a more timely manner.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 10:09:07 -04:00
akpm@linux-foundation.org
80b1c7bdc1 [SCSI] add easyRAID to the no report luns blacklist
According to http://bugzilla.kernel.org/show_bug.cgi?id=5953, the
easyRAID returns rubbish to REPORT LUNS.

Cc: Natalie Protasevich <protasnb@gmail.com>
Cc: Hans-Christian Armingeon <mog.johnny@gmx.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-28 10:00:28 -04:00
Yoann Padioleau
1e4dcd22ef [IA64] Compare pointer against NULL, not '0'
When comparing a pointer, it's clearer to compare it to NULL than to 0.

Signed-off-by: Yoann Padioleau <padator@wanadoo.fr>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-27 15:40:42 -07:00
Tony Luck
7a6c813594 [IA64] Fix build failure in fs/quota.c
b716395e2b added code to handle
a compatability issue with 32bit quota tools, but the new compat
routines are only needed when CONFIG_COMPAT=y (and with this set
to 'n' there are compilation problems since some new typedefs are
not visible).

Reported by Doug Chapman.  Fix tuned by a cast of thousands (Andi,
Andreas, Arthur, HPA, Willy)

Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-27 15:40:13 -07:00
Thomas Renninger
7091138fb7 [IA64] Use new acpi_device_id struct for HID init in ia64/hp/common/sba_iommu.c
Forgot to adjust this one with the acpi autoloading patches
in commit 8c8eb78f67

Acked-by: Myron Stowe <myron.stowe@hp.com>
Acked-by: Len Brown <len.brown@intel.com>
Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-27 15:38:31 -07:00
Matthew Wilcox
27c868c223 [SCSI] advansys: lindent and other large, uninteresting changes
- Run Lindent
 - Move advansys_detect and advansys_release to the end of the file
 - Split advansys_board_found out of advansys_detect
 - Rename a few variables, such as shp to shost and pci_devp to pdev
 - Turn STATIC into static

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 11:41:40 -04:00
James Bottomley
0f82cb9211 [SCSI] aic79xx, aic7xxx: Fix incorrect width setting
Wide transfers are required for every setting of PPR apart from QAS.
It seems the DV code starts at the minimum, which turns on DT and Wide
regardless of the setting of max_width.  Redo the PPR and period
setting routines to respect max_width (i.e. start at period = 10 if it
is zero).

This fixes bugzilla 8366

Acked-by: "Freels, James D." <freelsjd@ornl.gov>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:20:20 -04:00
Seokmann Ju
281afe1947 [SCSI] qla2xxx: fix to honor ignored parameters in sysfs attributes
This is a patch to fix 'segmentation fault' issue which was initiated
by Richard Lary <rlary@us.ibm.com>.  Thanks again Richard.

- on following sysfs attritute function, changes have made so that both
  count and offset input parameters are honored by the functions.
    = qla2x00_sysfs_read_nvram()
    = qla2x00_sysfs_read_vpd()
- made changes so that NVRAM data to be cached to minimize H/W accesses
  during agent querying of the driver's.

Signed-off-by: Seokmann Ju <seokmann.ju@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:14:22 -04:00
Salyzyn, Mark
c835e3727b [SCSI] aacraid: draw line in sand, sundry cleanup and version update
Minor unimportant cuttings from the floor bundled in with a version
stamp update. Only controversial change is the dropping of Alan Cox
copyright on the nark.c module since that file has no code written by
him in it.

Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:13:28 -04:00
Mike Christie
b6d44fe958 [SCSI] iscsi_tcp: Turn off bounce buffers
It was found by LSI that on setups with large amounts of memory
we were bouncing buffers when we did not need to. If the iscsi tcp
code touches the data buffer (or a helper does),
it will kmap the buffer. iscsi_tcp also does not interact with hardware,
so it does not have any hw dma restrictions. This patch sets the bounce
buffer settings for our device queue so buffers should not be bounced
because of a driver limit.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:12:54 -04:00
Mike Christie
e07264071f [SCSI] libiscsi: fix cmd seqeunce number checking
We should not be checking the cmd windown for just handling r2t responses.
And if the window closes in on us, always have scsi-ml requeue the command
from our queuecommand function.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:12:05 -04:00
Mike Christie
7974392c0b [SCSI] iscsi_tcp, ib_iser Enable module refcounting for iscsi host template
This prevents the iscsi modules from being unloaded while
there are active mounts from an iscsi target.

Signed-off-by: Olaf Kirch <olaf.kirch@oracle.com>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:11:45 -04:00
Mike Christie
464bb99ea4 [SCSI] libiscsi: make sure session is not blocked when removing host
When we logout we block the session since we are not taking any more
commands, but when we call remove host we want to make sure any
IO that got queued up and blocked gets failed upwards quickly, so
we unblock the session and fail it.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-07-27 09:11:14 -04:00
Heiko Carstens
5aaaf9f0ed [S390] Fix sclp_vt220 error handling.
Also convert to slab_is_available() as an indicator if
get_zeroed_page() will work or not.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:20 +02:00
Cornelia Huck
4434a38c37 [S390] cio: Reorganize initialization.
- Localize more of the init calls in init_channel_subsystem().
- Print a warning if init_channel_subsystem() failed.

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:20 +02:00
Cornelia Huck
303fa9e396 [S390] cio: Make CIO_* macros safe if dbfs are not available.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:20 +02:00
Cornelia Huck
e556bbbd9d [S390] cio: Clean up messages.
- Remove unneeded messages.
- Move some messages into the debug feature.
- Use dev_* where appropriate.
- Use "cio: " prefix consistently.

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:19 +02:00
Heiko Carstens
b771aeac32 [S390] Fix IRQ tracing.
If a machine check is pending and the external or I/O interrupt handler
returns to userspace io_mcck_pending is going to call s390_handle_mcck.
Before this happens a call to TRACE_IRQS_ON was already made since we
know that we are going back to userspace and hence interrupts will be
enabled. So there was an indication that interrupts are enabled while
in reality they are still disabled.
s390_handle_mcck will do a local_irq_save/restore pair and confuse
lockdep which later complains about inconsistent irq tracing.
To solve this just call trace_hardirqs_off before calling
s390_handle_mcck and trace_hardirqs_on afterwards.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:19 +02:00
Frank Munzert
2b3d8c9e06 [S390] vmur: fix diag14_read.
Record length of spool file must be only stored in 1st SPLINK record

Signed-off-by: Frank Munzert <munzert@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:19 +02:00
Martin Schwidefsky
7a8e0c8d9a [S390] Wire up sys_fallocate.
This patch implements support of fallocate system call on s390(x)
platform.  A wrapper is added to address the issue which s390 ABI has with
the arguments of this system call.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:19 +02:00
Christian Borntraeger
cb1863a461 [S390] add types.h include to s390_ext.h
The header file for external interrupts uses the _u16 type. Make sure
that _u16 is defined by including linux/types.h. This prevents compile
failures, if asm/s390_ext.h is the first include file.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:18 +02:00
Cornelia Huck
8059862c63 [S390] cio: Remove deprecated rdc/rcd.
http://marc.info/?l=linux-kernel&m=118481061928246&w=2 seems to
indicate disfavour of "deprecated", so let's just kill it now.

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:18 +02:00
Heiko Carstens
e62133b4ea [S390] Get rid of new section mismatch warnings.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:18 +02:00
Heiko Carstens
3b74a87422 [S390] sclp: kill unused SCLP config option.
sclp is always compiled in.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:18 +02:00
Cornelia Huck
36914e5d69 [S390] cio: Remove remains of _ccw_device_get_device_number().
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:17 +02:00
Cornelia Huck
07c6a3386d [S390] cio: css_sch_device_register() can be made static.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:17 +02:00
Heiko Carstens
8da1aecde0 [S390] Improve __smp_call_function_map.
There is no need to disable bottom halves when holding call_lock. Also
this could imply that it is legal to call smp_call_function* from
bh context, which it is not.
Also test if func will be executed locally before disabling
and aterwards enabling interrupts again. It's not necessary to disable
and enable interrupts each time __smp_call_function_map gets called.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:17 +02:00
Heiko Carstens
3bb447fc8b [S390] Convert to smp_call_function_single.
smp_call_function_single now has the same semantics as s390's
smp_call_function_on. Therefore convert to the *single variant
and get rid of some architecture specific code.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2007-07-27 12:29:17 +02:00
Randy Dunlap
79685b8dee docbook: add pipes, other fixes
Fix some typos in pipe.c and splice.c.
Add pipes API to kernel-api.tmpl.

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-07-27 08:08:51 +02:00
Ingo Molnar
7c2ff389bb blktrace: use cpu_clock() instead of sched_clock()
use cpu_clock() instead of sched_clock(). (the latter is not a proper
clock-source)

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-07-27 08:08:24 +02:00
Paul Mundt
4d5d8e9d3e bsg: Fix build for CONFIG_BLOCK=n
BLK_DEV_BSG was added outside of the if BLOCK check, which allows it to
be enabled when CONFIG_BLOCK=n. This leads to many screenlengths of
errors, starting with a parse error on the request_queue_t definition.
Obviously this wasn't intended for CONFIG_BLOCK=n usage, so just move the
option back in to the block.

Caught with a randconfig on sh.

Signed-off-by: Paul Mundt <lethal@linux-sh.org>

--

 block/Kconfig |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-07-27 08:08:24 +02:00
Qi Yong
4e97182a22 [patch] QUEUE_FLAG_READFULL QUEUE_FLAG_WRITEFULL comment fix
The two comments were transposed.

Signed-off-by: Qi Yong <qiyong@mail.fc-cn.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-07-27 08:08:24 +02:00
Alan Hourihane
f191f14407 agp: AMD AGP is used on UP1100 & UP1500 alpha boxen
Signed-off-by: Dave Airlie <airlied@redhat.com>
2007-07-27 10:56:43 +10:00
Zhenyu Wang
dde4787642 intel_agp: really fix 945/965GME
Fix some missing places to check with device id info, which
should probe the device gart correctly.

Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2007-07-27 10:48:13 +10:00
Nick Piggin
a51b34593f agp: don't lock pages
AGP should not need to lock pages. They are not protecting any race
because there is no lock_page calls, only SetPageLocked.

This is causing hangs with d00806b183.

Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2007-07-27 10:46:26 +10:00
Chuck Ebbert
c99c108ac3 AGP: document boot options
Add documentation for AGP boot options.

Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2007-07-27 10:46:20 +10:00
Jesper Juhl
190644e180 Fix "use after free" / "double free" bug in ati_create_gatt_pages / ati_free_gatt_pages
Hi,

Coverity spotted a "use after free" bug in
drivers/char/agp/ati-agp.c::ati_create_gatt_pages().

The same one that was in
  drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages()

The problem is this:
       If "entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);"
fails, then there's a loop in the function to free all entries
allocated so far and break out of the allocation loop. That in itself
is pretty sane, but then the (now freed) 'tables' is assigned to
ati_generic_private.gatt_pages and 'retval' is set to -ENOMEM which
causes ati_free_gatt_pages(); to be called at the end of the function.
The problem with this is that ati_free_gatt_pages() will then loop
'ati_generic_private.num_tables' times and try to free each entry in
tables[] - this is bad since tables has already been freed and
furthermore it will call kfree(tables) at the end - a double free.

This patch removes the freeing loop in ati_create_gatt_pages() and
instead relies entirely on the call to ati_free_gatt_pages() to free
everything we allocated in case of an error. It also sets
ati_generic_private.num_tables to the actual number of entries
allocated instead of just using the value passed in from the caller -
this ensures that ati_free_gatt_pages() will only attempt to free
stuff that was actually allocated.

Note: I'm in no way intimate with this code and I have no way to
actually test this patch (besides compile test it), so while I've
tried to be careful in reading the code and make sure the patch
does the right thing an ACK from someone who actually knows the
code in-depth would be very much appreciated.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>
2007-07-27 10:44:32 +10:00
Kenji Kaneshige
074ff85600 [IA64] Fix wrong return value in parse_vector_domain
Fix wrong return value in parse_vector_domain().

Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-26 14:28:02 -07:00
Kenji Kaneshige
3c3738c874 [IA64] Fix wrong assumption in acpi_gsi_to_irq
The ia64's acpi_gsi_to_irq() function assumes irq == vector. But in
fact irq can be different from vector. This patch fix this wrong
assumption.

Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-26 14:27:42 -07:00
Kenji Kaneshige
6bde71ec1e [IA64] Add sanity check into __bind_irq_vector
Add some sanity checks into __bind_irq_vector().

Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2007-07-26 14:27:19 -07:00