Commit Graph

247840 Commits

Author SHA1 Message Date
Dave Jones
bb0a56ecc4 [CPUFREQ] Move x86 drivers to drivers/cpufreq/
Signed-off-by: Dave Jones <davej@redhat.com>
2011-05-19 18:51:07 -04:00
David S. Miller
63722966d7 be2net: Kill set but unused variable 'req' in lancer_fw_download()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:49:54 -04:00
David S. Miller
fa7479cf48 irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:46:41 -04:00
David S. Miller
d187c1aab8 atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:44:41 -04:00
David S. Miller
2a64255019 rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
I backed off from trying to just eliminate this variable, since
transforming atomic_inc_return() into atomic_inc() takes away
the memory barriers.

Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:41:03 -04:00
David S. Miller
c9d10c497c rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:37:11 -04:00
David S. Miller
9e5e10a225 rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:35:58 -04:00
David S. Miller
504f284a71 rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:34:37 -04:00
David S. Miller
f06cd54f55 pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
I checked the history and this has been like this since the
beginning of time.

Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:32:55 -04:00
David S. Miller
8fb53b959b isdn: capi: Use pr_debug() instead of ifdefs.
I was investigating some warnings that spew because of the
_DEBUG_FOO ifdef'ery in here.

Instead of adding more ifdefs to fix that warning, let's use
pr_debug() and get rid of these CPP checks altogether.

Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:20:29 -04:00
Matt Carlson
43a5f002af tg3: Update version to 3.119
This patch updates the tg3 version to 3.119.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:01 -04:00
Matt Carlson
310050fad8 tg3: Apply rx_discards fix to 5719/5720
Commit 4d95847381, entitled
"tg3: Workaround rx_discards stat bug", was intended to be applied to
the 5717, 5718, 5719_A0, and 5720 A0 chip revisions.  The implementation
missed the latter two when applying the fix in a critical area.  This
patch fixes the problem.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:01 -04:00
Matt Carlson
6ff6f81dd4 tg3: Remove excessive parenthesis
This patch removes some excessive parenthesizing.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:01 -04:00
Matt Carlson
0da0606f49 tg3: Consolidate all netdev feature assignments
This patch consolidates all the netdev feature bit assignments to one
location.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:01 -04:00
Matt Carlson
dabc5c670d tg3: Move TSO_CAPABLE assignment
This patch moves the code that asserts the TSO_CAPABLE flag closer to
where the TSO capabilities flags are set.  There isn't a good enough
reason for the code to be separated.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
4452d09999 tg3: Fix stats for 5704 and later devices
Commit 4d95847381, entitled
"tg3: Workaround rx_discards stat bug" modified the hardware statistics
data structure.  The modification shifted the statistics so that the
labels no longer corresponded to the counter values.  This patch fixes
the problem by utilizing reserved space for the new counters.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
54e0a67f44 tg3: Fix TSO loopback test
Commit bb158d6964, entitled
"tg3: Add TSO loopback test", mistakenly inverted the checksum field
test from the receive BD.  This patch corrects the problem.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
42b64a450b tg3: Consolidate autoneg advertisement setup code
Autonegotiation setup has gotten a little more complicated since the tg3
driver was created.  This patch consolidates autoneg setup into one
routine and modifies the call sites accordingly.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
b0c5943f1c tg3: Fix EEE interoperability workaround
Commit 21a00ab270, entitled
"tg3: Fix EEE interoperability issue", added an EEE interoperability
fix.  We found that the fix doesn't work if applied too early though.
This patch delays the fix until right before allowing LPI assertion.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
108a6c1655 tg3: Fix IPv6 TCP problems for 5719
Commit 4d163b75e9, entitled
"tg3: Fix 5719 A0 tx completion bug" turned off TSO to fix a hardware
bug.  In doing so, it accidentally turned off all IPv6 TCP checksum
offloading too.  This patch fixes the problem by reenabling the hardware
bit that control both features.  The TSO capability is still not exposed
to the kernel.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
1ff30a59f6 tg3: Fix 57765 B0 data corruption
The PCIe max FTS limit is too aggressive on these chips.  This patch
loosens the limit a little to eliminate data corruption issues.

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 18:00:00 -04:00
Matt Carlson
432aa7ed75 tg3: Cleanup transmit error path
This patch consolidates the skb cleanup code into a function named
tg3_skb_error_unmap().  The modification addresses a long-standing bug
where pci_unmap_single() was incorrectly being called instead of
pci_unmap_page() in tigon3_dma_hwbug_workaround().

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:59:59 -04:00
Matt Carlson
2ffcc981d8 tg3: Set tx bug flags for more devices
It has been recently discovered that all tg3 devices have a 4Gb boundary
DMA problem, and that all 5755 and newer devices can't handle fragments
less than or equal to 8 bytes in size.  This patch adjusts the flags and
removes tg3_start_xmit().  tg3_start_xmit_dma_bug() has been renamed to
tg3_start_xmit().

Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:59:59 -04:00
Linus Torvalds
98a38a5d60 Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus
* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus:
  params.c: Use new strtobool function to process boolean inputs
  debugfs: move to new strtobool
  Add a strtobool function matching semantics of existing in kernel equivalents
  modpost: Update 64k section support for binutils 2.18.50
  module: Use binary search in lookup_symbol()
  module: Use the binary search for symbols resolution
  lib: Add generic binary search function to the kernel.
  module: Sort exported symbols
  module: each_symbol_section instead of each_symbol
  module: split unset_section_ro_nx function.
  module: undo module RONX protection correctly.
  module: zero mod->init_ro_size after init is freed.
  minor ANSI prototype sparse fix
  module: reorder kparam_array to remove alignment padding on 64 bit builds
  module: remove 64 bit alignment padding from struct module with CONFIG_TRACE*
  module: do not hide __modver_version_show declaration behind ifdef
  module: deal with alignment issues in built-in module versions
2011-05-19 14:56:13 -07:00
Linus Torvalds
7663164f26 Merge branch 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs
* 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs:
  Correct occurrences of - Documentation/kvm/ to Documentation/virtual/kvm - Documentation/uml/ to Documentation/virtual/uml - Documentation/lguest/ to Documentation/virtual/lguest throughout the kernel source tree.
  Add a 00-INDEX file to Documentation/virtual Remove uml from the top level 00-INDEX file.
  Move kvm, uml, and lguest subdirectories under a common "virtual" directory, I.E:
2011-05-19 14:55:34 -07:00
David S. Miller
5b5ed8afe4 9p: Kill unused variable 'ret' in trans_rdma.c:parse_opts()
Probably just cut and pasted from the other parse_opts() implementations
in the 9p sources.

Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:45:29 -04:00
David S. Miller
99517e3d79 9p: Kill set but not used variable 'ret' in parse_opts()
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:38:57 -04:00
Paul E. McKenney
80d02085d9 Revert "rcu: Decrease memory-barrier usage based on semi-formal proof"
This reverts commit e59fb3120b.

This reversion was due to (extreme) boot-time slowdowns on SPARC seen by
Yinghai Lu and on x86 by Ingo
.
This is a non-trivial reversion due to intervening commits.

Conflicts:

	Documentation/RCU/trace.txt
	kernel/rcutree.c

Signed-off-by: Ingo Molnar <mingo@elte.hu>
2011-05-19 23:25:29 +02:00
Linus Torvalds
e66eed651f list: remove prefetching from regular list iterators
This is removes the use of software prefetching from the regular list
iterators.  We don't want it.  If you do want to prefetch in some
iterator of yours, go right ahead.  Just don't expect the iterator to do
it, since normally the downsides are bigger than the upsides.

It also replaces <linux/prefetch.h> with <linux/const.h>, because the
use of LIST_POISON ends up needing it.  <linux/poison.h> is sadly not
self-contained, and including prefetch.h just happened to hide that.

Suggested by David Miller (networking has a lot of regular lists that
are often empty or a single entry, and prefetching is not going to do
anything but add useless instructions).

Acked-by: Ingo Molnar <mingo@elte.hu>
Acked-by: David S. Miller <davem@davemloft.net>
Cc: linux-arch@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-19 14:15:29 -07:00
Micha Nelissen
3fb72f1e6e ipconfig wait for carrier
v3 -> v4: fix return boolean false instead of 0 for ic_is_init_dev

Currently the ip auto configuration has a hardcoded delay of 1 second.
When (ethernet) link takes longer to come up (e.g. more than 3 seconds),
nfs root may not be found.

Remove the hardcoded delay, and wait for carrier on at least one network
device.

Signed-off-by: Micha Nelissen <micha@neli.hopto.org>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:13:04 -04:00
Jacek Luczak
c182f90bc1 SCTP: fix race between sctp_bind_addr_free() and sctp_bind_addr_conflict()
During the sctp_close() call, we do not use rcu primitives to
destroy the address list attached to the endpoint.  At the same
time, we do the removal of addresses from this list before
attempting to remove the socket from the port hash

As a result, it is possible for another process to find the socket
in the port hash that is in the process of being closed.  It then
proceeds to traverse the address list to find the conflict, only
to have that address list suddenly disappear without rcu() critical
section.

Fix issue by closing address list removal inside RCU critical
section.

Race can result in a kernel crash with general protection fault or
kernel NULL pointer dereference:

kernel: general protection fault: 0000 [#1] SMP
kernel: RIP: 0010:[<ffffffffa02f3dde>]  [<ffffffffa02f3dde>] sctp_bind_addr_conflict+0x64/0x82 [sctp]
kernel: Call Trace:
kernel:  [<ffffffffa02f415f>] ? sctp_get_port_local+0x17b/0x2a3 [sctp]
kernel:  [<ffffffffa02f3d45>] ? sctp_bind_addr_match+0x33/0x68 [sctp]
kernel:  [<ffffffffa02f4416>] ? sctp_do_bind+0xd3/0x141 [sctp]
kernel:  [<ffffffffa02f5030>] ? sctp_bindx_add+0x4d/0x8e [sctp]
kernel:  [<ffffffffa02f5183>] ? sctp_setsockopt_bindx+0x112/0x4a4 [sctp]
kernel:  [<ffffffff81089e82>] ? generic_file_aio_write+0x7f/0x9b
kernel:  [<ffffffffa02f763e>] ? sctp_setsockopt+0x14f/0xfee [sctp]
kernel:  [<ffffffff810c11fb>] ? do_sync_write+0xab/0xeb
kernel:  [<ffffffff810e82ab>] ? fsnotify+0x239/0x282
kernel:  [<ffffffff810c2462>] ? alloc_file+0x18/0xb1
kernel:  [<ffffffff8134a0b1>] ? compat_sys_setsockopt+0x1a5/0x1d9
kernel:  [<ffffffff8134aaf1>] ? compat_sys_socketcall+0x143/0x1a4
kernel:  [<ffffffff810467dc>] ? sysenter_dispatch+0x7/0x32

Signed-off-by: Jacek Luczak <luczak.jacek@gmail.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
CC: Eric Dumazet <eric.dumazet@gmail.com>
Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 17:13:04 -04:00
Linus Torvalds
75d65a425c hlist: remove software prefetching in hlist iterators
They not only increase the code footprint, they actually make things
slower rather than faster.  On internationally acclaimed benchmarks
("make -j16" on an already fully built kernel source tree) the hlist
prefetching slows down the build by up to 1%.

(Almost all of it comes from hlist_for_each_entry_rcu() as used by
avc_has_perm_noaudit(), which is very hot due to all the pathname
lookups to see if there is anything to do).

The cause seems to be two-fold:

 - on at least some Intel cores, prefetch(NULL) ends up with some
   microarchitectural stall due to the TLB miss that it incurs.  The
   hlist case triggers this very commonly, since the NULL pointer is the
   last entry in the list.

 - the prefetch appears to cause more D$ activity, probably because it
   prefetches hash list entries that are never actually used (because we
   ended the search early due to a hit).

Regardless, the numbers clearly say that the implicit prefetching is
simply a bad idea.  If some _particular_ user of the hlist iterators
wants to prefetch the next list entry, they can do so themselves
explicitly, rather than depend on all list iterators doing so
implicitly.

Acked-by: Ingo Molnar <mingo@elte.hu>
Acked-by: David S. Miller <davem@davemloft.net>
Cc: linux-arch@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-19 13:50:07 -07:00
Eric Dumazet
be281e554e ipv6: reduce per device ICMP mib sizes
ipv6 has per device ICMP SNMP counters, taking too much space because
they use percpu storage.

needed size per device is :
(512+4)*sizeof(long)*number_of_possible_cpus*2

On a 32bit kernel, 16 possible cpus, this wastes more than 64kbytes of
memory per ipv6 enabled network device, taken in vmalloc pool.

Since ICMP messages are rare, just use shared counters (atomic_long_t)

Per network space ICMP counters are still using percpu memory, we might
also convert them to shared counters in a future patch.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 16:21:22 -04:00
Changli Gao
75e308c894 net: ping: fix the coding style
The characters in a line should be no more than 80.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 16:17:51 -04:00
Changli Gao
bb0cd2fb53 net: ping: make local functions static
As these functions are only used in this file.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-05-19 16:17:51 -04:00
David S. Miller
6b60d7b9df Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2011-05-19 15:55:45 -04:00
Ingo Molnar
29510ec3b6 Merge branch 'tip/perf/core' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-trace into perf/core 2011-05-19 19:48:03 +02:00
Ingo Molnar
398995ce79 Merge branch 'tip/perf/core-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-trace into perf/core 2011-05-19 19:25:55 +02:00
Catalin Marinas
9b090f2da8 kmemleak: Initialise kmemleak after debug_objects_mem_init()
Kmemleak frees objects via RCU and when CONFIG_DEBUG_OBJECTS_RCU_HEAD
is enabled, the RCU callback triggers a call to free_object() in
lib/debugobjects.c. Since kmemleak is initialised before debug objects
initialisation, it may result in a kernel panic during booting. This
patch moves the kmemleak_init() call after debug_objects_mem_init().

Reported-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Tested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@kernel.org>
2011-05-19 17:36:37 +01:00
Catalin Marinas
79e0d9bd26 kmemleak: Select DEBUG_FS unconditionally in DEBUG_KMEMLEAK
In the past DEBUG_FS used to depend on SYSFS and DEBUG_KMEMLEAK selected
it conditionally. This is no longer the case, so always select DEBUG_FS
via DEBUG_KMEMLEAK.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2011-05-19 17:36:27 +01:00
Catalin Marinas
52c3ce4ec5 kmemleak: Do not return a pointer to an object that kmemleak did not get
The kmemleak_seq_next() function tries to get an object (and increment
its use count) before returning it. If it could not get the last object
during list traversal (because it may have been freed), the function
should return NULL rather than a pointer to such object that it did not
get.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Phil Carmody <ext-phil.2.carmody@nokia.com>
Acked-by: Phil Carmody <ext-phil.2.carmody@nokia.com>
Cc: <stable@kernel.org>
2011-05-19 17:35:28 +01:00
Geert Uytterhoeven
659e6ed55f input/atari: Fix mouse movement and button mapping
Up and down movements were reversed, left and right buttons were swapped.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:12 +02:00
Michael Schmitz
186f200a95 input/atari: Fix atarimouse init
Atarimouse fails to load as a module (with ENODEV), due to a brown paper
bag bug, misinterpreting the semantics of atari_keyb_init().

[geert] Propagate the return value of atari_keyb_init() everywhere

Signed-off-by: Michael Schmitz <schmitz@debian.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:11 +02:00
Michael Schmitz
7786908c3c input/atari: Use the correct mouse interrupt hook
The Atari keyboard driver calls atari_mouse_interrupt_hook if it's set, not
atari_input_mouse_interrupt_hook. Fix below.

[geert] Killed off atari_mouse_interrupt_hook completely, after fixing another
incorrect assignment in atarimouse.c.

Signed-off-by: Michael Schmitz <schmitz@debian.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:11 +02:00
Geert Uytterhoeven
79abeed6ee m68k/atari: Do not use "/" in interrupt names
It may trigger a warning in fs/proc/generic.c:__xlate_proc_name() when
trying to add an entry for the interrupt handler to sysfs.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:10 +02:00
Geert Uytterhoeven
1fc74ac612 m68k: unistd - Comment out definitions for unimplemented syscalls
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:10 +02:00
Geert Uytterhoeven
d6d42bb2f8 m68k: Really wire up sys_pselect6 and sys_ppoll
We reserved the numbers a long time ago, but never wired them up in the
syscall table as they need TIF_RESTORE_SIGMASK, which we only got last year
in commit cb6831d5d3099e772a510eb3e1ed0760ccffb45e ("m68k: Switch to saner
sigsuspend()")

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Greg Ungerer <gerg@uclinux.org>
Cc: stable@kernel.org
2011-05-19 18:19:10 +02:00
Geert Uytterhoeven
c4245c9d65 m68k: Merge mmu and non-mmu versions of sys_call_table
Impact for nommu:
  - Store table in .rodata instead of .text,
  - Let kernel/sys_ni.c handle the stubbing of MMU-only syscalls,
  - Implement sys_mremap and sys_nfsservct,
  - Remove unused padding at the end of the table.

Impact for mmu:
  - Store table in .rodata instead of .data.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Greg Ungerer <gerg@uclinux.org>
2011-05-19 18:19:10 +02:00
Geert Uytterhoeven
6cf515e113 MAINTAINERS: Roman Zippel has been MIA for several years.
Hence make AFFS and HFS orphans, and remove him as an m68k maintainer.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:09 +02:00
Geert Uytterhoeven
f82a519f12 m68k: bitops - Never step beyond the end of the bitmap
find_next bitops on m68k (find_next_zero_bit, find_next_bit, and
find_next_bit_le) may cause out of bounds memory access
when the bitmap size in bits % 32 != 0 and offset (the bitnumber
to start searching at) is very close to the bitmap size.

For example,

       unsigned long bitmap[2] = { 0, 0 };
       find_next_bit(bitmap, 63, 62);

1. find_next_bit() tries to find any set bits in bitmap[1],
   but no bits set.

2. Then find_first_bit(bimap + 2, -1)

3. Unfortunately find_first_bit() takes unsigned int as the size argument.

4. find_first_bit will access bitmap[2~] until it find any set bits.

Add missing tests for stepping beyond the end of the bitmap to all
find_{first,next}_*() functions, and make sure they never return a value
larger than the bitmap size.

Reported-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2011-05-19 18:19:09 +02:00