Commit graph

10970 commits

Author SHA1 Message Date
James Simmons
c14e2cfc18 [PATCH] Return the line length via sysfs for fbdev
This small patch returns the stride/line length of the framebuffer via
sysfs.

Signed-off-by: James Simmons <jsimmons@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 14:08:29 -07:00
Sean Hefty
ae7971a770 [IB] CM: Fix initialization of QP attributes for UC QPs.
Fix cm_init_qp_init_attr(), cm_init_qp_rtr_attr() and cm_init_qp_rts_attr()
so that they correctly handle the differences between UC and RC QPs.  This
fixes problems with setting up UC QPs through the CM.

Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
2005-10-24 12:33:56 -07:00
Roland Dreier
ec329a1359 Manual merge of for-linus to upstream (fix conflicts in drivers/infiniband/core/ucm.c) 2005-10-24 10:55:29 -07:00
Roland Dreier
5d7edb3c1a [IB] Add idr_destroy() calls on module unload
Add idr_destroy() calls to the module_exit() functions of the four IB
driver modules that use idrs, so we don't leak idr_layer_cache objects
when these modules are unloaded.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
2005-10-24 10:53:25 -07:00
Takashi Iwai
d5c5d8fe32 [PATCH] ALSA: Fix Oops of suspend/resume with generic drivers
The patch fixes Oops from sound drivers using generic platform device
but have no suspend/resume callbacks.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 09:45:28 -07:00
Miklos Szeredi
10ded9493e [PATCH] uml: fix compile failure for TT mode
Without this patch, uml compile fails with:

  LD      .tmp_vmlinux1
arch/um/kernel/built-in.o: In function `config_gdb_cb':
arch/um/kernel/tt/gdb.c:129: undefined reference to `TASK_EXTERN_PID'

Tested on i386, but fix needed on x86_64 too AFAICS.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:59:25 -07:00
Oleg Nesterov
a69ac4a78d [PATCH] posix-timers: fix posix_cpu_timer_set() vs run_posix_cpu_timers() race
This might be harmless, but looks like a race from code inspection (I
was unable to trigger it).  I must admit, I don't understand why we
can't return TIMER_RETRY after 'spin_unlock(&p->sighand->siglock)'
without doing bump_cpu_timer(), but this is what original code does.

posix_cpu_timer_set:

	read_lock(&tasklist_lock);

	spin_lock(&p->sighand->siglock);
	list_del_init(&timer->it.cpu.entry);
	spin_unlock(&p->sighand->siglock);

We are probaly deleting the timer from run_posix_cpu_timers's 'firing'
local list_head while run_posix_cpu_timers() does list_for_each_safe.

Various bad things can happen, for example we can just delete this timer
so that list_for_each() will not notice it and run_posix_cpu_timers()
will not reset '->firing' flag. In that case,

	....

	if (timer->it.cpu.firing) {
		read_unlock(&tasklist_lock);
		timer->it.cpu.firing = -1;
		return TIMER_RETRY;
	}

sys_timer_settime() goes to 'retry:', calls posix_cpu_timer_set() again,
it returns TIMER_RETRY ...

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:13:14 -07:00
Oleg Nesterov
ca531a0a5e [PATCH] posix-timers: exit path cleanup
No need to rebalance when task exited

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:12:35 -07:00
Oleg Nesterov
3de463c7d9 [PATCH] posix-timers: remove false BUG_ON() from run_posix_cpu_timers()
do_exit() clears ->it_##clock##_expires, but nothing prevents
another cpu to attach the timer to exiting process after that.

After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
before do_exit() calls 'schedule() local timer interrupt can find
tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
does sys_wait4) interrupted task has ->signal == NULL.

At this moment exiting task has no pending cpu timers, they were cleaned
up in __exit_signal()->posix_cpu_timers_exit{,_group}(), so we can just
return from irq.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:12:35 -07:00
Oleg Nesterov
108150ea78 [PATCH] posix-timers: fix cleanup_timers() and run_posix_cpu_timers() races
1. cleanup_timers() sets timer->task = NULL under tasklist + ->sighand locks.
   That means that this code in posix_cpu_timer_del() and posix_cpu_timer_set()

   		lock_timer(timer);
		if (timer->task == NULL)
			return;
		read_lock(tasklist);
		put_task_struct(timer->task)

   is racy. With this patch timer->task modified and accounted only under
   timer->it_lock. Sadly, this means that dead task_struct won't be freed
   until timer deleted or armed.

2. run_posix_cpu_timers() collects expired timers into local list under
   tasklist + ->sighand again. That means that posix_cpu_timer_del()
   should check timer->it.cpu.firing under these locks too.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-24 08:12:35 -07:00
Roland Dreier
e7d311da9c Merge master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 2005-10-23 17:56:59 -07:00
Linus Torvalds
ba9e358fd0 Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-for-linus-2.6 2005-10-23 17:13:14 -07:00
Roland Dreier
75eeec2f3f [PATCH] ib: mthca: Always re-arm EQs in mthca_tavor_interrupt()
We should always re-arm an event queue's interrupt in
mthca_tavor_interrupt() if the corresponding bit is set in the event cause
register (ECR), even if we didn't find any entries in the EQ.  If we don't,
then there's a window where we miss an EQ entry and then get stuck because
we don't get another EQ event.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:39 -07:00
Andrew Morton
8d3b35914a [PATCH] inotify/idr leak fix
Fix a bug which was reported and diagnosed by
Stefan Jones <stefan.jones@churchillrandoms.co.uk>

IDR trees include a cache of idr_layer objects.  There's no way to destroy
this cache, so when we discard an overall idr tree we end up leaking some
memory.

Add and use idr_destroy() for this.  v9fs and infiniband also need to use
idr_destroy() to avoid leaks.

Or, we make the cache global, like radix_tree_preload().  Which is probably
better.  Later.

Cc: Eric Van Hensbergen <ericvh@ericvh.myip.org>
Cc: Roland Dreier <rolandd@cisco.com>
Cc: Robert Love <rml@novell.com>
Cc: John McCutchan <ttb@tentacle.dhs.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:39 -07:00
Mike Krufky
c0fef676bb [PATCH] Kconfig: saa7134-dvb should not select cx22702
On 2005-05-01, Gerd Knorr sent in a patch to add cx22702 to cx88-dvb:

 [PATCH] dvb: cx22702 frontend driver update
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9990d744bea7d28e83c420e2c9d524c7a8a2d136

...but as we can see, the Kconfig portion of his patch was incorrectly
applied to saa7134-dvb instead of cx88-dvb.

On 2005-06-24, Adrian bunk fixed cx88-dvb:

 [PATCH] VIDEO_CX88_DVB must select DVB_CX22702
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d6988588e13616587aa879c2e0bd7cd811705e5d

...but we never removed the original patch from Gerd.

This patch sets things straight:

saa7134-dvb should not select cx22702

Signed-off-by: Michael Krufky <mkrufky@m1k.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:39 -07:00
Davi Arnaut
20c19e4179 [PATCH] SELinux: handle sel_make_bools() failure in selinuxfs
This patch fixes error handling in sel_make_bools(), where currently we'd
get a memory leak via security_get_bools() and try to kfree() the wrong
pointer if called again.

Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:39 -07:00
Stephen Smalley
282c1f5eba [PATCH] selinux: Fix NULL deref in policydb_destroy
This patch fixes a possible NULL dereference in policydb_destroy, where
p->type_attr_map can be NULL if policydb_destroy is called to clean up a
partially loaded policy upon an error during policy load.  Please apply.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:38 -07:00
Kostik Belousov
8766ce4101 [PATCH] aio syscalls are not checked by lsm
Another case of missing call to security_file_permission: aio functions
(namely, io_submit) does not check credentials with security modules.

Below is the simple patch to the problem.  It seems that it is enough to
check for rights at the request submission time.

Signed-off-by: Kostik Belousov <kostikbel@gmail.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:38 -07:00
Randy Dunlap
a991304496 [PATCH] kernel-parameters cleanup
Fix typos & trailing whitespace.
Add blank lines in a few places.
Remove "AM53C974=" option:  driver does not exist.
Restrict to < 80 columns in most places (but don't split formatted
  command-line arguments).
Add a few option arguments for completeness.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:38:38 -07:00
Linus Torvalds
4196c3af25 cardbus: limit IO windows to 256 bytes
That's what we've always historically done, and bigger windows seem to
confuse some cardbus bridges. Or something.

Alan reports that this makes the ThinkPad 600x series work properly
again: the 4kB IO window for some reason made IDE DMA not work, which
makes IDE painfully slow even if it works after DMA timeouts.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 16:31:16 -07:00
Linus Torvalds
9092b20803 Merge master.kernel.org:/pub/scm/linux/kernel/git/acme/net-2.6 2005-10-23 10:10:37 -07:00
Linus Torvalds
e80eda94d3 Posix timers: limit number of timers firing at once
Bursty timers aren't good for anybody, very much including latency for
other programs when we trigger lots of timers in interrupt context.  So
set a random limit, after which we'll handle the rest on the next timer
tick.

Noted by Oleg Nesterov <oleg@tv-sign.ru>

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-23 10:02:50 -07:00
Herbert Xu
49636bb128 [NEIGH] Fix timer leak in neigh_changeaddr
neigh_changeaddr attempts to delete neighbour timers without setting
nud_state.  This doesn't work because the timer may have already fired
when we acquire the write lock in neigh_changeaddr.  The result is that
the timer may keep firing for quite a while until the entry reaches
NEIGH_FAILED.

It should be setting the nud_state straight away so that if the timer
has already fired it can simply exit once we relinquish the lock.

In fact, this whole function is simply duplicating the logic in
neigh_ifdown which in turn is already doing the right thing when
it comes to deleting timers and setting nud_state.

So all we have to do is take that code out and put it into a common
function and make both neigh_changeaddr and neigh_ifdown call it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2005-10-23 17:18:00 +10:00
Herbert Xu
6fb9974f49 [NEIGH] Fix add_timer race in neigh_add_timer
neigh_add_timer cannot use add_timer unconditionally.  The reason is that
by the time it has obtained the write lock someone else (e.g., neigh_update)
could have already added a new timer.

So it should only use mod_timer and deal with its return value accordingly.

This bug would have led to rare neighbour cache entry leaks.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2005-10-23 16:37:48 +10:00
Herbert Xu
203755029e [NEIGH] Print stack trace in neigh_add_timer
Stack traces are very helpful in determining the exact nature of a bug.
So let's print a stack trace when the timer is added twice.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2005-10-23 16:11:39 +10:00
Ivan Kokshaysky
d475f3f47a [PATCH] alpha: additional smp barriers
As stated in Documentation/atomic_ops.txt, atomic functions
returning values must have the memory barriers both before and after
the operation.

Thanks to DaveM for pointing that out.

Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-22 19:38:33 -07:00
Ralf Baechle
4595f25105 [AX.25]: Fix signed char bug
On architectures where the char type defaults to unsigned some of the
arithmetic in the AX.25 stack to fail, resulting in some packets being dropped
on receive.

Credits for tracking this down and the original patch to
Bob Brose N0QBJ <linuxhams@n0qbj-11.ampr.org>.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-10-22 17:20:50 -02:00
Julian Anastasov
c98d80edc8 [SK_BUFF]: ipvs_property field must be copied
IPVS used flag NFC_IPVS_PROPERTY in nfcache but as now nfcache was removed the
new flag 'ipvs_property' still needs to be copied. This patch should be
included in 2.6.14.

Further comments from Harald Welte:

Sorry, seems like the bug was introduced by me.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-10-22 17:06:01 -02:00
Jeff Garzik
057ace5e79 libata: const-ification bombing run
Enforce access rules where appropriate.

If the compiler is smart enough, this may buy us an optimization or two
as a side effect.
2005-10-22 14:27:05 -04:00
Roland Dreier
c8e0ca683d [IB] mthca: Always re-arm EQs in mthca_tavor_interrupt()
We should always re-arm an event queue's interrupt in
mthca_tavor_interrupt() if the corresponding bit is set in the event
cause register (ECR), even if we didn't find any entries in the EQ.
If we don't, then there's a window where we miss an EQ entry and then
get stuck because we don't get another EQ event.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
2005-10-22 09:43:29 -07:00
Jeff Garzik
7bbaa75452 drivers/block/sx8: kill unused variable 2005-10-22 01:33:18 -04:00
Jeff Garzik
cf482935c6 libata: turn on block layer clustering 2005-10-22 00:19:33 -04:00
Jeff Garzik
2d5a2ae52d drivers/block/sx8: several minor changes
* Newer hardware doesn't corrupt data when the queue depth
  is greater than one.  Rather than force the user to recompile
  with a greater queue depth, make it a module parameter.
* update copyright date
* add MODULE_VERSION()
* trim trailing whitespace
* move CARM_SG_BOUNDARY to a separate enum, since its unsigned long
* bump to version 1.0
2005-10-22 00:14:31 -04:00
Kyle McMartin
6958ae318b [PARISC] Update MAINTAINERS and CREDITS
Add Kyle McMartin and Thibaut Varene as maintainers for ALSA ad1889
driver.

Add myself to CREDITS.

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 23:11:27 -04:00
Kyle McMartin
2767820133 [PARISC] defconfig updates
defconfig updates from Kyle McMartin, Grant Grundler,
and Matthew Wilcox.

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 23:11:03 -04:00
Matthew Wilcox
6ab0f5cd36 [PARISC] Update parisc specific input code from parisc tree
Update drivers to new input layer changes.

Signed-off-by: Helge Deller <deller@parisc-linux.org>
Signed-off-by: Matthew Wilcox <willy@parisc-linux.org>

Reorder code in gscps2_interrupt() and only enable ports when opened.
This fixes issues with hangs booting an SMP kernel on my C360.
Previously serio_interrupt() could be called before the lock in
struct serio was initialised.

Signed-off-by: Richard Hirst <rhirst@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:58:51 -04:00
Matthew Wilcox
ae8c75c1c4 [PARISC] Fix mux.c driver
Missing spin_lock_init() made the Mux driver hang on SMP systems.

Fix up users of ->hpa to use ->hpa.start instead

Remove warning in 8250_gsc.c by eliminating serial_line_nr

Signed-off-by: Matthew Wilcox <willy@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:58:03 -04:00
Matthew Wilcox
27ee073cd2 [PARISC] Update scsi drivers from parisc tree
Fix lasi700 for James's ioread*be() changes

Signed-off-by: Matthew Wilcox <willy@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:57:43 -04:00
Randolph Chung
abff75439f [PARISC] Avoid use of floating point in the kernel
don't use *printf %f in the kernel, mm'kay?

Signed-off-by: Randolph Chung <tausq@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:57:13 -04:00
Grant Grundler
e55fb3e787 [PARISC] Properly specify section alignment for real2.S
.align applies to the current section - ie section directives come first.
Thanks to Joel Soete for catching this.

Signed-off-by: Grant Grundler <grundler@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:56:53 -04:00
Grant Grundler
61520e1f8f [PARISC] Specify level to fix binutils level promotion bug
fixup.S needs to specify .level and use correct LDREG macro.
New binutils has a bug where it doesn't "promote" from PA1.0 to PA1.1
correctly when using ",s" completer.

remove use of __LP64__ in assembly.h and add some white space.

Signed-off-by: Grant Grundler <grundler@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:56:35 -04:00
Matthew Wilcox
e635c96ed6 [PARISC] Explicitly specify sr4 when flushing kernel space
Specify sr4 when flushing kernel space (we could equally well use sr5-7,
but must not use sr0).

Signed-off-by: Matthew Wilcox <willy@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:56:14 -04:00
Grant Grundler
9b3b331d03 [PARISC] Properly specify index field to I/D cache flush ops
replace use of "0" with "%r0" since PA 1.1 I/D flush ops only take a
general register and not an immediate value for the index field.
This just forces the code to always be PA 1.1 "clean".

From: Joel Soete <soete.joel@tiscali.be>
Signed-off-by: Grant Grundler <grundler@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:55:51 -04:00
Grant Grundler
37318a3cb1 [PARISC] Fix copy_user_page_asm to NOT access past end of page
2.6.12-rc2-pa3 fix copy_user_page_asm to NOT access past end of page.

My bad. /o\
Lamont confirmed that instructions following a conditional
branch are *alway* executed regardless if the branch is taken or not.
Unless they are nullified (which was missing in this case).

He also noted:
Conditional branches nullify on forward taken branch, and on
non-taken backward branch. Note that .+4 is a backwards branch.

This makes alot more sense than the giberish in the PA20 arch book.

Compiles and boots on both 64-bit (a500) and 32-bit (j6k).

Signed-off-by: Grant Grundler <grundler@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:55:34 -04:00
Sven Schnelle
c2709020ad [PARISC] Add NETPOLL support to lasi_82596
add netpoll support
Patch by Sven Schnelle <svens@gmx.de>

Signed-off-by: Sven Schnelle <svens@gmx.de>
Signed-off-by: Helge Deller <deller@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:55:15 -04:00
James Bottomley
dd0fd51dc1 [PARISC] Remove the spurious do_softirq calls from entry.S
remove the spurious do_softirq calls from entry.S

With these in we were calling do_softirq twice; plus the calls in
entry.S took no account of nesting.

Signed-off-by: James Bottomley <jejb@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:54:38 -04:00
Grant Grundler
63af965d2b [PARISC] Define pgprot_noncached macro in pgtable.h
drivers/infiniband depends on definition of pgprot_noncached() macro.
Someone else will have to fix it's wrong.

Signed-off-by: Grant Grundler <grundler@parisc-linux.org

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:54:20 -04:00
Kyle McMartin
b4b45313e5 [PARISC] Add other CRT_ID for newer cards to grfioctl.h
Add IDs for some other STI graphics cards found on HP PA-RISC
machines.

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:54:00 -04:00
Grant Grundler
05aa10de70 [PARISC] Add ECANCELED to errno.h
add ECANCELED - SuSv3 wants one L.  IB/SDP actually returns this error.

Signed-off-by: Grant Grundler <grundler@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:53:43 -04:00
James Bottomley
618febd678 [PARISC] Fix the alloc_slabmgmt panic
Fix the alloc_slabmgmt panic

Hopefully this should also fix a lot of other intermittent kernel bugs.

The problem has been around since 2.6.9-rc2-pa6 when we allowed
floating point registers to be used in kernel code.  The essence of
the problem is that gcc prefers to use floating point for integer
divides and multiples.  Further, it can rely on the values in the no
clobber fp regs being correct across a function call.  Unfortunately,
our task switch function only saves the integer no clobber registers,
not the fp ones, so if gcc makes a function call to any function in
the kernel which could sleep, the values it is relying on in any no
clobber floating point register may be lost.  In the case of
alloc_slabmgmt, the value of the page offset is being stored in %fr12
across a call to kmem_getpages(), which sleeps if no pages are
available.  Thus, the offset can be trashed and the slab code can end
up with a completely bogus address leading to corruption.

Kudos to Randolph who came up with the program to trip this problem at
will and thus allowed it to be tracked and fixed.

Signed-off-by: James Bottomley <jejb@parisc-linux.org>

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
2005-10-21 22:53:26 -04:00