Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Commits on Mar 23, 2009
  1. @gregkh

    Linux 2.6.28.9

    gregkh authored
  2. @gregkh

    eCryptfs: Allocate a variable number of pages for file headers

    Tyler Hicks authored gregkh committed
    commit 8faece5 upstream.
    
    When allocating the memory used to store the eCryptfs header contents, a
    single, zeroed page was being allocated with get_zeroed_page().
    However, the size of an eCryptfs header is either PAGE_CACHE_SIZE or
    ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE (8192), whichever is larger, and is
    stored in the file's private_data->crypt_stat->num_header_bytes_at_front
    field.
    
    ecryptfs_write_metadata_to_contents() was using
    num_header_bytes_at_front to decide how many bytes should be written to
    the lower filesystem for the file header.  Unfortunately, at least 8K
    was being written from the page, despite the chance of the single,
    zeroed page being smaller than 8K.  This resulted in random areas of
    kernel memory being written between the 0x1000 and 0x1FFF bytes offsets
    in the eCryptfs file headers if PAGE_SIZE was 4K.
    
    This patch allocates a variable number of pages, calculated with
    num_header_bytes_at_front, and passes the number of allocated pages
    along to ecryptfs_write_metadata_to_contents().
    
    Thanks to Florian Streibelt for reporting the data leak and working with
    me to find the problem.  2.6.28 is the only kernel release with this
    vulnerability.  Corresponds to CVE-2009-0787
    
    Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Acked-by: Dustin Kirkland <kirkland@canonical.com>
    Reviewed-by: Eric Sandeen <sandeen@redhat.com>
    Reviewed-by: Eugene Teo <eugeneteo@kernel.sg>
    Cc: dann frazier <dannf@dannf.org>
    Cc: Serge E. Hallyn <serue@us.ibm.com>
    Cc: Florian Streibelt <florian@f-streibelt.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  3. @gregkh

    menu: fix embedded menu snafu

    Randy Dunlap authored gregkh committed
    commit b943c46 upstream.
    
    The COMPAT_BRK kconfig symbol does not depend on EMBEDDED, but it is in
    the midst of the EMBEDDED menu symbols, so it mucks up the EMBEDDED menu.
    Fix by moving it to just after all of the EMBEDDED menu symbols.  Also,
    ANON_INODES has a similar problem, so move it to just above the EMBEDDED
    menu items since it is used in the EMBEDDED menu.
    
    Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  4. @anholt @gregkh

    drm/i915: Don't allow objects to get bound while VT switched.

    anholt authored gregkh committed
    commit 9bb2d6f upstream.
    
    This avoids a BUG_ON in the enter_vt path due to objects being in the GTT
    when we shouldn't have ever let them be (as we're not supposed to touch the
    device during that time).
    
    This was triggered by a change in the 2D driver to use the GTT mapping of
    objects after pinning them to improve software fallback performance.
    
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Dave Airlie <airlied@linux.ie>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  5. @anholt @gregkh

    drm/i915: Don't print to dmesg when taking signal during object_pin.

    anholt authored gregkh committed
    commit f1acec9 upstream.
    
    This showed up in logs where people had a hung chip, so pinning was blocked
    on the chip unpinning other buffers, and the X Server took its scheduler
    signal during that time.
    
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Dave Airlie <airlied@linux.ie>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  6. @anholt @gregkh

    drm/i915: Don't double-unpin buffers if we take a signal in evict_eve…

    anholt authored gregkh committed
    …rything().
    
    commit b117763 upstream.
    
    We haven't seen this in practice, but it was visible when looking at a bug
    report from when i915_gem_evict_everything() was broken and would always
    return error.
    
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Dave Airlie <airlied@linux.ie>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  7. @gregkh

    drm/i915: don't enable vblanks on disabled pipes

    Jesse Barnes authored gregkh committed
    commit 71e0ffa upstream.
    
    In some cases userland may be confused and try to wait on vblank events from
    pipes that aren't actually enabled.  We shouldn't allow this, so return
    -EINVAL if the pipe isn't on.
    
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Dave Airlie <airlied@linux.ie>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  8. @gregkh

    drm/i915: set vblank enabled flag correctly across IRQ install/uninstall

    Jesse Barnes authored gregkh committed
    commit dc1336f upstream.
    
    In the absence of kernel mode setting, many drivers disable IRQs across VT
    switch.  The core DRM vblank code is missing a check for this case however;
    even after IRQ disable, the vblank code will still have the vblank_enabled
    flag set, so unless we track the fact that they're disabled at IRQ uninstall
    time, when we VT switch back in we won't actually re-enable them, which means
    any apps waiting on vblank before the switch will hang.
    
    This patch does that and also adds a sanity check to the wait condition to
    look for the irq_enabled flag in general, as well as adding a wakeup to the
    IRQ uninstall path.
    
    Fixes fdo bug #18879 with compiz hangs at VT switch.
    
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Dave Airlie <airlied@linux.ie>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  9. @gregkh

    powerpc: Remove extra semicolon in fsl_soc.c

    Johns Daniel authored gregkh committed
    TSEC/MDIO will not work with older device trees because of a semicolon
    at the end of a macro resulting in an empty for loop body.
    
    This fix only applies to 2.6.28; this code is gone in 2.6.29, according
    to Grant Likely!
    
    Signed-off-by: Johns Daniel <johns.daniel@gmail.com>
    Acked-by: Grant Likely <grant.likely@secretlab.ca>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  10. @gregkh

    USB: EHCI: Fix isochronous URB leak

    Karsten Wiese authored gregkh committed
    commit 508db8c upstream.
    
    ehci-hcd uses usb_get_urb() and usb_put_urb() in an unbalanced way causing
    isochronous URB's kref.counts incrementing once per usb_submit_urb() call.
    The culprit is *usb being set to NULL when usb_put_urb() is called after URB
    is given back.
    Due to other fixes there is no need for ehci-hcd to deal with usb_get_urb()
    nor usb_put_urb() anymore, so patch removes their usages in ehci-hcd.
    Patch also makes ehci_to_hcd(ehci)->self.bandwidth_allocated adjust, if a
    stream finishes.
    
    Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
    Cc: David Brownell <david-b@pacbell.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  11. @gregkh

    USB: EHCI: expedite unlinks when the root hub is suspended

    Alan Stern authored gregkh committed
    commit 391016f upstream.
    
    This patch (as1225) fixes a bug in ehci-hcd.  The condition for
    whether unlinked QHs can become IDLE should not be that the controller
    is halted, but rather that the controller isn't running.  In other
    words when the root hub is suspended, the hardware doesn't own any
    QHs.
    
    This fixes a problem that can show up during hibernation: If a QH is
    only partially unlinked when the root hub is frozen, then when the
    root hub is thawed the QH won't be in the IDLE state.  As a result it
    can't be used properly for new URB submissions.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Brandon Philips <brandon@ifup.org>
    Tested-by: Brandon Philips <brandon@ifup.org>
    Acked-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  12. @gregkh

    USB: usbfs: keep async URBs until the device file is closed

    Alan Stern authored gregkh committed
    commit 6ff1046 upstream.
    
    The usbfs driver manages a list of completed asynchronous URBs.  But
    it is too eager to free the entries on this list: destroy_async() gets
    called whenever an interface is unbound or a device is removed, and it
    deallocates the outstanding struct async entries for all URBs on that
    interface or device.  This is wrong; the user program should be able
    to reap an URB any time after it has completed, regardless of whether
    or not the interface is still bound or the device is still present.
    
    This patch (as1222) moves the code for deallocating the completed list
    entries from destroy_async() to usbdev_release().  The outstanding
    entries won't be freed until the user program has closed the device
    file, thereby eliminating any possibility that the remaining URBs
    might still be reaped.
    
    This fixes a bug in which a program can hang in the USBDEVFS_REAPURB
    ioctl when the device is unplugged.
    
    Reported-and-tested-by: Martin Poupe <martin.poupe@upek.com>
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  13. @gregkh

    USB: usbtmc: add protocol 1 support

    gregkh authored
    commit 228dd05 upstream.
    
    The driver already supports the 1 protocol support, so just add it to
    the MODULE_DEVICE_TABLE entry so it properly picks up these devices.
    
    Thanks to Jouni Rynö for pointing this out.
    
    Reported-by: Jouni Ryno <Jouni.Ryno@fmi.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  14. @gregkh

    USB: usbtmc: fix stupid bug in open()

    gregkh authored
    commit 5b10916 upstream.
    
    open() will never succeed, as we always return -ENODEV.  Fix this
    obvious bug.
    
    Thanks to Jouni Ryno for reporting it.
    
    Reported-by: Jouni Ryno <Jouni.Ryno@fmi.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  15. @gregkh

    USB: serial: new cp2101 device id

    Robert M. Kenney authored gregkh committed
    commit c653566 upstream.
    
    From: Robert M. Kenney <rmk@unh.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  16. @mhennerich @gregkh

    USB: serial: ftdi: enable UART detection on gnICE JTAG adaptors black…

    mhennerich authored gregkh committed
    …list interface0
    
    commit b0d6590 upstream.
    
    Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
    Signed-off-by: Bryan Wu <cooloney@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  17. @gregkh

    USB: serial: add FTDI USB/Serial converter devices

    Axel Wachtler authored gregkh committed
    commit 7f82b6d upstream.
    
    Add the following devices to the USB FTDI SIO device table:
    
     Bus 001 Device 009: ID 03eb:2109 Atmel Corp.
     http://www.atmel.com/dyn/products/tools_card.asp?tool_id=4187
    
     Bus 001 Device 008: ID 1cf1:0001
     http://www.dresden-elektronik.de/shop/prod75.html
    
     Bus 001 Device 007: ID 1c1f:0004
     http://www.dresden-elektronik.de/shop/prod64.html
    
    Signed-off-by: Axel Wachtler <axel.wachtler@atmel.com>
    Signed-off-by: Robert Richter <robert.richter@amd.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  18. @gregkh

    USB: unusual_devs: Add support for GI 0431 SD-Card interface

    Jan Dumon authored gregkh committed
    commit c497e71 upstream.
    
    Enable the SD-Card interface on the GI 0431 HSUPA stick from Option.
    
    The unusual_devs.h entry is necessary because the device descriptor is
    vendor-specific. That prevents usb-storage from binding to it as an
    interface driver.
    
    T:  Bus=07 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 15 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=ff MxPS=64 #Cfgs=  1
    P:  Vendor=0af0 ProdID=7501 Rev= 0.00
    S:  Manufacturer=Option N.V.
    S:  Product=Globetrotter HSUPA Modem
    C:* #Ifs=11 Cfg#= 1 Atr=a0 MxPwr=500mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=hso
    E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=hso
    E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=hso
    E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=hso
    E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=hso
    E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
    E:  Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#=10 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
    E:  Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    
    Signed-off-by: Jan Dumon <j.dumon@option.com>
    Signed-off-by: Phil Dibowitz <phil@ipom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  19. @muehlenhoff @gregkh

    USB: Updated unusual-devs entry for USB mass storage on Nokia 6233

    muehlenhoff authored gregkh committed
    commit 716a9c8 upstream.
    
    Current firmware revision 5.60 still behaves the same,
    so update the quirk up a (non-existing) 99.99 revision.
    
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493415
    
    Signed-off-by: Moritz Muehlenhoff <jmm@debian.org>
    Tested-by: Jan Heitkoetter <devnull@heitkoetter.net>
    Signed-off-by: Phil Dibowitz <phil@ipom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  20. @dcbw @gregkh

    USB: Option: let cdc-acm handle Sony Ericsson F3507g / Dell 5530

    dcbw authored gregkh committed
    commit 0cc6bfe upstream.
    
    The generic cdc-acm driver is now the best one to handle Sony Ericsson
    F3507g-based devices (which the Dell 5530 is a rebrand of), now that all
    the pieces are in place (ie, cac477e).
    Removing the IDs from option allows cdc-acm to handle the device.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  21. @gregkh

    USB: Add device id for Option GTM380 to option driver

    Achilleas Kotsis authored gregkh committed
    commit e7f2f0d upstream.
    
    Option GTM380 in Modem mode uses Product ID 0x7201. This has been tested and works
    on production systems for over 6 months.
    
    Signed-off-by: Achilleas Kotsis <akots@exponent.gr>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  22. @gregkh

    USB: option.c: add ZTE 622 modem device

    Albert Pauw authored gregkh committed
    commit 9ea19b8 upstream.
    
    Please consider this small patch for the usb option-card driver.
    This patch adds the ZTE 622 usb modem device.
    
    Signed-off-by: Albert Pauw <albert.pauw@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  23. @gregkh

    USB: Add Vendor/Product ID for new CDMA U727 to option driver

    Dirk Hohndel authored gregkh committed
    commit 56a2182 upstream.
    
    * newer versions of the Novatel Wireless U727 CDMA 3G USB stick
       have a different Product ID (0x5010); adding this ID makes them
       work just fine with the option driver
    
    Signed-off-by: Dirk Hohndel <hohndel@infradead.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  24. @gregkh

    USB: storage: Unusual USB device Prolific 2507 variation added

    Thomas Bartosik authored gregkh committed
    commit 8a0845c upstream.
    
    The "c-enter" USB to Toshiba 1.8" IDE enclosure needs special treatment
    to work flawlessly. This patch is absolutely trivial, as the integrated
    USB-IDE bridge is already identified to be an "unusual" device, only the
    bcdDevice is different (lower) to the bcdDeviceMin already included in
    the kernel.
    It is a Prolific 2507 bridge.
    
    T:  Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
    P:  Vendor=067b ProdID=2507 Rev= 0.01
    S:  Manufacturer=Prolific Technology Inc.
    S:  Product=ATAPI-6 Bridge Controller
    S:  SerialNumber=00000272
    C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    
    
    Signed-off-by: Thomas Bartosik <tbartdev@gmx-topmail.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  25. @torvalds @gregkh

    Move cc-option to below arch-specific setup

    torvalds authored gregkh committed
    commit d011555 upstream.
    
    Sam Ravnborg says:
     "We have several architectures that plays strange games with $(CC) and
      $(CROSS_COMPILE).
    
      So we need to postpone any use of $(call cc-option..) until we have
      included the arch specific Makefile so we try with the correct $(CC)
      version."
    
    Requested-by: Sam Ravnborg <sam@ravnborg.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  26. @torvalds @gregkh

    Add '-fwrapv' to gcc CFLAGS

    torvalds authored gregkh committed
    commit 68df375 upstream.
    
    This makes sure that gcc doesn't try to optimize away wrapping
    arithmetic, which the kernel occasionally uses for overflow testing, ie
    things like
    
    	if (ptr + offset < ptr)
    
    which technically is undefined for non-unsigned types. See
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=12597
    
    for details.
    
    Not all versions of gcc support it, so we need to make it conditional
    (it looks like it was introduced in gcc-3.4).
    
    Reminded-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  27. @gregkh

    thinkpad-acpi: fix module autoloading for older models

    Mathieu Chouquet-Stringer authored gregkh committed
    commit b36a50f upstream.
    
    Looking at the source, there seems to be a missing * to match my DMI
    string.  I mean for newer IBM and Lenovo's laptops you match either one
    of the following:
    MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
    MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:*:pvrThinkPad*:rvnLENOVO:*");
    
    While for older Thinkpads, you do this (for instance):
    IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
    
    with IBM_BIOS_MODULE_ALIAS being MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
    
    Note there's no * terminating the string.  As result, udev doesn't load
    anything because modprobe cannot find anything matching this (my
    machine actually):
    
    udevtest: run: '/sbin/modprobe dmi:bvnIBM:bvr1IET71WW(2.10):bd06/16/2006:svnIBM:pn236621U:pvrNotAv
    
    Signed-off-by: Mathieu Chouquet-Stringer <mchouque@free.fr>
    Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  28. @gregkh

    V4L/DVB (10218): cx23885: Fix Oops for mixed install of analog and di…

    Andy Walls authored gregkh committed
    …gital only cards
    
    commit cd8f894 upstream.
    
    Analog support for HVR-1250 has not been completed, but does exist for
    the HVR-1800.
    
    Since both cards use the same driver, it tries to create the analog
    dev for both devices, which is not possible.
    
    This causes a NULL error to show up in video_open and mpeg_open.
    
    -Mark
    
    Iterations through the cx23885_devlist must check for NULL
    pointers as some supported devices only have DVB support at the moment.
    Mark Jenks encoutered an Oops in a system with both an HVR-1250 and HVR-1800
    installed.
    
    -Andy
    
    Reported-by: Mark Jenks <mjenks1968@gmail.com>
    Tested-by: Mark Jenks <mjenks1968@gmail.com>
    Signed-off-by: Mark Jenks <mjenks1968@gmail.com>
    Signed-off-by: Andy Walls <awalls@radix.net>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Jarod Wilson <jarod@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  29. @gregkh

    ata_piix: add workaround for Samsung DB-P70

    Tejun Heo authored gregkh committed
    commit e9c1670 upstream.
    
    Samsung DB-P70 somehow botched the first ICH9 SATA port.  The board
    doesn't expose the first port but somehow SStatus reports link online
    while failing SRST protocol leading to repeated probe failures and
    thus long boot delay.
    
    Because the BIOS doesn't carry any identifying DMI information, the
    port can't be blacklisted safely.  Fortunately, the controller does
    have subsystem vendor and ID set.  It's unclear whether the subsystem
    IDs are used only for the board but it can be safely worked around by
    disabling SIDPR access and just using SRST works around the problem.
    Even when the workaround is triggered on an unaffected board the only
    side effect will be missing SCR access.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Joseph Jang <josephjang@gmail.com>
    Reported-by: Jonghyon Sohn <mrsohn@gmail.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  30. @gregkh

    dm crypt: wait for endio to complete before destruction

    Milan Broz authored gregkh committed
    commit b35f8ca upstream.
    
    The following oops has been reported when dm-crypt runs over a loop device.
    
    ...
    [   70.381058] Process loop0 (pid: 4268, ti=cf3b2000 task=cf1cc1f0 task.ti=cf3b2000)
    ...
    [   70.381058] Call Trace:
    [   70.381058]  [<d0d76601>] ? crypt_dec_pending+0x5e/0x62 [dm_crypt]
    [   70.381058]  [<d0d767b8>] ? crypt_endio+0xa2/0xaa [dm_crypt]
    [   70.381058]  [<d0d76716>] ? crypt_endio+0x0/0xaa [dm_crypt]
    [   70.381058]  [<c01a2f24>] ? bio_endio+0x2b/0x2e
    [   70.381058]  [<d0806530>] ? dec_pending+0x224/0x23b [dm_mod]
    [   70.381058]  [<d08066e4>] ? clone_endio+0x79/0xa4 [dm_mod]
    [   70.381058]  [<d080666b>] ? clone_endio+0x0/0xa4 [dm_mod]
    [   70.381058]  [<c01a2f24>] ? bio_endio+0x2b/0x2e
    [   70.381058]  [<c02bad86>] ? loop_thread+0x380/0x3b7
    [   70.381058]  [<c02ba8a1>] ? do_lo_send_aops+0x0/0x165
    [   70.381058]  [<c013754f>] ? autoremove_wake_function+0x0/0x33
    [   70.381058]  [<c02baa06>] ? loop_thread+0x0/0x3b7
    
    When a table is being replaced, it waits for I/O to complete
    before destroying the mempool, but the endio function doesn't
    call mempool_free() until after completing the bio.
    
    Fix it by swapping the order of those two operations.
    
    The same problem occurs in dm.c with md referenced after dec_pending.
    Again, we swap the order.
    
    Signed-off-by: Milan Broz <mbroz@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  31. @gregkh

    dm crypt: fix kcryptd_async_done parameter

    Huang Ying authored gregkh committed
    commit b2174ee upstream.
    
    In the async encryption-complete function (kcryptd_async_done), the
    crypto_async_request passed in may be different from the one passed to
    crypto_ablkcipher_encrypt/decrypt.  Only crypto_async_request->data is
    guaranteed to be same as the one passed in.  The current
    kcryptd_async_done uses the passed-in crypto_async_request directly
    which may cause the AES-NI-based AES algorithm implementation to panic.
    
    This patch fixes this bug by only using crypto_async_request->data,
    which points to dm_crypt_request, the crypto_async_request passed in.
    The original data (convert_context) is gotten from dm_crypt_request.
    
    [mbroz@redhat.com: reworked]
    Signed-off-by: Huang Ying <ying.huang@intel.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Milan Broz <mbroz@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  32. @gregkh

    dm io: respect BIO_MAX_PAGES limit

    Mikulas Patocka authored gregkh committed
    commit d659e6c upstream.
    
    dm-io calls bio_get_nr_vecs to get the maximum number of pages to use
    for a given device.  It allocates one additional bio_vec to use
    internally but failed to respect BIO_MAX_PAGES, so fix this.
    
    This was the likely cause of:
      https://bugzilla.redhat.com/show_bug.cgi?id=173153
    
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  33. @gregkh

    dm ioctl: validate name length when renaming

    Milan Broz authored gregkh committed
    commit bc0fd67 upstream.
    
    When renaming a mapped device validate the length of the new name.
    
    The rename ioctl accepted any correctly-terminated string enclosed
    within the data passed from userspace.  The other ioctls enforce a
    size limit of DM_NAME_LEN.  If the name is changed and becomes longer
    than that, the device can no longer be addressed by name.
    
    Fix it by properly checking for device name length (including
    terminating zero).
    
    Signed-off-by: Milan Broz <mbroz@redhat.com>
    Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
    Reviewed-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  34. @gregkh

    NFSD: provide encode routine for OP_OPENATTR

    Benny Halevy authored gregkh committed
    commit 84f09f4 upstream.
    
    Although this operation is unsupported by our implementation
    we still need to provide an encode routine for it to
    merely encode its (error) status back in the compound reply.
    
    Thanks for Bill Baker at sun.com for testing with the Sun
    OpenSolaris' client, finding, and reporting this bug at
    Connectathon 2009.
    
    This bug was introduced in 2.6.27
    
    Signed-off-by: Benny Halevy <bhalevy@panasas.com>
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  35. @gregkh

    nfsd: nfsd should drop CAP_MKNOD for non-root

    J. Bruce Fields authored gregkh committed
    commit 76a67ec upstream.
    
    Since creating a device node is normally an operation requiring special
    privilege, Igor Zhbanov points out that it is surprising (to say the
    least) that a client can, for example, create a device node on a
    filesystem exported with root_squash.
    
    So, make sure CAP_MKNOD is among the capabilities dropped when an nfsd
    thread handles a request from a non-root user.
    
    Reported-by: Igor Zhbanov <izh1979@gmail.com>
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Something went wrong with that request. Please try again.