aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-05-22Merge branch 'sh/for-2.6.30' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.30' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: video: stop sh_mobile_lcdcfb only if started sh: ap325 camera without i2c driver fix
2009-05-22ipmi: fix ipmi_si modprobe hangCorey Minyard
Instead of queuing IPMB messages before channel initialization, just throw them away. Nobody will be listening for them at this point, anyway, and they will clog up the queue and nothing will be delivered if we queue them. Also set the current channel to the number of channels, as this value is used to tell if the channel information has been initialized. Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: Ferenc Wagner <wferi@niif.hu> Cc: Dan Frazier <dannf@hp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-05-22via82cxxx: Add VIA VX855 PCI Device IDHarald Welte
This patch adds the PCI Device ID 0xc409 to the PCI ID table of via82cxxx.c, as well as the 0x8409 south bridge ID. This is required to make the IDE driver work on the VX855/VX875 integrated chipset. Signed-off-by: Harald Welte <HaraldWelte@viatech.com> Cc: Joseph Chan <JosephChan@via.com.tw> Cc: Bruce Chang <BruceChang@via.com.tw> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22ide: report timeouts in ide_busy_sleep()Bartlomiej Zolnierkiewicz
* change 'hwif' argument to 'drive' * report an error on timeout Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22ide: improve failed opcode reportingBartlomiej Zolnierkiewicz
Nowadays we (almost) always store the currently executing command in hwif->cmd so we can use it for the failed opcode reporting. Cc: Martin Lottermoser <Martin.Lottermoser@t-online.de> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22ide: fix printk() levels in ide_dump_ata[pi]_error()Bartlomiej Zolnierkiewicz
Fixes "<3>" in error messages like this one: hdc: cdrom_decode_status: error=0x40 <3>{ LastFailedSense=0x04 } Reported-by: Martin Lottermoser <Martin.Lottermoser@t-online.de> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22ide: fix OOPS during ide-cd error recoveryBartlomiej Zolnierkiewicz
On Tuesday 19 May 2009 20:29:28 Martin Lottermoser wrote: > hdc: cdrom_decode_status: error=0x40 <3>{ LastFailedSense=0x04 } > ide: failed opcode was: unknown > hdc: DMA disabled > ------------[ cut here ]------------ > kernel BUG at drivers/ide/ide-io.c:872! It is possible for ide-cd to ignore ide_error()'s return value under some circumstances. Workaround it in ide_intr() and ide_timer_expiry() by checking if there is a device/port reset pending currently. Fixes bug #13345: http://bugzilla.kernel.org/show_bug.cgi?id=13345 Reported-by: Martin Lottermoser <Martin.Lottermoser@t-online.de> Reported-and-tested-by: Modestas Vainius <modestas@vainius.eu> Cc: Borislav Petkov <petkovbb@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22ide: fix 40-wire cable detection for TSST SH-S202* ATAPI devices (v2)Bartlomiej Zolnierkiewicz
Since 2.6.26 we support UDMA66 on ATAPI devices requiring IVB quirk: commit 8588a2b732928b343233af9b1855705b8286bed4 ("ide: add SH-S202J to ivb_list[]") We also later added support for more such devices in: commit e97564f362a93f8c248246c19828895950341252 ("ide: More TSST drives with broken cable detection") and in: commit 3ced5c49bd2d1f2c7f769e3a54385883de63a652 ("ide: add TSSTcorp CDDVDW SH-S202H to ivb_list[]") It turns out that such devices lack cable detection altogether (which in turn results in incorrect detection of 40-wire cables by our current cable detection strategy) so always handle them by trusting host-side cable detection only. v2: Model detection fixup from Martin. Reported-and-tested-by: Martin Lottermoser <Martin.Lottermoser@t-online.de> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2009-05-22MIPS: IP32: Remove unnecessary if not even harmful volatile keywords.Ralf Baechle
They are unneeded and as the issue fixed in lmo commit 63f7ec59053e3f850ab67a9938e631bcba64c6ce shows even harmful. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-22MIPS: IP32: Fix build error due to uninitialized variable.Ralf Baechle
CC arch/mips/sgi-ip32/ip32-reset.o cc1: warnings being treated as errors arch/mips/sgi-ip32/ip32-reset.c: In function 'debounce': arch/mips/sgi-ip32/ip32-reset.c:97: error: 'reg_a' is used uninitialized in this function The issues is old but due to the volatile keyword gcc older than 4.4 did not warn about this obvious bug. Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-22MIPS: Fix sparse warning in incompatiable argument type of clear_user.Wu Zhangjin
The type of the second argument of access_ok should be (void __user *). The unnecessary conversion of the clear_user address argument was causing sparse to emit warnings on the __chk_user_ptr check. Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-22nilfs2: fix memory leak in nilfs_ioctl_clean_segmentsRyusuke Konishi
This fixes a new memory leak problem in garbage collection. The problem was brought by the bugfix patch ("nilfs2: fix lock order reversal in nilfs_clean_segments ioctl"). Thanks to Kentaro Suzuki for finding this problem. Reported-by: Kentaro Suzuki <k_suzuki@ms.sylc.co.jp> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
2009-05-22wimax/i2400m: usb: fix device reset on autosuspend while not yet idleInaky Perez-Gonzalez
When the i2400m is connected to a network, the host interface (USB) cannot be suspended. For that to happen, the device has to have negotiated with the basestation to put the link on IDLE state. If the host tries to put the device in standby while it is connected but not idle, the device resets, as the driver should not do that. To avoid triggering that, when the USB susbsytem requires the driver to autosuspend the device, the driver checks if the device is not yet idle. If it is not, the request is rejected (will be retried again later on after the autosuspend timeout). At some point the device will enter idle and the request will succeed (unless of course, there is network traffic, but at that point, there is no idle neither in the link or the host interface). Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-05-22x86: DMI match for the Sony VGN-Z540N as it needs BIOS rebootZhang Rui
x86: DMI match for the Sony VGN-Z540N as it needs BIOS reboot, see: http://bugzilla.kernel.org/show_bug.cgi?id=12901 [ Impact: fix hung reboot on certain systems ] Signed-off-by: Zhang Rui <rui.zhang@intel.com> Cc: Len Brown <lenb@kernel.org> LKML-Reference: <1242963350.32574.53.camel@rzhang-dt> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-05-22Merge branch 'fix/hda' into for-linusTakashi Iwai
* fix/hda: ALSA: hda - fix audio on HP TX25xx series notebooks
2009-05-22ALSA: hda - fix audio on HP TX25xx series notebooksAdam Williamson
Fixes https://bugtrack.alsa-project.org/alsa-bug/view.php?id=4121 Taken from https://bugzilla.redhat.com/show_bug.cgi?id=498060 Signed-off-by: Adam Williamson <awilliam@redhat.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-05-22powerpc/maple: Add a quirk to disable MSI for IPR on BiminiMichael Ellerman
Something in the HW or FW setup is busted and MSIs aren't working with IPR on Bimini, so until we figure out exaxtly what's up, we quirk them out Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2009-05-22video: stop sh_mobile_lcdcfb only if startedMagnus Damm
This patch fixes the LCDC driver to avoid calling the function sh_mobile_lcdc_start_stop(priv, 0) unless the same function has been called before to start the LCDC hardware. Triggered when sh_mobile_lcdcfb.c failed to probe() due to missing MSTP clocks. Signed-off-by: Magnus Damm <damm@igel.co.jp> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2009-05-22sh: ap325 camera without i2c driver fixMagnus Damm
This patch fixes the ap325rxa ncm03j camera code to handle the case where no i2c driver is present. Without this fix i2c_transfer() may be passed NULL as adapter which results in a crash. Triggered when i2c-sh_mobile.c failed to probe() due to missing MSTP clocks. Signed-off-by: Magnus Damm <damm@igel.co.jp> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2009-05-21[CIFS] fix posix open regressionSteve French
Posix open code was not properly adding the file to the list of open files. Fix allocating cifsFileInfo more than once, and adding twice to flist and tlist. Also fix mode setting to be done in one place in these paths. Signed-off-by: Steve French <sfrench@us.ibm.com> Reviewed-by: Shirish Pargaonkar <shirishp@us.ibm.com> Tested-by: Jeff Layton <jlayton@redhat.com> Tested-by: Luca Tettamanti <kronos.it@gmail.com>
2009-05-21RxRPC: Error handling for rxrpc_alloc_connection()Dan Carpenter
rxrpc_alloc_connection() doesn't return an error code on failure, it just returns NULL. IS_ERR(NULL) is false. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-21ipv4: Fix oops with FIB_TRIERobert Olsson
It seems we can fix this by disabling preemption while we re-balance the trie. This is with the CONFIG_CLASSIC_RCU. It's been stress-tested at high loads continuesly taking a full BGP table up/down via iproute -batch. Note. fib_trie is not updated for CONFIG_PREEMPT_RCU Reported-by: Andrei Popa Signed-off-by: Robert Olsson <robert.olsson@its.uu.se> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-21pktgen: do not access flows[] beyond its lengthFlorian Westphal
typo -- pkt_dev->nflows is for stats only, the number of concurrent flows is stored in cflows. Reported-By: Vladimir Ivashchenko <hazard@francoudi.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-21gigaset: beyond ARRAY_SIZE of iwb->dataRoel Kluin
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-21hugh: update email addressHugh Dickins
My old address will shut down in a few days time: remove it from the tree, and add a tmpfs (shmem filesystem) maintainer entry with the new address. Signed-off-by: Hugh Dickins <hugh@veritas.com> Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-05-20IPv6: set RTPROT_KERNEL to initial routeJean-Mickael Guerin
The use of unspecified protocol in IPv6 initial route prevents quagga to install IPv6 default route: # show ipv6 route S ::/0 [1/0] via fe80::1, eth1_0 K>* ::/0 is directly connected, lo, rej C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto none metric -1 error -101 hoplimit 255 The attached patch ensures RTPROT_KERNEL to the default initial route and fixes the problem for quagga. This is similar to "ipv6: protocol for address routes" f410a1fba7afa79d2992620e874a343fdba28332. # show ipv6 route S>* ::/0 [1/0] via fe80::1, eth1_0 C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 default via fe80::1 dev eth1_0 proto zebra metric 1024 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto kernel metric -1 error -101 hoplimit 255 Signed-off-by: Jean-Mickael Guerin <jean-mickael.guerin@6wind.com> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-20Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-05-20net: fix rtable leak in net/ipv4/route.cEric Dumazet
Alexander V. Lukyanov found a regression in 2.6.29 and made a complete analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339 Quoted here because its a perfect one : begin_of_quotation 2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the patch has at least one critical flaw, and another problem. rt_intern_hash calculates rthi pointer, which is later used for new entry insertion. The same loop calculates cand pointer which is used to clean the list. If the pointers are the same, rtable leak occurs, as first the cand is removed then the new entry is appended to it. This leak leads to unregister_netdevice problem (usage count > 0). Another problem of the patch is that it tries to insert the entries in certain order, to facilitate counting of entries distinct by all but QoS parameters. Unfortunately, referencing an existing rtable entry moves it to list beginning, to speed up further lookups, so the carefully built order is destroyed. For the first problem the simplest patch it to set rthi=0 when rthi==cand, but it will also destroy the ordering. end_of_quotation Problematic commit is 1080d709fb9d8cd4392f93476ee46a9d6ea05a5b (net: implement emergency route cache rebulds when gc_elasticity is exceeded) Trying to keep dst_entries ordered is too complex and breaks the fact that order should depend on the frequency of use for garbage collection. A possible fix is to make rt_intern_hash() simpler, and only makes rt_check_expire() a litle bit smarter, being able to cope with an arbitrary entries order. The added loop is running on cache hot data, while cpu is prefetching next object, so should be unnoticied. Reported-and-analyzed-by: Alexander V. Lukyanov <lav@yar.ru> Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-20net: fix length computation in rt_check_expire()Eric Dumazet
rt_check_expire() computes average and standard deviation of chain lengths, but not correclty reset length to 0 at beginning of each chain. This probably gives overflows for sum2 (and sum) on loaded machines instead of meaningful results. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-20Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI PM: Fix initialization and kexec breakage for some devices
2009-05-20Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6: drm: Copy back ioctl data to userspace regardless of return code. drm: Round size of SHM maps to PAGE_SIZE
2009-05-20Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: MIPS: 64-bit: Fix system lockup. MIPS: IP28: Change to build with -mr10k-cache-barrier=store MIPS: IP22: Fix hang in power button interrupt handler MIPS: IP32: Fix hang on shutdown in power button interrupt handler.
2009-05-20Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds
* master.kernel.org:/home/rmk/linux-2.6-arm: (25 commits) [ARM] 5519/1: amba probe: pass "struct amba_id *" instead of void * [ARM] 5517/1: integrator: don't put clock lookups in __initdata [ARM] 5518/1: versatile: don't put clock lookups in __initdata [ARM] mach-l7200: fix spelling of SYS_CLOCK_OFF [ARM] Double check memmap is actually valid with a memmap has unexpected holes V2 [ARM] realview: fix broadcast tick support [ARM] realview: remove useless smp_cross_call_done() [ARM] smp: fix cpumask usage in ARM SMP code [ARM] 5513/1: Eurotech VIPER SBC: fix compilation error [ARM] 5509/1: ep93xx: clkdev enable UARTS ARM: OMAP2/3: Change omapfb to use clkdev for dispc and rfbi, v2 ARM: OMAP3: Fix HW SAVEANDRESTORE shift define ARM: OMAP3: Fix number of GPIO lines for 34xx [ARM] S3C: Do not set clk->owner field if unset [ARM] S3C2410: mach-bast.c registering i2c data too early [ARM] S3C24XX: Fix unused code warning in arch/arm/plat-s3c24xx/dma.c [ARM] S3C64XX: fix GPIO debug [ARM] S3C64XX: GPIO include cleanup [ARM] nwfpe: fix 'floatx80_is_nan' sparse warning [ARM] nwfpe: Add decleration for ExtendedCPDO ...
2009-05-20[ARM] 5519/1: amba probe: pass "struct amba_id *" instead of void *Alessandro Rubini
The second argument of the probe method points to the amba_id structure, so it's better passed with the correct type. None of the current in-tree drivers uses the pointer, so they have only been checked for a clean compile. Change suggested by Russell King. Signed-off-by: Alessandro Rubini <rubini@unipv.it> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2009-05-20drm: Copy back ioctl data to userspace regardless of return code.Michel Dänzer
Fixes a regression from commit 9d5b3ffc42f7820e8ee07705496955e4c2c38dd9 ('drm: fixup some of the ioctl function exit paths'): The vblank ioctl needs to update the userspace parameters when interrupted by a signal, which was prevented by the return code check. This could cause the X server to hang in drmWaitVBlank(). Signed-off-by: Michel Dänzer <daenzer@vmware.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
2009-05-20wireless: beyond ARRAY_SIZE of intf->crypto_statsRoel Kluin
Do not go beyond ARRAY_SIZE of intf->crypto_stats Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20iwlwifi: update 5000 ucode support to version 2 of APIJay Sternberg
enable iwl driver to support 5000 ucode having version 2 of API Signed-off-by: Jay Sternberg <jay.e.sternberg@linux.intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20cfg80211: fix race between core hint and driver's custom applyLuis R. Rodriguez
Its possible for cfg80211 to have scheduled the work and for the global workqueue to not have kicked in prior to a cfg80211 driver's regulatory hint or wiphy_apply_custom_regulatory(). Although this is very unlikely its possible and should fix this race. When this race would happen you are expected to have hit a null pointer dereference panic. Cc: stable@kernel.org Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20airo: fix airo_get_encode{,ext} buffer overflow like I mean it...John W. Linville
"airo: airo_get_encode{,ext} potential buffer overflow" was actually a no-op, due to an unrecognized type overflow in an assignment. Oddly, gcc only seems to tell me about it when using -Wextra...grrr... Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20ath5k: fix interpolation with equal power levelsFabio Rossi
When the EEPROM contains weird values for the power levels we have to fix the interpolation process. Signed-off-by: Fabio Rossi <rossi.f@inwind.it> Acked-by: Nick Kossifidis <mickflemm@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20iwlwifi: do not cancel delayed work inside spin_lock_irqsaveReinette Chatre
Calling cancel_delayed_work() from inside spin_lock_irqsave, introduces a potential deadlock. As explained by Johannes Berg <johannes@sipsolutions.net> A - lock T - timer phase CPU 1 CPU 2 --------------------------------------------- some place that calls cancel_timer_sync() (which is the | code) lock-irq(A) | "lock-irq"(T) | "unlock"(T) | wait(T) unlock(A) timer softirq "lock"(T) run(T) "unlock"(T) irq handler lock(A) unlock(A) Now all that again, interleaved, leading to deadlock: lock-irq(A) "lock"(T) run(T) IRQ during or maybe before run(T) --> lock(A) "lock-irq"(T) wait(T) We fix this by moving the call to cancel_delayed_work() into workqueue. There are cases where the work may not actually be queued or running at the time we are trying to cancel it, but cancel_delayed_work() is able to deal with this. Also cleanup iwl_set_mode related to this call. This function (iwl_set_mode) is only called when bringing interface up and there will thus not be any scanning done. No need to try to cancel scanning. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13224, which was also reported at http://marc.info/?l=linux-wireless&m=124081921903223&w=2 . Tested-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Acked-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20ath5k: fix exp off-by-one when computing OFDM delta slopeForrest Zhang
Commit e8f055f0c3b ("ath5k: Update reset code") subtly changed the code that computes floating point values for the PHY3_TIMING register such that the exponent is off by a decimal point, which can cause problems with OFDM channel operation. get_bitmask_order() actually returns the highest bit set plus one, whereas the previous code wanted the highest bit set. Instead, use ilog2 which is what this code is really calculating. Also check coef_scaled to handle the (invalid) case where we need log2(0). Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20wext: verify buffer size for SIOCSIWENCODEEXTJohannes Berg
Another design flaw in wireless extensions (is anybody surprised?) in the way it handles the iw_encode_ext structure: The structure is part of the 'extra' memory but contains the key length explicitly, instead of it just being the length of the extra buffer - size of the struct and using the explicit key length only for the get operation (which only writes it). Therefore, we have this layout: extra: +-------------------------+ | struct iw_encode_ext { | | ... | | u16 key_len; | | u8 key[0]; | | }; | +-------------------------+ | key material | +-------------------------+ Now, all drivers I checked use ext->key_len without checking that both key_len and the struct fit into the extra buffer that has been copied from userspace. This leads to a buffer overrun while reading that buffer, depending on the driver it may be possible to specify arbitrary key_len or it may need to be a proper length for the key algorithm specified. Thankfully, this is only exploitable by root, but root can actually cause a segfault or use kernel memory as a key (which you can even get back with siocgiwencode or siocgiwencodeext from the key buffer). Fix this by verifying that key_len fits into the buffer along with struct iw_encode_ext. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20ath5k: fix scanning in AR2424Pavel Roskin
AR5K_PHY_PLL_40MHZ_5413 should not be ORed with AR5K_PHY_MODE_RAD_RF5112 for 5 GHz channels. The incorrect PLL value breaks scanning in the countries where 5 GHz channels are allowed. Signed-off-by: Pavel Roskin <proski@gnu.org> Acked-by: Nick Kossifidis <mickflemm@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-05-20MIPS: 64-bit: Fix system lockup.Greg Ungerer
The address range size calculation inside local_flush_tlb_kernel_range() is being truncated by a too small size variable holder on 64-bit systems. The truncated size can result in an erroneous tlbsize check that means we sit spinning inside a loop trying to flush a hige number of TLB entries. This is for all intents and purposes a system hang. Fix by using an appropriately sized valiable to hold the size. [Ralf: Greg's original patch submission identified the issue and fixed one instance in tlb-r4k.c but there there were several more. For consistency I also modified tlb-r3k.c even though that file is only used on 32-bit.] Signed-off-by: Greg Ungerer <gerg@snapgear.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-20MIPS: IP28: Change to build with -mr10k-cache-barrier=storepeter fuerst
Richard Sandiford's new code for inserting the cache-barriers, for GCC 4.3 and above and already incorporated in the current GCC-release, uses a slightly different option-syntax. Signed-off-by: peter fuerst <post@pfrst.de> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-20MIPS: IP22: Fix hang in power button interrupt handlerRalf Baechle
The hang was caused by the use of disable_irq() from the interrupt handler itself. Fixed by the use of disable_irq_nosync(). The issue was triggered by: commit 3aa551c9b4c40018f0e261a178e3d25478dc04a9 Author: Thomas Gleixner <tglx@linutronix.de> Date: Mon Mar 23 18:28:15 2009 +0100 genirq: add threaded interrupt handler support Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-20MIPS: IP32: Fix hang on shutdown in power button interrupt handler.Andrew Randrianasulu
The hang was caused by the use of disable_irq() from the interrupt handler itself. Fixed by the use of disable_irq_nosync(). The issue was triggered by: commit 3aa551c9b4c40018f0e261a178e3d25478dc04a9 Author: Thomas Gleixner <tglx@linutronix.de> Date: Mon Mar 23 18:28:15 2009 +0100 genirq: add threaded interrupt handler support Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2009-05-20Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: cdrom: beyond ARRAY_SIZE of viocd_diskinfo xen/blkfront: fix warning when deleting gendisk on unplug/shutdown xen/blkfront: allow xenbus state transition to Closing->Closed when not Connected
2009-05-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: fix pointer initialization and checks in cifs_follow_symlink (try #4)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-18 14:59:07 +0000