21 Oct, 2010
2 commits
-
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
[SCSI] bsg: fix incorrect device_status value
[SCSI] Fix VPD inquiry page wrapper -
* 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: Fix fs/gs reload oops with invalid ldt
20 Oct, 2010
2 commits
-
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm/radeon/kms: avivo cursor workaround applies to evergreen as well -
kvm reloads the host's fs and gs blindly, however the underlying segment
descriptors may be invalid due to the user modifying the ldt after loading
them.Fix by using the safe accessors (loadsegment() and load_gs_index()) instead
of home grown unsafe versions.This is CVE-2010-3698.
KVM-Stable-Tag.
Signed-off-by: Avi Kivity
Signed-off-by: Marcelo Tosatti
19 Oct, 2010
6 commits
-
* 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus:
MIPS: Enable ISA_DMA_API config to fix build failure
MIPS: 32-bit: Fix build failure in asm/fcntl.h
MIPS: Remove all generated vmlinuz* files on "make clean"
MIPS: do_sigaltstack() expects userland pointers
MIPS: Fix error values in case of bad_stack
MIPS: Sanitize restart logics
MIPS: secure_computing, syscall audit: syscall number should in r2, not r0.
MIPS: Don't block signals if we'd failed to setup a sigframe -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - fix EVIOCSABS regression
Input: evdev - fix Ooops in EVIOCGABS/EVIOCSABS -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 -
This patch reverts the driver to enabling/disabling the NFC interrupt
mask rather than enabling/disabling the system interrupt. This cleans
up the driver so that it doesn't rely on interrupts being disabled
within the interrupt handler.For i.MX21 we keep the current behaviour, that is calling
enable_irq/disable_irq_nosync to enable/disable interrupts. This patch
is based on earlier work by John Ogness.Signed-off-by: Sascha Hauer
Acked-by: John Ogness
Tested-by: John Ogness
Signed-off-by: David Woodhouse
Signed-off-by: Linus Torvalds -
* 'for-linus/i2c/2636-rc8' of git://git.fluff.org/bjdooks/linux:
i2c-imx: do not allow interruptions when waiting for I2C to complete
i2c-davinci: Fix TX setup for more SoCs -
* fixes:
v4l1: fix 32-bit compat microcode loading translation
De-pessimize rds_page_copy_user
18 Oct, 2010
14 commits
-
Add ISA_DMA_API config item and select it when GENERIC_ISA_DMA enabled.
This fixes build failure on allmodconfig like following:CC sound/isa/es18xx.o
sound/isa/es18xx.c: In function 'snd_es18xx_playback1_prepare':
sound/isa/es18xx.c:501:9: error: implicit declaration of function 'snd_dma_program'
sound/isa/es18xx.c: In function 'snd_es18xx_playback_pointer':
sound/isa/es18xx.c:818:3: error: implicit declaration of function 'snd_dma_pointer'
make[3]: *** [sound/isa/es18xx.o] Error 1
make[2]: *** [sound/isa/es18xx.o] Error 2
make[1]: *** [sub-make] Error 2
make: *** [all] Error 2Signed-off-by: Namhyung Kim
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/1717/
Signed-off-by: Ralf Baechle -
CC security/integrity/ima/ima_fs.o
In file included from linux/include/linux/fcntl.h:4:0,
from linux/security/integrity/ima/ima_fs.c:18:
linux/arch/mips/include/asm/fcntl.h:63:2: error: expected specifier-qualifier-list before 'off_t'
make[3]: *** [security/integrity/ima/ima_fs.o] Error 1
make[2]: *** [security/integrity/ima/ima_fs.o] Error 2
make[1]: *** [sub-make] Error 2
make: *** [all] Error 2Signed-off-by: Namhyung Kim
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/1715/
Signed-off-by: Ralf Baechle -
[Ralf: I changed the patch to explicitly list all files to be deleted out
of paranoia.]Signed-off-by: Wu Zhangjin
Patchwork: http://patchwork.linux-mips.org/patch/1590/
Signed-off-by: Ralf Baechle -
o32 compat does the right thing, native and n32 compat do not...
Signed-off-by: Al Viro
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/1700/
Signed-off-by: Ralf Baechle -
We want EFAULT, not -
Signed-off-by: Al Viro
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1699/
Signed-off-by: Ralf Baechle -
Put the original syscall number into ->regs[0] when we leave syscall
with error. Use it in restart logics. Everything else will have
it 0 since we pass through SAVE_SOME on all the ways in. Note that
in places like bad_stack and inllegal_syscall we leave it 0 - it's not
restartable.Signed-off-by: Al Viro
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1698/
Signed-off-by: Ralf Baechle -
As it is, audit_syscall_entry() and secure_computing() get the
bogus value (0, in fact)Signed-off-by: Al Viro
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1697/
Signed-off-by: Ralf Baechle -
Signed-off-by: Al Viro
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1696/
Signed-off-by: Ralf Baechle -
448cd16 ("Input: evdev - rearrange ioctl handling") broke EVIOCSABS by
checking for the wrong direction bit.Signed-off-by: Daniel Mack
Reported-by: Sven Neumann
Tested-by: Sven Neumann
Signed-off-by: Dmitry Torokhov -
This fixes a regression introduced by the dynamic allocation of absinfo
for input devices. We need to bail out early for input devices which
don't have absolute axis.[ 929.664303] Pid: 2989, comm: input Not tainted 2.6.36-rc8+ #14 MS-7260/MS-7260
[ 929.664318] EIP: 0060:[] EFLAGS: 00010246 CPU: 0
[ 929.664331] EIP is at evdev_ioctl+0x4f8/0x59f
[ 929.664341] EAX: 00000040 EBX: 00000000 ECX: 00000006 EDX: f45a1efc
[ 929.664355] ESI: 00000000 EDI: f45a1efc EBP: f45a1f24 ESP: f45a1eb8
[ 929.664369] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 929.664402] f470da74 f6a30e78 f462c240 00000018 bfe4a260 00000000 f45b06fc 00000000
[ 929.664429] 000000c4 b769d000 c3544620 f470da74 f45b06fc f45b06fc f45a1f38 c107dd1f
[ 929.664458] f4710b74 000000c4 00000000 00000000 00000000 0000029d 00000a74 f4710b74
[ 929.664500] [] ? handle_mm_fault+0x2be/0x59a
[ 929.664513] [] ? evdev_ioctl+0x0/0x59f
[ 929.664524] [] ? do_vfs_ioctl+0x494/0x4d9
[ 929.664538] [] ? up_read+0x16/0x29
[ 929.664550] [] ? do_page_fault+0x2ff/0x32d
[ 929.664564] [] ? do_sys_open+0xc5/0xcf
[ 929.664575] [] ? sys_ioctl+0x41/0x61
[ 929.664587] [] ? sysenter_do_call+0x12/0x36
[ 929.684570] ---[ end trace 11b83e923bd8f2bb ]---Signed-off-by: Daniel Mack
Signed-off-by: Dmitry Torokhov -
The i2c_imx_trx_complete() function is using
wait_event_interruptible_timeout() to wait for the I2C controller to
signal that it has completed an I2C bus operation. If the process that
causes the I2C operation receives a signal, the wait will be
interrupted, returning an error. It is better to let the I2C operation
finished before handling the signal (i.e. returning into userspace).It is safe to use wait_event_timeout() instead, because the timeout
will allow the process to exit if the I2C bus hangs. It's also better
to allow the I2C operation to finish, because unacknowledged I2C
operations can cause the I2C bus to hang.Signed-off-by: Marc Kleine-Budde
Reviewed-by: Wolfram Sang
Signed-off-by: Ben Dooks -
This patch is an improvement to 4bba0fd8d1c6d405df666e2573e1a1f917098be0
which got to mainline a little early.Sudhakar Rajashekhara explains that at least OMAP-L138 requires MDR mode
settings before DXR for correct behaviour, so load MDR first with
STT cleared and later load again with STT set.Tested on DM355 connected to Techwell TW2836 and Wolfson WM8985
Signed-off-by: Jon Povey
Acked-by: Troy Kisky
Tested-by: Sudhakar Rajashekhara
Acked-by: Kevin Hilman
Signed-off-by: Ben Dooks -
Fixes cursor corruption in certain cases.
Signed-off-by: Alex Deucher
Cc: stable@kernel.org
Signed-off-by: Dave Airlie -
* 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: rawmidi: fix oops (use after free) when unloading a driver module
17 Oct, 2010
2 commits
-
Revert commit 54672386ccf36ffa21d1de8e75624af83f9b0eeb
"firewire: ohci: fix up configuration of TI chips".
It caused massive slow-down and data corruption with a TSB82AA2 based
StarTech EC1394B2 ExpressCard and FireWire 800 harddisks.https://bugs.launchpad.net/ubuntu/+source/linux/+bug/657081
http://thread.gmane.org/gmane.linux.kernel.firewire.user/4013The fact that some card EEPROMs do not program these enhancements may be
related to TSB81BA3 phy chip errata, if not to bugs of TSB82AA2 itself.
We could re-add these configuration steps, but only conditional on a
whitelist of cards on which these enhancements bring a proven positive
effect.Reported-and-tested-by: Eric Shattow
Cc: Clemens Ladisch
Cc: 2.6.35
Signed-off-by: Stefan Richter -
When a driver module is unloaded and the last still open file is a raw
MIDI device, the card and its devices will be actually freed in the
snd_card_file_remove() call when that file is closed. Afterwards, rmidi
and rmidi->card point into freed memory, so the module pointer is likely
to be garbage.
(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)Signed-off-by: Clemens Ladisch
Reported-by: Krzysztof Foltman
Cc: 2.6.30-2.6.35
Signed-off-by: Takashi Iwai
16 Oct, 2010
14 commits
-
Fixes build for me... these are what's tested in byteorder.h...
Signed-off-by: Kyle McMartin
Signed-off-by: Linus Torvalds -
Signed-off-by: Kyle McMartin
Signed-off-by: Linus Torvalds -
Signed-off-by: Kyle McMartin
Acked-by: Al "my fuckup" Viro
Signed-off-by: Linus Torvalds -
Commit a7f8388e accidentally removed it... Al explains:
"Sorry, reordering breakage. In the signals tree here I have
static inline void sig_set_blocked(struct sigset_t *set)
...and it's used all over the place (including quite a few places where
we currently have sigprocmask(SIG_SETMASK, set, NULL), which is what
it's equivalent to). With that done, m32r doesn't use _BLOCKABLE
anywhere, so it got removed. And that chunk got picked when I'd been
reordering the queue to pull the arch-specific fixes in front.
Sorry."Signed-off-by: Kyle McMartin
Cc: Al Viro
Signed-off-by: Linus Torvalds -
We currently have a kernel internal type called aligned_u64 which aligns
__u64's on 8 bytes boundaries even on systems which would normally align
them on 4 byte boundaries. This patch creates a new type __aligned_u64
which does the same thing but which is exposed to userspace rather than
being kernel internal.[akpm: merge early as both the net and audit trees want this]
[akpm@linux-foundation.org: enhance the comment describing the reasons for using aligned_u64. Via Andreas and Andi.]
Based-on-patch-by: Andreas Gruenbacher
Signed-off-by: Eric Paris
Cc: Jan Engelhardt
Cc: David Miller
Cc: Andi Kleen
Cc: Arnd Bergmann
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
Fix a build error introduced by d6d1b650ae6acce73d55dd024 ("param: simple
locking for sysfs-writable charp parameters").CC arch/um/kernel/trap.o
arch/um/drivers/hostaudio_kern.c: In function 'hostaudio_open':
arch/um/drivers/hostaudio_kern.c:204: error: '__param_dsp' undeclared (first use in this function)
arch/um/drivers/hostaudio_kern.c:204: error: (Each undeclared identifier is reported only once
arch/um/drivers/hostaudio_kern.c:204: error: for each function it appears in.)
arch/um/drivers/hostaudio_kern.c: In function 'hostmixer_open_mixdev':
arch/um/drivers/hostaudio_kern.c:265: error: '__param_mixer' undeclared (first use in this function)
arch/um/drivers/hostaudio_kern.c:272: error: '__param_dsp' undeclared (first use in this function)Reported-by: Toralf Förster
Tested-by: Toralf Förster
Cc: Rusty Russell
Cc: Takashi Iwai
Cc: Jeff Dike
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
sysctl check complains with a WARN() when proc_doulongvec_minmax() or
proc_doulongvec_ms_jiffies_minmax() are used by a vector of longs (with
more than one element), with no min or max value specified.This is unexpected, given we had a bug on this min/max handling :)
Reported-by: Jiri Slaby
Signed-off-by: Eric Dumazet
Cc: "Eric W. Biederman"
Cc: David Miller
Acked-by: WANG Cong
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds -
The compat code for the VIDIOCSMICROCODE ioctl is totally buggered.
It's only used by the VIDEO_STRADIS driver, and that one is scheduled to
staging and eventually removed unless somebody steps up to maintain it
(at which point it should use request_firmware() rather than some magic
ioctl). So we'll get rid of it eventually.But in the meantime, the compatibility ioctl code is broken, and this
tries to get it to at least limp along (even if Mauro suggested just
deleting it entirely, which may be the right thing to do - I don't think
the compatibility translation code has ever worked unless you were very
lucky).Reported-by: Kees Cook
Cc: Mauro Carvalho Chehab
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds -
Don't try to "optimize" rds_page_copy_user() by using kmap_atomic() and
the unsafe atomic user mode accessor functions. It's actually slower
than the straightforward code on any reasonable modern CPU.Back when the code was written (although probably not by the time it was
actually merged, though), 32-bit x86 may have been the dominant
architecture. And there kmap_atomic() can be a lot faster than kmap()
(unless you have very good locality, in which case the virtual address
caching by kmap() can overcome all the downsides).But these days, x86-64 may not be more populous, but it's getting there
(and if you care about performance, it's definitely already there -
you'd have upgraded your CPU's already in the last few years). And on
x86-64, the non-kmap_atomic() version is faster, simply because the code
is simpler and doesn't have the "re-try page fault" case.People with old hardware are not likely to care about RDS anyway, and
the optimization for the 32-bit case is simply buggy, since it doesn't
verify the user addresses properly.Reported-by: Dan Rosenberg
Acked-by: Andrew Morton
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
mmc: sdio: fix SDIO suspend/resume regression -
Fix SDIO suspend/resume regression introduced by 4c2ef25fe0b "mmc: fix
all hangs related to mmc/sd card insert/removal during suspend/resume":PM: Syncing filesystems ... done.
Freezing user space processes ... (elapsed 0.01 seconds) done.
Freezing remaining freezable tasks ... (elapsed 0.01 seconds) done.
Suspending console(s) (use no_console_suspend to debug)
pm_op(): platform_pm_suspend+0x0/0x5c returns -38
PM: Device pxa2xx-mci.0 failed to suspend: error -38
PM: Some devices failed to suspend4c2ef25fe0b moved the card removal/insertion mechanism out of MMC's
suspend/resume path and into pm notifiers (mmc_pm_notify), and that
broke SDIO's expectation that mmc_suspend_host() will remove the card,
and squash the error, in case -ENOSYS is returned from the bus suspend
handler (mmc_sdio_suspend() in this case).mmc_sdio_suspend() is using this whenever at least one of the card's SDIO
function drivers does not have suspend/resume handlers - in that case
it is agreed to force removal of the entire card.This patch fixes this regression by trivially bringing back that part of
mmc_suspend_host(), which was removed by 4c2ef25fe0b.Reported-and-tested-by: Sven Neumann
Signed-off-by: Ohad Ben-Cohen
Cc: Maxim Levitsky
Cc:
Acked-by: Nicolas Pitre
Signed-off-by: Chris Ball -
…nel/git/tip/linux-2.6-tip
* 'timers-for-linus-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
hrtimer: Preserve timer state in remove_hrtimer() -
* 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: Add Cando touch screen 15.6-inch product id
HID: Add MULTI_INPUT quirk for turbox/mosart touchscreen
HID: hidraw, fix a NULL pointer dereference in hidraw_write
HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl -
* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
ubd: fix incorrect sector handling during request restart
ps3disk: passing wrong variable to bvec_kunmap_irq()
