- 21 Nov, 2011 13 commits
-
-
Dan Carpenter authored
commit bc5b8a90 upstream. On a corrupted file system the ->len field could be wrong leading to a buffer overflow. Reported-and-acked-by:
Clement LECIGNE <clement.lecigne@netasq.com> Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
-
David Howells authored
commit 9f35a33b upstream. Fix a NULL pointer deref in the user-defined key type whereby updating a negative key into a fully instantiated key will cause an oops to occur when the code attempts to free the non-existent old payload. This results in an oops that looks something like the following: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [<ffffffff81085fa1>] __call_rcu+0x11/0x13e PGD 3391d067 PUD 3894a067 PMD 0 Oops: 0002 [#1] SMP CPU 1 Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140 /DG965RY RIP: 0010:[<ffffffff81085fa1>] [<ffffffff81085fa1>] __call_rcu+0x11/0x13e RSP: 0018:ffff88003d591df8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538 R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908 FS: 00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040) Stack: ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50 ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0 Call Trace: [<ffffffff810860f0>] call_rcu_sched+0x10/0x12 [<ffffffff8117bfea>] user_update+0x8d/0xa2 [<ffffffff8117723a>] key_create_or_update+0x236/0x270 [<ffffffff811789b1>] sys_add_key+0x123/0x17e [<ffffffff813b84bb>] system_call_fastpath+0x16/0x1b Signed-off-by:
David Howells <dhowells@redhat.com> Acked-by:
Jeff Layton <jlayton@redhat.com> Acked-by:
Neil Horman <nhorman@redhat.com> Acked-by:
Steve Dickson <steved@redhat.com> Acked-by:
James Morris <jmorris@namei.org> Signed-off-by:
-
Takashi Iwai authored
commit dcaaf9f2 upstream. In the recent usb-audio driver, the initialization of volume ranges may be delayed when the device doesn't respond well at the probing time. But the volume quirks for certain devices are applied only in mixer_ctl_feature_info() thus only at the very first probe and will be missing when the volume range is initialized later. This patch moves the volume quirk code to be always called from the volume-range extraction (get_min_max()), so that the quirks are properly applied in the later init time. Reported-and-tested-by:
Alexey Fisher <bug-track@fisher-privat.net> Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Takashi Iwai authored
commit 9fcd0ab1 upstream. When the initial check of dB-range failed due to the read error, try to check again at the later read, too. When an invalid dB range is found, remove TLV flags and notify the mixer info change. Signed-off-by:
-
Alex Deucher authored
commit 091264f0 upstream. Can happen when there is no DP panel attached, confusing users. Make it debug only. Signed-off-by:
Alex Deucher <alexander.deucher@amd.com> Signed-off-by:
Dave Airlie <airlied@redhat.com> Signed-off-by:
-
Marcin Slusarz authored
commit 5e60ee78 upstream. Fence lock needs to be initialized before any call to nouveau_channel_put because it calls nouveau_channel_idle->nouveau_fence_update which uses fence lock. BUG: spinlock bad magic on CPU#0, test/24134 lock: ffff88019f90dba8, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 Pid: 24134, comm: test Not tainted 3.0.0-nv+ #800 Call Trace: spin_bug+0x9c/0xa3 do_raw_spin_lock+0x29/0x13c _raw_spin_lock+0x1e/0x22 nouveau_fence_update+0x2d/0xf1 nouveau_channel_idle+0x22/0xa0 nouveau_channel_put_unlocked+0x84/0x1bd nouveau_channel_put+0x20/0x24 nouveau_channel_alloc+0x4ec/0x585 nouveau_ioctl_fifo_alloc+0x50/0x130 drm_ioctl+0x289/0x361 do_vfs_ioctl+0x4dd/0x52c sys_ioctl+0x42/0x65 system_call_fastpath+0x16/0x1b It's easily triggerable from userspace. Additionally remove double initialization of chan->fence.pending. Signed-off-by:
Marcin Slusarz <marcin.slusarz@gmail.com> Signed-off-by:
Ben Skeggs <bskeggs@redhat.com> Signed-off-by:
-
Eric Anholt authored
commit 14660ccd upstream. I've been seeing memory leaks on my system in the form of large (300-400MB) GEM objects created by now-dead processes laying around clogging up memory. I usually notice when it gets to about 1.2GB of them. Hopefully this clears up the issue, but I just found this bug by inspection. Signed-off-by:
Eric Anholt <eric@anholt.net> Signed-off-by:
Keith Packard <keithp@keithp.com> Signed-off-by:
-
Nobuhiro Iwamatsu authored
commit dfd3b596 upstream. In the case of 29bit mode, CAC/UNCAC_ADDR does not return a right address. This revises this problem by using P1SEGADDR and P2SEGADDR in 29bit mode. Reported-by:
Yutaro Ebihara <ebiharaml@si-linux.co.jp> Signed-off-by:
Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com> Tested-by:
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Tested-by:
Simon Horman <horms@verge.net.au> Signed-off-by:
Paul Mundt <lethal@linux-sh.org> Signed-off-by:
-
Mark Brown authored
commit 8eeea521 upstream. The field is no longer initialised so this will crash if running on wm8958. Reported-by:
Thomas Abraham <thomas.abraham@linaro.org> Signed-off-by:
Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by:
-
Jochen Friedrich authored
commit dd0b3825 upstream. Since 193ab2a6, various AT91 boards don't register USBA adapters anymore due to depending on a now non-existing symbol. Fix the symbol name. Signed-off-by:
Jochen Friedrich <jochen@scram.de> Acked-by:
Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by:
Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by:
-
Michael S. Tsirkin authored
commit 72103bd1 upstream. Commit 31a3ddda introduced a use after free in virtio-pci. The main issue is that the release method signals removal of the virtio device, while remove signals removal of the pci device. For example, on driver removal or hot-unplug, virtio_pci_release_dev is called before virtio_pci_remove. We then might get a crash as virtio_pci_remove tries to use the device freed by virtio_pci_release_dev. We allocate/free all resources together with the pci device, so we can leave the release method empty. Signed-off-by:
Michael S. Tsirkin <mst@redhat.com> Acked-by:
Amit Shah <amit.shah@redhat.com> Signed-off-by:
Rusty Russell <rusty@rustcorp.com.au> Signed-off-by:
-
Takashi Iwai authored
commit aeb4b88e upstream. When a virtual mater control is created, the driver looks for slave elements from the assigned card instance. But this may include the elements of other codecs when multiple codecs are on the same HD-audio bus. This works at the first time, but it'll give Oops when it's once freed and re-created via reconfig sysfs. This patch changes the element-look-up strategy to limit only to the mixer elements of the same codec. Reported-by:
David Henningsson <david.henningsson@canonical.com> Signed-off-by:
-
Julian Wollrath authored
commit f7f9bdfa upstream. Fix the not working internal mic on Dell Vostro 3500 laptop by introducing the new model dell-vostro-3500. Signed-off-by:
Julian Wollrath <jwollrath@web.de> Signed-off-by:
-
- 11 Nov, 2011 27 commits
-
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
commit 21404b77 upstream. This removes the use of the special "macbookair_fn_keys" keyboard translation table for the MacBookAir4,x models (ie the 2011 refresh). They use the standard apple_fn_keys[] translation. Apparently only the old MacBook Air's need a different translation table. This mirrors the change that commit da617c7c ("HID: consolidate MacbookAir 4,1 mappings") did for the WELLSPRING6A ones, but does it for the WELLSPRING6 model used on the MacBookAir4,2. Reported-and-tested-by:
Dirk Hohndel <hohndel@infradead.org> Cc: Jiri Kosina <jkosina@suse.cz> Cc: Joshua V Dillon <jvdillon@gmail.com> Cc: Chase Douglas <chase.douglas@canonical.com> Signed-off-by:
-
Jiri Kosina authored
commit da617c7c upstream. MacbookAir 4,1 doesn't require extra mapping table, as the mappings are identical to apple_fn_keys[]. Signed-off-by:
Jiri Kosina <jkosina@suse.cz> Signed-off-by:
-
Andreas Krist authored
commit ad734bc1 upstream. I've recently bought a Apple wireless aluminum keyboard (model 2011) which is not yet supported by the kernel - it seems they just changed the device id. After applying the attached patch, the device is fully functional. Signed-off-by:
Andreas Krist <andreas.krist@gmail.com> Signed-off-by:
-
Gökçen Eraslan authored
commit 213f9da8 upstream. This patch adds keyboard support for Macbook Pro 8 models which has WELLSPRING5A model name and 0x0252, 0x0253 and 0x0254 USB IDs. Trackpad support for those models are added to bcm5974 in c331eb58 ("Input: bcm5974 - Add support for newer MacBookPro8,2). Signed-off-by:
Gökçen Eraslan <gokcen@pardus.org.tr> Acked-by:
Henrik Rydberg <rydberg@euromail.se> Signed-off-by:
-
Nobuhiro Iwamatsu authored
commit d762cc29 upstream. Added USB device IDs and keyboard map for MacBookAir 4,1 keyboard. Signed-off-by:
Nobuhiro Iwamatsu <iwamatsu@nigauri.org> Signed-off-by:
-
Jiri Kosina authored
commit f6f554f0 upstream. Otherwise the generic driver wouldn't unbind from it and wouldn't let hid-apple to automatically take over. Signed-off-by:
-
Jeff Brown authored
commit c50bb1a4 upstream. This panel is also known as the Dell ST2220Tc. Signed-off-by: jeffbrown@android.com Reviewed-By:
Benjamin Tissoires <Benjamin_Tissoires@logitech.com> Signed-off-by:
-
Joshua V. Dillon authored
commit 5d922baa upstream. Added USB device IDs for MacBookAir4,2 keyboard. Device constants were copied from the MacBookAir3,2 constants. The 4,2 device specification is reportedly unchanged from the 3,2 predecessor and seems to work well. Signed-off-by:
Joshua V Dillon <jvdillon@gmail.com> Signed-off-by:
Chase Douglas <chase.douglas@canonical.com> Signed-off-by:
-
THOMSON, Adam (Adam) authored
commit f722013e upstream. In nand_do_write_ops() code it is possible for a caller to provide ops.oobbuf populated and ops.mode == MTD_OOB_AUTO, which currently means that the chip->oob_poi buffer isn't initialised to all 0xFF. The nand_fill_oob() method then carries out the task of copying the provided OOB data to oob_poi, but with MTD_OOB_AUTO it skips areas marked as unavailable by the layout struct, including the bad block marker bytes. An example of this causing issues is when the last OOB data read was from the start of a bad block where the markers are not 0xFF, and the caller wishes to write new OOB data at the beginning of another block. In this scenario the caller would provide OOB data, but nand_fill_oob() would skip the bad block marker bytes in oob_poi before copying the OOB data provided by the caller. This means that when the OOB data is written back to NAND, the block is inadvertently marked as bad without the caller knowing. This has been witnessed when using YAFFS2 where tags are stored in the OOB. To avoid this oob_poi is always initialised to 0xFF to make sure no left over data is inadvertently written back to the OOB area. Credits to Brian Norris <computersforpeace@gmail.com> for fixing this patch. Signed-off-by:
Adam Thomson <adam.thomson@alcatel-lucent.com> Signed-off-by:
Artem Bityutskiy <dedekind1@gmail.com> Signed-off-by:
-
Dan Williams authored
commit 257a4b42 upstream. All updates that occur under STRIPE_ACTIVE should be globally visible when STRIPE_ACTIVE clears. test_and_set_bit() implies a barrier, but clear_bit() does not. This is suitable for 3.1-stable. Signed-off-by:
Dan Williams <dan.j.williams@intel.com> Signed-off-by:
NeilBrown <neilb@suse.de> Signed-off-by:
-
NeilBrown authored
commit 9a3f530f upstream. When the number of failed devices exceeds the allowed number we must abort any active parity operations (checks or updates) as they are no longer meaningful, and can lead to a BUG_ON in handle_parity_checks6. This bug was introduce by commit 6c0069c0 in 2.6.29. Reported-by:
Manish Katiyar <mkatiyar@gmail.com> Tested-by:
-
Rajkumar Manoharan authored
commit 52d6d4ef upstream. My recent commits (3782c69d, 324c74ad) introduced regression for register offset selection that based on the macversion. Not using parentheses in proper manner for ternary operator leads to select wrong offset for the registers. This issue was observed with AR9462 chip that immediate disconnect after the association with the following message ieee80211 phy3: wlan0: Failed to send nullfunc to AP 00:23:69:12:ea:47 after 500ms, disconnecting. Signed-off-by:
Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-off-by:
John W. Linville <linville@tuxdriver.com> Signed-off-by:
-
Richard Cochran authored
commit f5ff7cd1 upstream. The previous commit enforces a new rule for handling the cloned packets for transmit time stamping. These packets must not be freed using any other function than skb_complete_tx_timestamp. This commit fixes the one and only driver using this API. The driver first appeared in v3.0. Signed-off-by:
Richard Cochran <richard.cochran@omicron.at> Acked-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
-
Herbert Xu authored
commit b2bac6ac upstream. As cryptd is depeneded on by other algorithms such as aesni-intel, it needs to be registered before them. When everything is built as modules, this occurs naturally. However, for this to work when they are built-in, we need to use subsys_initcall in cryptd. Tested-by:
Josh Boyer <jwboyer@redhat.com> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au> Cc: Kerin Millar <kerframil@gmail.com> Signed-off-by:
-
Dan Carpenter authored
commit 528f7ce6 upstream. In enter_state() we use "state" as an offset for the pm_states[] array. The pm_states[] array only has PM_SUSPEND_MAX elements so this test is off by one. Signed-off-by:
Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by:
-
Daniel Mack authored
commit 543e32d5 upstream. This bug was introduced in f8155a40 ("mtd: pxa3xx_nand: rework irq logic") and causes the PXA3xx NAND controller fail to operate with NAND flash that has empty pages. According to the comment in this block, the hardware controller will report a double-bit error for empty pages, which can and must be ignored. This patch restores the original behaviour of the driver. Signed-off-by:
Daniel Mack <zonque@gmail.com> Acked-by:
Lei Wen <leiwen@marvell.com> Cc: Haojian Zhuang <haojian.zhuang@marvell.com> Cc: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by:
Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by:
-
Lei Wen authored
commit 0fab028b upstream. When keep_config is set, the detection would goes different routine. That the driver would read out the setting which is set previously by bootloader. While most bootloader keep the irq mask as off, and current driver need all irq default open, keep_config behavior would lead to no irq at all. Signed-off-by:
-
Andres Salomon authored
commit d5de1907 upstream. parse_mtd_partitions takes a list of partition types; if the driver isn't loaded, it attempts to load it, and then it grabs the partition parser. For redboot, the module name is "redboot.ko", while the parser name is "RedBoot". Since modprobe is case-sensitive, attempting to modprobe "RedBoot" will never work. I suspect the embedded systems that make use of redboot just always manually loaded redboot prior to loading their specific nand chip drivers (or statically compiled it in). Signed-off-by:
Andres Salomon <dilinger@queued.net> Signed-off-by:
Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by:
-
Peter Wippich authored
commit bf514081 upstream. On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently initialized which may cause nandwrite to fail. With this patch it is possible to write raw nand/oob data without additional ECC (either for testing or when some sectors need different oob layout e.g. bootloader) like nandwrite -n -r -o /dev/mtd0 <myfile> Signed-off-by:
Peter Wippich <pewi@gw-instruments.de> Tested-by:
Ricard Wanderlof <ricardw@axis.com> Signed-off-by:
-
Johannes Berg authored
commit 05cb9108 upstream. Only AID values 1-2007 are valid, but some APs have been found to send random bogus values, in the reported case an AP that was sending the AID field value 0xffff, an AID of 0x3fff (16383). There isn't much we can do but disable powersave since there's no way it can work properly in this case. Reported-by:
Bill C Riemers <briemers@redhat.com> Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Signed-off-by:
-
Eliad Peller authored
commit 6911bf04 upstream. When going back on-channel, we should reconfigure the hw iff the hardware is not already configured to the operational channel. Signed-off-by:
Eliad Peller <eliad@wizery.com> Signed-off-by:
-
Eliad Peller authored
commit eaa7af2a upstream. The offchannel code is currently broken - we should remain_off_channel if the work was started, and the work's channel and channel_type are the same as local->tmp_channel and local->tmp_channel_type. However, if wk->chan_type and local->tmp_channel_type coexist (e.g. have the same channel type), we won't remain_off_channel. This behavior was introduced by commit da2fd1f0 ("mac80211: Allow work items to use existing channel type.") Tested-by:
Ben Greear <greearb@candelatech.com> Signed-off-by:
-
Rajkumar Manoharan authored
commit 98fb2cc1 upstream. This patch fixes system hang when resuming from S3 state and lower rate sens failure issue. Signed-off-by:
-
Johannes Berg authored
commit c30bc947 upstream. L2TP for example uses NLA_MSECS like this: policy: [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, }, code: if (info->attrs[L2TP_ATTR_RECV_TIMEOUT]) cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]); As nla_get_msecs() is essentially nla_get_u64() plus the conversion to a HZ-based value, this will not properly reject attributes from userspace that aren't long enough and might overrun the message. Add NLA_MSECS to the attribute minlen array to check the size properly. Cc: Thomas Graf <tgraf@suug.ch> Signed-off-by:
-
Bart Van Assche authored
commit c1056b42 upstream. Recently the ACPI ops structs were constified but the inline version of register_hotplug_dock_device() was overlooked (see also commit 9c8b04be, June 25 2011). Update the inline function register_hotplug_dock_device() that is enabled with CONFIG_ACPI_DOCK=n too. This patch fixes at least the following compiler warnings: drivers/ata/libata-acpi.c: In function .ata_acpi_associate.: drivers/ata/libata-acpi.c:266:11: warning: passing argument 2 of .register_hotplug_dock_device. discards qualifiers from pointer target type include/acpi/acpi_drivers.h:146:19: note: expected .struct acpi_dock_ops *. but argument is of type .const struct acpi_dock_ops *. drivers/ata/libata-acpi.c:275:11: warning: passing argument 2 of .register_hotplug_dock_device. discards qualifiers from pointer target type include/acpi/acpi_drivers.h:146:19: note: expected .struct acpi_dock_ops *. but argument is of type .const struct acpi_dock_ops *. Signed-off-by:
Len Brown <len.brown@intel.com> Signed-off-by:
-
Luck, Tony authored
commit 3bf3f8b1 upstream. Callers to __acpi_ioremap_fast() pass the bit_width that they found in the acpi_generic_address structure. Convert from bits to bytes when passing to __acpi_find_iomap() - as it wants to see bytes, not bits. Signed-off-by:
Tony Luck <tony.luck@intel.com> Signed-off-by:
-
