linux-toradex.git, branch v2.6.23.8

Linux 2.6.23.8

2007-11-16T18:14:27+00:00

wait_task_stopped: Check p->exit_state instead of TASK_TRACED (CVE-2007-5500)

2007-11-16T18:10:56+00:00

patch a3474224e6a01924be40a8255636ea5522c1023a in mainline

The original meaning of the old test (p->state > TASK_STOPPED) was
"not dead", since it was before TASK_TRACED existed and before the
state/exit_state split.  It was a wrong correction in commit
14bf01bb0599c89fc7f426d20353b76e12555308 to make this test for
TASK_TRACED instead.  It should have been changed when TASK_TRACED
was introducted and again when exit_state was introduced.

Signed-off-by: Roland McGrath 
Cc: Oleg Nesterov 
Cc: Alexey Dobriyan 
Cc: Kees Cook 
Acked-by: Scott James Remnant 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

TCP: Make sure write_queue_from does not begin with NULL ptr (CVE-2007-5501)

2007-11-16T18:10:56+00:00

patch 96a2d41a3e495734b63bff4e5dd0112741b93b38 in mainline.

NULL ptr can be returned from tcp_write_queue_head to cached_skb
and then assigned to skb if packets_out was zero. Without this,
system is vulnerable to a carefully crafted ACKs which obviously
is remotely triggerable.

Besides, there's very little that needs to be done in sacktag
if there weren't any packets outstanding, just skipping the rest
doesn't hurt.

Signed-off-by: Ilpo Järvinen 
Signed-off-by: David S. Miller

Linux 2.6.23.7

2007-11-16T17:43:31+00:00

NFS: Fix a writeback race...

2007-11-16T17:37:01+00:00

patch 61e930a904966cc37e0a3404276f0b73037e57ca in mainline

This patch fixes a regression that was introduced by commit
44dd151d5c21234cc534c47d7382f5c28c3143cd

We cannot zero the user page in nfs_mark_uptodate() any more, since

  a) We'd be modifying the page without holding the page lock
  b) We can race with other updates of the page, most notably
     because of the call to nfs_wb_page() in nfs_writepage_setup().

Instead, we do the zeroing in nfs_update_request() if we see that we're
creating a request that might potentially be marked as up to date.

Thanks to Olivier Paquet for reporting the bug and providing a test-case.

Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

ocfs2: fix write() performance regression

2007-11-16T17:37:01+00:00

patch 4e9563fd55ff4479f2b118d0757d121dd0cfc39c in mainline.

ocfs2: fix write() performance regression

On file systems which don't support sparse files, Ocfs2_map_page_blocks()
was reading blocks on appending writes. This caused write performance to
suffer dramatically. Fix this by detecting an appending write on a nonsparse
fs and skipping the read.

Signed-off-by: Mark Fasheh 
Signed-off-by: Greg Kroah-Hartman

minixfs: limit minixfs printks on corrupted dir i_size (CVE-2006-6058)

2007-11-16T17:37:00+00:00

patch f44ec6f3f89889a469773b1fd894f8fcc07c29cf upstream.

This attempts to address CVE-2006-6058
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6058

first reported at http://projects.info-pull.com/mokb/MOKB-17-11-2006.html

Essentially a corrupted minix dir inode reporting a very large
i_size will loop for a very long time in minix_readdir, minix_find_entry,
etc, because on EIO they just move on to try the next page.  This is
under the BKL, printk-storming as well.  This can lock up the machine
for a very long time.  Simply ratelimiting the printks gets things back
under control.  Make the message a bit more informative while we're here.

Signed-off-by: Eric Sandeen 
Cc: Bodo Eggert <7eggert@gmx.de>
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Linux 2.6.23.6

2007-11-16T17:33:58+00:00

ACPI: suspend: Wrong order of GPE restore.

2007-11-16T17:30:26+00:00

commit 1dbc1fda5d8ca907f320b806005d4a447977d26a in mainline.

ACPI: suspend: Wrong order of GPE restore.

acpi_leave_sleep_state() should have correct list of wake and
runtime GPEs, which is available only after disable_wakeup_device()
is called.

[cebbert@redhat.com: backport to 2.6.23]

Signed-off-by: Alexey Starikovskiy 
Acked-by: Rafael J. Wysocki 
Signed-off-by: Len Brown 
Cc: Chuck Ebbert 
Signed-off-by: Greg Kroah-Hartman

ACPI: sleep: Fix GPE suspend cleanup

2007-11-16T17:30:26+00:00

patch is 9c1c6a1ba786d58bd03e27ee49f89a5685e8e07b in mainline.

ACPI: sleep: Fix GPE suspend cleanup

Commit 9b039330808b83acac3597535da26f47ad1862ce removed
acpi_gpe_sleep_prepare(), the only function used at S5 transition
Add call to generic acpi_enable_wake_device().

Reference: https://bugzilla.novell.com/show_bug.cgi?id=299882

Signed-off-by: Alexey Starikovskiy 
Acked-by: Rafael J. Wysocki 
Signed-off-by: Len Brown 
Cc: Chuck Ebbert 
Signed-off-by: Greg Kroah-Hartman