linux-toradex.git, branch v2.6.28.9

Linux 2.6.28.9

2009-03-23T21:55:52+00:00

eCryptfs: Allocate a variable number of pages for file headers

2009-03-23T21:55:32+00:00

commit 8faece5f906725c10e7a1f6caf84452abadbdc7b upstream.

When allocating the memory used to store the eCryptfs header contents, a
single, zeroed page was being allocated with get_zeroed_page().
However, the size of an eCryptfs header is either PAGE_CACHE_SIZE or
ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE (8192), whichever is larger, and is
stored in the file's private_data->crypt_stat->num_header_bytes_at_front
field.

ecryptfs_write_metadata_to_contents() was using
num_header_bytes_at_front to decide how many bytes should be written to
the lower filesystem for the file header.  Unfortunately, at least 8K
was being written from the page, despite the chance of the single,
zeroed page being smaller than 8K.  This resulted in random areas of
kernel memory being written between the 0x1000 and 0x1FFF bytes offsets
in the eCryptfs file headers if PAGE_SIZE was 4K.

This patch allocates a variable number of pages, calculated with
num_header_bytes_at_front, and passes the number of allocated pages
along to ecryptfs_write_metadata_to_contents().

Thanks to Florian Streibelt for reporting the data leak and working with
me to find the problem.  2.6.28 is the only kernel release with this
vulnerability.  Corresponds to CVE-2009-0787

Signed-off-by: Tyler Hicks 
Acked-by: Dustin Kirkland 
Reviewed-by: Eric Sandeen 
Reviewed-by: Eugene Teo 
Cc: dann frazier 
Cc: Serge E. Hallyn 
Cc: Florian Streibelt 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

menu: fix embedded menu snafu

2009-03-23T21:55:32+00:00

commit b943c460ff8556a193b28e2145b513f8b978e869 upstream.

The COMPAT_BRK kconfig symbol does not depend on EMBEDDED, but it is in
the midst of the EMBEDDED menu symbols, so it mucks up the EMBEDDED menu.
Fix by moving it to just after all of the EMBEDDED menu symbols.  Also,
ANON_INODES has a similar problem, so move it to just above the EMBEDDED
menu items since it is used in the EMBEDDED menu.

Signed-off-by: Randy Dunlap 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

drm/i915: Don't allow objects to get bound while VT switched.

2009-03-23T21:55:32+00:00

commit 9bb2d6f94aeb9a185d69aedbd19421b6da4e3309 upstream.

This avoids a BUG_ON in the enter_vt path due to objects being in the GTT
when we shouldn't have ever let them be (as we're not supposed to touch the
device during that time).

This was triggered by a change in the 2D driver to use the GTT mapping of
objects after pinning them to improve software fallback performance.

Signed-off-by: Eric Anholt 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm/i915: Don't print to dmesg when taking signal during object_pin.

2009-03-23T21:55:30+00:00

commit f1acec933848219c402c165686677b1c307407f8 upstream.

This showed up in logs where people had a hung chip, so pinning was blocked
on the chip unpinning other buffers, and the X Server took its scheduler
signal during that time.

Signed-off-by: Eric Anholt 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm/i915: Don't double-unpin buffers if we take a signal in evict_everything().

2009-03-23T21:55:30+00:00

commit b117763627ef4d24086801dd5f74c9eb2f487790 upstream.

We haven't seen this in practice, but it was visible when looking at a bug
report from when i915_gem_evict_everything() was broken and would always
return error.

Signed-off-by: Eric Anholt 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm/i915: don't enable vblanks on disabled pipes

2009-03-23T21:55:30+00:00

commit 71e0ffa599f54058d9b8724b4b14d0486751681d upstream.

In some cases userland may be confused and try to wait on vblank events from
pipes that aren't actually enabled.  We shouldn't allow this, so return
-EINVAL if the pipe isn't on.

Signed-off-by: Jesse Barnes 
Signed-off-by: Eric Anholt 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm/i915: set vblank enabled flag correctly across IRQ install/uninstall

2009-03-23T21:55:30+00:00

commit dc1336ff4fe08ae7cfe8301bfd7f0b2cfd31d20a upstream.

In the absence of kernel mode setting, many drivers disable IRQs across VT
switch.  The core DRM vblank code is missing a check for this case however;
even after IRQ disable, the vblank code will still have the vblank_enabled
flag set, so unless we track the fact that they're disabled at IRQ uninstall
time, when we VT switch back in we won't actually re-enable them, which means
any apps waiting on vblank before the switch will hang.

This patch does that and also adds a sanity check to the wait condition to
look for the irq_enabled flag in general, as well as adding a wakeup to the
IRQ uninstall path.

Fixes fdo bug #18879 with compiz hangs at VT switch.

Signed-off-by: Jesse Barnes 
Signed-off-by: Eric Anholt 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

powerpc: Remove extra semicolon in fsl_soc.c

2009-03-23T21:55:29+00:00

TSEC/MDIO will not work with older device trees because of a semicolon
at the end of a macro resulting in an empty for loop body.

This fix only applies to 2.6.28; this code is gone in 2.6.29, according
to Grant Likely!

Signed-off-by: Johns Daniel 
Acked-by: Grant Likely 
Signed-off-by: Greg Kroah-Hartman

USB: EHCI: Fix isochronous URB leak

2009-03-23T21:55:29+00:00

commit 508db8c954d55ed30f870d2c24d741ba6269d13c upstream.

ehci-hcd uses usb_get_urb() and usb_put_urb() in an unbalanced way causing
isochronous URB's kref.counts incrementing once per usb_submit_urb() call.
The culprit is *usb being set to NULL when usb_put_urb() is called after URB
is given back.
Due to other fixes there is no need for ehci-hcd to deal with usb_get_urb()
nor usb_put_urb() anymore, so patch removes their usages in ehci-hcd.
Patch also makes ehci_to_hcd(ehci)->self.bandwidth_allocated adjust, if a
stream finishes.

Signed-off-by: Karsten Wiese 
Cc: David Brownell 
Signed-off-by: Greg Kroah-Hartman