linux-toradex.git, branch v2.6.37.3

Linux 2.6.37.3

2011-03-07T23:05:50+00:00

arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS.

2011-03-07T23:05:27+00:00

commit d11327ad6695db8117c78d70611e71102ceec2ac upstream.

NETDEV_NOTIFY_PEER is an explicit request by the driver to send a link
notification while NETDEV_UP/NETDEV_CHANGEADDR generate link
notifications as a sort of side effect.

In the later cases the sysctl option is present because link
notification events can have undesired effects e.g. if the link is
flapping. I don't think this applies in the case of an explicit
request from a driver.

This patch makes NETDEV_NOTIFY_PEER unconditional, if preferred we
could add a new sysctl for this case which defaults to on.

This change causes Xen post-migration ARP notifications (which cause
switches to relearn their MAC tables etc) to be sent by default.

Signed-off-by: Ian Campbell 
Signed-off-by: David S. Miller 
[reported to solve hyperv live migration problem - gkh]
Cc: Haiyang Zhang 
Cc: Mike Surcouf 
Cc: Hank Janssen 
Signed-off-by: Greg Kroah-Hartman

DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]

2011-03-07T23:05:27+00:00

commit 1362fa078dae16776cd439791c6605b224ea6171 upstream.

When a DNS resolver key is instantiated with an error indication, attempts to
read that key will result in an oops because user_read() is expecting there to
be a payload - and there isn't one [CVE-2011-1076].

Give the DNS resolver key its own read handler that returns the error cached in
key->type_data.x[0] as an error rather than crashing.

Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
amount of data it prints, since the data is not necessarily NUL-terminated.

The buggy code was added in:

	commit 4a2d789267e00b5a1175ecd2ddefcc78b83fbf09
	Author: Wang Lei 
	Date:   Wed Aug 11 09:37:58 2010 +0100
	Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]

This can trivially be reproduced by any user with the following program
compiled with -lkeyutils:

	#include 
	#include 
	#include 
	static char payload[] = "#dnserror=6";
	int main()
	{
		key_serial_t key;
		key = add_key("dns_resolver", "a", payload, sizeof(payload),
			      KEY_SPEC_SESSION_KEYRING);
		if (key == -1)
			err(1, "add_key");
		if (keyctl_read(key, NULL, 0) == -1)
			err(1, "read_key");
		return 0;
	}

What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:

	dns-break: read_key: No such device or address

but instead the kernel oopses.

This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
as both of those cut the data down below the NUL termination that must be
included in the data.  Without this dns_resolver_instantiate() will return
-EINVAL and the key will not be instantiated such that it can be read.

The oops looks like:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [] user_read+0x4f/0x8f
PGD 3bdf8067 PUD 385b9067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
CPU 0
Modules linked in:

Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468                  /DG965RY
RIP: 0010:[]  [] user_read+0x4f/0x8f
RSP: 0018:ffff88003bf47f08  EFLAGS: 00010246
RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378
RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000
R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1
FS:  00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)
Stack:
 ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
 ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
 00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
Call Trace:
 [] keyctl_read_key+0xac/0xcf
 [] sys_keyctl+0x75/0xb6
 [] system_call_fastpath+0x16/0x1b
Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
RIP  [] user_read+0x4f/0x8f
 RSP 
CR2: 0000000000000010

Signed-off-by: David Howells 
Acked-by: Jeff Layton 
cc: Wang Lei 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead

2011-03-07T23:05:26+00:00

commit 4def99bbfd46e05c5e03b5b282cb4ee30e27ff19 upstream.

When support for 82577/82578 was added[1] in 2.6.31, PHY wakeup was in-
advertently enabled (even though it does not function properly) on ICH10
LOMs.  This patch makes it so that the ICH10 LOMs use MAC wakeup instead
as was done with the initial support for those devices (i.e. 82567LM-3,
82567LF-3 and 82567V-4).

[1] commit a4f58f5455ba0efda36fb33c37074922d1527a10

Reported-by: Aurelien Jarno 
Signed-off-by: Bruce Allan 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman

dccp: fix oops on Reset after close

2011-03-07T23:05:26+00:00

commit 720dc34bbbe9493c7bd48b2243058b4e447a929d upstream.

This fixes a bug in the order of dccp_rcv_state_process() that still permitted
reception even after closing the socket. A Reset after close thus causes a NULL
pointer dereference by not preventing operations on an already torn-down socket.

 dccp_v4_do_rcv()
	|
	| state other than OPEN
	v
 dccp_rcv_state_process()
	|
	| DCCP_PKT_RESET
	v
 dccp_rcv_reset()
	|
	v
 dccp_time_wait()

 WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()
 Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah
 [] (unwind_backtrace+0x0/0xec) from [] (warn_slowpath_common)
 [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_n)
 [] (warn_slowpath_null+0x1c/0x24) from [] (__inet_twsk_hashd)
 [] (__inet_twsk_hashdance+0x48/0x128) from [] (dccp_time_wai)
 [] (dccp_time_wait+0x40/0xc8) from [] (dccp_rcv_state_proces)
 [] (dccp_rcv_state_process+0x120/0x538) from [] (dccp_v4_do_)
 [] (dccp_v4_do_rcv+0x11c/0x14c) from [] (release_sock+0xac/0)
 [] (release_sock+0xac/0x110) from [] (dccp_close+0x28c/0x380)
 [] (dccp_close+0x28c/0x380) from [] (inet_release+0x64/0x70)

The fix is by testing the socket state first. Receiving a packet in Closed state
now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.

Reported-and-tested-by: Johan Hovold 
Signed-off-by: Gerrit Renker 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

r8169: disable ASPM

2011-03-07T23:05:26+00:00

commit ba04c7c93bbcb48ce880cf75b6e9dffcd79d4c7b upstream.

For some time is known that ASPM is causing troubles on r8169, i.e. make
device randomly stop working without any errors in dmesg.

Currently Tomi Leppikangas reports that system with r8169 device hangs
with MCE errors when ASPM is enabled:
https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4

Lets disable ASPM for r8169 devices at all, to avoid problems with
r8169 PCIe devices at least for some users.

Reported-by: Tomi Leppikangas 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

carl9170: add Airlive X.USB a/b/g/n USBID

2011-03-07T23:05:25+00:00

commit c86664e5a285af1afa06416e450e7c4af04daa7c upstream.

"AirLive X.USB now works perfectly under a Linux
environment!"

Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix regression that i-flag is not set on changeless checkpoints

2011-03-07T23:05:25+00:00

commit 72746ac643928f6c3113b5aa783d8ea1b13949d2 upstream.

According to the report from Jiro SEKIBA titled "regression in
2.6.37?"  (Message-Id: <8739n8vs1f.wl%jir@sekiba.com>), on 2.6.37 and
later kernels, lscp command no longer displays "i" flag on checkpoints
that snapshot operations or garbage collection created.

This is a regression of nilfs2 checkpointing function, and it's
critical since it broke behavior of a part of nilfs2 applications.
For instance, snapshot manager of TimeBrowse gets to create
meaningless snapshots continuously; snapshot creation triggers another
checkpoint, but applications cannot distinguish whether the new
checkpoint contains meaningful changes or not without the i-flag.

This patch fixes the regression and brings that application behavior
back to normal.

Reported-by: Jiro SEKIBA 
Signed-off-by: Ryusuke Konishi 
Tested-by: Ryusuke Konishi 
Tested-by: Jiro SEKIBA 
Signed-off-by: Greg Kroah-Hartman

p54usb: add Senao NUB-350 usbid

2011-03-07T23:05:24+00:00

commit 2b799a6b25bb9f9fbc478782cd9503e8066ab618 upstream.

Reported-by: Mark Davis
Signed-off-by: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

ath9k_htc: Fix an endian issue

2011-03-07T23:05:24+00:00

commit 2c27392dc4d4f5ee8a3967a520b8f6cac0418031 upstream.

The stream length/tag fields have to be in little endian
format. Fixing this makes the driver work on big-endian
platforms.

Tested-by: raghunathan.kailasanathan@wipro.com
Signed-off-by: Sujith Manoharan 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman