linux-toradex.git, branch v2.6.38.5

Linux 2.6.38.5

2011-05-02T16:30:53+00:00

Input: xen-kbdfront - fix mouse getting stuck after save/restore

2011-05-02T16:19:50+00:00

commit c36b58e8a9112017c2bcc322cc98e71241814303 upstream.

Mouse gets "stuck" after restore of PV guest but buttons are in working
condition.

If driver has been configured for ABS coordinates at start it will get
XENKBD_TYPE_POS events and then suddenly after restore it'll start getting
XENKBD_TYPE_MOTION events, that will be dropped later and they won't get
into user-space.

Regression was introduced by hunk 5 and 6 of
5ea5254aa0ad269cfbd2875c973ef25ab5b5e9db
("Input: xen-kbdfront - advertise either absolute or relative
coordinates").

Driver on restore should ask xen for request-abs-pointer again if it is
available. So restore parts that did it before 5ea5254.

Acked-by: Olaf Hering 
Signed-off-by: Igor Mammedov 
[v1: Expanded the commit description]
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Dmitry Torokhov

iwlegacy: fix tx_power initialization

2011-05-02T16:19:49+00:00

commit 332704a51498a7e29aa92c19dc03f11f80b71bfe upstream.

priv->tx_power_next is not initialized to max supported power,
but instead default value is used, what cause errors like

[   58.597834] iwl3945 0000:03:00.0: Requested user TXPOWER 15 above upper limit 14.
[   58.597839] iwl3945 0000:03:00.0: Error setting Tx power (-22).

if maximum tx power read from the eeprom is smaller than default.
In consequence card is unable to initialize properly. Fix the problem
and cleanup tx power initialization.

Reported-and-tested-by: Robin Dong 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwl3945: disable hw scan by default

2011-05-02T16:19:49+00:00

commit 0263aa45293838b514b8af674a03faf040991a90 upstream.

After new NetworkManager 0.8.996 changes, hardware scanning is causing
microcode errors as reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=683571
and sometimes kernel crashes:
https://bugzilla.redhat.com/show_bug.cgi?id=688252

Also with hw scan there are very bad performance on some systems
as reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=671366

Since Intel no longer supports 3945, there is no chance to get proper
firmware fixes, we need workaround problems by disable hardware scanning
by default.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwl3945: do not deprecate software scan

2011-05-02T16:19:48+00:00

commit 3bda50e3eaf58a4b9c4ce34204e5faa15c8b1b97 upstream.

Software scanning can be used for workaround some performance problems,
so do not deprecate it.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: do not set tx power when channel is changing

2011-05-02T16:19:48+00:00

commit f844a709a7d8f8be61a571afc31dfaca9e779621 upstream.

Mac80211 can request for tx power and channel change in one ->config
call. If that happens, *_send_tx_power functions will try to setup tx
power for old channel, what can be not correct because we already change
the band. I.e  error  "Failed to get channel info for channel 140 [0]",
can be printed frequently when operating in software scanning mode.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

agp: fix OOM and buffer overflow

2011-05-02T16:19:47+00:00

commit b522f02184b413955f3bc952e3776ce41edc6355 upstream.

page_count is copied from userspace.  agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case.  Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.

Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

agp: fix arbitrary kernel memory writes

2011-05-02T16:19:47+00:00

commit 194b3da873fd334ef183806db751473512af29ce upstream.

pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm: select FRAMEBUFFER_CONSOLE_PRIMARY if we have FRAMEBUFFER_CONSOLE

2011-05-02T16:19:47+00:00

commit bf5192edcbc1f0a7f9c054649dbf1a0b3210d9b7 upstream.

Multi-gpu/switcheroo relies on this option to get the console on the
correct GPU at bootup, some distros enable it but it seems some get
it wrong.

Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

um: mdd support for 64 bit atomic operations

2011-05-02T16:19:46+00:00

commit 57d8e02e3cd21bccf2b84b26b42feb79e1f0f83e upstream.

This adds support for 64 bit atomic operations on 32 bit UML systems.  XFS
needs them since 2.6.38.

  $ make ARCH=um SUBARCH=i386
  ...
    LD      .tmp_vmlinux1
  fs/built-in.o: In function `xlog_regrant_reserve_log_space':
  xfs_log.c:(.text+0xd8584): undefined reference to `atomic64_read_386'
  xfs_log.c:(.text+0xd85ac): undefined reference to `cmpxchg8b_emu'
  ...

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=32812

Reported-by: Martin Walch 
Tested-by: Martin Walch 
Cc: Martin Walch 
Signed-off-by: Richard Weinberger 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman