linux-toradex.git/drivers/isdn, branch v3.0.74

isdn/gigaset: fix zero size border case in debug dump

2013-02-14T18:47:34+00:00

[ Upstream commit d721a1752ba544df8d7d36959038b26bc92bdf80 ]

If subtracting 12 from l leaves zero we'd do a zero size allocation,
leading to an oops later when we try to set the NUL terminator.

Reported-by: Dan Carpenter 
Signed-off-by: Tilman Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bas_gigaset: fix pre_reset handling

2012-12-03T20:59:15+00:00

commit c6fdd8e5d0c65bb8821dc6da26ee1a2ddd58b3cc upstream.

The delayed work function int_in_work() may call usb_reset_device()
and thus, indirectly, the driver's pre_reset method. Trying to
cancel the work synchronously in that situation would deadlock.
Fix by avoiding cancel_work_sync() in the pre_reset method.

If the reset was NOT initiated by int_in_work() this might cause
int_in_work() to run after the post_reset method, with urb_int_in
already resubmitted, so handle that case gracefully.

Signed-off-by: Tilman Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

isdnloop: fix and simplify isdnloop_init()

2012-10-02T16:47:05+00:00

[ Upstream commit 77f00f6324cb97cf1df6f9c4aaeea6ada23abdb2 ]

Fix a buffer overflow bug by removing the revision and printk.

[   22.016214] isdnloop-ISDN-driver Rev 1.11.6.7
[   22.097508] isdnloop: (loop0) virtual card added
[   22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972
[   22.174400]
[   22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129
[   22.624071] Call Trace:
[   22.720558]  [] ? CallcNew+0x56/0x56
[   22.815248]  [] panic+0x110/0x329
[   22.914330]  [] ? isdnloop_init+0xaf/0xb1
[   23.014800]  [] ? CallcNew+0x56/0x56
[   23.090763]  [] __stack_chk_fail+0x2b/0x30
[   23.185748]  [] isdnloop_init+0xaf/0xb1

Signed-off-by: Fengguang Wu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

isdn/gigaset: ratelimit CAPI message dumps

2012-06-01T07:12:53+00:00

commit 8e618aad5348b6e6c5a90e8d97ea643197963b20 upstream.

Introduce a global ratelimit for CAPI message dumps to protect
against possible log flood.
Drop the ratelimit for ignored messages which is now covered by the
global one.

Signed-off-by: Tilman Schmidt 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

2011-08-16T01:31:38+00:00

[ Upstream commit 550fd08c2cebad61c548def135f67aba284c6162 ]

After the last patch, We are left in a state in which only drivers calling
ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real
hardware call ether_setup for their net_devices and don't hold any state in
their skbs.  There are a handful of drivers that violate this assumption of
course, and need to be fixed up.  This patch identifies those drivers, and marks
them as not being able to support the safe transmission of skbs by clearning the
IFF_TX_SKB_SHARING flag in priv_flags

Signed-off-by: Neil Horman 
CC: Karsten Keil 
CC: "David S. Miller" 
CC: Jay Vosburgh 
CC: Andy Gospodarek 
CC: Patrick McHardy 
CC: Krzysztof Halasa 
CC: "John W. Linville" 
CC: Greg Kroah-Hartman 
CC: Marcel Holtmann 
CC: Johannes Berg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

gigaset: call module_put before restart of if_open()

2011-06-17T19:27:32+00:00

if_open() calls try_module_get(), and after an attempt to lock a mutex
the if_open() function may return -ERESTARTSYS without
putting the module.  Then, when if_open() is executed again,
try_module_get() is called making the reference counter of THIS_MODULE
greater than one at successful exit from if_open().  The if_close()
function puts the module only once, and as a result it can't be
unloaded.

This patch adds module_put call before the return from if_open().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Shved 
Signed-off-by: David S. Miller

ISDN, hfcsusb: Don't leak in hfcsusb_ph_info()

2011-06-12T01:59:07+00:00

We leak the memory allocated to 'phi' when the variable goes out of scope
in hfcsusb_ph_info().

Signed-off-by: Jesper Juhl 
Signed-off-by: David S. Miller

Revert "tty: make receive_buf() return the amout of bytes received"

2011-06-03T21:33:24+00:00

This reverts commit b1c43f82c5aa265442f82dba31ce985ebb7aa71c.

It was broken in so many ways, and results in random odd pty issues.

It re-introduced the buggy schedule_work() in flush_to_ldisc() that can
cause endless work-loops (see commit a5660b41af6a: "tty: fix endless
work loop when the buffer fills up").

It also used an "unsigned int" return value fo the ->receive_buf()
function, but then made multiple functions return a negative error code,
and didn't actually check for the error in the caller.

And it didn't actually work at all.  BenH bisected down odd tty behavior
to it:
  "It looks like the patch is causing some major malfunctions of the X
   server for me, possibly related to PTYs.  For example, cat'ing a
   large file in a gnome terminal hangs the kernel for -minutes- in a
   loop of what looks like flush_to_ldisc/workqueue code, (some ftrace
   data in the quoted bits further down).

   ...

   Some more data: It -looks- like what happens is that the
   flush_to_ldisc work queue entry constantly re-queues itself (because
   the PTY is full ?) and the workqueue thread will basically loop
   forver calling it without ever scheduling, thus starving the consumer
   process that could have emptied the PTY."

which is pretty much exactly the problem we fixed in a5660b41af6a.

Milton Miller pointed out the 'unsigned int' issue.

Reported-by: Benjamin Herrenschmidt 
Reported-by: Milton Miller 
Cc: Stefan Bigler 
Cc: Toby Gray 
Cc: Felipe Balbi 
Cc: Greg Kroah-Hartman 
Cc: Alan Cox 
Signed-off-by: Linus Torvalds

Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6

2011-05-26T20:19:00+00:00

* 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6:
  gfs2: Drop __TIME__ usage
  isdn/diva: Drop __TIME__ usage
  atm: Drop __TIME__ usage
  dlm: Drop __TIME__ usage
  wan/pc300: Drop __TIME__ usage
  parport: Drop __TIME__ usage
  hdlcdrv: Drop __TIME__ usage
  baycom: Drop __TIME__ usage
  pmcraid: Drop __DATE__ usage
  edac: Drop __DATE__ usage
  rio: Drop __DATE__ usage
  scsi/wd33c93: Drop __TIME__ usage
  scsi/in2000: Drop __TIME__ usage
  aacraid: Drop __TIME__ usage
  media/cx231xx: Drop __TIME__ usage
  media/radio-maxiradio: Drop __TIME__ usage
  nozomi: Drop __TIME__ usage
  cyclades: Drop __TIME__ usage

isdn/diva: Drop TIME usage

2011-05-26T08:27:51+00:00

The kernel already prints its build timestamp during boot, no need to
repeat it in random drivers and produce different object files each
time.

Cc: Armin Schindler 
Cc: netdev@vger.kernel.org
Signed-off-by: Michal Marek