linux-toradex.git/drivers/isdn, branch v3.6

mISDN: Fix wrong usage of flush_work_sync while holding locks

2012-09-13T18:58:54+00:00

It is a bad idea to hold a spinlock and call flush_work_sync.
Move the workqueue cleanup outside the spinlock and use cancel_work_sync,
on closing the channel this seems to be the more correct function.
Remove the never used and constant return value of mISDN_freebchannel.

Signed-off-by: Karsten Keil 
Cc: 
Signed-off-by: David S. Miller

mISDN: fix possible memory leak in hfcmulti_init()

2012-09-03T19:37:29+00:00

hc has been allocated in this function and missing free it before
leaving from some error handling cases.

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

mISDN: Bugfix for layer2 fixed TEI mode

2012-08-06T20:22:50+00:00

If a fixed TEI is used, the initial state of the layer 2 statmachine need to be
4 (TEI assigned). This was true only for Point to Point connections, but not
for the other fixed TEIs. It was not found before, because usually only the
TEI 0 is used as fixed TEI for PtP mode, but if you try X31 packet mode
connections with SAPI 16, TEI 1, it did fail.

Signed-off-by: Karsten Keil 
Cc:  # 3.5.x
Signed-off-by: David S. Miller

isdnloop: fix and simplify isdnloop_init()

2012-08-03T23:53:22+00:00

Fix a buffer overflow bug by removing the revision and printk.

[   22.016214] isdnloop-ISDN-driver Rev 1.11.6.7
[   22.097508] isdnloop: (loop0) virtual card added
[   22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972
[   22.174400]
[   22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129
[   22.624071] Call Trace:
[   22.720558]  [] ? CallcNew+0x56/0x56
[   22.815248]  [] panic+0x110/0x329
[   22.914330]  [] ? isdnloop_init+0xaf/0xb1
[   23.014800]  [] ? CallcNew+0x56/0x56
[   23.090763]  [] __stack_chk_fail+0x2b/0x30
[   23.185748]  [] isdnloop_init+0xaf/0xb1

Signed-off-by: Fengguang Wu 
Signed-off-by: David S. Miller

mISDN: Bugfix only few bytes are transfered on a connection

2012-07-30T06:18:30+00:00

The test for the fillempty condition was wrong in one place.
Changed the variable to the right boolean type.

Signed-off-by: Karsten Keil 
Signed-off-by: David S. Miller

ISDN: Add check for usb_alloc_urb() result

2012-07-18T16:40:54+00:00

usb_alloc_urb() return value needs to be checked to avoid
later NULL pointer access.
Reported by rucsoftsec@gmail.com via bugzilla.kernel.org #44601.

Signed-off-by: Karsten Keil 
Signed-off-by: David S. Miller

ISDN: Add check for return value of pnp_activate_dev()

2012-07-18T16:40:54+00:00

pnp_activate_dev() return value needs to be checked to make sure that
following calls calls to the PNP functions do work correctly.
Fix for report #44491 on bugzilla.kernel.org.

Signed-off-by: Karsten Keil 
Signed-off-by: David S. Miller

gigaset: silence GCC warning for unused 'format_ie'

2012-07-17T06:23:53+00:00

Building Gigaset's CAPI support without Gigaset's debugging enabled
triggers this GCC warning:
    'format_ie' defined but not used [-Wunused-function]

Silence this warning by wrapping format_ie() in an "#ifdef
CONFIG_GIGASET_DEBUG" and "#endif" pair.

Signed-off-by: Paul Bolle 
Signed-off-by: David S. Miller

drivers/isdn/mISDN/stack.c: remove invalid reference to list iterator variable

2012-07-09T22:24:33+00:00

If list_for_each_entry, etc complete a traversal of the list, the iterator
variable ends up pointing to an address at an offset from the list head,
and not a meaningful structure.  Thus this value should not be used after
the end of the iterator.  The dereferences are just deleted from the
debugging statement.

This problem was found using Coccinelle (http://coccinelle.lip6.fr/).

Signed-off-by: Julia Lawall 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-05-24T18:54:29+00:00

Pull more networking updates from David Miller:
 "Ok, everything from here on out will be bug fixes."

1) One final sync of wireless and bluetooth stuff from John Linville.
   These changes have all been in his tree for more than a week, and
   therefore have had the necessary -next exposure.  John was just away
   on a trip and didn't have a change to send the pull request until a
   day or two ago.

2) Put back some defines in user exposed header file areas that were
   removed during the tokenring purge.  From Stephen Hemminger and Paul
   Gortmaker.

3) A bug fix for UDP hash table allocation got lost in the pile due to
   one of those "you got it..  no I've got it.." situations.  :-)

   From Tim Bird.

4) SKB coalescing in TCP needs to have stricter checks, otherwise we'll
   try to coalesce overlapping frags and crash.  Fix from Eric Dumazet.

5) RCU routing table lookups can race with free_fib_info(), causing
   crashes when we deref the device pointers in the route.  Fix by
   releasing the net device in the RCU callback.  From Yanmin Zhang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (293 commits)
  tcp: take care of overlaps in tcp_try_coalesce()
  ipv4: fix the rcu race between free_fib_info and ip_route_output_slow
  mm: add a low limit to alloc_large_system_hash
  ipx: restore token ring define to include/linux/ipx.h
  if: restore token ring ARP type to header
  xen: do not disable netfront in dom0
  phy/micrel: Fix ID of KSZ9021
  mISDN: Add X-Tensions USB ISDN TA XC-525
  gianfar:don't add FCB length to hard_header_len
  Bluetooth: Report proper error number in disconnection
  Bluetooth: Create flags for bt_sk()
  Bluetooth: report the right security level in getsockopt
  Bluetooth: Lock the L2CAP channel when sending
  Bluetooth: Restore locking semantics when looking up L2CAP channels
  Bluetooth: Fix a redundant and problematic incoming MTU check
  Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
  Bluetooth: Fix EIR data generation for mgmt_device_found
  Bluetooth: Fix Inquiry with RSSI event mask
  Bluetooth: improve readability of l2cap_seq_list code
  Bluetooth: Fix skb length calculation
  ...