linux-toradex.git/drivers, branch v2.6.27.39

bonding: fix a race condition in calls to slave MII ioctls

2009-11-10T00:52:45+00:00

commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream.

In mii monitor mode, bond_check_dev_link() calls the the ioctl
handler of slave devices. It stores the ndo_do_ioctl function
pointer to a static (!) ioctl variable and later uses it to call the
handler with the IOCTL macro.

If another thread executes bond_check_dev_link() at the same time
(even with a different bond, which none of the locks prevent), a
race condition occurs. If the two racing slaves have different
drivers, this may result in one driver's ioctl handler being
called with a pointer to a net_device controlled with a different
driver, resulting in unpredictable breakage.

Unless I am overlooking something, the "static" must be a
copy'n'paste error (?).

Signed-off-by: Jiri Bohac 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

appletalk: Fix skb leak when ipddp interface is not loaded (CVE-2009-2903)

2009-11-10T00:52:22+00:00

commit ffcfb8db540ff879c2a85bf7e404954281443414 upstream

appletalk: Fix skb leak when ipddp interface is not loaded

[ backport to 2.6.27 : Chuck Ebbert 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 
Cc: Chuck Ebbert 
Signed-off-by: Greg Kroah-Hartman

tty: Mark generic_serial users as BROKEN

2009-11-10T00:52:18+00:00

commit 412145947adfca60a4b5b4893fbae82dffa25edd upstream.

There isn't much else I can do with these. I can find no hardware for any
of them and no users. The code is broken.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"

2009-11-10T00:52:17+00:00

commit f61f925859c57f6175082aeeee17743c68558a6e upstream.

This reverts commit eab4b645769fa2f8703f5a3cb0cc4ac090d347af.

http://bugzilla.kernel.org/show_bug.cgi?id=13002

Signed-off-by: Len Brown 
Cc: Chuck Ebbert 
Signed-off-by: Greg Kroah-Hartman

ray_cs: Fix copy_from_user handling

2009-11-10T00:52:15+00:00

commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream.

I've not touched the other stuff here but the word "locking" comes to mind.

Signed-off-by: Alan Cox 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

libertas if_usb: Fix crash on 64-bit machines

2009-11-10T00:52:10+00:00

commit e9024a059f2c17fb2bfab212ee9d31511d7b8e57 upstream.

On a 64-bit kernel, skb->tail is an offset, not a pointer. The libertas
usb driver passes it to usb_fill_bulk_urb() anyway, causing interesting
crashes. Fix that by using skb->data instead.

This highlights a problem with usb_fill_bulk_urb(). It doesn't notice
when dma_map_single() fails and return the error to its caller as it
should. In fact it _can't_ currently return the error, since it returns
void.

So this problem was showing up only at unmap time, after we'd already
suffered memory corruption by doing DMA to a bogus address.

Signed-off-by: David Woodhouse 
Acked-by: David S. Miller 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

libata: fix internal command failure handling

2009-11-10T00:52:09+00:00

commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d upstream.

When an internal command fails, it should be failed directly without
invoking EH.  In the original implemetation, this was accomplished by
letting internal command bypass failure handling in ata_qc_complete().
However, later changes added post-successful-completion handling to
that code path and the success path is no longer adequate as internal
command failure path.  One of the visible problems is that internal
command failure due to timeout or other freeze conditions would
spuriously trigger WARN_ON_ONCE() in the success path.

This patch updates failure path such that internal command failure
handling is contained there.

Signed-off-by: Tejun Heo 
Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

Input: synaptics - add another Protege M300 to rate blacklist

2009-11-10T00:52:06+00:00

commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 upstream.

Apparently some of Toshiba Protege M300 identify themselves as
"Portable PC" in DMI so we need to add that to the DMI table as
well. We need DMI data so we can automatically lower Synaptics
reporting rate from 80 to 40 pps to avoid over-taxing their
keyboard controllers.

Tested-by: Rod Davison 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Driver core: fix driver_register() return value

2009-11-10T00:51:59+00:00

commit 39acbc12affcaa23ef1d887ba3d197baca8e6e47 upstream.

In this patch:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=16dc42e018c2868211b4928f20a957c0c216126c
the check was added for another driver to already claim the same device
on the same bus. But the returned error code was wrong: to modprobe, the
-EEXIST means that _this_ driver is already installed. It therefore
doesn't produce the needed error message when _another_ driver is trying
to register for the same device.  Returning -EBUSY fixes the problem.

Signed-off-by: Stas Sergeev 
Signed-off-by: Greg Kroah-Hartman

dpt_i2o: Fix typo of EINVAL

2009-11-10T00:51:57+00:00

commit aefba418bfecd1985a08f50a95bd854a119f0153 upstream.

Commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 ("dpt_i2o: Fix up
copy*user") had a silly typo: EINVAL should be -EINVAL.

Signed-off-by: OGAWA Hirofumi 
Cc: Alan Cox 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman