linux-toradex.git/drivers, branch v2.6.31.4

appletalk: Fix skb leak when ipddp interface is not loaded

2009-10-12T19:40:29+00:00

[ Upstream commit ffcfb8db540ff879c2a85bf7e404954281443414 ]

And also do a better job of returning proper NET_{RX,XMIT}_ values.

Based on a patch by Mark Smith.

This fixes CVE-2009-2903

Reported-by: Mark Smith 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman

sky2: Set SKY2_HW_RAM_BUFFER in sky2_init

2009-10-12T19:40:28+00:00

[ Upstream commit 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 ]

The SKY2_HW_RAM_BUFFER bit in hw->flags was checked in sky2_mac_init(),
 before being set later in sky2_up().

Setting SKY2_HW_RAM_BUFFER in sky2_init() where other hw->flags are set
 should avoid this problem recurring.

Signed-off-by: Mike McCormack 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

smsc95xx: fix transmission where ZLP is expected

2009-10-12T19:40:28+00:00

[ Upstream commit ec4756238239f1a331d9fb95bad8b281dad56855 ]

Usbnet framework assumes USB hardware doesn't handle zero length
packets, but SMSC LAN95xx requires these to be sent for correct
operation.

This patch fixes an easily reproducible tx lockup when sending a frame
that results in exactly 512 bytes in a USB transmission (e.g. a UDP
frame with 458 data bytes, due to IP headers and our USB headers).  It
adds an extra flag to usbnet for the hardware driver to indicate that
it can handle and requires the zero length packets.

This patch should not affect other usbnet users, please also consider
for -stable.

Signed-off-by: Steve Glendinning 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tun: Return -EINVAL if neither IFF_TUN nor IFF_TAP is set.

2009-10-12T19:40:26+00:00

[ Upstream commit 36989b90879c785f95b877bdcf65a2527dadd893 ]

After commit 2b980dbd77d229eb60588802162c9659726b11f4
("lsm: Add hooks to the TUN driver") tun_set_iff doesn't
return -EINVAL though neither IFF_TUN nor IFF_TAP is set.

Signed-off-by: Kusanagi Kouichi 
Reviewed-by: Paul Moore 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ACPI: Clarify resource conflict message

2009-10-12T19:40:22+00:00

commit 14f03343ad1080c2fea29ab2c13f05b976c4584e upstream.

The message "ACPI: Device needs an ACPI driver" is misleading. The
device _may_ need an ACPI driver, if the BIOS implemented a custom
API for the device in question (which, AFAIK, can't be checked.) If
not, then either a generic ACPI driver may be used (for example
"thermal"), or nothing can be done (other than a white list).

I propose to reword the message to:

ACPI: If an ACPI driver is available for this device, you should use
it instead of the native driver

which I think is more correct. Comments and suggestions welcome.

I also added a message warning about possible problems and system
instability when users pass acpi_enforce_resources=lax, as suggested
by Len.

Signed-off-by: Jean Delvare 
Cc: Thomas Renninger 
Cc: Alan Jenkins 
Signed-off-by: Len Brown 
Signed-off-by: Greg Kroah-Hartman

sis5513: fix PIO setup for ATAPI devices

2009-10-12T19:40:21+00:00

commit e13ee546bb06453939014c7b854e77fb643fd6f1 upstream.

Clear prefetch setting before potentially (re-)enabling it in
config_drive_art_rwp() so the transition of the device type on
the port from ATA to ATAPI (i.e. during warm-plug operation)
is handled correctly.

This is a really old bug (it probably goes back to very early
days of the driver) but it was only affecting warm-plug operation
until the recent "ide: try to use PIO Mode 0 during probe if
possible" change (commit 6029336426a2b43e4bc6f4a84be8789a047d139e).

Signed-off-by: Bartlomiej Zolnierkiewicz 
Tested-by: David Fries 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: Fix wrong sizeof

2009-10-12T19:40:20+00:00

commit b607bd900051efc3308c4edc65dd98b34b230021 upstream.

Which is why I have always preferred sizeof(struct foo) over
sizeof(var).

Signed-off-by: Jean Delvare 
Acked-by: Randy Dunlap 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

libata: fix incorrect link online check during probe

2009-10-12T19:40:14+00:00

commit 3b761d3d437cffcaf160a5d37eb6b3b186e491d5 upstream.

While trying to work around spurious detection retries for
non-existent devices on slave links, commit
816ab89782ac139a8b65147cca990822bb7e8675 incorrectly added link
offline check logic before ata_eh_thaw() was called.  This means that
if an occupied link goes down briefly at the time that offline check
was performed, device class will be cleared to ATA_DEV_NONE and libata
wouldn't retry thus failing detection of the device.

The offline check should be done after the port is thawed together
with online check so that such link glitches can be detected by the
interrupt handler and handled properly.

Signed-off-by: Tejun Heo 
Reported-by: Tim Blechmann 
Signed-off-by: Jeff Garzik 
Signed-off-by: Greg Kroah-Hartman

tty: Avoid dropping ldisc_mutex over hangup tty re-initialization

2009-10-12T19:40:05+00:00

commit 0b5759c654e74c8dc317ea2c6b3a7476160f688a upstream.

A couple of people have hit the WARN_ON() in drivers/char/tty_io.c,
tty_open() that is unhappy about seeing the tty line discipline go away
during the tty hangup. See for example

	http://bugzilla.kernel.org/show_bug.cgi?id=14255

and the reason is that we do the tty_ldisc_halt() outside the
ldisc_mutex in order to be able to flush the scheduled work without a
deadlock with vhangup_work.

However, it turns out that we can solve this particular case by

 - using "cancel_delayed_work_sync()" in tty_ldisc_halt(), which waits
   for just the particular work, rather than synchronizing with any
   random outstanding pending work.

   This won't deadlock, since the buf.work we synchronize with doesn't
   care about the ldisc_mutex, it just flushes the tty ldisc buffers.

 - realize that for this particular case, we don't need to wait for any
   hangup work, because we are inside the hangup codepaths ourselves.

so as a result we can just drop the flush_scheduled_work() entirely, and
then move the tty_ldisc_halt() call to inside the mutex.  That way we
never expose the partially torn down ldisc state to tty_open(), and hold
the ldisc_mutex over the whole sequence.

Reported-by: Ingo Molnar 
Reported-by: Heinz Diehl 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

TTY: fix typos

2009-10-07T21:30:44+00:00

commit 1f5c13fad4ec5617b610e12205902c06298c096a upstream.

This patch (as1282) fixes some obvious typos in the TTY core.

Signed-off-by: Alan Stern 
CC: Alan Cox 
Signed-off-by: Greg Kroah-Hartman