linux-toradex.git/drivers, branch v2.6.32.40

fix oops in scsi_run_queue()

2011-05-09T22:55:42+00:00

commit c055f5b2614b4f758ae6cc86733f31fa4c2c5844 upstream.

The recent commit closing the race window in device teardown:

commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b
Author: James Bottomley 
Date:   Fri Apr 22 10:39:59 2011 -0500

    [SCSI] put stricter guards on queue dead checks

is causing a potential NULL deref in scsi_run_queue() because the
q->queuedata may already be NULL by the time this function is called.
Since we shouldn't be running a queue that is being torn down, simply
add a NULL check in scsi_run_queue() to forestall this.

Tested-by: Jim Schutt 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

iwlwifi: fix skb usage after free

2011-05-09T22:55:41+00:00

commit b25026981aecde3685dd0e45ad980fff9f528daa upstream.

Since

commit a120e912eb51e347f36c71b60a1d13af74d30e83
Author: Stanislaw Gruszka 
Date:   Fri Feb 19 15:47:33 2010 -0800

    iwlwifi: sanity check before counting number of tfds can be free

we use skb->data after calling ieee80211_tx_status_irqsafe(), which
could free skb instantly.

On current kernels I do not observe practical problems related with
bug, but on 2.6.35.y it cause random system hangs when stressing
wireless link.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Wey-Yi Guy 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

usb: musb: core: set has_tt flag

2011-05-09T22:55:41+00:00

commit ec95d35a6bd0047f05fe8a21e6c52f8bb418da55 upstream.

MUSB is a non-standard host implementation which
can handle all speeds with the same core. We need
to set has_tt flag after commit
d199c96d41d80a567493e12b8e96ea056a1350c1 (USB: prevent
buggy hubs from crashing the USB stack) in order for
MUSB HCD to continue working.

Signed-off-by: Felipe Balbi 
Cc: Alan Stern 
Tested-by: Michael Jones 
Tested-by: Alexander Holler 
Signed-off-by: Greg Kroah-Hartman

libata: set queue DMA alignment to sector size for ATAPI too

2011-05-09T22:55:41+00:00

commit 729a6a300e628a48cf12bac93a964a535e83cd1d upstream.

ata_pio_sectors() expects buffer for each sector to be contained in a
single page; otherwise, it ends up overrunning the first page.  This
is achieved by setting queue DMA alignment.  If sector_size is smaller
than PAGE_SIZE and all buffers are sector_size aligned, buffer for
each sector is always contained in a single page.

This wasn't applied to ATAPI devices but IDENTIFY_PACKET is executed
as ATA_PROT_PIO and thus uses ata_pio_sectors().  Newer versions of
udev issue IDENTIFY_PACKET with unaligned buffer triggering the
problem and causing oops.

This patch fixes the problem by setting sdev->sector_size to
ATA_SECT_SIZE on ATATPI devices and always setting DMA alignment to
sector_size.  While at it, add a warning for the unlikely but still
possible scenario where sector_size is larger than PAGE_SIZE, in which
case the alignment wouldn't be enough.

Signed-off-by: Tejun Heo 
Reported-by: John Stanley 
Tested-by: John Stanley 
Signed-off-by: Jeff Garzik 
Signed-off-by: Jonathan Liu 
Signed-off-by: Greg Kroah-Hartman

wireless: b43: fix error path in SDIO

2011-05-09T22:55:40+00:00

commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream.

Fix unbalanced call to sdio_release_host() on the error path.

Signed-off-by: Guennadi Liakhovetski 
Acked-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

tehuti: Firmware filename is tehuti/bdx.bin

2011-05-09T22:55:40+00:00

commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 upstream.

My conversion of tehuti to use request_firmware() was confused about
the filename of the firmware blob.  Change the driver to match the
blob.

Signed-off-by: Ben Hutchings 
Signed-off-by: Andy Gospodarek 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

sata_via: Delay on vt6420 when starting ATAPI DMA write

2011-05-09T22:55:40+00:00

commit a55ab496ea9c820b7192c15ef1fbf3291edfe638 upstream.

When writing a disc on certain lite-on dvd-writers (also rebadged
as optiarc/LG/...) connected to a vt6420, the ATAPI CDB ends
up in the datastream and on the disc, causing silent corruption.
Delaying between sending the CDB and starting DMA seems to
prevent this.

I do not know if there are burners that do not suffer from
this, but the patch should be safe for those as well.

There are many reports of this issue, but AFAICT no solution was
found before. For example:
http://lkml.indiana.edu/hypermail/linux/kernel/0802.3/0561.html

Signed-off-by: Bart Hartgers 
Signed-off-by: Jeff Garzik 
[bwh: Remove version bump for 2.6.32]
Signed-off-by: Greg Kroah-Hartman

rt2500usb: fallback to SW encryption for TKIP+AES

2011-05-09T22:55:40+00:00

commit 75f64dd54a185150ebfc45e99351c890d4a2252f upstream.

HW crypto in rt2500usb does not seem to support keys with different ciphers,
which breaks TKIP+AES mode. Fall back to software encryption to fix it.

This should fix long-standing problems with rt2500usb and WPA, such as:
http://rt2x00.serialmonkey.com/phpBB/viewtopic.php?f=4&t=4834
https://bugzilla.redhat.com/show_bug.cgi?id=484888

Also tested that it does not break WEP, TKIP-only and AES-only modes.

Signed-off-by: Ondrej Zary 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville 
[bwh: Adjust context for 2.6.32]
Signed-off-by: Greg Kroah-Hartman

niu: Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL

2011-05-09T22:55:39+00:00

commit ee9c5cfad29c8a13199962614b9b16f1c4137ac9 upstream.

niu_get_ethtool_tcam_all() assumes that its output buffer is the right
size, and warns before returning if it is not.  However, the output
buffer size is under user control and ETHTOOL_GRXCLSRLALL is an
unprivileged ethtool command.  Therefore this is at least a local
denial-of-service vulnerability.

Change it to check before writing each entry and to return an error if
the buffer is already full.

Compile-tested only.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
[Adjusted to apply to 2.6.32 by dann frazier ]
Signed-off-by: Greg Kroah-Hartman

mpt2sas: fix the incorrect scsi_dma_map error checking

2011-05-09T22:55:39+00:00

commit bb789d01620e5d36081b22edb6fb71cf55ff043c upstream.

scsi_dma_map() returns -1 if an error occurred (zero means that the
command has no data). So the following current code can't catch an
error:

sges_left = scsi_dma_map(scmd);
if (!sges_left) {
	sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
	" failed: request for %d bytes!\n", scsi_bufflen(scmd));
	return -ENOMEM;
}

Signed-off-by: FUJITA Tomonori 
Acked-by: "Kashyap Desai" 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman