linux-toradex.git/include, branch v2.6.16.50 Linux kernel for Apalis and Colibri modules [IPV6]: Disallow RH0 by default (CVE-2007-2242) 2007-04-30T23:31:47+00:00 Adrian Bunk bunk@stusta.de 2007-04-30T23:31:47+00:00 5225791117b564cd8b5683cf82d9eea45b0f0d59 A security issue is emerging. Disallow Routing Header Type 0 by default as we have been doing for IPv4. This version already includes a fix for the original patch. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
A security issue is emerging.  Disallow Routing Header Type 0 by default
as we have been doing for IPv4.

This version already includes a fix for the original patch.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
V4L: saa7146: Fix allocation of clipping memory 2007-04-13T20:58:25+00:00 Oliver Endriss o.endriss@gmx.de 2007-04-13T19:23:49+00:00 2d51ccdd501e620b3c323f4df3f07a6e5d03ea6d Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become very large for PAGE_SIZE > 4K. In fact, the number of clipping windows is limited to 16, and calculate_clipping_registers_rect() does not use more than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly. (cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799) Thanks-to: Olaf Hering <olaf@aepfle.de> Signed-off-by: Oliver Endriss <o.endriss@gmx.de> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become
very large for PAGE_SIZE > 4K.

In fact, the number of clipping windows is limited to 16,
and calculate_clipping_registers_rect() does not use more
than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly.

(cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799)

Thanks-to: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
fix MTIME_SEC_MAX on 32-bit 2007-04-08T22:54:30+00:00 Thomas Gleixner tglx@linutronix.de 2007-04-08T22:54:30+00:00 19b5054d01f856a189659a59b24c8497b038cb43 The maximum seconds value we can handle on 32bit is LONG_MAX. Signed-off-by: Adrian Bunk <bunk@stusta.de> 
The maximum seconds value we can handle on 32bit is LONG_MAX.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
prevent timespec/timeval to ktime_t overflow 2007-04-08T22:03:30+00:00 Thomas Gleixner tglx@linutronix.de 2007-04-08T22:03:30+00:00 812b03dc31229847825989f5e35359a7c4dff6f4 Frank v. Waveren pointed out that on 64bit machines the timespec to ktime_t conversion might overflow. This is also true for timeval to time_t conversions. This breaks a "sleep inf" on 64bit machines. While a timespec/timeval with tx.sec = MAX_LONG is valid by specification the internal representation of ktime_t is based on nanoseconds. The conversion of seconds to nanoseconds overflows for seconds values >= (MAX_LONG / NSEC_PER_SEC). Check the seconds argument to the conversion and limit it to the maximum time which can be represented by ktime_t. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Frank v.  Waveren pointed out that on 64bit machines the timespec to
ktime_t conversion might overflow.  This is also true for timeval to
time_t conversions.  This breaks a "sleep inf" on 64bit machines.

While a timespec/timeval with tx.sec = MAX_LONG is valid by specification
the internal representation of ktime_t is based on nanoseconds.  The
conversion of seconds to nanoseconds overflows for seconds values >=
(MAX_LONG / NSEC_PER_SEC).

Check the seconds argument to the conversion and limit it to the maximum
time which can be represented by ktime_t.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[IFB]: Fix crash on input device removal 2007-04-03T02:03:55+00:00 Patrick McHardy kaber@trash.net 2007-04-03T02:03:55+00:00 5f4a9d1b7a413d6aac382c51692ac0df785068c5 The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[ALSA] Fix invalid assignment of PCI revision 2007-03-28T20:32:32+00:00 Takashi Iwai tiwai@suse.de 2007-03-28T20:32:32+00:00 8e617c8834fe2dde4e88ea9c2dcd9530c5b30839 Fix the type of PCI revision to char from int and avoid invalid assignment with pointer cast. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Fix the type of PCI revision to char from int and avoid invalid
assignment with pointer cast.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[NET_SCHED]: Fix endless loops caused by inaccurate qlen counters 2007-03-28T19:31:36+00:00 Patrick McHardy kaber@trash.net 2007-03-28T19:31:36+00:00 39740872332b2dd28b479d9d8333c42c32465953 There are multiple problems related to qlen adjustment that can lead to an upper qdisc getting out of sync with the real number of packets queued, leading to endless dequeueing attempts by the upper layer code. All qdiscs must maintain an accurate q.qlen counter. There are basically two groups of operations affecting the qlen: operations that propagate down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the root qdisc and operations only affecting a subtree or single qdisc (change, graft, delete class). Since qlen changes during operations from the second group don't propagate to ancestor qdiscs, their qlen values become desynchronized. This patch adds a function to propagate qlen changes up the qdisc tree, optionally calling a callback function to perform qdisc-internal maintenance when the child qdisc is deactivated, and converts all qdiscs to use this where necessary. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
There are multiple problems related to qlen adjustment that can lead
to an upper qdisc getting out of sync with the real number of packets
queued, leading to endless dequeueing attempts by the upper layer code.

All qdiscs must maintain an accurate q.qlen counter. There are basically
two groups of operations affecting the qlen: operations that propagate
down the tree (enqueue, dequeue, requeue, drop, reset) beginning at the
root qdisc and operations only affecting a subtree or single qdisc
(change, graft, delete class). Since qlen changes during operations from
the second group don't propagate to ancestor qdiscs, their qlen values
become desynchronized.

This patch adds a function to propagate qlen changes up the qdisc tree,
optionally calling a callback function to perform qdisc-internal
maintenance when the child qdisc is deactivated, and converts all
qdiscs to use this where necessary.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[SERIAL] Fix oops when removing suspended serial port 2007-03-28T19:28:32+00:00 Russell King rmk+kernel@arm.linux.org.uk 2007-03-28T19:28:32+00:00 ef1136fb7497e0ad6b419add0b463c9a770c42ee A serial card might have been removed when the system is resumed. This results in a suspended port being shut down, which results in the ports shutdown method being called twice in a row. This causes BUGs. Avoid this by tracking the suspended state separately from the initialised state. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
A serial card might have been removed when the system is resumed.
This results in a suspended port being shut down, which results in
the ports shutdown method being called twice in a row.  This causes
BUGs.  Avoid this by tracking the suspended state separately from
the initialised state.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
USB Storage: US_FL_MAX_SECTORS_64 flag 2007-03-25T00:54:59+00:00 Phil Dibowitz phil@ipom.com 2007-03-25T00:54:59+00:00 1c4cb21c2d789fa174e8e7d6e0e25f76f29a4cc8 This patch adds a US_FL_MAX_SECTORS_64 and removes the Genesys special-cases for this that were in scsiglue.c. It also adds the flag to other devices reported to need it. Signed-off-by: Phil Dibowitz <phil@ipom.com> Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
This patch adds a US_FL_MAX_SECTORS_64 and removes the Genesys special-cases
for this that were in scsiglue.c. It also adds the flag to other devices
reported to need it.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
NETFILTER: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value 2007-03-24T20:22:57+00:00 Patrick McHardy kaber@trash.net 2007-03-24T20:22:57+00:00 0fbd895ff3731da9b7d7e2f1d182354297747b7b IP_CT_TCP_FLAG_CLOSE_INIT is a flag and should have a value of 0x4 instead of 0x3, which is IP_CT_TCP_FLAG_WINDOW_SCALE | IP_CT_TCP_FLAG_SACK_PERM. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
IP_CT_TCP_FLAG_CLOSE_INIT is a flag and should have a value of 0x4 instead
of 0x3, which is IP_CT_TCP_FLAG_WINDOW_SCALE | IP_CT_TCP_FLAG_SACK_PERM.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>