linux-toradex.git/include, branch v2.6.31.7

netfilter: nf_nat: fix NAT issue in 2.6.30.4+

2009-12-08T18:22:33+00:00

commit f9dd09c7f7199685601d75882447a6598be8a3e0 upstream.

Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work
over NAT. The "cause" of the problem was a fix of unacknowledged data
detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272).
However, actually, that fix uncovered a long standing bug in TCP conntrack:
when NAT was enabled, we simply updated the max of the right edge of
the segments we have seen (td_end), by the offset NAT produced with
changing IP/port in the data. However, we did not update the other parameter
(td_maxend) which is affected by the NAT offset. Thus that could drift
away from the correct value and thus resulted breaking active FTP.

The patch below fixes the issue by *not* updating the conntrack parameters
from NAT, but instead taking into account the NAT offsets in conntrack in a
consistent way. (Updating from NAT would be more harder and expensive because
it'd need to re-calculate parameters we already calculated in conntrack.)

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: fix sk_forward_alloc corruption

2009-12-08T18:22:01+00:00

[ Upstream commit: 9d410c796067686b1e032d54ce475b7055537138 ]

On UDP sockets, we must call skb_free_datagram() with socket locked,
or risk sk_forward_alloc corruption. This requirement is not respected
in SUNRPC.

Add a convenient helper, skb_free_datagram_locked() and use it in SUNRPC

Reported-by: Francis Moreau 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mac80211: fix spurious delBA handling

2009-12-08T18:21:44+00:00

commit 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 upstream.

Lennert Buytenhek noticed that delBA handling in mac80211
was broken and has remotely triggerable problems, some of
which are due to some code shuffling I did that ended up
changing the order in which things were done -- this was

  commit d75636ef9c1af224f1097941879d5a8db7cd04e5
  Author: Johannes Berg 
  Date:   Tue Feb 10 21:25:53 2009 +0100

    mac80211: RX aggregation: clean up stop session

and other parts were already present in the original

  commit d92684e66091c0f0101819619b315b4bb8b5bcc5
  Author: Ron Rindjunsky 
  Date:   Mon Jan 28 14:07:22 2008 +0200

      mac80211: A-MPDU Tx add delBA from recipient support

The first problem is that I moved a BUG_ON before various
checks -- thereby making it possible to hit. As the comment
indicates, the BUG_ON can be removed since the ampdu_action
callback must already exist when the state is != IDLE.

The second problem isn't easily exploitable but there's a
race condition due to unconditionally setting the state to
OPERATIONAL when a delBA frame is received, even when no
aggregation session was ever initiated. All the drivers
accept stopping the session even then, but that opens a
race window where crashes could happen before the driver
accepts it. Right now, a WARN_ON may happen with non-HT
drivers, while the race opens only for HT drivers.

For this case, there are two things necessary to fix it:
 1) don't process spurious delBA frames, and be more careful
    about the session state; don't drop the lock

 2) HT drivers need to be prepared to handle a session stop
    even before the session was really started -- this is
    true for all drivers (that support aggregation) but
    iwlwifi which can be fixed easily. The other HT drivers
    (ath9k and ar9170) are behaving properly already.

Reported-by: Lennert Buytenhek 
Signed-off-by: Johannes Berg 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

PM / yenta: Split resume into early and late parts (rev. 4)

2009-11-10T00:23:17+00:00

commit 9905d1b411946fb3fb228e8c6529fd94afda8a92 upstream.

Commit 0c570cdeb8fdfcb354a3e9cd81bfc6a09c19de0c
(PM / yenta: Fix cardbus suspend/resume regression) caused resume to
fail on systems with two CardBus bridges.  While the exact nature
of the failure is not known at the moment, it can be worked around by
splitting the yenta resume into an early part, executed during the
early phase of resume, that will only resume the socket and power it
up if there was a card in it during suspend, and a late part,
executed during "regular" resume, that will carry out all of the
remaining yenta resume operations.

Fixes http://bugzilla.kernel.org/show_bug.cgi?id=14334, which is a
listed regression from 2.6.31.

Signed-off-by: Rafael J. Wysocki 
Acked-by: Dominik Brodowski 
Reported-by: Stephen J. Gowdy 
Tested-by: Jose Marino 
Signed-off-by: Greg Kroah-Hartman

powerpc: Fix some late PowerMac G5 with PCIe ATI graphics

2009-11-10T00:23:15+00:00

commit cede3930f0ca6fef353fa01306c72a01420bd45e upstream.

A misconfiguration by the firmware of the U4 PCIe bridge on PowerMac G5
with the U4 bridge (latest generations, may also affect the iMac G5
"iSight") is causing us to re-assign the PCI BARs of the video card,
which can get it out of sync with the firmware, thus breaking offb.

This works around it by fixing up the bridge configuration properly
at boot time. It also fixes a bug where the firmware provides us with
an incorrect set of accessible regions in the device-tree.

Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: Greg Kroah-Hartman

drm/i915: add B43 chipset support

2009-11-10T00:22:38+00:00

commit 7839c5d5519b6d9e2ccf3cdbf1c39e3817ad0835 upstream.

Signed-off-by: Fabian Henze 
Signed-off-by: Zhenyu Wang 
Signed-off-by: Eric Anholt 
Signed-off-by: Greg Kroah-Hartman

param: fix lots of bugs with writing charp params from sysfs, by leaking mem.

2009-11-10T00:22:17+00:00

commit 65afac7d80ab3bc9f81e75eafb71eeb92a3ebdef upstream.

e180a6b7759a "param: fix charp parameters set via sysfs" fixed the case
where charp parameters written via sysfs were freed, leaving drivers
accessing random memory.

Unfortunately, storing a flag in the kparam struct was a bad idea: it's
rodata so setting it causes an oops on some archs.  But that's not all:

1) module_param_array() on charp doesn't work reliably, since we use an
   uninitialized temporary struct kernel_param.
2) there's a fundamental race if a module uses this parameter and then
   it's changed: they will still access the old, freed, memory.

The simplest fix (ie. for 2.6.32) is to never free the memory.  This
prevents all these problems, at cost of a memory leak.  In practice, there
are only 18 places where a charp is writable via sysfs, and all are
root-only writable.

Reported-by: Takashi Iwai 
Cc: Sitsofe Wheeler 
Cc: Frederic Weisbecker 
Cc: Christof Schmitt 
Signed-off-by: Rusty Russell 
Signed-off-by: Greg Kroah-Hartman

8250_pci: add IBM Saturn serial card

2009-11-10T00:22:13+00:00

commit c68d2b1594548cda7f6dbac6a4d9d30a9b01558c upstream.

The IBM Saturn serial card has only one port. Without that fixup,
the kernel thinks it has two, which confuses userland setup and
admin tools as well.

[akpm@linux-foundation.org: fix pci-ids.h layout]
Signed-off-by: Benjamin Herrenschmidt 
Acked-by: Alan Cox 
Cc: Michael Reed 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Acked-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

connector: Removed the destruct_data callback since it is always kfree_skb()

2009-10-22T22:11:55+00:00

(cherry picked from commit f4b5129f5e838942f759c2637967441cf4a98c20)

Signed-off-by: Philipp Reisner 
Acked-by: Lars Ellenberg 
Acked-by: Evgeniy Polyakov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

connector: Provide the sender's credentials to the callback

2009-10-22T22:11:55+00:00

commit 7069331dbe7155f23966f5944109f909fea0c7e4 upstream

Signed-off-by: Philipp Reisner 
Signed-off-by: Lars Ellenberg 
Acked-by: Evgeniy Polyakov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman