<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/lib, branch jb4.2.2_1.0.0-ga</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Merge remote branch 'fsl-linux-sdk/imx_3.0.35' into imx_3.0.35_android</title>
<updated>2012-07-25T08:54:33+00:00</updated>
<author>
<name>Xinyu Chen</name>
<email>xinyu.chen@freescale.com</email>
</author>
<published>2012-07-25T08:54:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=10ca2f12149b8c3fde9af51da89736529892dc69'/>
<id>10ca2f12149b8c3fde9af51da89736529892dc69</id>
<content type='text'>
Conflicts:
	arch/arm/configs/imx6_defconfig
	arch/arm/configs/imx6_updater_defconfig
	arch/arm/configs/imx6s_defconfig
	arch/arm/include/asm/dma-mapping.h
	arch/arm/kernel/smp.c
	arch/arm/mach-mx6/Kconfig
	arch/arm/mach-mx6/board-mx6dl_arm2.h
	arch/arm/mach-mx6/board-mx6dl_sabresd.h
	arch/arm/mach-mx6/board-mx6q_arm2.c
	arch/arm/mach-mx6/board-mx6q_arm2.h
	arch/arm/mach-mx6/board-mx6q_sabreauto.c
	arch/arm/mach-mx6/board-mx6q_sabreauto.h
	arch/arm/mach-mx6/board-mx6q_sabrelite.c
	arch/arm/mach-mx6/board-mx6q_sabresd.c
	arch/arm/mach-mx6/board-mx6q_sabresd.h
	arch/arm/mach-mx6/board-mx6sl_arm2.c
	arch/arm/mach-mx6/board-mx6sl_arm2.h
	arch/arm/mach-mx6/board-mx6solo_sabreauto.h
	arch/arm/mach-mx6/bus_freq.c
	arch/arm/mach-mx6/clock.c
	arch/arm/mach-mx6/clock_mx6sl.c
	arch/arm/mach-mx6/cpu.c
	arch/arm/mach-mx6/crm_regs.h
	arch/arm/mach-mx6/devices-imx6q.h
	arch/arm/mach-mx6/devices.c
	arch/arm/mach-mx6/mx6_anatop_regulator.c
	arch/arm/mach-mx6/pcie.c
	arch/arm/mach-mx6/system.c
	arch/arm/mm/dma-mapping.c
	arch/arm/plat-mxc/devices/Makefile
	arch/arm/plat-mxc/devices/platform-imx-dcp.c
	arch/arm/plat-mxc/devices/platform-imx-ocotp.c
	arch/arm/plat-mxc/devices/platform-imx-rngb.c
	arch/arm/plat-mxc/devices/platform-mxc_hdmi.c
	arch/arm/plat-mxc/include/mach/devices-common.h
	arch/arm/plat-mxc/include/mach/esdhc.h
	arch/arm/plat-mxc/include/mach/iomux-mx6dl.h
	arch/arm/plat-mxc/include/mach/iomux-mx6q.h
	arch/arm/plat-mxc/include/mach/memory.h
	arch/arm/plat-mxc/include/mach/mx6.h
	arch/arm/plat-mxc/include/mach/mxc_edid.h
	arch/arm/plat-mxc/include/mach/mxc_hdmi.h
	arch/arm/plat-mxc/system.c
	drivers/Kconfig
	drivers/char/hw_random/fsl-rngc.c
	drivers/cpufreq/Makefile
	drivers/cpufreq/cpufreq_interactive.c
	drivers/crypto/Kconfig
	drivers/crypto/caam/caamalg.c
	drivers/crypto/caam/compat.h
	drivers/crypto/caam/ctrl.c
	drivers/crypto/caam/desc_constr.h
	drivers/crypto/caam/intern.h
	drivers/crypto/dcp.c
	drivers/dma/pch_dma.c
	drivers/input/keyboard/gpio_keys.c
	drivers/input/touchscreen/egalax_ts.c
	drivers/input/touchscreen/max11801_ts.c
	drivers/media/video/mxc/capture/Kconfig
	drivers/media/video/mxc/capture/adv7180.c
	drivers/media/video/mxc/capture/ipu_csi_enc.c
	drivers/media/video/mxc/capture/ipu_prp_vf_sdc.c
	drivers/media/video/mxc/capture/ipu_prp_vf_sdc_bg.c
	drivers/media/video/mxc/capture/mxc_v4l2_capture.c
	drivers/media/video/mxc/capture/ov5640_mipi.c
	drivers/media/video/mxc/output/mxc_vout.c
	drivers/misc/Kconfig
	drivers/misc/Makefile
	drivers/mmc/card/block.c
	drivers/mmc/core/mmc.c
	drivers/mmc/host/mmci.c
	drivers/mmc/host/sdhci-esdhc-imx.c
	drivers/mmc/host/sdhci.c
	drivers/mmc/host/sdhci.h
	drivers/mxc/Kconfig
	drivers/mxc/Makefile
	drivers/mxc/asrc/mxc_asrc.c
	drivers/mxc/gpu-viv/arch/XAQ2/hal/kernel/gc_hal_kernel_context.c
	drivers/mxc/gpu-viv/arch/XAQ2/hal/kernel/gc_hal_kernel_hardware.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h
	drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c
	drivers/mxc/ipu3/ipu_device.c
	drivers/mxc/vpu/mxc_vpu.c
	drivers/net/fec.c
	drivers/net/wireless/Makefile
	drivers/power/sabresd_battery.c
	drivers/regulator/core.c
	drivers/tty/serial/imx.c
	drivers/usb/core/hub.c
	drivers/usb/gadget/arcotg_udc.c
	drivers/usb/gadget/fsl_updater.c
	drivers/usb/gadget/inode.c
	drivers/usb/host/ehci-hub.c
	drivers/video/mxc/ldb.c
	drivers/video/mxc/mipi_dsi.c
	drivers/video/mxc/mxc_dispdrv.c
	drivers/video/mxc/mxc_dispdrv.h
	drivers/video/mxc/mxc_edid.c
	drivers/video/mxc/mxc_elcdif_fb.c
	drivers/video/mxc/mxc_ipuv3_fb.c
	drivers/video/mxc/mxc_spdc_fb.c
	drivers/video/mxc_hdmi.c
	drivers/watchdog/imx2_wdt.c
	fs/proc/base.c
	include/linux/mmc/host.h
	include/linux/mmc/sdhci.h
	include/linux/mxc_v4l2.h
	kernel/power/main.c
	sound/soc/codecs/mxc_hdmi.c
	sound/soc/codecs/mxc_spdif.c
	sound/soc/codecs/wm8962.c
	sound/soc/imx/Kconfig
	sound/soc/imx/Makefile
	sound/soc/imx/imx-cs42888.c
	sound/soc/imx/imx-esai.c
	sound/soc/imx/imx-wm8958.c
	sound/soc/imx/imx-wm8962.c
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Conflicts:
	arch/arm/configs/imx6_defconfig
	arch/arm/configs/imx6_updater_defconfig
	arch/arm/configs/imx6s_defconfig
	arch/arm/include/asm/dma-mapping.h
	arch/arm/kernel/smp.c
	arch/arm/mach-mx6/Kconfig
	arch/arm/mach-mx6/board-mx6dl_arm2.h
	arch/arm/mach-mx6/board-mx6dl_sabresd.h
	arch/arm/mach-mx6/board-mx6q_arm2.c
	arch/arm/mach-mx6/board-mx6q_arm2.h
	arch/arm/mach-mx6/board-mx6q_sabreauto.c
	arch/arm/mach-mx6/board-mx6q_sabreauto.h
	arch/arm/mach-mx6/board-mx6q_sabrelite.c
	arch/arm/mach-mx6/board-mx6q_sabresd.c
	arch/arm/mach-mx6/board-mx6q_sabresd.h
	arch/arm/mach-mx6/board-mx6sl_arm2.c
	arch/arm/mach-mx6/board-mx6sl_arm2.h
	arch/arm/mach-mx6/board-mx6solo_sabreauto.h
	arch/arm/mach-mx6/bus_freq.c
	arch/arm/mach-mx6/clock.c
	arch/arm/mach-mx6/clock_mx6sl.c
	arch/arm/mach-mx6/cpu.c
	arch/arm/mach-mx6/crm_regs.h
	arch/arm/mach-mx6/devices-imx6q.h
	arch/arm/mach-mx6/devices.c
	arch/arm/mach-mx6/mx6_anatop_regulator.c
	arch/arm/mach-mx6/pcie.c
	arch/arm/mach-mx6/system.c
	arch/arm/mm/dma-mapping.c
	arch/arm/plat-mxc/devices/Makefile
	arch/arm/plat-mxc/devices/platform-imx-dcp.c
	arch/arm/plat-mxc/devices/platform-imx-ocotp.c
	arch/arm/plat-mxc/devices/platform-imx-rngb.c
	arch/arm/plat-mxc/devices/platform-mxc_hdmi.c
	arch/arm/plat-mxc/include/mach/devices-common.h
	arch/arm/plat-mxc/include/mach/esdhc.h
	arch/arm/plat-mxc/include/mach/iomux-mx6dl.h
	arch/arm/plat-mxc/include/mach/iomux-mx6q.h
	arch/arm/plat-mxc/include/mach/memory.h
	arch/arm/plat-mxc/include/mach/mx6.h
	arch/arm/plat-mxc/include/mach/mxc_edid.h
	arch/arm/plat-mxc/include/mach/mxc_hdmi.h
	arch/arm/plat-mxc/system.c
	drivers/Kconfig
	drivers/char/hw_random/fsl-rngc.c
	drivers/cpufreq/Makefile
	drivers/cpufreq/cpufreq_interactive.c
	drivers/crypto/Kconfig
	drivers/crypto/caam/caamalg.c
	drivers/crypto/caam/compat.h
	drivers/crypto/caam/ctrl.c
	drivers/crypto/caam/desc_constr.h
	drivers/crypto/caam/intern.h
	drivers/crypto/dcp.c
	drivers/dma/pch_dma.c
	drivers/input/keyboard/gpio_keys.c
	drivers/input/touchscreen/egalax_ts.c
	drivers/input/touchscreen/max11801_ts.c
	drivers/media/video/mxc/capture/Kconfig
	drivers/media/video/mxc/capture/adv7180.c
	drivers/media/video/mxc/capture/ipu_csi_enc.c
	drivers/media/video/mxc/capture/ipu_prp_vf_sdc.c
	drivers/media/video/mxc/capture/ipu_prp_vf_sdc_bg.c
	drivers/media/video/mxc/capture/mxc_v4l2_capture.c
	drivers/media/video/mxc/capture/ov5640_mipi.c
	drivers/media/video/mxc/output/mxc_vout.c
	drivers/misc/Kconfig
	drivers/misc/Makefile
	drivers/mmc/card/block.c
	drivers/mmc/core/mmc.c
	drivers/mmc/host/mmci.c
	drivers/mmc/host/sdhci-esdhc-imx.c
	drivers/mmc/host/sdhci.c
	drivers/mmc/host/sdhci.h
	drivers/mxc/Kconfig
	drivers/mxc/Makefile
	drivers/mxc/asrc/mxc_asrc.c
	drivers/mxc/gpu-viv/arch/XAQ2/hal/kernel/gc_hal_kernel_context.c
	drivers/mxc/gpu-viv/arch/XAQ2/hal/kernel/gc_hal_kernel_hardware.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel.h
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
	drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal.h
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_base.h
	drivers/mxc/gpu-viv/hal/kernel/inc/gc_hal_options.h
	drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c
	drivers/mxc/ipu3/ipu_device.c
	drivers/mxc/vpu/mxc_vpu.c
	drivers/net/fec.c
	drivers/net/wireless/Makefile
	drivers/power/sabresd_battery.c
	drivers/regulator/core.c
	drivers/tty/serial/imx.c
	drivers/usb/core/hub.c
	drivers/usb/gadget/arcotg_udc.c
	drivers/usb/gadget/fsl_updater.c
	drivers/usb/gadget/inode.c
	drivers/usb/host/ehci-hub.c
	drivers/video/mxc/ldb.c
	drivers/video/mxc/mipi_dsi.c
	drivers/video/mxc/mxc_dispdrv.c
	drivers/video/mxc/mxc_dispdrv.h
	drivers/video/mxc/mxc_edid.c
	drivers/video/mxc/mxc_elcdif_fb.c
	drivers/video/mxc/mxc_ipuv3_fb.c
	drivers/video/mxc/mxc_spdc_fb.c
	drivers/video/mxc_hdmi.c
	drivers/watchdog/imx2_wdt.c
	fs/proc/base.c
	include/linux/mmc/host.h
	include/linux/mmc/sdhci.h
	include/linux/mxc_v4l2.h
	kernel/power/main.c
	sound/soc/codecs/mxc_hdmi.c
	sound/soc/codecs/mxc_spdif.c
	sound/soc/codecs/wm8962.c
	sound/soc/imx/Kconfig
	sound/soc/imx/Makefile
	sound/soc/imx/imx-cs42888.c
	sound/soc/imx/imx-esai.c
	sound/soc/imx/imx-wm8958.c
	sound/soc/imx/imx-wm8962.c
</pre>
</div>
</content>
</entry>
<entry>
<title>plist: Remove the need to supply locks to plist heads</title>
<updated>2012-07-20T05:23:22+00:00</updated>
<author>
<name>Dima Zavin</name>
<email>dima@android.com</email>
</author>
<published>2011-07-08T00:27:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1e70c83ff5dcc061a4f434c6b0f8d5342ccc45cc'/>
<id>1e70c83ff5dcc061a4f434c6b0f8d5342ccc45cc</id>
<content type='text'>
This was legacy code brought over from the RT tree and
is no longer necessary.

Signed-off-by: Dima Zavin &lt;dima@android.com&gt;
Acked-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Daniel Walker &lt;dwalker@codeaurora.org&gt;
Cc: Steven Rostedt &lt;rostedt@goodmis.org&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Andi Kleen &lt;andi@firstfloor.org&gt;
Cc: Lai Jiangshan &lt;laijs@cn.fujitsu.com&gt;
Link: http://lkml.kernel.org/r/1310084879-10351-2-git-send-email-dima@android.com
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This was legacy code brought over from the RT tree and
is no longer necessary.

Signed-off-by: Dima Zavin &lt;dima@android.com&gt;
Acked-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Daniel Walker &lt;dwalker@codeaurora.org&gt;
Cc: Steven Rostedt &lt;rostedt@goodmis.org&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Andi Kleen &lt;andi@firstfloor.org&gt;
Cc: Lai Jiangshan &lt;laijs@cn.fujitsu.com&gt;
Link: http://lkml.kernel.org/r/1310084879-10351-2-git-send-email-dima@android.com
Signed-off-by: Ingo Molnar &lt;mingo@elte.hu&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>btree: fix tree corruption in btree_get_prev()</title>
<updated>2012-06-17T18:23:10+00:00</updated>
<author>
<name>Roland Dreier</name>
<email>roland@purestorage.com</email>
</author>
<published>2012-06-07T21:21:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=29684ecb7a675061933fb19531407fa9f9971ab4'/>
<id>29684ecb7a675061933fb19531407fa9f9971ab4</id>
<content type='text'>
commit cbf8ae32f66a9ceb8907ad9e16663c2a29e48990 upstream.

The memory the parameter __key points to is used as an iterator in
btree_get_prev(), so if we save off a bkey() pointer in retry_key and
then assign that to __key, we'll end up corrupting the btree internals
when we do eg

	longcpy(__key, bkey(geo, node, i), geo-&gt;keylen);

to return the key value.  What we should do instead is use longcpy() to
copy the key value that retry_key points to __key.

This can cause a btree to get corrupted by seemingly read-only
operations such as btree_for_each_safe.

[akpm@linux-foundation.org: avoid the double longcpy()]
Signed-off-by: Roland Dreier &lt;roland@purestorage.com&gt;
Acked-by: Joern Engel &lt;joern@logfs.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cbf8ae32f66a9ceb8907ad9e16663c2a29e48990 upstream.

The memory the parameter __key points to is used as an iterator in
btree_get_prev(), so if we save off a bkey() pointer in retry_key and
then assign that to __key, we'll end up corrupting the btree internals
when we do eg

	longcpy(__key, bkey(geo, node, i), geo-&gt;keylen);

to return the key value.  What we should do instead is use longcpy() to
copy the key value that retry_key points to __key.

This can cause a btree to get corrupted by seemingly read-only
operations such as btree_for_each_safe.

[akpm@linux-foundation.org: avoid the double longcpy()]
Signed-off-by: Roland Dreier &lt;roland@purestorage.com&gt;
Acked-by: Joern Engel &lt;joern@logfs.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>uevent: send events in correct order according to seqnum (v3)</title>
<updated>2012-04-02T16:27:09+00:00</updated>
<author>
<name>Andrew Vagin</name>
<email>avagin@openvz.org</email>
</author>
<published>2012-03-07T10:49:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=377c2f4aa985f937d77a6bb9b938b4deda2dc282'/>
<id>377c2f4aa985f937d77a6bb9b938b4deda2dc282</id>
<content type='text'>
commit 7b60a18da393ed70db043a777fd9e6d5363077c4 upstream.

The queue handling in the udev daemon assumes that the events are
ordered.

Before this patch uevent_seqnum is incremented under sequence_lock,
than an event is send uner uevent_sock_mutex. I want to say that code
contained a window between incrementing seqnum and sending an event.

This patch locks uevent_sock_mutex before incrementing uevent_seqnum.

v2: delete sequence_lock, uevent_seqnum is protected by uevent_sock_mutex
v3: unlock the mutex before the goto exit

Thanks for Kay for the comments.

Signed-off-by: Andrew Vagin &lt;avagin@openvz.org&gt;
Tested-By: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7b60a18da393ed70db043a777fd9e6d5363077c4 upstream.

The queue handling in the udev daemon assumes that the events are
ordered.

Before this patch uevent_seqnum is incremented under sequence_lock,
than an event is send uner uevent_sock_mutex. I want to say that code
contained a window between incrementing seqnum and sending an event.

This patch locks uevent_sock_mutex before incrementing uevent_seqnum.

v2: delete sequence_lock, uevent_seqnum is protected by uevent_sock_mutex
v3: unlock the mutex before the goto exit

Thanks for Kay for the comments.

Signed-off-by: Andrew Vagin &lt;avagin@openvz.org&gt;
Tested-By: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'android-3.0' into imx_3.0.15_android</title>
<updated>2012-02-02T08:58:05+00:00</updated>
<author>
<name>Xinyu Chen</name>
<email>xinyu.chen@freescale.com</email>
</author>
<published>2012-02-02T08:58:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=599a980adc5c2ba32f6aedcd87640b781d347d1f'/>
<id>599a980adc5c2ba32f6aedcd87640b781d347d1f</id>
<content type='text'>
Conflicts:
	drivers/misc/Kconfig
	drivers/misc/Makefile
	drivers/net/wireless/Makefile
	kernel/power/main.c
	sound/soc/soc-core.c
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Conflicts:
	drivers/misc/Kconfig
	drivers/misc/Makefile
	drivers/net/wireless/Makefile
	kernel/power/main.c
	sound/soc/soc-core.c
</pre>
</div>
</content>
</entry>
<entry>
<title>netlink: validate NLA_MSECS length</title>
<updated>2011-11-11T17:37:12+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2011-11-03T00:07:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6167ded5698377fca7830c22be0ba976f91f2434'/>
<id>6167ded5698377fca7830c22be0ba976f91f2434</id>
<content type='text'>
commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.

L2TP for example uses NLA_MSECS like this:
policy:
        [L2TP_ATTR_RECV_TIMEOUT]        = { .type = NLA_MSECS, },
code:
        if (info-&gt;attrs[L2TP_ATTR_RECV_TIMEOUT])
                cfg.reorder_timeout = nla_get_msecs(info-&gt;attrs[L2TP_ATTR_RECV_TIMEOUT]);

As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.

Add NLA_MSECS to the attribute minlen array to check the
size properly.

Cc: Thomas Graf &lt;tgraf@suug.ch&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.

L2TP for example uses NLA_MSECS like this:
policy:
        [L2TP_ATTR_RECV_TIMEOUT]        = { .type = NLA_MSECS, },
code:
        if (info-&gt;attrs[L2TP_ATTR_RECV_TIMEOUT])
                cfg.reorder_timeout = nla_get_msecs(info-&gt;attrs[L2TP_ATTR_RECV_TIMEOUT]);

As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.

Add NLA_MSECS to the attribute minlen array to check the
size properly.

Cc: Thomas Graf &lt;tgraf@suug.ch&gt;
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>kobj_uevent: Ignore if some listeners cannot handle message</title>
<updated>2011-11-11T17:35:46+00:00</updated>
<author>
<name>Milan Broz</name>
<email>mbroz@redhat.com</email>
</author>
<published>2011-08-22T13:51:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7b59e3e29e1a28ad40892dd2115175e2702f1153'/>
<id>7b59e3e29e1a28ad40892dd2115175e2702f1153</id>
<content type='text'>
commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.

kobject_uevent() uses a multicast socket and should ignore
if one of listeners cannot handle messages or nobody is
listening at all.

Easily reproducible when a process in system is cloned
with CLONE_NEWNET flag.

(See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)

Signed-off-by: Milan Broz &lt;mbroz@redhat.com&gt;
Acked-by: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.

kobject_uevent() uses a multicast socket and should ignore
if one of listeners cannot handle messages or nobody is
listening at all.

Easily reproducible when a process in system is cloned
with CLONE_NEWNET flag.

(See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)

Signed-off-by: Milan Broz &lt;mbroz@redhat.com&gt;
Acked-by: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Merge commit 'v3.0.8' into android-3.0</title>
<updated>2011-10-27T22:01:19+00:00</updated>
<author>
<name>Colin Cross</name>
<email>ccross@android.com</email>
</author>
<published>2011-10-27T22:01:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2bb3e310159b65c88caf0c67a20ed257568be267'/>
<id>2bb3e310159b65c88caf0c67a20ed257568be267</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>XZ: Fix incorrect XZ_BUF_ERROR</title>
<updated>2011-10-03T18:40:37+00:00</updated>
<author>
<name>Lasse Collin</name>
<email>lasse.collin@tukaani.org</email>
</author>
<published>2011-09-21T14:30:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ac82a9c88d9e0db9f33ed03517c3e3925ceae634'/>
<id>ac82a9c88d9e0db9f33ed03517c3e3925ceae634</id>
<content type='text'>
commit 9c1f8594df4814ebfd6822ca3c9444fb3445888d upstream.

xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the
following was true:

 - The caller knows how many bytes of output to expect and only provides
   that much output space.

 - When the last output bytes are decoded, the caller-provided input
   buffer ends right before the LZMA2 end of payload marker.  So LZMA2
   won't provide more output anymore, but it won't know it yet and thus
   won't return XZ_STREAM_END yet.

 - A BCJ filter is in use and it hasn't left any unfiltered bytes in the
   temp buffer.  This can happen with any BCJ filter, but in practice
   it's more likely with filters other than the x86 BCJ.

This fixes &lt;https://bugzilla.redhat.com/show_bug.cgi?id=735408&gt; where
Squashfs thinks that a valid file system is corrupt.

This also fixes a similar bug in single-call mode where the uncompressed
size of a block using BCJ + LZMA2 was 0 bytes and caller provided no
output space.  Many empty .xz files don't contain any blocks and thus
don't trigger this bug.

This also tweaks a closely related detail: xz_dec_bcj_run() could call
xz_dec_lzma2_run() to decode into temp buffer when it was known to be
useless.  This was harmless although it wasted a minuscule number of CPU
cycles.

Signed-off-by: Lasse Collin &lt;lasse.collin@tukaani.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9c1f8594df4814ebfd6822ca3c9444fb3445888d upstream.

xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the
following was true:

 - The caller knows how many bytes of output to expect and only provides
   that much output space.

 - When the last output bytes are decoded, the caller-provided input
   buffer ends right before the LZMA2 end of payload marker.  So LZMA2
   won't provide more output anymore, but it won't know it yet and thus
   won't return XZ_STREAM_END yet.

 - A BCJ filter is in use and it hasn't left any unfiltered bytes in the
   temp buffer.  This can happen with any BCJ filter, but in practice
   it's more likely with filters other than the x86 BCJ.

This fixes &lt;https://bugzilla.redhat.com/show_bug.cgi?id=735408&gt; where
Squashfs thinks that a valid file system is corrupt.

This also fixes a similar bug in single-call mode where the uncompressed
size of a block using BCJ + LZMA2 was 0 bytes and caller provided no
output space.  Many empty .xz files don't contain any blocks and thus
don't trigger this bug.

This also tweaks a closely related detail: xz_dec_bcj_run() could call
xz_dec_lzma2_run() to decode into temp buffer when it was known to be
useless.  This was harmless although it wasted a minuscule number of CPU
cycles.

Signed-off-by: Lasse Collin &lt;lasse.collin@tukaani.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>crypto: Move md5_transform to lib/md5.c</title>
<updated>2011-08-16T01:31:35+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2011-08-04T02:45:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2468b895fc7dcbc436cb02f0707ab8d7cb2f0aa7'/>
<id>2468b895fc7dcbc436cb02f0707ab8d7cb2f0aa7</id>
<content type='text'>
We are going to use this for TCP/IP sequence number and fragment ID
generation.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We are going to use this for TCP/IP sequence number and fragment ID
generation.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;
</pre>
</div>
</content>
</entry>
</feed>
