linux-stable.git/drivers/char, branch linux-2.6.23.y

vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007)

2008-02-08T20:01:45+00:00

Drivers that register a ->fault handler, but do not range-check the
offset argument, must set VM_DONTEXPAND in the vm_flags in order to
prevent an expanding mremap from overflowing the resource.

I've audited the tree and attempted to fix these problems (usually by
adding VM_DONTEXPAND where it is not obvious).

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Freezer: Fix APM emulation breakage

2008-02-08T20:01:33+00:00

The APM emulation is currently broken as a result of commit
831441862956fffa17b9801db37e6ea1650b0f69
"Freezer: make kernel threads nonfreezable by default"
that removed the PF_NOFREEZE annotations from apm_ioctl() without
adding the appropriate freezer hooks.  Fix it and remove the
unnecessary variable flags from apm_ioctl().

This problem has been fixed in the mainline by
commit cb43c54ca05c01533c45e4d3abfe8f99b7acf624
"Freezer: Fix APM emulation breakage".

Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

tty: fix logic change introduced by wait_event_interruptible_timeout()

2008-02-08T20:01:15+00:00

patch db99247ac68fc352100090ad7704fb5efb9327b6 in mainline.

Commit 5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8 introduced a subtle logic
change in tty_wait_until_sent().  The original version would only error out
of the 'do { ...  } while (timeout)' loop if signal_pending() evaluated to
true; a timeout or break due to an empty buffer would fall out of the loop
and into the tty->driver->wait_until_sent handling.  The current
implementation will error out on either a pending signal or an empty
buffer, falling through to the tty->driver->wait_until_sent handling only
on a timeout.

The ->wait_until_sent() will not be reached if the buffer empties before
timeout jiffies have elapsed.  This behavior differs from that prior to commit
5a52bd4a2dcb570333ce6fe2e16cd311650dbdc8.

I turned this up while using a little serial download utility to bootstrap an
ARM-based eval board.  The util worked fine on 2.6.22.x, but consistently
failed on 2.6.23.x.  Once I'd determined that, I narrowed things down with git
bisect, and found the above difference in logic in tty_wait_until_sent() by
inspection.

This change reverts the logic flow in tty_wait_until_sent() to match that
prior to the aforementioned commit.

Signed-off-by: Cory T. Tusar 
Cc: Alan Cox 
Acked-by: Jiri Slaby 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

Revert "Freezer: Fix APM emulation breakage"

2007-12-15T03:29:43+00:00

This reverts commit a6eda373a0fe1c4d169d0ec081518d68323428ab.

It causes a build breakage.

Thanks to Chuck Ebbert  for pointing it out.

Signed-off-by: Greg Kroah-Hartman

Freezer: Fix APM emulation breakage

2007-12-14T17:51:00+00:00

patch cb43c54ca05c01533c45e4d3abfe8f99b7acf624 in mainline.

The APM emulation is currently broken as a result of commit
831441862956fffa17b9801db37e6ea1650b0f69
"Freezer: make kernel threads nonfreezable by default"
that removed the PF_NOFREEZE annotations from apm_ioctl() without adding
the appropriate freezer hooks.  Fix it and remove the unnecessary variable flags
from apm_ioctl().

Special thanks to Franck Bui-Huu  for pointing out the
problem.

Signed-off-by: Rafael J. Wysocki 
Cc: Pavel Machek 
Cc: Franck Bui-Huu 
Cc: Nigel Cunningham 
Signed-off-by: Len Brown 
Signed-off-by: Greg Kroah-Hartman

NET: random : secure_tcp_sequence_number should not assume CONFIG_KTIME_SCALAR

2007-12-14T17:50:50+00:00

[NET] random : secure_tcp_sequence_number should not assume CONFIG_KTIME_SCALAR

[ Upstream commit: 6dd10a62353a50b30b30e0c18653650975b29c71 ]

All 32 bits machines but i386 dont have CONFIG_KTIME_SCALAR. On these
machines, ktime.tv64 is more than 4 times the (correct) result given
by ktime_to_ns()

Again on these machines, using ktime_get_real().tv64 >> 6 give a
32bits rollover every 64 seconds, which is not wanted (less than the
120 s MSL)

Using ktime_to_ns() is the portable way to get nsecs from a ktime, and
have correct code.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Cc: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

radeon: set the address to access the GART table on the CPU side correctly

2007-11-16T17:30:24+00:00

Upstream as 7fc86860cf73e060ab8ed9763010dfe5b5389b1c

This code relied on the CPU and GPU address for the aperture being the same,
On some r5xx hardware I was playing with I noticed that this isn't always true.
This fixes issues seen on some r400 cards. (bugs.freedesktop.org 9957)

Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

Char: moxa, fix and optimise empty timer

2007-11-16T17:30:24+00:00

patch c43422053bea7a5ce09f18d0c50a606fe1a549f4 in mainline.

moxa, fix and optimise empty timer

don't wait and delete empty timer in empty timer function. Also fire next
empty timer at rounded jiffies to save power.

This fixes a lockup, because we wait for ourselves to finish forever.
(i.e.  sync called from the timer itself).


Signed-off-by: Jiri Slaby 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Char: rocket, fix dynamic_dev tty

2007-11-16T17:30:24+00:00

patch ac6aec2f5683588361ab408cb3346b08c66bdfbe in mainline.

- register_device unconditionally (non-pci dependent) to have also isa
  devices in /dev
- unregister devices on module removal
- don't set TTY_DRIVER_DYNAMIC_DEV twice (removed the one dependent on some
  macro)

This is the substantial part of the patch and the previous point is for
not checking which devices to unregister and which not (simply register
and unregister all found no matter on which bus they are plugged).


Signed-off-by: Jiri Slaby 
Cc: Ferenc Wagner 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

i915: fix vbl swap allocation size.

2007-11-16T17:30:19+00:00

This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81

Oops...

Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman