<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/char, branch v2.6.27</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>kgdboc,tty: Fix tty polling search to use name correctly</title>
<updated>2008-09-26T15:36:42+00:00</updated>
<author>
<name>Jason Wessel</name>
<email>jason.wessel@windriver.com</email>
</author>
<published>2008-09-26T15:36:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0dca0fd2bfeb99738708d6c9117994ebf398e72c'/>
<id>0dca0fd2bfeb99738708d6c9117994ebf398e72c</id>
<content type='text'>
The tty_find_polling_driver() routine did not correctly check the base
part of the tty name.  This can lead to kgdboc selecting an incorrect
driver, as well as accepting a completely invalid tty such as "echo
ffff0 &gt; /sys/module/kgdboc/parameters/kgdboc".

Signed-off-by: Jason Wessel &lt;jason.wessel@windriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The tty_find_polling_driver() routine did not correctly check the base
part of the tty name.  This can lead to kgdboc selecting an incorrect
driver, as well as accepting a completely invalid tty such as "echo
ffff0 &gt; /sys/module/kgdboc/parameters/kgdboc".

Signed-off-by: Jason Wessel &lt;jason.wessel@windriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/char/random.c: fix a race which can lead to a bogus BUG()</title>
<updated>2008-09-03T02:21:40+00:00</updated>
<author>
<name>Andrew Morton</name>
<email>akpm@linux-foundation.org</email>
</author>
<published>2008-09-02T21:36:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=8b76f46a2db29407fed66cf4aca19d61b3dcb3e1'/>
<id>8b76f46a2db29407fed66cf4aca19d61b3dcb3e1</id>
<content type='text'>
Fix a bug reported by and diagnosed by Aaron Straus.

This is a regression intruduced into 2.6.26 by

    commit adc782dae6c4c0f6fb679a48a544cfbcd79ae3dc
    Author: Matt Mackall &lt;mpm@selenic.com&gt;
    Date:   Tue Apr 29 01:03:07 2008 -0700

        random: simplify and rename credit_entropy_store

credit_entropy_bits() does:

	spin_lock_irqsave(&amp;r-&gt;lock, flags);
	...
	if (r-&gt;entropy_count &gt; r-&gt;poolinfo-&gt;POOLBITS)
		r-&gt;entropy_count = r-&gt;poolinfo-&gt;POOLBITS;

so there is a time window in which this BUG_ON():

static size_t account(struct entropy_store *r, size_t nbytes, int min,
		      int reserved)
{
	unsigned long flags;

	BUG_ON(r-&gt;entropy_count &gt; r-&gt;poolinfo-&gt;POOLBITS);

	/* Hold lock while accounting */
	spin_lock_irqsave(&amp;r-&gt;lock, flags);

can trigger.

We could fix this by moving the assertion inside the lock, but it seems
safer and saner to revert to the old behaviour wherein
entropy_store.entropy_count at no time exceeds
entropy_store.poolinfo-&gt;POOLBITS.

Reported-by: Aaron Straus &lt;aaron@merfinllc.com&gt;
Cc: Matt Mackall &lt;mpm@selenic.com&gt;
Cc: Theodore Ts'o &lt;tytso@mit.edu&gt;
Cc: &lt;stable@kernel.org&gt;		[2.6.26.x]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix a bug reported by and diagnosed by Aaron Straus.

This is a regression intruduced into 2.6.26 by

    commit adc782dae6c4c0f6fb679a48a544cfbcd79ae3dc
    Author: Matt Mackall &lt;mpm@selenic.com&gt;
    Date:   Tue Apr 29 01:03:07 2008 -0700

        random: simplify and rename credit_entropy_store

credit_entropy_bits() does:

	spin_lock_irqsave(&amp;r-&gt;lock, flags);
	...
	if (r-&gt;entropy_count &gt; r-&gt;poolinfo-&gt;POOLBITS)
		r-&gt;entropy_count = r-&gt;poolinfo-&gt;POOLBITS;

so there is a time window in which this BUG_ON():

static size_t account(struct entropy_store *r, size_t nbytes, int min,
		      int reserved)
{
	unsigned long flags;

	BUG_ON(r-&gt;entropy_count &gt; r-&gt;poolinfo-&gt;POOLBITS);

	/* Hold lock while accounting */
	spin_lock_irqsave(&amp;r-&gt;lock, flags);

can trigger.

We could fix this by moving the assertion inside the lock, but it seems
safer and saner to revert to the old behaviour wherein
entropy_store.entropy_count at no time exceeds
entropy_store.poolinfo-&gt;POOLBITS.

Reported-by: Aaron Straus &lt;aaron@merfinllc.com&gt;
Cc: Matt Mackall &lt;mpm@selenic.com&gt;
Cc: Theodore Ts'o &lt;tytso@mit.edu&gt;
Cc: &lt;stable@kernel.org&gt;		[2.6.26.x]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: Fix termios tty window resize race with pty/tty pair</title>
<updated>2008-08-27T21:37:09+00:00</updated>
<author>
<name>Alan Cox</name>
<email>alan@lxorguk.ukuu.org.uk</email>
</author>
<published>2008-08-26T18:55:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=a152db71d962f405f7e9be5c818bddf6d1be50a7'/>
<id>a152db71d962f405f7e9be5c818bddf6d1be50a7</id>
<content type='text'>
Kanru Chen posted a patch versus the old code which deals with the case
where you resize the pty side of a pty/tty pair. In that situation the
termios data is updated for both pty and tty but the locks are not held
for the right side.

This implements the fix differently against the updated tty code. Patch
by self but the hard bit (noticing and fixing the bug) is thanks to Kanru
Chen.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Kanru Chen posted a patch versus the old code which deals with the case
where you resize the pty side of a pty/tty pair. In that situation the
termios data is updated for both pty and tty but the locks are not held
for the right side.

This implements the fix differently against the updated tty code. Patch
by self but the hard bit (noticing and fixing the bug) is thanks to Kanru
Chen.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: TIOCGSOFTCAR/SSOFTCAR on pty is wron</title>
<updated>2008-08-27T21:37:09+00:00</updated>
<author>
<name>Alan Cox</name>
<email>alan@lxorguk.ukuu.org.uk</email>
</author>
<published>2008-08-26T18:52:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f753f3272b4d2108d1e4b121ddcde504737a8693'/>
<id>f753f3272b4d2108d1e4b121ddcde504737a8693</id>
<content type='text'>
The termios settings ioctls on a pty should affect the bound tty side not
the pty. The SOFTCAR ioctls use the wrong device file.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The termios settings ioctls on a pty should affect the bound tty side not
the pty. The SOFTCAR ioctls use the wrong device file.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>removed unused #include &lt;linux/version.h&gt;'s</title>
<updated>2008-08-23T19:14:12+00:00</updated>
<author>
<name>Adrian Bunk</name>
<email>bunk@kernel.org</email>
</author>
<published>2008-08-17T14:36:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=7a8fc9b248e77a4eab0613acf30a6811799786b3'/>
<id>7a8fc9b248e77a4eab0613acf30a6811799786b3</id>
<content type='text'>
This patch lets the files using linux/version.h match the files that
#include it.

Signed-off-by: Adrian Bunk &lt;bunk@kernel.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch lets the files using linux/version.h match the files that
#include it.

Signed-off-by: Adrian Bunk &lt;bunk@kernel.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/char/ipmi/ipmi_si_intf.c:default_find_bmc(): fix leak</title>
<updated>2008-08-20T22:40:31+00:00</updated>
<author>
<name>Andrew Morton</name>
<email>akpm@linux-foundation.org</email>
</author>
<published>2008-08-20T21:09:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=a09f48551273ee89d4e9ae37474807dc2da1d757'/>
<id>a09f48551273ee89d4e9ae37474807dc2da1d757</id>
<content type='text'>
If check_legacy_ioport() returns true, we leak *info.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11362

Reported-by: Daniel Marjamki &lt;danielm77@spray.se&gt;
Cc: Christian Krafft &lt;krafft@de.ibm.com&gt;
Cc: Michael Ellerman &lt;michael@ellerman.id.au&gt;
Cc: Corey Minyard &lt;minyard@acm.org&gt;
Cc: Paul Mackerras &lt;paulus@samba.org&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If check_legacy_ioport() returns true, we leak *info.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11362

Reported-by: Daniel Marjamki &lt;danielm77@spray.se&gt;
Cc: Christian Krafft &lt;krafft@de.ibm.com&gt;
Cc: Michael Ellerman &lt;michael@ellerman.id.au&gt;
Cc: Corey Minyard &lt;minyard@acm.org&gt;
Cc: Paul Mackerras &lt;paulus@samba.org&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6</title>
<updated>2008-08-19T16:59:02+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2008-08-19T16:59:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=4309e092421e08f411830b2675bc1538a9b90e9b'/>
<id>4309e092421e08f411830b2675bc1538a9b90e9b</id>
<content type='text'>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (94 commits)
  pkt_sched: Prevent livelock in TX queue running.
  Revert "pkt_sched: Add BH protection for qdisc_stab_lock."
  Revert "pkt_sched: Protect gen estimators under est_lock."
  pkt_sched: remove bogus block (cleanup)
  nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
  netfilter: ctnetlink: sleepable allocation with spin lock bh
  netfilter: ctnetlink: fix sleep in read-side lock section
  netfilter: ctnetlink: fix double helper assignation for NAT'ed conntracks
  netfilter: ipt_addrtype: Fix matching of inverted destination address type
  dccp: Fix panic caused by too early termination of retransmission mechanism
  pkt_sched: Don't hold qdisc lock over qdisc_destroy().
  pkt_sched: Add lockdep annotation for qdisc locks
  pkt_sched: Never schedule non-root qdiscs.
  removed unused #include &lt;version.h&gt;
  rt2x00: Fix txdone_entry_desc_flags
  b43: Fix for another Bluetooth Coexistence SPROM Programming error for BCM4306
  mac80211: remove kdoc references to IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE
  p54u: reset skb's data/tail pointer on requeue
  p54: move p54_vdcf_init to the right place.
  iwlwifi: fix printk newlines
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (94 commits)
  pkt_sched: Prevent livelock in TX queue running.
  Revert "pkt_sched: Add BH protection for qdisc_stab_lock."
  Revert "pkt_sched: Protect gen estimators under est_lock."
  pkt_sched: remove bogus block (cleanup)
  nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
  netfilter: ctnetlink: sleepable allocation with spin lock bh
  netfilter: ctnetlink: fix sleep in read-side lock section
  netfilter: ctnetlink: fix double helper assignation for NAT'ed conntracks
  netfilter: ipt_addrtype: Fix matching of inverted destination address type
  dccp: Fix panic caused by too early termination of retransmission mechanism
  pkt_sched: Don't hold qdisc lock over qdisc_destroy().
  pkt_sched: Add lockdep annotation for qdisc locks
  pkt_sched: Never schedule non-root qdiscs.
  removed unused #include &lt;version.h&gt;
  rt2x00: Fix txdone_entry_desc_flags
  b43: Fix for another Bluetooth Coexistence SPROM Programming error for BCM4306
  mac80211: remove kdoc references to IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE
  p54u: reset skb's data/tail pointer on requeue
  p54: move p54_vdcf_init to the right place.
  iwlwifi: fix printk newlines
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization</title>
<updated>2008-08-19T04:32:32+00:00</updated>
<author>
<name>Stephen Hemminger</name>
<email>shemminger@vyatta.com</email>
</author>
<published>2008-08-19T04:32:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=9f593653742d1dd816c4e94c6e5154a57ccba6d1'/>
<id>9f593653742d1dd816c4e94c6e5154a57ccba6d1</id>
<content type='text'>
Use incoming network tuple as seed for NAT port randomization.
This avoids concerns of leaking net_random() bits, and also gives better
port distribution. Don't have NAT server, compile tested only.

Signed-off-by: Stephen Hemminger &lt;shemminger@vyatta.com&gt;

[ added missing EXPORT_SYMBOL_GPL ]

Signed-off-by: Patrick McHardy &lt;kaber@trash.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use incoming network tuple as seed for NAT port randomization.
This avoids concerns of leaking net_random() bits, and also gives better
port distribution. Don't have NAT server, compile tested only.

Signed-off-by: Stephen Hemminger &lt;shemminger@vyatta.com&gt;

[ added missing EXPORT_SYMBOL_GPL ]

Signed-off-by: Patrick McHardy &lt;kaber@trash.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>removed unused #include &lt;version.h&gt;</title>
<updated>2008-08-17T00:21:58+00:00</updated>
<author>
<name>Huang Weiyi</name>
<email>weiyi.huang@gmail.com</email>
</author>
<published>2008-08-16T23:51:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=b09c3e3f1710b554348c98e78fbf4a661918779a'/>
<id>b09c3e3f1710b554348c98e78fbf4a661918779a</id>
<content type='text'>
The drivers below do not use LINUX_VERSION_CODE nor KERNEL_VERSION.
  drivers/char/pcmcia/ipwireless/tty.c
  drivers/char/synclink_gt.c
  drivers/char/xilinx_hwicap/xilinx_hwicap.c

This patch removes the said #include &lt;version.h&gt;.

Signed-off-by: Huang Weiyi &lt;weiyi.huang@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The drivers below do not use LINUX_VERSION_CODE nor KERNEL_VERSION.
  drivers/char/pcmcia/ipwireless/tty.c
  drivers/char/synclink_gt.c
  drivers/char/xilinx_hwicap/xilinx_hwicap.c

This patch removes the said #include &lt;version.h&gt;.

Signed-off-by: Huang Weiyi &lt;weiyi.huang@gmail.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: remove resize window special case</title>
<updated>2008-08-15T17:34:07+00:00</updated>
<author>
<name>Alan Cox</name>
<email>alan@redhat.com</email>
</author>
<published>2008-08-15T09:39:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=8c9a9dd0fa3a269d380eaae2dc1bee39e865fae1'/>
<id>8c9a9dd0fa3a269d380eaae2dc1bee39e865fae1</id>
<content type='text'>
This moves it to being a tty operation. That removes special cases and now
also means that resize can be picked up by um and other non vt consoles
which may have a resize operation.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This moves it to being a tty operation. That removes special cases and now
also means that resize can be picked up by um and other non vt consoles
which may have a resize operation.

Signed-off-by: Alan Cox &lt;alan@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
