1. 10 Aug, 2010 32 commits
  2. 02 Aug, 2010 8 commits
    • Greg Kroah-Hartman's avatar
      Linux 2.6.32.17 · f23dc93c
      Greg Kroah-Hartman authored
      f23dc93c
    • Daniel Ritz's avatar
      V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight cameras · 8da94648
      Daniel Ritz authored
      commit 68f194e0 upstream.
      
      For some unknown reason, on a MacBookPro5,3 the iSight sometimes report
      a different video format GUID. This patch add the other (wrong) GUID to
      the format table, making the iSight work always w/o other problems.
      
      What it should report: 32595559-0000-0010-8000-00aa00389b71
      What it often reports: 32595559-0000-0010-8000-000000389b71
      Signed-off-by: default avatarDaniel Ritz <daniel.ritz@gmx.ch>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      Cc: Leann Ogasawara <leann.ogasawara@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      8da94648
    • Dmitry Torokhov's avatar
      Input: RX51 keymap - fix recent compile breakage · 16a7cf55
      Dmitry Torokhov authored
      commit 2e65a207 upstream.
      
      Commit 3fea6026 ("Input: twl40300-keypad - fix handling of "all
      ground" rows") broke compilation as I managed to use non-existent
      keycodes.
      Reported-by: default avatarArjan van de Ven <arjan@infradead.org>
      Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      16a7cf55
    • Bob Copeland's avatar
      ath5k: initialize ah->ah_current_channel · 2e3d0738
      Bob Copeland authored
      commit b6855772 upstream.
      
      ath5k assumes ah_current_channel is always a valid pointer in
      several places, but a newly created interface may not have a
      channel.  To avoid null pointer dereferences, set it up to point
      to the first available channel until later reconfigured.
      
      This fixes the following oops:
      $ rmmod ath5k
      $ insmod ath5k
      $ iw phy0 set distance 11000
      
      BUG: unable to handle kernel NULL pointer dereference at 00000006
      IP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k]
      *pde = 00000000
      Oops: 0000 [#1]
      last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index
      Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90
      scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci
      8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc
      
      Pid: 1597, comm: iw Not tainted (2.6.32.14 #8)
      EIP: 0060:[<d0a1ff24>] EFLAGS: 00010296 CPU: 0
      EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k]
      EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080
      ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4
        DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
      Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000)
      Stack:
        d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0
      <0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7
      <0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000
      Call Trace:
        [<d0a27f0c>] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k]
        [<d09bfdc7>] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211]
        [<d08e0d28>] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211]
        [<c10f5db9>] ? nla_parse+0x59/0xc0
        [<c11ca8d9>] ? genl_rcv_msg+0x169/0x1a0
        [<c11ca770>] ? genl_rcv_msg+0x0/0x1a0
        [<c11c7e68>] ? netlink_rcv_skb+0x38/0x90
        [<c11c9649>] ? genl_rcv+0x19/0x30
        [<c11c7c03>] ? netlink_unicast+0x1b3/0x220
        [<c11c893e>] ? netlink_sendmsg+0x26e/0x290
        [<c11a409e>] ? sock_sendmsg+0xbe/0xf0
        [<c1032780>] ? autoremove_wake_function+0x0/0x50
        [<c104d846>] ? __alloc_pages_nodemask+0x106/0x530
        [<c1074933>] ? do_lookup+0x53/0x1b0
        [<c10766f9>] ? __link_path_walk+0x9b9/0x9e0
        [<c11acab0>] ? verify_iovec+0x50/0x90
        [<c11a42b1>] ? sys_sendmsg+0x1e1/0x270
        [<c1048e50>] ? find_get_page+0x10/0x50
        [<c104a96f>] ? filemap_fault+0x5f/0x370
        [<c1059159>] ? __do_fault+0x319/0x370
        [<c11a55b4>] ? sys_socketcall+0x244/0x290
        [<c101962c>] ? do_page_fault+0x1ec/0x270
        [<c1019440>] ? do_page_fault+0x0/0x270
        [<c1002ae5>] ? syscall_call+0x7/0xb
      Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24
      0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7
      43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2
      EIP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP
      0068:cfa09bf4
      CR2: 0000000000000006
      ---[ end trace 54f73d6b10ceb87b ]---
      Reported-by: default avatarSteve Brown <sbrown@cortland.com>
      Signed-off-by: default avatarBob Copeland <me@bobcopeland.com>
      Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      2e3d0738
    • Andre Osterhues's avatar
      ecryptfs: Bugfix for error related to ecryptfs_hash_buckets · c7fe2f52
      Andre Osterhues authored
      commit a6f80fb7 upstream.
      
      The function ecryptfs_uid_hash wrongly assumes that the
      second parameter to hash_long() is the number of hash
      buckets instead of the number of hash bits.
      This patch fixes that and renames the variable
      ecryptfs_hash_buckets to ecryptfs_hash_bits to make it
      clearer.
      
      Fixes: CVE-2010-2492
      Signed-off-by: default avatarAndre Osterhues <aosterhues@escrypt.com>
      Signed-off-by: default avatarTyler Hicks <tyhicks@linux.vnet.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      c7fe2f52
    • Tony Luck's avatar
      Fix spinaphore down_spin() · d1a6b6c9
      Tony Luck authored
      commit b70f4e85 upstream.
      
      Typo in down_spin() meant it only read the low 32 bits of the
      "serve" value, instead of the full 64 bits. This results in the
      system hanging when the values in ticket/serve get larger than
      32-bits. A big enough system running the right test can hit this
      in a just a few hours.
      
      Broken since 883a3acf
          [IA64] Re-implement spinaphores using ticket lock concepts
      
      Reported via IRC by Bjorn Helgaas
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      d1a6b6c9
    • Alan Jenkins's avatar
      eeepc-laptop: check wireless hotplug events · fe17e2bb
      Alan Jenkins authored
      commit bc9d24a3 upstream.
      
      Before we mark the wireless device as unplugged, check PCI config space
      to see whether the wireless device is really disabled (and vice versa).
      This works around newer models which don't want the hotplug code, where
      we end up disabling the wired network device.
      
      My old 701 still works correctly with this.  I can also simulate an
      afflicted model by changing the hardcoded PCI bus/slot number in the
      driver, and it seems to work nicely (although it is a bit noisy).
      
      In future this type of hotplug support will be implemented by the PCI
      core.  The existing blacklist and the new warning message will be
      removed at that point.
      Signed-off-by: default avatarAlan Jenkins <alan-jenkins@tuffmail.co.uk>
      Signed-off-by: default avatarCorentin Chary <corentincj@iksaif.net>
      Cc: Tim Gardner <tim.gardner@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      fe17e2bb
    • Krzysztof Halasa's avatar
      kbuild: Fix modpost segfault · bf1fe0bc
      Krzysztof Halasa authored
      commit 1c938663 upstream.
      
      Alan <alan@clueserver.org> writes:
      
      > program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o
      > Module.symvers -S vmlinux.o
      >
      > Program received signal SIGSEGV, Segmentation fault.
      
      It just hit me.
      It's the offset calculation in reloc_location() which overflows:
              return (void *)elf->hdr + sechdrs[section].sh_offset +
                     (r->r_offset - sechdrs[section].sh_addr);
      
      E.g. for the first rodata r entry:
      r->r_offset < sechdrs[section].sh_addr
      and the expression in the parenthesis produces 0xFFFFFFE0 or something
      equally wise.
      Reported-by: default avatarAlan <alan@clueserver.org>
      Signed-off-by: default avatarKrzysztof Hałasa <khc@pm.waw.pl>
      Tested-by: default avatarAlan <alan@clueserver.org>
      Signed-off-by: default avatarMichal Marek <mmarek@suse.cz>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      bf1fe0bc