kernel/linux.git, branch v2.6.26.2

Linux 2.6.26.2

2008-08-06T16:19:01+00:00

sound: ensure device number is valid in snd_seq_oss_synth_make_info

2008-08-06T16:03:27+00:00

commit 82e68f7ffec3800425f2391c8c86277606860442 upstream snd_seq_oss_synth_make_info() incorrectly reports information to userspace without first checking for the validity of the device number, leading to possible information leak (CVE-2008-3272). Reported-By: Tobias Klein Acked-and-tested-by: Takashi Iwai Cc: stable@kernel.org Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

Ath5k: kill tasklets on shutdown

2008-08-06T16:03:25+00:00

commit 10488f8ad62be3b860bad74e60b4fe6ab87aece3 upstream Don't forget to kill tasklets on stop to not panic if they fire after freeing some structures. Signed-off-by: Jiri Slaby Acked-by: Nick Kossifidis Cc: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

Ath5k: fix memory corruption

2008-08-06T16:03:24+00:00

commit 3a0f2c871849f23c1070965bf94dec3f9c0b479d upstream When signal is noisy, hardware can use all RX buffers and since the last entry in the list is self-linked, it overwrites the entry until we link new buffers. Ensure that we don't free this last one until we are 100% sure that it is not used by the hardware anymore to not cause memory curruption as can be seen below. This is done by checking next buffer in the list. Even after that we know that the hardware refetched the new link and proceeded further (the next buffer is ready) we can finally free the overwritten buffer. We discard it since the status in its descriptor is overwritten (OR-ed by new status) too. ============================================================================= BUG kmalloc-4096: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff810067419060-0xffff810067419667. First byte 0x8 instead of 0x6b INFO: Allocated in dev_alloc_skb+0x18/0x30 age=1118 cpu=1 pid=0 INFO: Freed in skb_release_data+0x85/0xd0 age=1105 cpu=1 pid=3718 INFO: Slab 0xffffe200019d0600 objects=7 used=0 fp=0xffff810067419048 flags=0x40000000000020c3 INFO: Object 0xffff810067419048 @offset=4168 fp=0xffff81006741c120 Bytes b4 0xffff810067419038: 4f 0b 02 00 01 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a O.......ZZZZZZZZ Object 0xffff810067419048: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object 0xffff810067419058: 6b 6b 6b 6b 6b 6b 6b 6b 08 42 30 00 00 0b 6b 80 kkkkkkkk.B0...k. Object 0xffff810067419068: f0 5d 00 4f 62 08 a3 64 00 0c 42 16 52 e4 f0 5a 360].Ob.243d..B.R344360Z Object 0xffff810067419078: 68 81 00 00 7b a5 b4 be 7d 3b 8f 53 cd d5 de 12 h...{245264276};.S315325336. Object 0xffff810067419088: 96 10 0b 89 48 54 23 41 0f 4e 2d b9 37 c3 cb 29 ....HT#A.N-2717303313) Object 0xffff810067419098: d1 e0 de 14 8a 57 2a cc 3b 44 0d 78 7a 19 12 15 321340336..W*314;D.xz... Object 0xffff8100674190a8: a9 ec d4 35 a8 10 ec 8c 40 a7 06 0a 51 a7 48 bb 2513543245250.354.@247..Q247H273 Object 0xffff8100674190b8: 3e cf a1 c7 38 60 63 3f 51 15 c7 20 eb ba 65 30 >ϡ3078`c?Q.307.353272e0 Redzone 0xffff81006741a048: bb bb bb bb bb bb bb bb 273273273273273273273273 Padding 0xffff81006741a088: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ Pid: 3297, comm: ath5k_pci Not tainted 2.6.26-rc8-mm1_64 #427 Call Trace: [] print_trailer+0xf6/0x150 [] check_bytes_and_report+0x125/0x180 [] check_object+0xac/0x260 [] __slab_alloc+0x368/0x6d0 [] ? wireless_send_event+0x142/0x310 [] ? __alloc_skb+0x44/0x150 [] ? wireless_send_event+0x142/0x310 [] __kmalloc_track_caller+0xc3/0xf0 [] __alloc_skb+0x6e/0x150 [... stack snipped] FIX kmalloc-4096: Restoring 0xffff810067419060-0xffff810067419667=0x6b FIX kmalloc-4096: Marking all objects used Signed-off-by: Jiri Slaby Acked-by: Nick Kossifidis Cc: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman

vfs: fix lookup on deleted directory

2008-08-06T16:03:23+00:00

commit d70b67c8bc72ee23b55381bd6a884f4796692f77 upstream Lookup can install a child dentry for a deleted directory. This keeps the directory dentry alive, and the inode pinned in the cache and on disk, even after all external references have gone away. This isn't a big problem normally, since memory pressure or umount will clear out the directory dentry and its children, releasing the inode. But for UBIFS this causes problems because its orphan area can overflow. Fix this by returning ENOENT for all lookups on a S_DEAD directory before creating a child dentry. Thanks to Zoltan Sogor for noticing this while testing UBIFS, and Artem for the excellent analysis of the problem and testing. Reported-by: Artem Bityutskiy Tested-by: Artem Bityutskiy Signed-off-by: Miklos Szeredi Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman

ALSA: emu10k1 - Fix inverted Analog/Digital mixer switch on Audigy2

2008-08-06T16:03:23+00:00

commit d2cd74b158d7214a556226e3312f9fb1de64d7ae upstream On Audigy2 Platinum, the Analog/Digital mixer switch is inverted. https://bugzilla.novell.com/show_bug.cgi?id=396204 The patch adds a simple workaround. There might be another device requiring a similar fix, too (or fix for audigy2 generically), but right now I fix only the known broken one. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Add missing Thinkpad Z60m support

2008-08-06T16:03:22+00:00

commit 470eaf6be78424fc499a5039e5d5fe58bace2bc3 upstream Added the missing SSID of Thinkpad Z60m for model=thinkpad with AD1981HD. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Fix DMA position inaccuracy

2008-08-06T16:03:21+00:00

commit 9ad593f6d326e7a4664e3856520f6c042f82a37f upstream Many HD-audio controllers seem inaccurate about the IRQ timing of PCM period updates. This has caused problems on audio quality; e.g. JACK doesn't work with two periods. This patch fixes the problem by checking the current DMA position at IRQ handler and delays the period-update via a workq if it's inaccurate. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Fix wrong volumes in AD1988 auto-probe mode

2008-08-06T16:03:21+00:00

commit 43785eaeb1cfb8aed3cf8027f298b242f88fdc45 upstream Don't create mixer volume elements for Headphone and Speaker if they use the same DAC as normal line-outs on AD1988. Otherwise the amp value gets screwed up, e.g. https://bugzilla.novell.com/show_bug.cgi?id=398255 Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman

Add compat handler for PTRACE_GETSIGINFO

2008-08-06T16:03:20+00:00

commit e4cc58944c1e2ce41e3079d4eb60c95e7ce04b2b upstream Current versions of gdb require a working implementation of PTRACE_GETSIGINFO for proper watchpoint support. Since struct siginfo contains pointers it must be converted when passed to a 32-bit debugger. Signed-off-by: Andreas Schwab Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman