Commit Graph

9330 Commits

Author SHA1 Message Date
Guennadi Liakhovetski b66597d697 [PPP]: Don't leak an sk_buff on interface destruction.
Signed-off-by: Guennadi Liakhovetski <gl@dsa-ac.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 22:00:29 +02:00
Pete Zaitcev b48ebb90b3 USB: RAZR v3i unusual_devs
This adds an unusual_devs entry for the Motorola RAZR 3vi.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 21:45:16 +02:00
Andrew Nayenko f53223a462 USB storage: Nokia 6288 unusual_devs entry
This patch adds an usual_devs entry for the Nokia 6288.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 21:44:39 +02:00
Dylan Taft 88b9f4dfeb USB Storage: US_FL_IGNORE_RESIDUE needed for Aiptek MP3 Player
Device will not work as a mass storage device without US_FL_IGNORE_RESIDUE.

I bought this mp3 player that takes SD cards here

http://www.aiptek.com/Merchant2/merchant.mvc?Screen=PROD&Product_Code=AX4&Category_Code=MP3&Store_Code=AS

Signed-off-by: Dylan Taft <d13f00l@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 21:43:59 +02:00
Luiz Fernando N. Capitulino 42290797c6 USB: unusual_devs.h for Sony floppy
This patch increases the range for 0x054c:0x002c devices to make
the following Sony USB floppy to work:

T:  Bus=02 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#=  6 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=054c ProdID=002c Rev=20.00
S:  Manufacturer=SONY
S:  Product=USB Floppy
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=04 Prot=00 Driver=usb-storage
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   2 Ivl=127ms

Signed-off-by: Marcelo Ricardo Leitner <mrl@mandriva.com>
Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 21:42:29 +02:00
Russell King ef1136fb74 [SERIAL] Fix oops when removing suspended serial port
A serial card might have been removed when the system is resumed.
This results in a suspended port being shut down, which results in
the ports shutdown method being called twice in a row.  This causes
BUGs.  Avoid this by tracking the suspended state separately from
the initialised state.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-28 21:28:32 +02:00
Stefan Richter aaab1c66f7 ieee1394: dv1394: fix CardBus card ejection
Fix NULL pointer dereference on hot ejection of a FireWire card while
dv1394 was loaded.  http://bugzilla.kernel.org/show_bug.cgi?id=7121

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-27 00:49:40 +02:00
Akinbou Mita 25c72f3709 md: fix /proc/mdstat refcounting
I have seen mdadm oops after successfully unloading md module.

This patch privents from unloading md module while
mdadm is polling /proc/mdstat.

Signed-off-by: Akinbou Mita <akinobu.mita@gmail.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:43:10 +02:00
Andy Isaacson 36c8a3d3ac fix read past end of array in md/linear.c
When iterating through an array, one must be careful to test one's index
variable rather than another similarly-named variable.

The loop will read off the end of conf->disks[] in the following
(pathological) case:

% dd bs=1 seek=840716287 if=/dev/zero of=d1 count=1
% for i in 2 3 4; do dd if=/dev/zero of=d$i bs=1k count=$(($i+150)); done
% ./vmlinux ubd0=root ubd1=d1 ubd2=d2 ubd3=d3 ubd4=d4
# mdadm -C /dev/md0 --level=linear --raid-devices=4 /dev/ubd[1234]

adding some printks, I saw this:
[42949374.960000] hash_spacing = 821120
[42949374.960000] cnt          = 4
[42949374.960000] min_spacing  = 801
[42949374.960000] j=0 size=820928 sz=820928
[42949374.960000] i=0 sz=820928 hash_spacing=820928
[42949374.960000] j=1 size=64 sz=64
[42949374.960000] j=2 size=64 sz=128
[42949374.960000] j=3 size=64 sz=192
[42949374.960000] j=4 size=1515870810 sz=1515871002

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:42:40 +02:00
Lars Ellenberg 6b9720b5ac md: pass down BIO_RW_SYNC in raid{1,10}
md raidX make_request functions strip off the BIO_RW_SYNC flag, thus
introducing additional latency.

Fixing this in raid1 and raid10 seems to be straightforward enough.

For our particular usage case in DRBD, passing this flag improved some
initialization time from ~5 minutes to ~5 seconds.

Signed-off-by: Lars Ellenberg <lars@linbit.com>
Acked-by: NeilBrown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:41:58 +02:00
Neil Brown c920d11e0b md: Fix bug where spares don't always get rebuilt properly when they become live
If save_raid_disk is >= 0, then the device could be a device that is
already in sync that is being re-added.  So we need to default this
value to -1.

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:41:22 +02:00
Neil Brown d03e0c61f6 MD: Fix problem where hot-added drives are not resynced.
If a drive is added with HOT_ADD_DISK rather than ADD_NEW_DISK,
saved_raid_disk isn't initialised properly, and the drive can be
included in the array without a resync.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:40:42 +02:00
Alan Stern cf2492d903 USB: unusual_devs update for Sony P990i phone
This patch (as846) adds the IGNORE_RESIDUE flag to the unusual_devs
entry for Sony-Ericsson's P990i phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:35:49 +02:00
Lars Jacob 82ef27f35c USB: unusual_devs entry for Sony DSC-H5
This patch (as749) extends the unusual_devs entry for the Sony DSC-T1 and
T5 to cover the H5 as well.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-26 23:30:19 +02:00
Manuel Osdoba 6dcaba06ab USB: unusual_devs.h entry for nokia 6233
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:25:00 +02:00
Pete Zaitcev 28ce74672a USB: unusual_devs.h for 0x046b:ff40
American Megatrends did something wrong in their floppy emulator. It breaks
with both kinds of MODE SENSE which our stack sends. Alan and I tried a few
tweaks, and got LUNs sensed right, but US_FL_NO_WP_DETECT is still needed.

I set the firmware bracket to 1.00 exactly, in case AMI or Sun fix it with a
firmware update. Hey, you never know.

Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:24:11 +02:00
Phil Dibowitz f21a8311a9 USB: Fix UCR-61S2B unusual_dev entry
Recently this entry's bcd scope was narrowed so as not to falsly apply
to bcd's other than 0x0110. But while it breaks those of a larger bcd,
it is still needed for those of a smaller bcd - so this changes the
lower bcd limit to 0x0000.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:23:20 +02:00
Alan Stern 5c83895101 unusual_devs update for UCR-61S2B
The existing unusual_devs entry for the UCR-61S2B appears to have too
wide a revision range.  It matches at least one device that doesn't
respond to the initialization sequence.  Perhaps the sequence needs to
be updated, or perhaps something else can be done.  For now, this patch
(as764) restricts the range to include only the revision mentioned in
the original comment.

This resolves (for now!) Bugzilla entry #6950.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:22:24 +02:00
Pete Zaitcev 9bb4a9ba44 USB storage: fix ipod ejecting issue
Signed-off-by: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:18:00 +02:00
Phil Dibowitz a2390a76af USB Storage: unusual_devs: add supertop drives
This combines patches from Alan Stern and Robert Schedel for two "Super Top"
drives that need the IGNORE_RESIDUE flag but have different vendor IDs.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:17:17 +02:00
Mikko Honkala 51083285b8 USB: Nokia E70 is an unusual device
When the Nokia E70 Phone is plugged in to the USB port, I get:

end_request: I/O error, dev sda, sector 1824527
sd 0:0:0:0: SCSI error: return code = 0x10070000
end_request: I/O error, dev sda, sector 1824535
sd 0:0:0:0: SCSI error: return code = 0x10070000

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:16:42 +02:00
Jaco Kroon 7051ce2dd1 USB: add Digitech USB-Storage to unusual_devs.h
The mass storage device from Digitech designed for Flash Cards, as found
on (for example) the GNX4 device has issues with residue, similar to the
bug report at http://kerneltrap.org/node/6297.  This patch adds the
faulty storage device to unusual_devs.h, this not only reduces the noise
in dmesg but also increases the transfer speeds by a factor of 7x for me
(89kB/s -> 637kB/s).

T:  Bus=02 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1210 ProdID=0003 Rev= 1.00
S:  Manufacturer=DigiTech HMG
S:  Product=DigiTech Mass Storage
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=  0mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50
Driver=usb-storage
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms

Signed-off-by: Jaco Kroon <jaco@kroon.co.za>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:14:22 +02:00
Tobias Lorenz 80c52d7641 USB: Mitsumi USB FDD 061M: UNUSUAL_DEV multilun fix
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:10:55 +02:00
Phil Dibowitz d73ef9d3b6 USB: usb-storage: Unusual_dev update
The protocol in this entry is needed for some versions of the device but
not others. This adds the NEED_OVERRIDE flag to prevent it complaining
to users who don't need it.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:10:17 +02:00
Alan Stern 22246d496e USB: unusual_devs entry for Nokia 6234
This patch (as803) adds an unusual_devs entry for the Nokia 6234
mobile phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:08:55 +02:00
Alan Stern d7803bf382 USB: unusual_devs entry for Nokia 6131
This patch (as796) adds an unusual_devs entry for the Nokia 6131, which
doesn't like large transfer sizes.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:06:00 +02:00
Alan Stern 5f7102db89 USB: unusual-devs entry for Nokia E60
This patch (as794) adds an unusual_devs entry for the Nokia E60.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:03:42 +02:00
Phil Dibowitz 7c47d54d21 USB: unusual_dev entry for Sony P990i
This patch is a re-diffed version of one originally sent by
Jan Mate <mate@fiit.stuba.sk>.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:03:13 +02:00
Alan Stern 14f9953a8c USB: unusual_devs entry for Lacie DVD+-RW
This patch (as781) adds an entry to unusual_devs.h for the Lacie DVD+-RW
drive.  Apparently its USB interface has requirements similar to the
Genesys Logic interface; it doesn't like data to be sent too soon after
a command.

This fixes Bugzilla #6817.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:02:24 +02:00
Phil Dibowitz d92e39de3c USB Storage: unusual_devs.h for Sony Ericsson M600i
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 03:01:01 +02:00
Jürgen Mell e56df0401a USB floppy drive SAMSUNG SFD-321U/EP was detected 8 times
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:59:34 +01:00
David Kuehling 825661f361 USB: unusual_devs entry for A-VOX WSX-300ER MP3 player
This patch (as763) adds an unusual_devs entry for the A-VOX WSX-300ER MP3
player.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:57:41 +01:00
Mario Rettig 74b98c7c26 USB: unusual_devs entry for Nokia 3250
Here is another unusual_devs entry (as760) for another Nokia device,
this time the 3250.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:57:06 +01:00
Phil Dibowitz 81371c98b9 USB: another unusual device
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:56:30 +01:00
Alan Stern 6017d092e6 USB: unusual_devs entry for Nokia E61
This patch (as748) adds an unusual_devs entry for the Nokia E61 mobile
phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:56:02 +01:00
Alan Stern f5402dd797 USB: unusual_devs entry for Nokia N91
This patch (as745) adds an unusual_devs entry for the Nokia N91, just like
the entry for the N80 added a couple of weeks ago.  Apparently Nokia isn't
using very good firmware these days...

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:55:30 +01:00
Phil Dibowitz 1c4cb21c2d USB Storage: US_FL_MAX_SECTORS_64 flag
This patch adds a US_FL_MAX_SECTORS_64 and removes the Genesys special-cases
for this that were in scsiglue.c. It also adds the flag to other devices
reported to need it.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:54:59 +01:00
Ernis 4d5d3838da USB: unusual_devs entry for Samsung MP3 player
This patch (as730) contains an unusual_devs entry for a Samsung MP3
device.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:53:46 +01:00
Davide Perini 392a24815c usb-storage: unusual_devs entry for Motorola RAZR V3x
This patch (as725) adds an unusual_devs entry for the Motorola RAZR V3x.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:53:16 +01:00
Alan Stern b3c89496b4 USB: unusual_devs entry for Nokia N80
Here is a patch (as720) adding an unusual_devs entry for the Nokia N80
mobile phone.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:52:47 +01:00
Alan Stern 62756b800f usb-storage: unusual_devs entry for Nikon DSC D70s
This patch (as704) adds an unusual_devs entry for the Nikon DSC D70s,
which uses a different Product ID from the D70.  It also moves the entry
for the DSC E2000 up in the list, to preserve the numerical ordering.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:52:12 +01:00
Olivier Blondeau d75cfc1091 USB: storage: atmel unusual dev update
Originally submitted by Olivier Blondeau <zeitoun@gmail.com>, with re-diffing
by me. Adds a new atmel unusual_dev entry.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:51:39 +01:00
Phil Dibowitz 694355c5ac USB: Storage: unusual devs update
This patch removes the Protocol portion of the Iomega Click! device as it's not
needed. Not-needed message reported by Kenneth Crudup <kenny@panix.com>

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:50:55 +01:00
Rodolfo Quesada 1f6629566c USB: storage: new unusual_devs.h entry: Mitsumi 7in1 Card Reader
This patch (as661) adds an unusual_devs entry for the Mitsumi 7in1 Card
reader.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:50:11 +01:00
Phil Dibowitz de932b4b64 USB: storage: unusual_devs.h entry 0420:0001
Ref
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176584

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:49:34 +01:00
Phil Dibowitz e1fc34983a USB: storage: another unusual_devs.h entry
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:48:56 +01:00
Phil Dibowitz 6efa8538c4 USB: storage: sandisk unusual_devices entry
The following adds an unusual_devs entry for the SanDisk ImageMate CompactFlash
USB drive, for the US_FL_FIX_CAPACITY flag. Additionally, it removes trailing
whitespace from the previous entry. It's based on the patch sent by Roman Hodek
<roman@hodek.net>.

Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-25 01:48:23 +01:00
Hugh Dickins 955d349bbe pwc-uncompress.c shouldn't #include <asm/current.h>
Fix a compile error on powerpc.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-14 22:25:08 +01:00
Marcel Holtmann dfe67217ae Fix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)
Based on a patch from Don Howard <dhoward@redhat.com>

When calling write() with a buffer larger than 512 bytes, the
driver's write buffer overflows, allowing to overwrite the EIP and
execute arbitrary code with kernel privileges.

In read(), there exists a similar problem, but coming from the device.
A malicous or buggy device sending more than 512 bytes can overflow
of the driver's read buffer, with the same effects as above.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11 07:39:14 +01:00
Michael S. Tsirkin 59d2b00151 IB/mthca: Fix off-by-one in FMR handling on memfree
From: Michael S. Tsirkin <mst@mellanox.co.il>

mthca_table_find() will return the wrong address when the table entry
being searched for is exactly at the beginning of a sglist entry
(other than the first), because it uses >= when it should use >.

Example: assume we have 2 entries in scatterlist, 4K each, offset is 4K.
The current code will return first entry + 4K when we really want
the second entry.

In particular this means mapping an FMR on a memfree HCA may end up
writing the page table into the wrong place, leading to memory
corruption and also causing the HCA to use an incorrect address
translation table.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
2007-03-11 07:37:12 +01:00