kernel/git/stable/linux.git/arch, branch linux-2.6.39.y

alpha: fix several security issues

2011-08-03T19:42:52+00:00

commit 21c5977a836e399fc710ff2c5367845ed5c2527f upstream. Fix several security issues in Alpha-specific syscalls. Untested, but mostly trivial. 1. Signedness issue in osf_getdomainname allows copying out-of-bounds kernel memory to userland. 2. Signedness issue in osf_sysinfo allows copying large amounts of kernel memory to userland. 3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy size, allowing copying large amounts of kernel memory to userland. 4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows privilege escalation via writing return value of sys_wait4 to kernel memory. Signed-off-by: Dan Rosenberg Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

davinci: DM365 EVM: fix video input mux bits

2011-08-03T19:42:42+00:00

commit 9daedd833a38edd90cf7baa1b1fcf61c3a0721e3 upstream. Video input mux settings for tvp7002 and imager inputs were swapped. Comment was correct. Tested on EVM with tvp7002 input. Signed-off-by: Jon Povey Acked-by: Manjunath Hadli Signed-off-by: Sekhar Nori Signed-off-by: Greg Kroah-Hartman

x86: Make Dell Latitude E5420 use reboot=pci

2011-08-03T19:42:42+00:00

commit b7798d28ec15d20fd34b70fa57eb13f0cf6d1ecd upstream. Rebooting on the Dell E5420 often hangs with the keyboard or ACPI methods, but is reliable via the PCI method. [ hpa: this was deferred because we believed for a long time that the recent reshuffling of the boot priorities in commit 660e34cebf0a11d54f2d5dd8838607452355f321 fixed this platform. Unfortunately that turned out to be incorrect. ] Signed-off-by: Daniel J Blueman Link: http://lkml.kernel.org/r/1305248699-2347-1-git-send-email-daniel.blueman@gmail.com Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman

ARM: pxa: fix PGSR register address calculation

2011-08-03T19:42:28+00:00

commit beb0c9b056b1c23d2029b46a425362e9ccbeba01 upstream. The file mfp-pxa2xx.c defines a macro, PGSR(), which translates a gpio bank number to a PGSR register address. The function pxa2xx_mfp_suspend() erroneously passed in a gpio number instead of a gpio bank number. Signed-off-by: Paul Parsons Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman

ARM: pxa910: correct nand pmu setting

2011-08-03T19:42:27+00:00

commit d204b2c5b16df935fa9a546c528e168859fddcc0 upstream. The original pair of <0x01db, 208000000> is invalid. Correct to the valid value. Signed-off-by: Lei Wen Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman

ARM: pxa168: correct nand pmu setting

2011-08-03T19:42:27+00:00

commit 6662498e132dfa758925a160fd5ef80a083651c3 upstream. The original pair of <0x01db, 208000000> is invalid. Correct it to the valid value. The 6th bit of the NFC APMU register indicates NFC works whether at 156Mhz or 78Mhz. So 0x19b indicates NFC works at 156Mhz, and 0x1db indicates it works at 78Mhz. Signed-off-by: Lei Wen Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman

ARM: 6989/1: perf: do not start the PMU when no events are present

2011-08-03T19:42:27+00:00

commit f4f38430c94c38187db73a2cf3892cc8b12a2713 upstream. armpmu_enable can be called in situations where no events are present (for example, from the event rotation tick after a profiled task has exited). In this case, we currently start the PMU anyway which may leave it active inevitably without any events being monitored. This patch adds a simple check to the enabling code so that we avoid starting the PMU when no events are present. Reported-by: Ashwin Chaugle Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman

KVM: Fix register corruption in pvclock_scale_delta

2011-07-09T06:15:41+00:00

(cherry picked from commit de2d1a524e94a79078d9fe22c57c0c6009237547) The 128-bit multiply in pvclock.h was missing an output constraint for EDX which caused a register corruption to appear. Thanks to Ulrich for diagnosing the EDX corruption and Avi for providing this fix. Signed-off-by: Zachary Amsden Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman

oprofile, x86: Fix race in nmi handler while starting counters

2011-07-09T06:15:11+00:00

commit 8fe7e94eb71430cf63a742f3c19739d82a662758 upstream. In some rare cases, nmis are generated immediately after the nmi handler of the cpu was started. This causes the counter not to be enabled. Before enabling the nmi handlers we need to set variable ctr_running first and make sure its value is written to memory. Also, the patch makes all existing barriers a memory barrier instead of a compiler barrier only. Reported-by: Suravee Suthikulpanit Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman

x86, suspend: Restore MISC_ENABLE MSR in realmode wakeup

2011-07-09T06:15:11+00:00

commit 7a3136666bc0f0419f7aaa7b1fabb4b0e0a7fb76 upstream. Some BIOSes will reset the Intel MISC_ENABLE MSR (specifically the XD_DISABLE bit) when resuming from S3, which can interact poorly with ebba638ae723d8a8fc2f7abce5ec18b688b791d7. In 32bit PAE mode, this can lead to a fault when EFER is restored by the kernel wakeup routines, due to it setting the NX bit for a CPU that (thanks to the BIOS reset) now incorrectly thinks it lacks the NX feature. (64bit is not affected because it uses a common CPU bring-up that specifically handles the XD_DISABLE bit.) The need for MISC_ENABLE being restored so early is specific to the S3 resume path. Normally, MISC_ENABLE is saved in save_processor_state(), but this happens after the resume header is created, so just reproduce the logic here. (acpi_suspend_lowlevel() creates the header, calls do_suspend_lowlevel, which calls save_processor_state(), so the saved processor context isn't available during resume header creation.) [ hpa: Consider for stable if OK in mainline ] Signed-off-by: Kees Cook Link: http://lkml.kernel.org/r/20110707011034.GA8523@outflux.net Signed-off-by: H. Peter Anvin Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman