Linux kernel stable tree https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-2.6.37.y 2010-12-26T20:06:56+00:00 2010-12-26T20:06:56+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-12-26T20:06:56+00:00 urn:sha1:d7c1255a3a21e98bdc64df8ccf005a174d7e6289 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits) ipv4: dont create routes on down devices epic100: hamachi: yellowfin: Fix skb allocation size sundance: Fix oopses with corrupted skb_shared_info Revert "ipv4: Allow configuring subnets as local addresses" USB: mcs7830: return negative if auto negotiate fails irda: prevent integer underflow in IRLMP_ENUMDEVICES tcp: fix listening_get_next() atl1c: Do not use legacy PCI power management mac80211: fix mesh forwarding MAINTAINERS: email address change net: Fix range checks in tcf_valid_offset(). net_sched: sch_sfq: fix allot handling hostap: remove netif_stop_queue from init mac80211/rt2x00: add ieee80211_tx_status_ni() typhoon: memory corruption in typhoon_get_drvinfo() net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant net_sched: always clone skbs ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed. netlink: fix gcc -Wconversion compilation warning asix: add USB ID for Logitec LAN-GTJ U2A ... 2010-12-23T18:09:43+00:00 Dan Rosenberg drosenberg@vsecurity.com 2010-12-22T13:58:27+00:00 urn:sha1:fdac1e0697356ac212259f2147aa60c72e334861 If the user-provided len is less than the expected offset, the IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large size value. While this isn't be a security issue on x86 because it will get caught by the access_ok() check, it may leak large amounts of kernel heap on other architectures. In any event, this patch fixes it. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: David S. Miller <davem@davemloft.net> 2010-11-19T23:25:59+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-11-19T23:25:59+00:00 urn:sha1:caf8394524fdc039b090cd3af99157e9e76f4f06 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (31 commits) net: fix kernel-doc for sk_filter_rcu_release be2net: Fix to avoid firmware update when interface is not open. netfilter: fix IP_VS dependencies net: irda: irttp: sync error paths of data- and udata-requests ipv6: Expose reachable and retrans timer values as msecs ipv6: Expose IFLA_PROTINFO timer values in msecs instead of jiffies 3c59x: fix build failure on !CONFIG_PCI ipg.c: remove id [SUNDANCE, 0x1021] net: caif: spi: fix potential NULL dereference ath9k_htc: Avoid setting QoS control for non-QoS frames net: zero kobject in rx_queue_release net: Fix duplicate volatile warning. MAINTAINERS: Add stmmac maintainer bonding: fix a race in IGMP handling cfg80211: fix can_beacon_sec_chan, reenable HT40 gianfar: fix signedness issue net: bnx2x: fix error value sign 8139cp: fix checksum broken r8169: fix checksum broken rds: Integer overflow in RDS cmsg handling ... 2010-11-18T20:24:25+00:00 Wolfram Sang w.sang@pengutronix.de 2010-11-16T09:40:02+00:00 urn:sha1:925e277f5221defdc53cbef1ac3ed1803fa32357 irttp_data_request() returns meaningful errorcodes, while irttp_udata_request() just returns -1 in similar situations. Sync the two and the loglevels of the accompanying output. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Samuel Ortiz <sameo@linux.intel.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net> 2010-11-17T16:59:32+00:00 Arnd Bergmann arnd@arndb.de 2010-11-17T15:26:55+00:00 urn:sha1:451a3c24b0135bce54542009b5fde43846c7cf67 The big kernel lock has been removed from all these files at some point, leaving only the #include. Remove this too as a cleanup. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2010-11-16T17:50:47+00:00 Wolfram Sang w.sang@pengutronix.de 2010-11-16T17:50:47+00:00 urn:sha1:4c62ab9c538bc09c38093fa079e6902ea4d42b98 Sending zero byte packets is not neccessarily an error (AF_INET accepts it, too), so just apply a shortcut. This was discovered because of a non-working software with WINE. See http://bugs.winehq.org/show_bug.cgi?id=19397#c86 http://thread.gmane.org/gmane.linux.irda.general/1643 for very detailed debugging information and a testcase. Kudos to Wolfgang for those! Reported-by: Wolfgang Schwotzer <wolfgang.schwotzer@gmx.net> Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Tested-by: Mike Evans <mike.evans@cardolan.com> Signed-off-by: David S. Miller <davem@davemloft.net> 2010-10-24T20:41:39+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-10-24T20:41:39+00:00 urn:sha1:229aebb873e29726b91e076161649cf45154b0bf * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits) Update broken web addresses in arch directory. Update broken web addresses in the kernel. Revert "drivers/usb: Remove unnecessary return's from void functions" for musb gadget Revert "Fix typo: configuation => configuration" partially ida: document IDA_BITMAP_LONGS calculation ext2: fix a typo on comment in ext2/inode.c drivers/scsi: Remove unnecessary casts of private_data drivers/s390: Remove unnecessary casts of private_data net/sunrpc/rpc_pipe.c: Remove unnecessary casts of private_data drivers/infiniband: Remove unnecessary casts of private_data drivers/gpu/drm: Remove unnecessary casts of private_data kernel/pm_qos_params.c: Remove unnecessary casts of private_data fs/ecryptfs: Remove unnecessary casts of private_data fs/seq_file.c: Remove unnecessary casts of private_data arm: uengine.c: remove C99 comments arm: scoop.c: remove C99 comments Fix typo configue => configure in comments Fix typo: configuation => configuration Fix typo interrest[ing|ed] => interest[ing|ed] Fix various typos of valid in comments ... Fix up trivial conflicts in: drivers/char/ipmi/ipmi_si_intf.c drivers/usb/gadget/rndis.c net/irda/irnet/irnet_ppp.c 2010-10-11T00:12:26+00:00 Samuel Ortiz samuel@sortiz.org 2010-10-05T23:03:12+00:00 urn:sha1:37f9fc452d138dfc4da2ee1ce5ae85094efc3606 While parsing the GetValuebyClass command frame, we could potentially write passed the skb->data pointer. Cc: stable@kernel.org Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org> 2010-10-11T00:12:17+00:00 Samuel Ortiz samuel@sortiz.org 2010-10-10T23:17:56+00:00 urn:sha1:efc463eb508798da4243625b08c7396462cabf9f Cc: stable@kernel.org Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org> 2010-10-11T00:11:34+00:00 Samuel Ortiz samuel@sortiz.org 2010-10-04T23:24:20+00:00 urn:sha1:f8cba16cad68c9b9ee7fecae48a1b91708e8e482 The code intends to lock the irnet_socket, so adding a mutex to it allows for a complet BKL removal. Signed-off-by: Samuel Ortiz <samuel@sortiz.org>