diff options
author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-02-13 12:16:30 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-02-13 12:16:30 -0800 |
commit | b9bea2875d55b981fe428acd5140876cf9240b27 (patch) | |
tree | af0d693f37bc02deb4f0ac9c7059e22ecf09f7b7 | |
parent | 969546ba3fefa2ceb2889c41d94c23886795fcb8 (diff) | |
download | longterm-queue-2.6.32-b9bea2875d55b981fe428acd5140876cf9240b27.tar.gz |
2.6.32-stable patches
added patches:
hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch
lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch
mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch
relay-prevent-integer-overflow-in-relay_open.patch
5 files changed, 161 insertions, 0 deletions
diff --git a/queue-2.6.32/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch b/queue-2.6.32/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch new file mode 100644 index 0000000..55139f7 --- /dev/null +++ b/queue-2.6.32/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch @@ -0,0 +1,31 @@ +From eb2f255b2d360df3f500042a2258dcf2fcbe89a2 Mon Sep 17 00:00:00 2001 +From: Nikolaus Schulz <schulz@macnetix.de> +Date: Wed, 8 Feb 2012 18:56:10 +0100 +Subject: hwmon: (f75375s) Fix bit shifting in f75375_write16 + +From: Nikolaus Schulz <schulz@macnetix.de> + +commit eb2f255b2d360df3f500042a2258dcf2fcbe89a2 upstream. + +In order to extract the high byte of the 16-bit word, shift the word to +the right, not to the left. + +Signed-off-by: Nikolaus Schulz <mail@microschulz.de> +Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + drivers/hwmon/f75375s.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/f75375s.c ++++ b/drivers/hwmon/f75375s.c +@@ -159,7 +159,7 @@ static inline void f75375_write8(struct + static inline void f75375_write16(struct i2c_client *client, u8 reg, + u16 value) + { +- int err = i2c_smbus_write_byte_data(client, reg, (value << 8)); ++ int err = i2c_smbus_write_byte_data(client, reg, (value >> 8)); + if (err) + return; + i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF)); diff --git a/queue-2.6.32/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch b/queue-2.6.32/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch new file mode 100644 index 0000000..1d31ace --- /dev/null +++ b/queue-2.6.32/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch @@ -0,0 +1,45 @@ +From 3310225dfc71a35a2cc9340c15c0e08b14b3c754 Mon Sep 17 00:00:00 2001 +From: Wu Fengguang <fengguang.wu@intel.com> +Date: Mon, 9 Jan 2012 11:53:50 -0600 +Subject: lib: proportion: lower PROP_MAX_SHIFT to 32 on 64-bit kernel + +From: Wu Fengguang <fengguang.wu@intel.com> + +commit 3310225dfc71a35a2cc9340c15c0e08b14b3c754 upstream. + +PROP_MAX_SHIFT should be set to <=32 on 64-bit box. This fixes two bugs +in the below lines of bdi_dirty_limit(): + + bdi_dirty *= numerator; + do_div(bdi_dirty, denominator); + +1) divide error: do_div() only uses the lower 32 bit of the denominator, + which may trimmed to be 0 when PROP_MAX_SHIFT > 32. + +2) overflow: (bdi_dirty * numerator) could easily overflow if numerator + used up to 48 bits, leaving only 16 bits to bdi_dirty + +Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> +Reported-by: Ilya Tumaykin <librarian_rus@yahoo.com> +Tested-by: Ilya Tumaykin <librarian_rus@yahoo.com> +Signed-off-by: Wu Fengguang <fengguang.wu@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + include/linux/proportions.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/include/linux/proportions.h ++++ b/include/linux/proportions.h +@@ -81,7 +81,11 @@ void prop_inc_percpu(struct prop_descrip + * Limit the time part in order to ensure there are some bits left for the + * cycle counter and fraction multiply. + */ ++#if BITS_PER_LONG == 32 + #define PROP_MAX_SHIFT (3*BITS_PER_LONG/4) ++#else ++#define PROP_MAX_SHIFT (BITS_PER_LONG/2) ++#endif + + #define PROP_FRAC_SHIFT (BITS_PER_LONG - PROP_MAX_SHIFT - 1) + #define PROP_FRAC_BASE (1UL << PROP_FRAC_SHIFT) diff --git a/queue-2.6.32/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch b/queue-2.6.32/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch new file mode 100644 index 0000000..54bd7bd --- /dev/null +++ b/queue-2.6.32/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch @@ -0,0 +1,33 @@ +From 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 Mon Sep 17 00:00:00 2001 +From: Eliad Peller <eliad@wizery.com> +Date: Wed, 1 Feb 2012 18:48:09 +0200 +Subject: mac80211: timeout a single frame in the rx reorder buffer + +From: Eliad Peller <eliad@wizery.com> + +commit 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 upstream. + +The current code checks for stored_mpdu_num > 1, causing +the reorder_timer to be triggered indefinitely, but the +frame is never timed-out (until the next packet is received) + +Signed-off-by: Eliad Peller <eliad@wizery.com> +Acked-by: Johannes Berg <johannes@sipsolutions.net> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + net/mac80211/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2363,7 +2363,7 @@ static u8 ieee80211_sta_manage_reorder_b + index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) + % tid_agg_rx->buf_size; + if (!tid_agg_rx->reorder_buf[index] && +- tid_agg_rx->stored_mpdu_num > 1) { ++ tid_agg_rx->stored_mpdu_num) { + /* + * No buffers ready to be released, but check whether any + * frames in the reorder buffer have timed out. diff --git a/queue-2.6.32/relay-prevent-integer-overflow-in-relay_open.patch b/queue-2.6.32/relay-prevent-integer-overflow-in-relay_open.patch new file mode 100644 index 0000000..2e9f446 --- /dev/null +++ b/queue-2.6.32/relay-prevent-integer-overflow-in-relay_open.patch @@ -0,0 +1,48 @@ +From f6302f1bcd75a042df69866d98b8d775a668f8f1 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Fri, 10 Feb 2012 09:03:58 +0100 +Subject: relay: prevent integer overflow in relay_open() + +From: Dan Carpenter <dan.carpenter@oracle.com> + +commit f6302f1bcd75a042df69866d98b8d775a668f8f1 upstream. + +"subbuf_size" and "n_subbufs" come from the user and they need to be +capped to prevent an integer overflow. + +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Jens Axboe <axboe@kernel.dk> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> + +--- + kernel/relay.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -171,10 +171,14 @@ depopulate: + */ + static struct rchan_buf *relay_create_buf(struct rchan *chan) + { +- struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); +- if (!buf) ++ struct rchan_buf *buf; ++ ++ if (chan->n_subbufs > UINT_MAX / sizeof(size_t *)) + return NULL; + ++ buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); ++ if (!buf) ++ return NULL; + buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL); + if (!buf->padding) + goto free_buf; +@@ -581,6 +585,8 @@ struct rchan *relay_open(const char *bas + + if (!(subbuf_size && n_subbufs)) + return NULL; ++ if (subbuf_size > UINT_MAX / n_subbufs) ++ return NULL; + + chan = kzalloc(sizeof(struct rchan), GFP_KERNEL); + if (!chan) diff --git a/queue-2.6.32/series b/queue-2.6.32/series index c458036..4d9e87e 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -1 +1,5 @@ drm-i915-no-lvds-quirk-for-aopen-mp45.patch +hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch +lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch +relay-prevent-integer-overflow-in-relay_open.patch +mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch |