On AMD SB700/SB800/Hudson-2/3 platforms, USB EHCI controller may read/write
to memory space not allocated to USB controller if there is longer than
normal latency on DMA read encountered. In this condition the exposure will
be encountered only if the driver has following format of Periodic Frame
List link pointer structure:

For any idle periodic schedule, the Frame List link pointers that have the
T-bit set to 1 intending to terminate the use of frame list link pointer
as a physical memory pointer.

Idle periodic schedule Frame List Link pointer shoule be in the following
format to avoid the issue:

Frame list link pointer should be always contains a valid pointer to a
inactive QHead with T-bit set to 0.
Signed-off-by: NAndiry Xu <andiry.xu@amd.com>
Acked-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

They should not be writable by any user.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Hao Wu <hao.wu@intel.com>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Alek Du <alek.du@intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

They should not be writable by any user.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Harrison Metzger <harrisonmetz@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

They should not be writable by any user.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It should not be writable by any user.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Sam Hocevar <sam@zoy.org>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

They should not be writable by any user.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Oliver Bock <bock@tfh-berlin.de>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

A non-writable sysfs file shouldn't have writable attributes.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Kevin Lloyd <klloyd@sierrawireless.com>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The permissions for the lpm debugfs file is incorrect, this fixes it.
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Alek Du <alek.du@intel.com>
Cc: Jacob Pan <jacob.jun.pan@intel.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some of the sysfs files had the incorrect permissions.  Some didn't make
sense at all (writable for a file that you could not write to?)
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Cc: Matthieu Castet <castet.matthieu@free.fr>
Cc: Stanislaw Gruszka <stf_xl@wp.pl>
Cc: Damien Bergamini <damien.bergamini@free.fr>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Merge branch 'for-usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus

* 'for-usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci:
  xhci: Fix command ring replay after resume.
  xHCI: fix wMaxPacketSize mask
  xHCI: release spinlock when setup interrupt
  xhci: Remove excessive printks with shared IRQs.

Andiry's xHCI bus suspend patch introduced the possibly of a host
controller replaying old commands on the command ring, if the host
successfully restores the registers after a resume.

After a resume from suspend, the xHCI driver must restore the registers,
including the command ring pointer.  I had suggested that Andiry set the
command ring pointer to the current command ring dequeue pointer, so that
the driver wouldn't have to zero the command ring.

Unfortunately, setting the command ring pointer to the current dequeue
pointer won't work because the register assumes the pointer is 64-byte
aligned, and TRBs on the command ring are 16-byte aligned.  The lower
seven bits will always be masked off, leading to the written pointer being
up to 3 TRBs behind the intended pointer.

Here's a log excerpt.  On init, the xHCI driver places a vendor-specific
command on the command ring:

[  215.750958] xhci_hcd 0000:01:00.0: Vendor specific event TRB type = 48
[  215.750960] xhci_hcd 0000:01:00.0: NEC firmware version 30.25
[  215.750962] xhci_hcd 0000:01:00.0: Command ring deq = 0x3781e010 (DMA)

When we resume, the command ring dequeue pointer to be written should have
been 0x3781e010.  Instead, it's 0x3781e000:

[  235.557846] xhci_hcd 0000:01:00.0: // Setting command ring address to 0x3781e001
[  235.557848] xhci_hcd 0000:01:00.0: `MEM_WRITE_DWORD(3'b000, 64'hffffc900100bc038, 64'h3781e001, 4'hf);
[  235.557850] xhci_hcd 0000:01:00.0: `MEM_WRITE_DWORD(3'b000, 32'hffffc900100bc020, 32'h204, 4'hf);
[  235.557866] usb usb9: root hub lost power or was reset

(I can't see the results of this bug because the xHCI restore always fails
on this box, and the xHCI driver re-allocates everything.)

The fix is to zero the command ring and put the software and hardware
enqueue and dequeue pointer back to the beginning of the ring.  We do this
before the system suspends, to be paranoid and prevent the BIOS from
starting the host without clearing the command ring pointer, which might
cause the host to muck with stale memory.  (The pointer isn't required to
be in the suspend power well, but it could be.)  The command ring pointer
is set again after the host resumes.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: NAndiry Xu <andiry.xu@amd.com>

* 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6:
  drivers/pcmcia/soc_common.c: Use printf extension %pV
  pcmcia: fix warning in synclink driver
  pcmcia/sa1100: don't put machine specific init functions in .init.text
  pcmcia/cm4000: fix error code
  pd6729: Coding Style fixes

This reverts commit 47d3904f.

Crashes any x86 serial console bootup:

  Console: colour VGA+ 80x25
  BUG: unable to handle kernel NULL pointer dereference at 0000000000000158
  IP: [<ffffffff811ebcb4>] serial8250_do_set_termios+0x1d4/0x430
  ...
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Cc: Greg KH <gregkh@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: padlock - Fix AES-CBC handling on odd-block-sized input
  crypto: n2 - dubious error check

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  [media] soc-camera: Compile fixes for mx2-camera
  [media] SoC Camera: ov6650: minor cleanups
  [media] SOC Camera: OMAP1: typo fix
  [media] SoC Camera: OMAP1: update for recent videobuf changes
  [media] SoC Camera: OMAP1: update for recent framework changes
  [media] ARM mx3_camera: check for DMA engine type
  [media] tm6000: bugfix set tv standards
  [media] cafe_ccic: fix subdev configuration
  [media] saa7134: Fix autodetect for Behold A7 and H7 TV cards
  [media] v4l: kill the BKL
  [media] BZ#22292: dibx000_common: Restore i2c algo pointer

More recent GCC caused the i8k driver to stop working, on Slackware
compiler was upgraded from gcc-4.4.4 to gcc-4.5.1 after which it didn't
work anymore, meaning the driver didn't load or gave total nonsensical
output.

As it turned out the asm(..) statement forgot to mention it modifies the
*regs variable.

Credits to Andi Kleen and Andreas Schwab for providing the fix.
Signed-off-by: NJim Bos <jim876@xs4all.nl>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently we have:

  --w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custom_method

which is just crazy. Change this to --w-------.
Signed-off-by: NDave Jones <davej@redhat.com>
Signed-off-by: NLen Brown <len.brown@intel.com>
Cc: stable@kernel.org (for 2.6.36)
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (66 commits)
  can-bcm: fix minor heap overflow
  gianfar: Do not call device_set_wakeup_enable() under a spinlock
  ipv6: Warn users if maximum number of routes is reached.
  docs: Add neigh/gc_thresh3 and route/max_size documentation.
  axnet_cs: fix resume problem for some Ax88790 chip
  ipv6: addrconf: don't remove address state on ifdown if the address is being kept
  tcp: Don't change unlocked socket state in tcp_v4_err().
  x25: Prevent crashing when parsing bad X.25 facilities
  cxgb4vf: add call to Firmware to reset VF State.
  cxgb4vf: Fail open if link_start() fails.
  cxgb4vf: flesh out PCI Device ID Table ...
  cxgb4vf: fix some errors in Gather List to skb conversion
  cxgb4vf: fix bug in Generic Receive Offload
  cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue()
  ixgbe: Look inside vlan when determining offload protocol.
  bnx2x: Look inside vlan when determining checksum proto.
  vlan: Add function to retrieve EtherType from vlan packets.
  virtio-net: init link state correctly
  ucc_geth: Fix deadlock
  ucc_geth: Do not bring the whole IF down when TX failure.
  ...

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  drivers/ata/pata_octeon_cf.c: delete double assignment
  pata_legacy: fix CONFIG_PATA_WINBOND_VLB_MODULE test
  libata: fix NULL sdev dereference race in atapi_qc_complete()

* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (38 commits)
  Revert "staging: tidspbridge: replace iommu custom for opensource implementation"
  Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c"
  Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name"
  Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c"
  Revert "staging: tidspbridge - fix mmufault support"
  Revert "staging: tidspbridge - remove hw directory"
  Revert "staging: tidspbridge - move all iommu related code to a new file"
  Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct"
  Revert "staging: tidspbridge - remove reserved memory clean up"
  Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions"
  Revert "staging: tidspbridge - remove dmm custom module"
  Revert "staging: tidspbridge - update Kconfig to select IOMMU module"
  staging: tidspbridge: hardcode SCM macros while fix is upstreamed
  Staging: keucr driver: fix uninitialized variable & proper memset length
  omap: dsp: remove shm from normal memory
  Staging: wlan-ng: Fix wrong #ifdef #endif sequence
  Staging: Update parameters for cfg80211 key management operation
  Staging: ath6kl: Fix pointer casts on 64-bit architectures
  Staging: batman-adv: suppress false warning when changing the mac address
  Staging: batman-adv: fix interface alternating and bonding reggression
  ...

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (28 commits)
  Revert "USB: xhci: Use GFP_ATOMIC under spin_lock"
  USB: ohci-jz4740: Fix spelling in MODULE_ALIAS
  UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference if kzalloc fails
  usb: core: fix information leak to userland
  usb: misc: iowarrior: fix information leak to userland
  usb: misc: sisusbvga: fix information leak to userland
  usb: subtle increased memory usage in u_serial
  USB: option: fix when the driver is loaded incorrectly for some Huawei devices.
  USB: xhci: Use GFP_ATOMIC under spin_lock
  usb: gadget: goku_udc: add registered flag bit, fixing build
  USB: ehci/mxc: compile fix
  USB: Fix FSL USB driver on non Open Firmware systems
  USB: the development of the usb tree is now in git
  usb: musb: fail unaligned DMA transfers on v1.8 and above
  USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial
  usb.h: fix ioctl kernel-doc info
  usb: musb: gadget: kill duplicate code in musb_gadget_queue()
  usb: musb: Fix handling of spurious SESSREQ
  usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time
  USB: musb: blackfin: push clkin value to platform resources
  ...

* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  n_gsm: Fix length handling
  n_gsm: Copy n2 over when configuring via ioctl interface
  serial: bfin_5xx: grab port lock before making port termios changes
  serial: bfin_5xx: disable CON_PRINTBUFFER for consoles
  serial: bfin_5xx: remove redundant SSYNC to improve TX speed
  serial: bfin_5xx: always include DMA headers
  vcs: make proper usage of the poll flags
  amiserial: Remove unused variable icount
  8250: Fix tcsetattr to avoid ioctl(TIOCMIWAIT) hang
  tty_ldisc: Fix BUG() on hangup
  TTY: restore tty_ldisc_wait_idle
  SERIAL: blacklist si3052 chip
  drivers/serial/bfin_5xx.c: Fix line continuation defects
  tty: prevent DOS in the flush_to_ldisc
  8250: add support for Kouwell KW-L221N-2
  nozomi: Fix warning from the previous TIOCGCOUNT changes
  tty: fix warning in synclink driver
  tty: Fix formatting in tty.h
  tty: the development tree is now done in git

* 'upstream/core' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen:
  xen: do not release any memory under 1M in domain 0
  xen: events: do not unmask event channels on resume
  xen: correct size of level2_kernel_pgt

Merge branch 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  MAINTAINERS: Mark XEN lists as moderated
  xen-pcifront: fix PCI reference leak
  xen-pcifront: Remove duplicate inclusion of headers.
  xen: fix memory leak in Xen PCI MSI/MSI-X allocator.
  MAINTAINERS: Update mailing list name for Xen pieces.

Delete successive assignments to the same location.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression i;
@@

*i = ...;
 i = ...;
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

pata_legacy is incorrectly testing PATA_WINBOND_VLB_MODULE instead of
CONFIG_PATA_WINBOND_VLB_MODULE.  Fix it.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-by: N"Robert P. J. Day" <rpjday@crashcourse.ca>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

SCSI commands may be issued between __scsi_add_device() and dev->sdev
assignment, so it's unsafe for ata_qc_complete() to dereference
dev->sdev->locked without checking whether it's NULL or not.  Fix it.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: stable@kernel.org
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

On 64-bit platforms the ASCII representation of a pointer may be up to 17
bytes long. This patch increases the length of the buffer accordingly.

http://marc.info/?l=linux-netdev&m=128872251418192&w=2Reported-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NOliver Hartkopp <socketcan@hartkopp.net>
CC: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The gianfar driver calls device_set_wakeup_enable() under a spinlock,
which causes a problem to happen after the recent core power
management changes, because this function can sleep now.  Fix this
by moving the device_set_wakeup_enable() call out of the
spinlock-protected area.
Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This gives users at least some clue as to what the problem
might be and how to go about fixing it.
Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

axnet_cs:
    Some Ax88790 chip need to reinitialize the CISREG_CCSR register
    after resume.
Signed-off-by: NKen Kawasaki <ken_kawasaki@spring.nifty.jp>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Currently, addrconf_ifdown does not delete statically configured IPv6
addresses when the interface is brought down. The intent is that when
the interface comes back up the address will be usable again. However,
this doesn't actually work, because the system stops listening on the
corresponding solicited-node multicast address, so the address cannot
respond to neighbor solicitations and thus receive traffic. Also, the
code notifies the rest of the system that the address is being deleted
(e.g, RTM_DELADDR), even though it is not. Fix it so that none of this
state is updated if the address is being kept on the interface.

Tested: Added a statically configured IPv6 address to an interface,
started ping, brought link down, brought link up again. When link came
up ping kept on going and "ip -6 maddr" showed that the host was still
subscribed to there
Signed-off-by: NLorenzo Colitti <lorenzo@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Alexey Kuznetsov noticed a regression introduced by
commit f1ecd5d9
("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable")

The RTO and timer modification code added to tcp_v4_err()
doesn't check sock_owned_by_user(), which if true means we
don't have exclusive access to the socket and therefore cannot
modify it's critical state.

Just skip this new code block if sock_owned_by_user() is true
and eliminate the now superfluous sock_owned_by_user() code
block contained within.
Reported-by: NAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
CC: Damian Lukowski <damian@tvk.rwth-aachen.de>
Acked-by: NEric Dumazet <eric.dumazet@gmail.com>

Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add call to Firmware to reset its VF State when we first attach to the VF.
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fail open if link_start() fails.
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add a bunch of T4 Device IDs for the VF Driver.
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There were some errors in the way that internal Gather Lists were being
translated into skb's.  This also makes the VF Driver look more like the PF
Driver to facilitate easier comarison.
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix botch in Generic Receive Offload (the Packet Gather List Total length
field wasn't being initialized).
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>