~thopiekar/linux/+git/linux-stable:linux-2.6.28.y

Last commit made on 2009-05-02
Get this branch:
git clone -b linux-2.6.28.y https://git.launchpad.net/~thopiekar/linux/+git/linux-stable

Branch merges

Branch information

Name:
linux-2.6.28.y
Repository:
lp:~thopiekar/linux/+git/linux-stable

Recent commits

5861c85... by Greg Kroah-Hartman <email address hidden>

Linux 2.6.28.10

e002195... by Eugene Teo <email address hidden>

unreached code in selinux_ip_postroute_iptables_compat() (CVE-2009-1184)

Not upstream in 2.6.30, as the function was removed there, making this a
non-issue.

Node and port send checks can skip in the compat_net=1 case. This bug
was introduced in commit effad8d.

Signed-off-by: Eugene Teo <email address hidden>
Reported-by: Dan Carpenter <email address hidden>
Acked-by: James Morris <email address hidden>
Acked-by: Paul Moore <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

9817e23... by Henrique de Moraes Holschuh

thinkpad-acpi: fix LED blinking through timer trigger

commit 75bd3bf2ade9d548be0d2bde60b5ee0fdce0b127 upstream.

The set_blink hook code in the LED subdriver would never manage to get
a LED to blink, and instead it would just turn it on. The consequence
of this is that the "timer" trigger would not cause the LED to blink
if given default parameters.

This problem exists since 2.6.26-rc1.

To fix it, switch the deferred LED work handling to use the
thinkpad-acpi-specific LED status (off/on/blink) directly.

This also makes the code easier to read, and to extend later.

Signed-off-by: Henrique de Moraes Holschuh <email address hidden>
Cc: <email address hidden>
Signed-off-by: Len Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

8967d37... by Michael Buesch

b44: Use kernel DMA addresses for the kernel DMA API

commit 37efa239901493694a48f1d6f59f8de17c2c4509 upstream.

We must not use the device DMA addresses for the kernel DMA API, because
device DMA addresses have an additional offset added for the SSB translation.

Use the original dma_addr_t for the sync operation.

Cc: <email address hidden>
Signed-off-by: Michael Buesch <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

eab3d54... by Oleg Nesterov <email address hidden>

exit_notify: kill the wrong capable(CAP_KILL) check (CVE-2009-1337)

CVE-2009-1337

commit 432870dab85a2f69dc417022646cb9a70acf7f94 upstream.

The CAP_KILL check in exit_notify() looks just wrong, kill it.

Whatever logic we have to reset ->exit_signal, the malicious user
can bypass it if it execs the setuid application before exiting.

Signed-off-by: Oleg Nesterov <email address hidden>
Acked-by: Serge Hallyn <email address hidden>
Acked-by: Roland McGrath <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

1151ad3... by Yu Zhao <email address hidden>

PCI: fix incorrect mask of PM No_Soft_Reset bit

commit 998dd7c719f62dcfa91d7bf7f4eb9c160e03d817 upstream.

Reviewed-by: Matthew Wilcox <email address hidden>
Signed-off-by: Yu Zhao <email address hidden>
Signed-off-by: Jesse Barnes <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

82a8bec... by Christian Hohnstädt

crypto: ixp4xx - Fix handling of chained sg buffers

commit 0d44dc59b2b434b29aafeae581d06f81efac7c83 upstream.

 - keep dma functions away from chained scatterlists.
   Use the existing scatterlist iteration inside the driver
   to call dma_map_single() for each chunk and avoid dma_map_sg().

Signed-off-by: Christian Hohnstaedt <email address hidden>
Tested-By: Karl Hiramoto <email address hidden>
Signed-off-by: Herbert Xu <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

358c4bc... by Miklos Szeredi <email address hidden>

fix ptrace slowness

commit 53da1d9456fe7f87a920a78fdbdcf1225d197cb7 upstream.

This patch fixes bug #12208:

  Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=12208
  Subject : uml is very slow on 2.6.28 host

This turned out to be not a scheduler regression, but an already
existing problem in ptrace being triggered by subtle scheduler
changes.

The problem is this:

 - task A is ptracing task B
 - task B stops on a trace event
 - task A is woken up and preempts task B
 - task A calls ptrace on task B, which does ptrace_check_attach()
 - this calls wait_task_inactive(), which sees that task B is still on the runq
 - task A goes to sleep for a jiffy
 - ...

Since UML does lots of the above sequences, those jiffies quickly add
up to make it slow as hell.

This patch solves this by not rescheduling in read_unlock() after
ptrace_stop() has woken up the tracer.

Thanks to Oleg Nesterov and Ingo Molnar for the feedback.

Signed-off-by: Miklos Szeredi <email address hidden>
CC: <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

e179e9a... by Hugh Dickins <email address hidden>

fs core fixes

Please add the following 4 commits to 2.6.27-stable and 2.6.28-stable.
However, there has been a lot of change here between 2.6.28 and 2.6.29:
in particular, fs/exec.c's unsafe_exec() grew into the more complicated
check_unsafe_exec(). So applying the original patches gives too many
rejects: at the bottom is the diffstat and the combined patch required.

1
Commit: 53e9309e01277ec99c38e84e0ca16921287cf470
Author: Hugh Dickins <email address hidden>
Date: Sat, 28 Mar 2009 23:16:03 +0000 (+0000)
Subject: compat_do_execve should unshare_files

2
Commit: e426b64c412aaa3e9eb3e4b261dc5be0d5a83e78
Author: Hugh Dickins <email address hidden>
Date: Sat, 28 Mar 2009 23:20:19 +0000 (+0000)
Subject: fix setuid sometimes doesn't

3
Commit: 7c2c7d993044cddc5010f6f429b100c63bc7dffb
Author: Hugh Dickins <email address hidden>
Date: Sat, 28 Mar 2009 23:21:27 +0000 (+0000)
Subject: fix setuid sometimes wouldn't

4
Commit: f1191b50ec11c8e2ca766d6d99eb5bb9d2c084a3
Author: Al Viro <email address hidden>
Date: Mon, 30 Mar 2009 11:35:18 +0000 (-0400)
Subject: check_unsafe_exec() doesn't care about signal handlers sharing

Signed-off-by: Hugh Dickins <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>

898c2fd... by Josh Boyer

powerpc: Sanitize stack pointer in signal handling code

This has been backported to 2.6.28.x from commit efbda86098 in Linus' tree

On powerpc64 machines running 32-bit userspace, we can get garbage bits in the
stack pointer passed into the kernel. Most places handle this correctly, but
the signal handling code uses the passed value directly for allocating signal
stack frames.

This fixes the issue by introducing a get_clean_sp function that returns a
sanitized stack pointer. For 32-bit tasks on a 64-bit kernel, the stack
pointer is masked correctly. In all other cases, the stack pointer is simply
returned.

Additionally, we pass an 'is_32' parameter to get_sigframe now in order to
get the properly sanitized stack. The callers are know to be 32 or 64-bit
statically.

Signed-off-by: Josh Boyer <email address hidden>
Signed-off-by: Benjamin Herrenschmidt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>