]> git.pld-linux.org Git - packages/kernel.git/blob - kernel-small_fixes.patch
- add 'n_tty: Fix buffer overruns with larger-than-4k pastes' upstream fix
[packages/kernel.git] / kernel-small_fixes.patch
1 --- linux-2.6.33/scripts/mod/modpost.c~ 2010-02-24 19:52:17.000000000 +0100
2 +++ linux-2.6.33/scripts/mod/modpost.c  2010-03-07 14:26:47.242168558 +0100
3 @@ -15,7 +15,8 @@
4  #include <stdio.h>
5  #include <ctype.h>
6  #include "modpost.h"
7 -#include "../../include/generated/autoconf.h"
8 +// PLD architectures don't use CONFIG_SYMBOL_PREFIX
9 +//#include "../../include/generated/autoconf.h"
10  #include "../../include/linux/license.h"
11  
12  /* Some toolchains use a `_' prefix for all user symbols. */
13
14 --- linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh~       2011-07-22 04:17:23.000000000 +0200
15 +++ linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh        2011-08-25 21:26:04.799150642 +0200
16 @@ -9,6 +9,12 @@
17                         $cc -print-file-name=lib${lib}.${ext} | grep -q /
18                         if [ $? -eq 0 ]; then
19                                 echo "-l${lib}"
20 +                               for libt in tinfow tinfo ; do
21 +                                       $cc -print-file-name=lib${libt}.${ext} | grep -q /
22 +                                       if [ $? -eq 0 ]; then
23 +                                               echo "-l${libt}"
24 +                                       fi
25 +                               done
26                                 exit
27                         fi
28                 done
29
30 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
31 index 7a0c800..ec5ebbb 100644
32 --- a/drivers/net/ethernet/realtek/r8169.c
33 +++ b/drivers/net/ethernet/realtek/r8169.c
34 @@ -6927,6 +6927,14 @@ rtl_init_one(struct pci_dev *pdev, const
35         for (i = 0; i < ETH_ALEN; i++)
36                 dev->dev_addr[i] = RTL_R8(MAC0 + i);
37  
38 +       if (!is_valid_ether_addr(dev->dev_addr)) {
39 +               /* Report it and use a random ethernet address instead */
40 +               netdev_err(dev, "Invalid MAC address: %pM\n", dev->dev_addr);
41 +               random_ether_addr(dev->dev_addr);
42 +               netdev_info(dev, "Using random MAC address: %pM\n",
43 +                               dev->dev_addr);
44 +       }
45 +
46         SET_ETHTOOL_OPS(dev, &rtl8169_ethtool_ops);
47         dev->watchdog_timeo = RTL8169_TX_TIMEOUT;
48  
49 [PATCH] SCSI: Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
50
51 If a device has the skip_vpd_pages flag set we should simply fail the
52 scsi_get_vpd_page() call.
53
54 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
55 Acked-by: Alan Stern <stern@rowland.harvard.edu>
56 Tested-by: Stuart Foster <smf.linux@ntlworld.com>
57 Cc: stable@vger.kernel.org
58
59 diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
60 index 3b1ea34..eaa808e 100644
61 --- a/drivers/scsi/scsi.c
62 +++ b/drivers/scsi/scsi.c
63 @@ -1031,6 +1031,9 @@
64  {
65         int i, result;
66  
67 +       if (sdev->skip_vpd_pages)
68 +           goto fail;
69 +
70         /* Ask for all the pages supported by this device */
71         result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
72         if (result)
73 commit 4d0ed18277cc6f07513ee0b04475f19cd69e75ef
74 Author: Peter Hurley <peter@hurleysoftware.com>
75 Date:   Tue Dec 10 17:12:02 2013 -0500
76
77     n_tty: Fix buffer overruns with larger-than-4k pastes
78     
79     readline() inadvertently triggers an error recovery path when
80     pastes larger than 4k overrun the line discipline buffer. The
81     error recovery path discards input when the line discipline buffer
82     is full and operating in canonical mode and no newline has been
83     received. Because readline() changes the termios to non-canonical
84     mode to read the line char-by-char, the line discipline buffer
85     can become full, and then when readline() restores termios back
86     to canonical mode for the caller, the now-full line discipline
87     buffer triggers the error recovery.
88     
89     When changing termios from non-canon to canon mode and the read
90     buffer contains data, simulate an EOF push _without_ the
91     DISABLED_CHAR in the read buffer.
92     
93     Importantly for the readline() problem, the termios can be
94     changed back to non-canonical mode without changes to the read
95     buffer occurring; ie., as if the previous termios change had not
96     happened (as long as no intervening read took place).
97     
98     Preserve existing userspace behavior which allows '\0's already
99     received in non-canon mode to be read as '\0's in canon mode
100     (rather than trigger add'l EOF pushes or an actual EOF).
101     
102     Patch based on original proposal and discussion here
103     https://bugzilla.kernel.org/show_bug.cgi?id=55991
104     by Stas Sergeev <stsp@users.sourceforge.net>
105     
106     Reported-by: Margarita Manterola <margamanterola@gmail.com>
107     Cc: Maximiliano Curia <maxy@gnuservers.com.ar>
108     Cc: Pavel Machek <pavel@ucw.cz>
109     Cc: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
110     Acked-by: Stas Sergeev <stsp@users.sourceforge.net>
111     Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
112     Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
113
114 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
115 index fdc2ecd..961e6a9 100644
116 --- a/drivers/tty/n_tty.c
117 +++ b/drivers/tty/n_tty.c
118 @@ -104,6 +104,7 @@ struct n_tty_data {
119  
120         /* must hold exclusive termios_rwsem to reset these */
121         unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
122 +       unsigned char push:1;
123  
124         /* shared by producer and consumer */
125         char read_buf[N_TTY_BUF_SIZE];
126 @@ -341,6 +342,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
127  
128         ldata->erasing = 0;
129         bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
130 +       ldata->push = 0;
131  }
132  
133  static void n_tty_packet_mode_flush(struct tty_struct *tty)
134 @@ -1745,7 +1747,16 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
135  
136         if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
137                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
138 -               ldata->line_start = ldata->canon_head = ldata->read_tail;
139 +               ldata->line_start = ldata->read_tail;
140 +               if (!L_ICANON(tty) || !read_cnt(ldata)) {
141 +                       ldata->canon_head = ldata->read_tail;
142 +                       ldata->push = 0;
143 +               } else {
144 +                       set_bit((ldata->read_head - 1) & (N_TTY_BUF_SIZE - 1),
145 +                               ldata->read_flags);
146 +                       ldata->canon_head = ldata->read_head;
147 +                       ldata->push = 1;
148 +               }
149                 ldata->erasing = 0;
150                 ldata->lnext = 0;
151         }
152 @@ -1951,6 +1962,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
153   *     it copies one line of input up to and including the line-delimiting
154   *     character into the user-space buffer.
155   *
156 + *     NB: When termios is changed from non-canonical to canonical mode and
157 + *     the read buffer contains data, n_tty_set_termios() simulates an EOF
158 + *     push (as if C-d were input) _without_ the DISABLED_CHAR in the buffer.
159 + *     This causes data already processed as input to be immediately available
160 + *     as input although a newline has not been received.
161 + *
162   *     Called under the atomic_read_lock mutex
163   *
164   *     n_tty_read()/consumer path:
165 @@ -1997,7 +2014,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
166         n += found;
167         c = n;
168  
169 -       if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
170 +       if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
171                 n--;
172                 eof_push = !n && ldata->read_tail != ldata->line_start;
173         }
174 @@ -2024,7 +2041,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
175         ldata->read_tail += c;
176  
177         if (found) {
178 -               ldata->line_start = ldata->read_tail;
179 +               if (!ldata->push)
180 +                       ldata->line_start = ldata->read_tail;
181 +               else
182 +                       ldata->push = 0;
183                 tty_audit_push(tty);
184         }
185         return eof_push ? -EAGAIN : 0;
This page took 0.05307 seconds and 4 git commands to generate.