commit 4704cb76ab2ec08d94aba74567f4945abd6a5b9a Author: Greg Kroah-Hartman Date: Wed Jan 6 15:17:41 2010 -0800 Linux 2.6.27.43 commit d13f3207816596ef415660d011fec4ac6016d630 Author: Greg Kroah-Hartman Date: Wed Jan 6 15:17:21 2010 -0800 Revert: KVM: MMU: do not free active mmu pages in free_mmu_pages() This reverts the commit d2127c8300fb1ec54af56faee17170e7a525326d, which was the commit f00be0cae4e6ad0a8c7be381c6d9be3586800b3e upstream. This was done based on comments saying it was causing problems. Cc: Gleb Natapov Cc: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 5289cdcc9189f993d8f875676f68bd85f00c8092 Author: Serge E. Hallyn Date: Tue Dec 29 14:50:19 2009 -0600 generic_permission: MAY_OPEN is not write access commit 7ea6600148c265b1fd53e521022b1d7aec81d974 upstream. generic_permission was refusing CAP_DAC_READ_SEARCH-enabled processes from opening DAC-protected files read-only, because do_filp_open adds MAY_OPEN to the open mask. Ignore MAY_OPEN. After this patch, CAP_DAC_READ_SEARCH is again sufficient to open(fname, O_RDONLY) on a file to which DAC otherwise refuses us read permission. Reported-by: Mike Kazantsev Signed-off-by: Serge E. Hallyn Tested-by: Mike Kazantsev Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 43e1e809a5b7f9bdc65cfd0bdf45675dc7d40fb4 Author: Linus Torvalds Date: Thu Dec 17 07:04:56 2009 -0800 x86/ptrace: make genregs[32]_get/set more robust commit 04a1e62c2cec820501f93526ad1e46073b802dc4 upstream. The loop condition is fragile: we compare an unsigned value to zero, and then decrement it by something larger than one in the loop. All the callers should be passing in appropriately aligned buffer lengths, but it's better to just not rely on it, and have some appropriate defensive loop limits. Acked-by: Roland McGrath Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 016b73b363d8d717a37e63c267c0c79d40a6d7d3 Author: Stefan Weinhuber Date: Mon Dec 7 12:51:48 2009 +0100 S390: dasd: support DIAG access for read-only devices commit 22825ab7693fd29769518a0d25ba43c01a50092a upstream. When a DASD device is used with the DIAG discipline, the DIAG initialization will indicate success or error with a respective return code. So far we have interpreted a return code of 4 as error, but it actually means that the initialization was successful, but the device is read-only. To allow read-only devices to be used with DIAG we need to accept a return code of 4 as success. Re-initialization of the DIAG access is also part of the DIAG error recovery. If we find that the access mode of a device has been changed from writable to read-only while the device was in use, we print an error message. Signed-off-by: Stefan Weinhuber Signed-off-by: Martin Schwidefsky Cc: Stephen Powell Signed-off-by: Greg Kroah-Hartman commit 4e9e4fcb0d12ae07cd6e9a9430927eb1dbfb0166 Author: Patrick McHardy Date: Tue Dec 15 16:59:18 2009 +0100 ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery commit 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d upstream. Currently the same reassembly queue might be used for packets reassembled by conntrack in different positions in the stack (PREROUTING/LOCAL_OUT), as well as local delivery. This can cause "packet jumps" when the fragment completing a reassembled packet is queued from a different position in the stack than the previous ones. Add a "user" identifier to the reassembly queue key to seperate the queues of each caller, similar to what we do for IPv4. Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 18ba31ab3db7b92c9ecb01229d983fd37173ab8f Author: Michele Jr De Candia Date: Thu Nov 26 09:22:32 2009 +0100 i2c/tsl2550: Fix lux value in extended mode commit 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf upstream. According to the TAOS Application Note 'Controlling a Backlight with the TSL2550 Ambient Light Sensor' (page 14), the actual lux value in extended mode should be obtained multiplying the calculated lux value by 5. Signed-off-by: Michele Jr De Candia Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 3f6d77e001665a4d44ab9a70820d46a3e777dca8 Author: Clemens Ladisch Date: Fri Dec 18 09:27:24 2009 +0100 sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer commit 3e85fd614c7b6bb7f33bb04a0dcb5a3bfca4c0fe upstream. When allocating the PCM buffer, use vmalloc_user() instead of vmalloc(). Otherwise, it would be possible for applications to play the previous contents of the kernel memory to the speakers, or to read it directly if the buffer is exported to userspace. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d88be46507ffa20e69a237d5c7bfead253ad7c69 Author: Bartlomiej Zolnierkiewicz Date: Sun Dec 20 19:22:33 2009 +0100 pata_cmd64x: fix overclocking of UDMA0-2 modes commit 509426bd46ad0903dca409803e0ee3d30f99f1e8 upstream. adev->dma_mode stores the transfer mode value not UDMA mode number so the condition in cmd64x_set_dmamode() is always true and the higher UDMA clock is always selected. This can potentially result in data corruption when UDMA33 device is used, when 40-wire cable is used or when the error recovery code decides to lower the device speed down. The issue was introduced in the commit 6a40da0 ("libata cmd64x: whack into a shape that looks like the documentation") which goes back to kernel 2.6.20. Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit d9b7ad9d124b0d3154bf0fe64ca5425827de498b Author: Daniel Mack Date: Wed Dec 16 05:12:58 2009 +0100 Libertas: fix buffer overflow in lbs_get_essid() commit 45b241689179a6065384260242637cf21dabfb2d upstream. The libertas driver copies the SSID buffer back to the wireless core and appends a trailing NULL character for termination. This is a) unnecessary because the buffer is allocated with kzalloc and is hence already NULLed when this function is called, and b) for priv->curbssparams.ssid_len == 32, it writes back one byte too much which causes memory corruptions. Fix this by removing the extra write. Signed-off-by: Daniel Mack Cc: Stephen Hemminger Cc: Maithili Hinge Cc: Kiran Divekar Cc: Michael Hirsch Cc: netdev@vger.kernel.org Cc: libertas-dev@lists.infradead.org Cc: linux-wireless@lists.infradead.org Acked-by: Holger Schurig Acked-by: Dan Williams Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman