linux, branch v2.6.31.12

Linux 2.6.31.12

2010-01-18T18:30:45Z

ACPI: DMI init_set_sci_en_on_resume for HP-Compaq C700

2010-01-18T18:28:54Z

commit 87c687be055e67bc04189ce476690be73d16063e upstream. ...else ACPI thermal controls fail after resume. http://bugzilla.kernel.org/show_bug.cgi?id=13745 Signed-off-by: Len Brown Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman

ACPI: sleep: another HP/Compaq DMI entries for init_set_sci_en_on_resume

2010-01-18T18:28:54Z

commit 2839d396e3ae0891c1fdd87aa1cea218e6f5c4df upstream. http://bugzilla.kernel.org/show_bug.cgi?id=13745 Signed-off-by: Len Brown Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman

ACPI: add DMI entry for SCI_EN resume quirk on HP dv4

2010-01-18T18:28:53Z

commit 8a1cbf64977f89e9e9bc1d80dd01503337424f96 upstream. Fixes the missing battery on sleep problem for yet another HP laptop ("HP Pavilion dv4"). Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=13449 Signed-off-by: Gustavo Maciel Dias Vieira Signed-off-by: Len Brown Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman

ACPI: sleep: another HP DMI entry for init_set_sci_en_on_resume

2010-01-18T18:28:53Z

commit eb0ca849863ecdc593ba7faa95fda5695af891c8 upstream. DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv3 Notebook PC") http://bugzilla.kernel.org/show_bug.cgi?id=13745 Signed-off-by: Len Brown Cc: Stefan Bader Signed-off-by: Greg Kroah-Hartman

ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().

2010-01-18T18:28:52Z

commit 2570a4f5428bcdb1077622342181755741e7fa60 upstream. This fixes CERT-FI FICORA #341748 Discovered by Olli Jarva and Tuomo Untinen from the CROSS project at Codenomicon Ltd. Just like in CVE-2007-4567, we can't rely upon skb_dst() being non-NULL at this point. We fixed that in commit e76b2b2567b83448c2ee85a896433b96150c92e6 ("[IPV6]: Do no rely on skb->dst before it is assigned.") However commit 483a47d2fe794328d29950fe00ce26dd405d9437 ("ipv6: added net argument to IP6_INC_STATS_BH") put a new version of the same bug into this function. Complicating analysis further, this bug can only trigger when network namespaces are enabled in the build. When namespaces are turned off, the dev_net() does not evaluate it's argument, so the dereference would not occur. So, for a long time, namespaces couldn't be turned on unless SYSFS was disabled. Therefore, this code has largely been disabled except by people turning it on explicitly for namespace development. With help from Eugene Teo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

fix more leaks in audit_tree.c tag_chunk()

2010-01-18T18:28:51Z

commit b4c30aad39805902cf5b855aa8a8b22d728ad057 upstream. Several leaks in audit_tree didn't get caught by commit 318b6d3d7ddbcad3d6867e630711b8a705d873d7, including the leak on normal exit in case of multiple rules refering to the same chunk. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

fix braindamage in audit_tree.c untag_chunk()

2010-01-18T18:28:49Z

commit 6f5d51148921c242680a7a1d9913384a30ab3cbe upstream. ... aka "Al had badly fscked up when writing that thing and nobody noticed until Eric had fixed leaks that used to mask the breakage". The function essentially creates a copy of old array sans one element and replaces the references to elements of original (they are on cyclic lists) with those to corresponding elements of new one. After that the old one is fair game for freeing. First of all, there's a dumb braino: when we get to list_replace_init we use indices for wrong arrays - position in new one with the old array and vice versa. Another bug is more subtle - termination condition is wrong if the element to be excluded happens to be the last one. We shouldn't go until we fill the new array, we should go until we'd finished the old one. Otherwise the element we are trying to kill will remain on the cyclic lists... That crap used to be masked by several leaks, so it was not quite trivial to hit. Eric had fixed some of those leaks a while ago and the shit had hit the fan... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

quota: Fix dquot_transfer for filesystems different from ext4

2010-01-18T18:28:49Z

commit 05b5d898235401c489c68e1f3bc5706a29ad5713 upstream. Commit fd8fbfc1 modified the way we find amount of reserved space belonging to an inode. The amount of reserved space is checked from dquot_transfer and thus inode_reserved_space gets called even for filesystems that don't provide get_reserved_space callback which results in a BUG. Fix the problem by checking get_reserved_space callback and return 0 if the filesystem does not provide it. CC: Dmitry Monakhov Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman

netfilter: nf_ct_ftp: fix out of bounds read in update_nl_seq()

2010-01-18T18:28:48Z

commit aaff23a95aea5f000895f50d90e91f1e2f727002 upstream. As noticed by Dan Carpenter , update_nl_seq() currently contains an out of bounds read of the seq_aft_nl array when looking for the oldest sequence number position. Fix it to only compare valid positions. Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman