linux/drivers/char, branch v3.1

TPM: Zero buffer after copying to userspace

2011-09-22T23:46:41Z

Since the buffer might contain security related data it might be a good idea to zero the buffer after we have copied it to userspace. This got assigned CVE-2011-1162. Signed-off-by: Rajiv Andrade Cc: Stable Kernel Signed-off-by: James Morris

TPM: Call tpm_transmit with correct size

2011-09-22T23:46:29Z

This patch changes the call of tpm_transmit by supplying the size of the userspace buffer instead of TPM_BUFSIZE. This got assigned CVE-2011-1161. [The first hunk didn't make sense given one could expect way less data than TPM_BUFSIZE, so added tpm_transmit boundary check over bufsiz instead The last parameter of tpm_transmit() reflects the amount of data expected from the device, and not the buffer size being supplied to it. It isn't ideal to parse it directly, so we just set it to the maximum the input buffer can handle and let the userspace API to do such job.] Signed-off-by: Rajiv Andrade Cc: Stable Kernel Signed-off-by: James Morris

TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc

2011-09-22T23:46:17Z

platform_device_unregister() will release all resources and remove it from the subsystem, then drop reference count by calling platform_device_put(). We should not call kfree(pdev) after platform_device_unregister(pdev). Signed-off-by: Axel Lin Signed-off-by: Rajiv Andrade Signed-off-by: James Morris

TPM: TCG_ATMEL should depend on HAS_IOPORT

2011-09-22T23:45:57Z

On m68k, I get: drivers/char/tpm/tpm_atmel.h: In function ‘atmel_get_base_addr’: drivers/char/tpm/tpm_atmel.h:129: error: implicit declaration of function ‘ioport_map’ drivers/char/tpm/tpm_atmel.h:129: warning: return makes pointer from integer without a cast The code in tpm_atmel.h supports PPC64 (using the device tree and ioremap()) and "anything else" (using ioport_map()). However, ioportmap() is only available on platforms that set HAS_IOPORT. Although PC64 seems to have HAS_IOPORT, a "depends on HAS_IOPORT" should work, but I think it's better to expose the special PPC64 handling explicit using "depends on PPC64 || HAS_IOPORT". Signed-off-by: Geert Uytterhoeven Signed-off-by: Rajiv Andrade Signed-off-by: James Morris

drivers/char/msm_smd_pkt.c: don't use IS_ERR()

2011-08-25T23:25:33Z

The various basic memory allocation function return NULL, not an ERR_PTR. The semantic patch that makes this change is available in scripts/coccinelle/null/eno.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by: Thomas Meyer Cc: Niranjana Vishwanathapura Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

net: Compute protocol sequence numbers and fragment IDs using MD5.

2011-08-07T01:33:19Z

Computers have become a lot faster since we compromised on the partial MD4 hash which we use currently for performance reasons. MD5 is a much safer choice, and is inline with both RFC1948 and other ISS generators (OpenBSD, Solaris, etc.) Furthermore, only having 24-bits of the sequence number be truly unpredictable is a very serious limitation. So the periodic regeneration and 8-bit counter have been removed. We compute and use a full 32-bit sequence number. For ipv6, DCCP was found to use a 32-bit truncated initial sequence number (it needs 43-bits) and that is fixed here as well. Reported-by: Dan Kaminsky Tested-by: Willy Tarreau Signed-off-by: David S. Miller

tpm_tis: fix build when ACPI is not enabled

2011-08-04T00:25:21Z

Fix tpm_tis.c build when CONFIG_ACPI is not enabled by providing a stub function. Fixes many build errors/warnings: drivers/char/tpm/tpm_tis.c:89: error: dereferencing pointer to incomplete type drivers/char/tpm/tpm_tis.c:89: warning: type defaults to 'int' in declaration of 'type name' drivers/char/tpm/tpm_tis.c:89: error: request for member 'list' in something not a structure or union ... Signed-off-by: Randy Dunlap Cc: Leendert van Doorn Cc: James Morris Cc: Ingo Molnar Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

ramoops: update module parameters

2011-08-04T00:25:21Z

Update the module parameters when platform data is used. This means that they can be read from /sys/module/ramoops/parameters in order to parse the memory area. Signed-off-by: Sergiu Iordache Cc: Marco Stornelli Cc: Seiji Aguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile

2011-08-03T07:16:11Z

* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile/mm/init.c: trivial: use BUG_ON arch/tile: remove useless set_fixmap_nocache() macro arch/tile: add hypervisor-based character driver for SPI flash ROM ioctl-number.txt: add the tile hardwall ioctl range tile: use generic-y format for one-line asm-generic headers clocksource: tile: convert to use clocksource_register_hz

Merge tag 'v3.0' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-linus

2011-08-02T20:14:02Z