linux/drivers, branch v2.6.16.56

drivers/video/macmodes.c:mac_find_mode() mustn't be __init

2007-10-19T16:51:07Z

If it's EXPORT_SYMBOL'ed it can't be __devinit. Reported by Mikael Pettersson. Signed-off-by: Adrian Bunk

random: fix bound check ordering (CVE-2007-3105)

2007-10-06T22:27:53Z

If root raised the default wakeup threshold over the size of the output pool, the pool transfer function could overflow the stack with RNG bytes, causing a DoS or potential privilege escalation. (Bug reported by the PaX Team ) Signed-off-by: Matt Mackall Signed-off-by: Adrian Bunk

random: fix seeding with zero entropy (CVE-2007-2453 2 of 2)

2007-10-06T22:24:49Z

Add data from zero-entropy random_writes directly to output pools to avoid accounting difficulties on machines without entropy sources. Tested on lguest with all entropy sources disabled. Signed-off-by: Matt Mackall Acked-by: Theodore Ts'o Signed-off-by: Adrian Bunk

random: fix error in entropy extraction (CVE-2007-2453 1 of 2)

2007-10-06T22:19:10Z

Fix cast error in entropy extraction. Add comments explaining the magic 16. Remove extra confusing loop variable. Signed-off-by: Matt Mackall Acked-by: Theodore Ts'o Signed-off-by: Adrian Bunk

fix buffer overflow in the moxa driver (CVE-2005-0504)

2007-10-06T21:51:05Z

Signed-off-by: Dann Frazier Signed-off-by: Andres Salomon Signed-off-by: Adrian Bunk

unexport csr1212_release_keyval

2007-10-06T20:05:29Z

A static function mustn't be exported. Signed-off-by: Adrian Bunk

unexport cpufreq_parse_governor

2007-10-06T19:59:38Z

A static function mustn't be exported. Signed-off-by: Adrian Bunk

[PPP]: Fix output buffer size in ppp_decompress_frame().

2007-09-24T21:02:46Z

This patch addresses the issue with "osize too small" errors in mppe encryption. The patch fixes the issue with wrong output buffer size being passed to ppp decompression routine. -------------------- As pointed out by Suresh Mahalingam, the issue addressed by ppp-fix-osize-too-small-errors-when-decoding patch is not fully resolved yet. The size of allocated output buffer is correct, however it size passed to ppp->rcomp->decompress in ppp_generic.c if wrong. The patch fixes that. -------------------- Signed-off-by: Konstantin Sharlaimov Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[PPP]: Fix osize too small errors when decoding mppe.

2007-09-24T21:01:54Z

The mppe_decompress() function required a buffer that is 1 byte too small when receiving a message of mru size. This fixes buffer allocation to prevent this from occurring. Signed-off-by: Konstantin Sharlaimov Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

md: avoid possible BUG_ON in md bitmap handling

2007-08-23T00:13:17Z

md/bitmap tracks how many active write requests are pending on blocks associated with each bit in the bitmap, so that it knows when it can clear the bit (when count hits zero). The counter has 14 bits of space, so if there are ever more than 16383, we cannot cope. Currently the code just calles BUG_ON as "all" drivers have request queue limits much smaller than this. However is seems that some don't. Apparently some multipath configurations can allow more than 16383 concurrent write requests. So, in this unlikely situation, instead of calling BUG_ON we now wait for the count to drop down a bit. This requires a new wait_queue_head, some waiting code, and a wakeup call. Tested by limiting the counter to 20 instead of 16383 (writes go a lot slower in that case...). Signed-off-by: Neil Brown Signed-off-by: Adrian Bunk