kernel.git/drivers/s390/char, branch linux-2.6.32.y

compat: fix compile breakage on s390

2012-03-04T17:49:22Z

commit 048cd4e51d24ebf7f3552226d03c769d6ad91658 upstream. The new is_compat_task() define for the !COMPAT case in include/linux/compat.h conflicts with a similar define in arch/s390/include/asm/compat.h. This is the minimal patch which fixes the build issues. Signed-off-by: Heiko Carstens Signed-off-by: Linus Torvalds Cc: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman

keyboard: integer underflow bug

2011-03-14T21:29:53Z

commit b652277b09d3d030cb074cc6a98ba80b34244c03 upstream. The "ct" variable should be an unsigned int. Both struct kbdiacrs ->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints. Making it signed causes a problem in KBDIACRUC because the user could set the signed bit and cause a buffer overflow. Signed-off-by: Dan Carpenter Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman

[S390] sclp: undo quiesce handler override on resume

2009-11-13T14:45:03Z

In a system where the ctrl-alt-del init action initiated by signal quiesce suspends the machine the quiesce handler override for _machine_restart, _machine_halt and _machine_power_off needs to be undone, otherwise the override is still present in the resumed system. The next shutdown would then load the quiesce state psw instead of performing the correct shutdown action. Signed-off-by: Martin Schwidefsky

[S390] monreader: fix use after free bug with suspend/resume

2009-11-13T14:45:03Z

The monreader device driver doesn't set dev->driver_data to NULL after freeing the corresponding data structure. This leads to a use after free bug in the freeze/thaw suspend/resume functions after the device has been opened and closed once. Fix this by clearing dev->driver_data in the close() function. Signed-off-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky

[S390] call home: fix string length handling

2009-10-29T14:05:12Z

After copying uts->nodename to the static nodename array the static version isn't necessarily zero termininated, since the size of the array is one byte too short. Afterwards doing strncat(data, nodename, strlen(nodename)); may copy an arbitrary large amount of bytes. Fix this by getting rid of the static array and using strncat with proper length limit. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky

[S390] call home: fix error handling in init function

2009-10-29T14:05:12Z

Fix missing unregister_sysctl_table in case the SCLP doesn't provide the requested feature. Also simplify the whole error handling while at it. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky

[S390] call home: fix local buffer usage in proc handler

2009-10-29T14:05:12Z

Fix the size of the local buffer and use snprintf to prevent further miscalculations. Also fix the usage of bitwise vs logic operations. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky

[S390] sclp_vt220 build fix

2009-10-14T10:43:54Z

Fix this build error: next-20091013 randconfig build on s390x build breaks with drivers/s390/built-in.o:(.data+0x3354): undefined reference to `sclp_vt220_pm_event_fn' Reported-by: Kamalesh Babulal Signed-off-by: Michael Holzheu Signed-off-by: Martin Schwidefsky

[S390] call home support: fix proc handler

2009-10-14T10:43:53Z

8d65af78 "sysctl: remove "struct file *" argument of ->proc_handler" removed the struct file argument from all proc_handlers but didn't change the call home proc handler (or call home was merged later). So fix this now. Cc: Alexey Dobriyan Cc: Hans-Joachim Picht Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky

[S390] tape390: Fix request queue handling in block driver

2009-10-14T10:43:52Z

When setting a channel attached tape online under Linux 2.6.31, the "vol_id" process from udev hangs in sync_page(): 2 sync_page+144 [0x1dfaac] 3 __wait_on_bit_lock+194 [0x58c23e] 4 __lock_page+116 [0x1df9dc] 5 truncate_inode_pages_range+728 [0x1ed7cc] 6 __blkdev_put+244 [0x25f738] 7 __fput+300 [0x229c4c] 8 filp_close+122 [0x225a3a] The reason for that is an error in the request queue handling. It can happen that we fetch a request, but do not process it further because the number of queued requests exceeds TAPEBLOCK_MIN_REQUEUE. To fix this, we should call blk_peek_request() instead of blk_fetch_request() in the while condition and fetch the request in the loop body afterwards. This bug was introduced with the patch "block: implement and enforce request peek/start/fetch" (9934c8c04561413609d2bc38c6b9f268cba774a4) Signed-off-by: Michael Holzheu Signed-off-by: Martin Schwidefsky