18 Sep, 2010
3 commits
-
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
firewire: nosy: fix build when CONFIG_FIREWIRE=N
firewire: ohci: activate cycle timer register quirk on Ricoh chips -
* 'for-linus' of git://neil.brown.name/md:
md: fix v1.x metadata update when a disk is missing.
md: call md_update_sb even for 'external' metadata arrays. -
If a signal hits us outside of a syscall and another gets delivered
when we are in sigreturn (e.g. because it had been in sa_mask for
the first one and got sent to us while we'd been in the first handler),
we have a chance of returning from the second handler to location one
insn prior to where we ought to return. If r0 happens to contain -513
(-ERESTARTNOINTR), sigreturn will get confused into doing restart
syscall song and dance.Incredible joy to debug, since it manifests as random, infrequent and
very hard to reproduce double execution of instructions in userland
code...The fix is simple - mark it "don't bother with restarts" in wrapper,
i.e. set r8 to 0 in sys_sigreturn and sys_rt_sigreturn wrappers,
suppressing the syscall restart handling on return from these guys.
They can't legitimately return a restart-worthy error anyway.Testcase:
#include
#include
#include
#include
#includevoid f(int n)
{
__asm__ __volatile__(
"ldr r0, [%0]\n"
"b 1f\n"
"b 2f\n"
"1:b .\n"
"2:\n" : : "r"(&n));
}void handler1(int sig) { }
void handler2(int sig) { raise(1); }
void handler3(int sig) { exit(0); }main()
{
struct sigaction s = {.sa_handler = handler2};
struct itimerval t1 = { .it_value = {1} };
struct itimerval t2 = { .it_value = {2} };signal(1, handler1);
sigemptyset(&s.sa_mask);
sigaddset(&s.sa_mask, 1);
sigaction(SIGALRM, &s, NULL);signal(SIGVTALRM, handler3);
setitimer(ITIMER_REAL, &t1, NULL);
setitimer(ITIMER_VIRTUAL, &t2, NULL);f(-513); /* -ERESTARTNOINTR */
write(1, "buggered\n", 9);
return 1;
}Signed-off-by: Al Viro
Acked-by: Russell King
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds
17 Sep, 2010
14 commits
-
If an array with 1.x metadata is assembled with the last disk missing,
md doesn't properly record the fact that the disk was missing.This is unlikely to cause a real problem as the event count will be
different to the count on the missing disk so it won't be included in
the array. However it could still cause confusion.So make sure we clear all the relevant slots, not just the early ones.
Signed-off-by: NeilBrown
-
Now that we depend on md_update_sb to clear variable bits in
mddev->flags (rather than trying not to set them) it is important to
always call md_update_sb when appropriate.md_check_recovery has this job but explicitly avoids it for ->external
metadata arrays. This is not longer appropraite, or needed.However we do want to avoid taking the mddev lock if only
MD_CHANGE_PENDING is set as that is not cleared by md_update_sb for
external-metadata arrays.Reported-by: "Kwolek, Adam"
Signed-off-by: NeilBrown -
…git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: hpet: Work around hardware stupidity
x86, build: Disable -fPIE when compiling with CONFIG_CC_STACKPROTECTOR=y
x86, cpufeature: Suppress compiler warning with gcc 3.x
x86, UV: Fix initialization of max_pnode -
drivers/firewire/nosy* is a stand-alone driver that does not depend on
CONFIG_FIREWIRE. Hence let make descend into drivers/firewire/ also
if that option is off.The stand-alone driver drivers/ieee1394/init_ohci1394_dma* will soon be
moved into drivers/firewire/ too and will require the same makefile fix.Side effect:
As mentioned in https://bugzilla.novell.com/show_bug.cgi?id=586172#c24
this influences the order in which either firewire-ohci or ohci1394 is
going to be bound to an OHCI-1394 controller in case of a modular build
of both drivers if no modprobe blacklist entries are configured.
However, a user of such a setup cannot expect deterministic behavior
anyway. The Kconfig help and the migration guide at
ieee1394.wiki.kernel.org recommend blacklist entries when a dual
IEEE 1394 stack build is being used. (The coexistence period of the two
stacks is planned to end soon.)Cc: Michal Marek
Signed-off-by: Stefan Richter -
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
cifs: fix potential double put of TCP session reference -
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
[IA64] Optimize ticket spinlocks in fsys_rt_sigprocmask -
* '2.6.36-fixes' of git://github.com/schandinat/linux-2.6:
drivers/video/via/ioctl.c: prevent reading uninitialized stack memory -
* 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6:
pcmcia pcnet_cs: try setting io_lines to 16 if card setup fails
pcmcia: per-device, not per-socket debug messages
pcmcia serial_cs.c: fix multifunction card handling -
* git://git.infradead.org/users/cbou/battery-2.6.36:
apm_power: Add missing break statement
intel_pmic_battery: Fix battery charging status on mrst -
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
watchdog: Enable NXP LPC32XX support in Kconfig (resend)
watchdog: ts72xx_wdt: disable watchdog at probe
watchdog: sb_wdog: release irq and reboot notifier in error path and module_exit() -
* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
arch/tile: fix formatting bug in register dumps
arch/tile: fix memcpy_fromio()/memcpy_toio() signatures
arch/tile: Save and restore extra user state for tilegx
arch/tile: Change struct sigcontext to be more useful
arch/tile: finish const-ifying sys_execve() -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
regulator: wm8350-regulator - fix the logic of checking REGULATOR_MODE_STANDBY mode
regulator: wm831x-ldo - fix the logic to set REGULATOR_MODE_IDLE and REGULATOR_MODE_STANDBY modes
regulator: ab8500 - fix off-by-one value range checking for selector
regulator: 88pm8607 - fix value range checking for accessing info->vol_table
regulator: isl6271a-regulator - fix regulator_desc parameter for regulator_register()
regulator: ad5398 - fix a memory leak
regulator: Update e-mail address for Liam Girdwood
regulator: set max8998->dev to &pdev->dev.
regulator: tps6586x-regulator - fix bit_mask parameter for tps6586x_set_bits()
regulator: tps6586x-regulator - fix value range checking for val
regulator: max8998 - set max8998->num_regulators
regulator: max8998 - fix memory allocation size for max8998->rdev
regulator: tps6507x - remove incorrect comments
regulator: max1586 - improve the logic of choosing selector
regulator: ab8500 - fix the logic to remove already registered regulators in error path
regulator: ab3100 - fix the logic to remove already registered regulators in error path
regulator/ab8500: move dereference below the check for NULL -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: add documentation -
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm/radeon/kms: only warn on mipmap size checks in r600 cs checker (v2)
drm/radeon/kms: force legacy pll algo for RV620 LVDS
drm: fix race between driver loading and userspace open.
drm: Use a nondestructive mode for output detect when polling (v2)
drm/radeon/kms: fix the colorbuffer CS checker for r300-r500
drm/radeon/kms: increase lockup detection interval to 10 sec for r100-r500
drm/radeon/kms/evergreen: fix backend setup
drm: Use a nondestructive mode for output detect when polling
drm/radeon: add some missing copyright headers
drm: Only decouple the old_fb from the crtc is we call mode_set*
drm/radeon/kms: don't enable underscan with interlaced modes
drm/radeon/kms: add connector table for Mac x800
drm/radeon/kms: fix regression in RMX code (v2)
drm: Fix regression in disable polling e58f637
16 Sep, 2010
5 commits
-
The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user. This patch takes care of
it.Signed-off-by: Dan Rosenberg
Signed-off-by: Florian Tobias Schandinat -
Tony's fix (f574c843191728d9407b766a027f779dcd27b272) has a small bug,
it incorrectly uses "r3" as a scratch register in the first of the two
unlock paths ... it is also inefficient. Optimize the fast path again.Signed-off-by: Petr Tesarik
Signed-off-by: Tony Luck -
The NXP LPC32XX processor use the same watchdog as the Philips
PNX4008 processor.Signed-off-by: Kevin Wells
Tested-by: Wolfram Sang
Signed-off-by: Wim Van Sebroeck -
Since it may be already enabled by bootloader or some other utility. This patch
makes sure that the watchdog is disabled before any userspace daemon opens the
device. It is also required by the watchdog API.Signed-off-by: Mika Westerberg
Signed-off-by: Wim Van Sebroeck -
irq and reboot notifier are acquired in module_init() but never released.
They should be released correctly, otherwise reloading the module or error
during module_init() will cause a problem.Signed-off-by: Akinobu Mita
Cc: Andrew Sharp
Signed-off-by: Wim Van Sebroeck
15 Sep, 2010
18 commits
-
Some pcnet_cs compatible cards require an exact 16-lines match
of the ioport areas specified in CIS, but set the "iolines"
value in the CIS incorrectly. We can easily work around this
issue -- same as we do in serial_cs -- by first trying setting
iolines to the CIS-specified value, and then trying a 16-line
match.Reported-and-tested-by: Wolfram Sang
Hardware-supplied-by: Jochen Frieling
CC: netdev@vger.kernel.org
Signed-off-by: Dominik Brodowski -
As the iomem / ioport setup differs per device, it is much better
to print out the device instead of the socket.Tested-by: Wolfram Sang
Signed-off-by: Dominik Brodowski -
We shouldn't overwrite pre-set values, and we should also
set the port address to the beginning, and not the end of
the 8-port range.CC: linux-serial@vger.kernel.org
Reported-by: Komuro
Hardware-supplied-by: Jochen Frieling
Tested-by: Wolfram Sang
Signed-off-by: Dominik Brodowski -
This cut-and-paste bug was caused by rewriting the register dump
code to use only a single printk per line of output.Signed-off-by: Chris Metcalf
-
This tripped up a driver (not yet committed to git). Fix it now.
Signed-off-by: Chris Metcalf
-
During context switch, save and restore a couple of additional bits of
tilegx user state that can be persistently modified by userspace.Signed-off-by: Chris Metcalf
-
Rather than just using pt_regs, it now contains the actual saved
state explicitly, similar to pt_regs. By doing it this way, we
provide a cleaner API for userspace (or equivalently, we avoid the
need for libc to provide its own definition of sigcontext).While we're at it, move PT_FLAGS_xxx to where they are not visible
from userspace. And always pass siginfo and mcontext to signal
handlers, even if they claim they don't need it, since sometimes
they actually try to use it anyway in practice.Signed-off-by: Chris Metcalf
-
The sys_execve() implementation was properly const-ified but not
the declaration, the syscall wrappers, or the compat version.
This change completes the constification process.Signed-off-by: Chris Metcalf
-
The texture base address registers are in units of 256 bytes.
The original CS checker treated these offsets as bytes, so the
original check was wrong. I fixed the units in a patch during
the 2.6.36 cycle, but this ended up breaking some existing
userspace (probably due to a bug in either userspace texture allocation
or the drm texture mipmap checker). So for now, until we come
up with a better fix, just warn if the mipmap size it too large.
This will keep existing userspace working and it should be just
as safe as before when we were checking the wrong units. These
are GPU MC addresses, so if they fall outside of the VRAM or
GART apertures, they end up at the GPU default page, so this should
be safe from a security perspective.v2: Just disable the warning. It just spams the log and there's
nothing the user can do about it.Signed-off-by: Alex Deucher
Cc: Jerome Glisse
Signed-off-by: Dave Airlie -
* ssh://master.kernel.org/home/hpa/tree/sec:
x86-64, compat: Retruncate rax after ia32 syscall entry tracing
x86-64, compat: Test %rax for the syscall number, not %eax
compat: Make compat_alloc_user_space() incorporate the access_ok() -
Fix up the IRQ names for the MN10300 on-chip serial ports in the driver as
request_interrupt() no longer allows names containing slashes, giving a warning
like the following if one is encountered:------------[ cut here ]------------
WARNING: at fs/proc/generic.c:323 __xlate_proc_name+0x62/0x7c()
name 'ttySM0/Rx'Signed-off-by: David Howells
Signed-off-by: Linus Torvalds -
* git://git.infradead.org/mtd-2.6:
mtd: pxa3xx: fix build error when CONFIG_MTD_PARTITIONS is not defined
mtd: mxc_nand: configure pages per block for v2 controller
mtd: OneNAND: Fix loop hang when DMA error at Samsung SoCs
mtd: OneNAND: Fix 2KiB pagesize handling at Samsung SoCs
mtd: Blackfin NFC: fix invalid free in remove()
mtd: Blackfin NFC: fix build error after nand_scan_ident() change
mxc_nand: Do not do byte accesses to the NFC buffer. -
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: fix hiddev's use of usb_find_interface
HID: fixup blacklist entry for Asus T91MT
HID: add device ID for new Asus Multitouch Controller
HID: add no-get quirk for eGalax touch controller
HID: Add quirk for eGalax touch controler.
HID: add support for another BTC Emprex remote control
HID: Set Report ID properly for Output reports on the Control endpoint.
HID: Kanvus Note A5 tablet needs HID_QUIRK_MULTI_INPUT
HID: Add support for chicony multitouch screens. -
* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
SUNRPC: Fix the NFSv4 and RPCSEC_GSS Kconfig dependencies
statfs() gives ESTALE error
NFS: Fix a typo in nfs_sockaddr_match_ipaddr6
sunrpc: increase MAX_HASHTABLE_BITS to 14
gss:spkm3 miss returning error to caller when import security context
gss:krb5 miss returning error to caller when import security context
Remove incorrect do_vfs_lock message
SUNRPC: cleanup state-machine ordering
SUNRPC: Fix a race in rpc_info_open
SUNRPC: Fix race corrupting rpc upcall
Fix null dereference in call_allocate -
Tavis Ormandy pointed out that do_io_submit does not do proper bounds
checking on the passed-in iocb array:if (unlikely(nr < 0))
return -EINVAL;if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(iocbpp)))))
return -EFAULT; ^^^^^^^^^^^^^^^^^^The attached patch checks for overflow, and if it is detected, the
number of iocbs submitted is scaled down to a number that will fit in
the long. This is an ok thing to do, as sys_io_submit is documented as
returning the number of iocbs submitted, so callers should handle a
return value of less than the 'nr' argument passed in.Reported-by: Tavis Ormandy
Signed-off-by: Jeff Moyer
Signed-off-by: Linus Torvalds -
cifs_get_smb_ses must be called on a server pointer on which it holds an
active reference. It first does a search for an existing SMB session. If
it finds one, it'll put the server reference and then try to ensure that
the negprot is done, etc.If it encounters an error at that point then it'll return an error.
There's a potential problem here though. When cifs_get_smb_ses returns
an error, the caller will also put the TCP server reference leading to a
double-put.Fix this by having cifs_get_smb_ses only put the server reference if
it found an existing session that it could use and isn't returning an
error.Cc: stable@kernel.org
Reviewed-by: Suresh Jayaraman
Signed-off-by: Jeff Layton
Signed-off-by: Steve French -
In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
32-bit tracee in system call entry. A %rax value set via ptrace at the
entry tracing stop gets used whole as a 32-bit syscall number, while we
only check the low 32 bits for validity.Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
in addition to testing the full 64 bits as has already been added.Reported-by: Ben Hawkes
Signed-off-by: Roland McGrath
Signed-off-by: H. Peter Anvin -
On 64 bits, we always, by necessity, jump through the system call
table via %rax. For 32-bit system calls, in theory the system call
number is stored in %eax, and the code was testing %eax for a valid
system call number. At one point we loaded the stored value back from
the stack to enforce zero-extension, but that was removed in checkin
d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process
will not be able to introduce a non-zero-extended number, but it can
happen via ptrace.Instead of re-introducing the zero-extension, test what we are
actually going to use, i.e. %rax. This only adds a handful of REX
prefixes to the code.Reported-by: Ben Hawkes
Signed-off-by: H. Peter Anvin
Cc:
Cc: Roland McGrath
Cc: Andrew Morton
