21 May, 2008

6 commits

  • There is a race from when a device is created with device_create() and
    then the drvdata is set with a call to dev_set_drvdata() in which a
    sysfs file could be open, yet the drvdata will be NULL, causing all
    sorts of bad things to happen.

    This patch fixes the problem by using the new function,
    device_create_vargs().

    Many thanks to Arthur Jones for reporting the bug,
    and testing patches out.

    Cc: Kay Sievers
    Cc: Arthur Jones
    Cc: Peter Zijlstra
    Cc: Miklos Szeredi
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • We want to have the drvdata field set properly when creating the device
    as sysfs callbacks can assume it is present and it can race the later
    setting of this field.

    So, create two new functions, deviec_create_vargs() and
    device_create_drvdata() that take this new field.

    device_create_drvdata() will go away in 2.6.27 as the drvdata field will
    just be moved to the device_create() call as it should be.

    Cc: Kay Sievers
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
    firewire: prevent userspace from accessing shut down devices
    ieee1394: sbp2: use correct size of command descriptor block

    Linus Torvalds
     
  • vidiocgmbuf() does this:
    mutex_lock(&fh->cap.vb_lock);
    retval = videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
    V4L2_MEMORY_MMAP);

    and videobuf_mmap_setup() then just does
    mutex_lock(&q->vb_lock);
    ret = __videobuf_mmap_setup(q, bcount, bsize, memory);
    mutex_unlock(&q->vb_lock);

    which is an obvious double-take deadlock.

    This patch fixes this by having vidiocgmbuf() just call the
    __videobuf_mmap_setup function instead.

    Acked-by: Mauro Carvalho Chehab
    Reported-by: Koos Vriezen
    Signed-off-by: Arjan van de Ven
    Signed-off-by: Linus Torvalds

    Arjan van de Ven
     
  • If userspace ignores the POLLERR bit from poll(), and only attempts to
    read() the device when POLLIN is set, it can still make ioctl() calls on
    a device that has been removed from the system. The node_id and
    generation returned by GET_INFO will be outdated, but INITIATE_BUS_RESET
    would still cause a bus reset, and GET_CYCLE_TIMER will return data.
    And if you guess the correct generation to use, you can send requests to
    a different device on the bus, and get responses back.

    This patch prevents open, ioctl, compat_ioctl, and mmap against shutdown
    devices.

    Signed-off-by: Jay Fenlason
    Signed-off-by: Stefan Richter

    Jay Fenlason
     
  • Boaz Harrosh wrote:
    > cmd->cmd_len is now guarantied to be set properly at all cases.
    > And some commands you want to support will not be set correctly
    > by COMMAND_SIZE().

    Signed-off-by: Stefan Richter

    Stefan Richter
     

20 May, 2008

34 commits