27 Oct, 2010

5 commits

  • Structure info is copied to userland with some padding fields unitialized.
    It leads to leaking of stack memory.

    [akpm@linux-foundation.org: remove now-unneeded zeroing of info->hi_ireqfreq]
    Signed-off-by: Vasiliy Kulikov
    Cc: Clemens Ladisch
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Vasiliy Kulikov
     
  • Fix the following style problems:

    WARNING: Use #include instead of
    WARNING: Use #include instead of
    ERROR: code indent should use tabs where possible
    ERROR: do not initialise statics to 0 or NULL

    Signed-off-by: Jaswinder Singh Rajput
    Cc: Clemens Ladisch
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jaswinder Singh Rajput
     
  • Jaswinder Singh Rajput wrote:
    > By executing Documentation/timers/hpet_example.c
    >
    > for polling, I requested for 3 iterations but it seems iteration work
    > for only 2 as first expired time is always very small.
    >
    > # ./hpet_example poll /dev/hpet 10 3
    > -hpet: executing poll
    > hpet_poll: info.hi_flags 0x0
    > hpet_poll: expired time = 0x13
    > hpet_poll: revents = 0x1
    > hpet_poll: data 0x1
    > hpet_poll: expired time = 0x1868c
    > hpet_poll: revents = 0x1
    > hpet_poll: data 0x1
    > hpet_poll: expired time = 0x18645
    > hpet_poll: revents = 0x1
    > hpet_poll: data 0x1

    Clearing the HPET interrupt enable bit disables interrupt generation
    but does not disable the timer, so the interrupt status bit will still
    be set when the timer elapses. If another interrupt arrives before
    the timer has been correctly programmed (due to some other device on
    the same interrupt line, or CONFIG_DEBUG_SHIRQ), this results in an
    extra unwanted interrupt event because the status bit is likely to be
    set from comparator matches that happened before the device was opened.

    Therefore, we have to ensure that the interrupt status bit is and
    stays cleared until we actually program the timer.

    Signed-off-by: Clemens Ladisch
    Reported-by: Jaswinder Singh Rajput
    Cc: Ingo Molnar
    Cc: Thomas Gleixner
    Cc: john stultz
    Cc: Bob Picco
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Clemens Ladisch
     
  • When the initialization code in hpet finds a memory resource and does not
    find an IRQ, it does not unmap the memory resource previously mapped.

    There are buggy BIOSes which report resources exactly like this and what
    is worse the memory region bases point to normal RAM. This normally would
    not matter since the space is not touched. But when PAT is turned on,
    ioremap causes the page to be uncached and sets this bit in page->flags.

    Then when the page is about to be used by the allocator, it is reported
    as:

    BUG: Bad page state in process md5sum pfn:3ed00
    page:ffffea0000dbd800 count:0 mapcount:0 mapping:(null) index:0x0
    page flags: 0x20000001000000(uncached)
    Pid: 7956, comm: md5sum Not tainted 2.6.34-12-desktop #1
    Call Trace:
    [] bad_page+0xb1/0x100
    [] prep_new_page+0x1a5/0x1c0
    [] get_page_from_freelist+0x3a1/0x640
    [] __alloc_pages_nodemask+0x10f/0x6b0
    ...

    In this particular case:

    1) HPET returns 3ed00000 as memory region base, but it is not in
    reserved ranges reported by the BIOS (excerpt):
    BIOS-e820: 0000000000100000 - 00000000af6cf000 (usable)
    BIOS-e820: 00000000af6cf000 - 00000000afdcf000 (reserved)

    2) there is no IRQ resource reported by HPET method. On the other
    hand, the Intel HPET specs (1.0a) says (3.2.5.1):
    _CRS (
    // Report 1K of memory consumed by this Timer Block
    memory range consumed
    // Optional: only used if BIOS allocates Interrupts [1]
    IRQs consumed
    )

    [1] For case where Timer Block is configured to consume IRQ0/IRQ8 AND
    Legacy 8254/Legacy RTC hardware still exists, the device objects
    associated with 8254 & RTC devices should not report IRQ0/IRQ8 as
    "consumed resources".

    So in theory we should check whether if it is the case and use those
    interrupts instead.

    Anyway the address reported by the BIOS here is bogus, so non-presence
    of IRQ doesn't mean the "optional" part in point 2).

    Since I got no reply previously, fix this by simply unmapping the space
    when IRQ is not found and memory region was mapped previously. It would
    be probably more safe to walk the resources again and unmap appropriately
    depending on type. But as we now use only ioremap for both 2 memory
    resource types, it is not necessarily needed right now.

    Addresses https://bugzilla.novell.com/show_bug.cgi?id=629908

    Reported-by: Olaf Hering
    Signed-off-by: Jiri Slaby
    Acked-by: Clemens Ladisch
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jiri Slaby
     
  • Unloading ipmi module can trigger following error. (if
    CONFIG_DEBUG_SPINLOCK=y)

    [ 9633.779590] BUG: spinlock bad magic on CPU#1, rmmod/7170
    [ 9633.779606] lock: f41f5414, .magic: 00000000, .owner:
    /-1, .owner_cpu: 0
    [ 9633.779626] Pid: 7170, comm: rmmod Not tainted
    2.6.36-rc7-11474-gb71eb1e-dirty #328
    [ 9633.779644] Call Trace:
    [ 9633.779657] [] ? printk+0x18/0x1c
    [ 9633.779672] [] spin_bug+0xa3/0xf0
    [ 9633.779685] [] do_raw_spin_lock+0x7d/0x160
    [ 9633.779702] [] ? release_sysfs_dirent+0x47/0xb0
    [ 9633.779718] [] ? sysfs_addrm_finish+0xa8/0xd0
    [ 9633.779734] [] _raw_spin_lock_irqsave+0xc/0x20
    [ 9633.779752] [] cleanup_one_si+0x6a/0x200 [ipmi_si]
    [ 9633.779768] [] ? sysfs_hash_and_remove+0x72/0x80
    [ 9633.779786] [] ipmi_pnp_remove+0xd/0xf [ipmi_si]
    [ 9633.779802] [] pnp_device_remove+0x1b/0x40

    Fix this by initializing spinlocks in a smi_info_alloc() helper function,
    right after memory allocation and clearing.

    Signed-off-by: Eric Dumazet
    Acked-by: David Miller
    Cc: Yinghai Lu
    Acked-by: Corey Minyard
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric Dumazet
     

25 Oct, 2010

4 commits

  • * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: (48 commits)
    [S390] topology: export cpu topology via proc/sysinfo
    [S390] topology: move topology sysinfo code
    [S390] topology: clean up facility detection
    [S390] cleanup facility list handling
    [S390] enable ARCH_DMA_ADDR_T_64BIT with 64BIT
    [S390] dasd: ignore unsolicited interrupts for DIAG
    [S390] kvm: Enable z196 instruction facilities
    [S390] dasd: fix unsolicited interrupt recognition
    [S390] dasd: fix use after free in dbf
    [S390] kvm: Fix badness at include/asm/mmu_context.h:83
    [S390] cio: fix I/O cancel function
    [S390] topology: change default
    [S390] smp: use correct cpu address in print_cpu_info()
    [S390] remove ieee_instruction_pointer from thread_struct
    [S390] cleanup system call parameter setup
    [S390] correct alignment of cpuid structure
    [S390] cleanup lowcore access from external interrupts
    [S390] cleanup lowcore access from program checks
    [S390] pgtable: move pte_mkhuge() from hugetlb.h to pgtable.h
    [S390] fix SIGBUS handling
    ...

    Linus Torvalds
     
  • * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (75 commits)
    Input: wacom - specify Cinitq supported tools
    Input: ab8500-ponkey - fix IRQ freeing in error path
    Input: adp5588-keys - use more obvious i2c_device_id name string
    Input: ad7877 - switch to using threaded IRQ
    Input: ad7877 - use attribute group to control visibility of attributes
    Input: serio - add support for PS2Mult multiplexer protocol
    Input: wacom - properly enable runtime PM
    Input: ad7877 - filter events where pressure is beyond the maximum
    Input: ad7877 - implement EV_KEY:BTN_TOUCH reporting
    Input: ad7877 - implement specified chip select behavior
    Input: hp680_ts_input - use cancel_delayed_work_sync()
    Input: mousedev - correct lockdep annotation
    Input: ads7846 - switch to using threaded IRQ
    Input: serio - support multiple child devices per single parent
    Input: synaptics - simplify pass-through port handling
    Input: add ROHM BU21013 touch panel controller support
    Input: omap4-keypad - wake-up on events & long presses
    Input: omap4-keypad - fix interrupt line configuration
    Input: omap4-keypad - SYSCONFIG register configuration
    Input: omap4-keypad - use platform device helpers
    ...

    Linus Torvalds
     
  • If the iucv_register() functions fails, the error recovery calls
    iucv_unregister() which might cause the following stack backtrace:

    ( show_trace+0xee/0x144)
    panic+0xb6/0x248
    die+0x15a/0x16c
    do_no_context+0xa6/0xe4
    do_protection_exception+0x2e8/0x3a4
    pgm_exit+0x0/0x14
    iucv_unregister+0x5a/0x17c
    ( iucv_unregister+0x4a/0x17c)
    hvc_iucv_init+0x228/0x5dc
    do_one_initcall+0x3e/0x19c
    kernel_init+0x28e/0x404
    kernel_thread_starter+0x6/0xc
    kernel_thread_starter+0x0/0xc

    Remove the call to iucv_unregister() and remove the goto label
    as unregistering is the last step in the hvc_iucv initialization.
    If iucv_register() fails, simply clean up hvc terminals and free
    resources.

    Signed-off-by: Hendrik Brueckner
    Signed-off-by: Martin Schwidefsky

    Hendrik Brueckner
     
  • * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
    Update broken web addresses in arch directory.
    Update broken web addresses in the kernel.
    Revert "drivers/usb: Remove unnecessary return's from void functions" for musb gadget
    Revert "Fix typo: configuation => configuration" partially
    ida: document IDA_BITMAP_LONGS calculation
    ext2: fix a typo on comment in ext2/inode.c
    drivers/scsi: Remove unnecessary casts of private_data
    drivers/s390: Remove unnecessary casts of private_data
    net/sunrpc/rpc_pipe.c: Remove unnecessary casts of private_data
    drivers/infiniband: Remove unnecessary casts of private_data
    drivers/gpu/drm: Remove unnecessary casts of private_data
    kernel/pm_qos_params.c: Remove unnecessary casts of private_data
    fs/ecryptfs: Remove unnecessary casts of private_data
    fs/seq_file.c: Remove unnecessary casts of private_data
    arm: uengine.c: remove C99 comments
    arm: scoop.c: remove C99 comments
    Fix typo configue => configure in comments
    Fix typo: configuation => configuration
    Fix typo interrest[ing|ed] => interest[ing|ed]
    Fix various typos of valid in comments
    ...

    Fix up trivial conflicts in:
    drivers/char/ipmi/ipmi_si_intf.c
    drivers/usb/gadget/rndis.c
    net/irda/irnet/irnet_ppp.c

    Linus Torvalds
     

23 Oct, 2010

13 commits

  • * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: (49 commits)
    serial8250: ratelimit "too much work" error
    serial: bfin_sport_uart: speed up sport RX sample rate to be 3% faster
    serial: abstraction for 8250 legacy ports
    serial/imx: check that the buffer is non-empty before sending it out
    serial: mfd: add more baud rates support
    jsm: Remove the uart port on errors
    Alchemy: Add UART PM methods.
    8250: allow platforms to override PM hook.
    altera_uart: Don't use plain integer as NULL pointer
    altera_uart: Fix missing prototype for registering an early console
    altera_uart: Fixup type usage of port flags
    altera_uart: Make it possible to use Altera UART and 8250 ports together
    altera_uart: Add support for different address strides
    altera_uart: Add support for getting mapbase and IRQ from resources
    altera_uart: Add support for polling mode (IRQ-less)
    serial: Factor out uart_poll_timeout() from 8250 driver
    serial: mark the 8250 driver as maintained
    serial: 8250: Don't delay after transmitter is ready.
    tty: MAINTAINERS: add drivers/serial/jsm/ as maintained driver
    vcs: invoke the vt update callback when /dev/vcs* is written to
    ...

    Linus Torvalds
     
  • * 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl:
    vfs: make no_llseek the default
    vfs: don't use BKL in default_llseek
    llseek: automatically add .llseek fop
    libfs: use generic_file_llseek for simple_attr
    mac80211: disallow seeks in minstrel debug code
    lirc: make chardev nonseekable
    viotape: use noop_llseek
    raw: use explicit llseek file operations
    ibmasmfs: use generic_file_llseek
    spufs: use llseek in all file operations
    arm/omap: use generic_file_llseek in iommu_debug
    lkdtm: use generic_file_llseek in debugfs
    net/wireless: use generic_file_llseek in debugfs
    drm: use noop_llseek

    Linus Torvalds
     
  • * 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl:
    block: autoconvert trivial BKL users to private mutex
    drivers: autoconvert trivial BKL users to private mutex
    ipmi: autoconvert trivial BKL users to private mutex
    mac: autoconvert trivial BKL users to private mutex
    mtd: autoconvert trivial BKL users to private mutex
    scsi: autoconvert trivial BKL users to private mutex

    Fix up trivial conflicts (due to addition of private mutex right next to
    deletion of a version string) in drivers/char/pcmcia/cm40[04]0_cs.c

    Linus Torvalds
     
  • * 'config' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl:
    BKL: introduce CONFIG_BKL.
    dabusb: remove the BKL
    sunrpc: remove the big kernel lock
    init/main.c: remove BKL notations
    blktrace: remove the big kernel lock
    rtmutex-tester: make it build without BKL
    dvb-core: kill the big kernel lock
    dvb/bt8xx: kill the big kernel lock
    tlclk: remove big kernel lock
    fix rawctl compat ioctls breakage on amd64 and itanic
    uml: kill big kernel lock
    parisc: remove big kernel lock
    cris: autoconvert trivial BKL users
    alpha: kill big kernel lock
    isapnp: BKL removal
    s390/block: kill the big kernel lock
    hpet: kill BKL, add compat_ioctl

    Linus Torvalds
     
  • A notifier chain is called whenever the vt code modifies a terminal
    content, except for one case which is when the modification comes
    through writes to /dev/vcs* devices. Let's add the missing notifier
    invocation at the end of vcs_write() for that case too.

    Signed-off-by: Nicolas Pitre
    Cc: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Nicolas Pitre
     
  • The /dev/vcs* devices are used, amongst other things, by accessibility
    applications such as BRLTTY to display the screen content onto refreshable
    braille displays. Currently this is performed by constantly reading from
    /dev/vcsa0 whether or not the screen content has changed. Given the
    default braille refresh rate of 25 times per second, this easily qualifies
    as the biggest source of wake-up events preventing laptops from entering
    deeper power saving states.

    To avoid this periodic polling, let's add support for select()/poll() and
    SIGIO with the /dev/vcs* devices. The implemented semantic is to report
    data availability whenever the corresponding vt has seen some update after
    the last read() operation. The application still has to lseek() back
    as usual in order to read() the new data.

    Not to create unwanted overhead, the needed data structure is allocated
    and the vt notification callback is registered only when the poll or
    fasync method is invoked for the first time per file instance.

    Signed-off-by: Nicolas Pitre
    Cc: Andrew Morton
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Nicolas Pitre
     
  • Again basically cut and paste

    Convert the main driver set to use the hooks for GICOUNT

    Signed-off-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Alan Cox
     
  • Dan Rosenberg noted that various drivers return the struct with uncleared
    fields. Instead of spending forever trying to stomp all the drivers that
    get it wrong (and every new driver) do the job in one place.

    This first patch adds the needed operations and hooks them up, including
    the needed USB midlayer and serial core plumbing.

    Signed-off-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Alan Cox
     
  • Function tty_register_device may return ERR_PTR(...). Check for it.

    Signed-off-by: Vasiliy Kulikov
    Signed-off-by: Greg Kroah-Hartman

    Vasiliy Kulikov
     
  • Vasiliy found that pci_disable_device is not called on fail paths in
    mxser_probe. Actually, it is called from nowhere in the driver.

    There are three changes needed:
    1) don't use pseudo-generic mxser_release_res. Let's use it only from
    ISA paths from now on. All the pci stuff is moved to probe and
    remove PCI-related functions.
    2) reorder fail-paths in the probe function so that it makes sense and
    we can call them from the sequential code naturally (the further we
    are the earlier label we go to).
    3) add pci_disable_device both to mxser_probe and mxser_remove.

    There is a nit of adding CONFIG_PCI ifdef to mxser_remove. it is
    because this driver supports ISA-only compilations and it would choke
    up on the newly added calls now.

    Signed-off-by: Jiri Slaby
    Cc: Kulikov Vasiliy
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • Ttyprintk is a pseudo TTY driver, which allows users to make printk
    messages, via output to ttyprintk device. It is possible to store
    "console" messages inline with kernel messages for better analyses of
    the boot process, for example.

    Signed-off-by: Samo Pogacnik
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Samo Pogacnik
     
  • This patch removes __GFP_NOFAIL use from tty_add_file() and adds proper error
    handling to the call-sites of the function.

    Cc: Andrew Morton
    Cc: Alan Cox
    Cc: Arnd Bergmann
    Signed-off-by: Pekka Enberg
    Acked-by: David Rientjes
    Signed-off-by: Greg Kroah-Hartman

    Pekka Enberg
     
  • Some device drivers (mostly tty line disciplines) would like to have way
    know a struct device instance corresponding to passed tty_struct. Add
    a struct device pointer to struct tty_struct and populate it during
    initialize_tty_struct().

    Signed-off-by: Dmitry Eremin-Solenikov
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Dmitry Eremin-Solenikov
     

22 Oct, 2010

4 commits

  • * git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: (22 commits)
    pcmcia: synclink_cs: fix information leak to userland
    pcmcia: don't call flush_scheduled_work() spuriously
    serial_cs: drop spurious flush_scheduled_work() call
    pcmcia/yenta: guide users in case of problems with O2-bridges
    pcmcia: fix unused function compile warning
    pcmcia: vrc4173_cardu: Fix error path for pci_release_regions and pci_disable_device
    pcmcia: add a few debug statements
    pcmcia: remove obsolete and wrong comments
    pcmcia: avoid messages on module (un)loading
    pcmcia: move driver name to struct pcmcia_driver
    pcmcia: remove the "Finally, report what we've done" message
    pcmcia: use autoconfiguration feature for ioports and iomem
    pcmcia: introduce autoconfiguration feature
    pcmcia: Documentation update
    pcmcia: convert pcmcia_request_configuration to pcmcia_enable_device
    pcmcia: move config_{base,index,regs} to struct pcmcia_device
    pcmcia: simplify IntType
    pcmcia: simplify Status, ExtStatus register access
    pcmcia: remove Pin, Copy configuration register access
    pcmcia: move Vpp setup to struct pcmcia_device
    ...

    Linus Torvalds
     
  • …/git/tip/linux-2.6-tip

    * 'x86-amd-nb-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
    x86, amd_nb: Enable GART support for AMD family 0x15 CPUs
    x86, amd: Use compute unit information to determine thread siblings
    x86, amd: Extract compute unit information for AMD CPUs
    x86, amd: Add support for CPUID topology extension of AMD CPUs
    x86, nmi: Support NMI watchdog on newer AMD CPU families
    x86, mtrr: Assume SYS_CFG[Tom2ForceMemTypeWB] exists on all future AMD CPUs
    x86, k8: Rename k8.[ch] to amd_nb.[ch] and CONFIG_K8_NB to CONFIG_AMD_NB
    x86, k8-gart: Decouple handling of garts and northbridges
    x86, cacheinfo: Fix dependency of AMD L3 CID
    x86, kvm: add new AMD SVM feature bits
    x86, cpu: Fix allowed CPUID bits for KVM guests
    x86, cpu: Update AMD CPUID feature bits
    x86, cpu: Fix renamed, not-yet-shipping AMD CPUID feature bit
    x86, AMD: Remove needless CPU family check (for L3 cache info)
    x86, tsc: Remove CPU frequency calibration on AMD

    Linus Torvalds
     
  • …/git/tip/linux-2.6-tip

    * 'core-iommu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
    x86/amd-iommu: Update copyright headers
    x86/amd-iommu: Reenable AMD IOMMU if it's mysteriously vanished over suspend
    AGP: Warn when GATT memory cannot be set to UC
    x86, GART: Disable GART table walk probes
    x86, GART: Remove superfluous AMD64_GARTEN

    Linus Torvalds
     
  • …s/security-testing-2.6

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (26 commits)
    selinux: include vmalloc.h for vmalloc_user
    secmark: fix config problem when CONFIG_NF_CONNTRACK_SECMARK is not set
    selinux: implement mmap on /selinux/policy
    SELinux: allow userspace to read policy back out of the kernel
    SELinux: drop useless (and incorrect) AVTAB_MAX_SIZE
    SELinux: deterministic ordering of range transition rules
    kernel: roundup should only reference arguments once
    kernel: rounddown helper function
    secmark: export secctx, drop secmark in procfs
    conntrack: export lsm context rather than internal secid via netlink
    security: secid_to_secctx returns len when data is NULL
    secmark: make secmark object handling generic
    secmark: do not return early if there was no error
    AppArmor: Ensure the size of the copy is < the buffer allocated to hold it
    TOMOYO: Print URL information before panic().
    security: remove unused parameter from security_task_setscheduler()
    tpm: change 'tpm_suspend_pcr' to be module parameter
    selinux: fix up style problem on /selinux/status
    selinux: change to new flag variable
    selinux: really fix dependency causing parallel compile failure.
    ...

    Linus Torvalds
     

21 Oct, 2010

14 commits