13 Jan, 2012

1 commit


09 Oct, 2010

1 commit

  • setup.phone and setup.eazmsn are 32 character buffers.
    rcvmsg.msg_data.byte_array is a 48 character buffer.
    sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars.

    The rcvmsg struct comes from the memcpy_fromio() in receivemessage().
    I guess that means it's data off the wire. I'm not very familiar with
    this code but I don't see any reason to assume these strings are NULL
    terminated.

    Also it's weird that "dn" in a 50 character buffer but we only seem to
    use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49
    character buffer. So potentially there is still an issue there.

    The important thing for now is to prevent the memory corruption.

    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     

06 Aug, 2010

1 commit

  • The main motivation of this patch changing strcpy() to strlcpy().
    We strcpy() to copy a 48 byte buffers into a 49 byte buffers. So at
    best the last byte has leaked information, or maybe there is an
    overflow? Anyway, this patch closes the information leaks by zeroing
    the memory and the calls to strlcpy() prevent overflows.

    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     

31 May, 2010

1 commit

  • Use memdup_user when user data is immediately copied into the
    allocated region.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    expression from,to,size,flag;
    position p;
    identifier l1,l2;
    @@

    - to = \(kmalloc@p\|kzalloc@p\)(size,flag);
    + to = memdup_user(from,size);
    if (
    - to==NULL
    + IS_ERR(to)
    || ...) {

    }
    - if (copy_from_user(to, from, size) != 0) {
    -
    - }
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: David S. Miller

    Julia Lawall
     

30 Mar, 2010

1 commit

  • …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

05 Feb, 2010

1 commit


09 Nov, 2009

1 commit


12 Oct, 2009

1 commit


20 Feb, 2009

1 commit


13 Jun, 2008

1 commit

  • spid has been allocated in this function and so should be freed before
    leaving it, as in the other error handling cases.

    The semantic match that finds the problem is as follows:
    (http://www.emn.fr/x-info/coccinelle/)

    @r exists@
    expression E,E1;
    statement S;
    position p1,p2,p3;
    @@

    E =@p1 \(kmalloc\|kcalloc\|kzalloc\)(...)
    ... when != E = E1
    if (E == NULL || ...) S
    ... when != E = E1
    if@p2 (...) {
    ... when != kfree(E)
    }
    ... when != E = E1
    kfree@p3(E);

    @forall@
    position r.p2;
    expression r.E;
    int E1 != 0;
    @@

    * if@p2 (...) {
    ... when != kfree(E)
    when strict
    return E1; }

    Signed-off-by: Julia Lawall
    Cc: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Julia Lawall
     

15 Nov, 2007

2 commits

  • CC [M] drivers/isdn/sc/shmem.o
    drivers/isdn/sc/shmem.c: In function ‘memcpy_toshmem’:
    drivers/isdn/sc/shmem.c:53: warning: passing argument 1 of ‘memcpy_toio’ makes pointer from integer without a cast

    Commit 9317d4313e0cd51b2256ea9a9316f2d8561e37a8:

    ISDN/sc: fix longstanding warning

    claimed to fix it, but it didn't.

    [ Changed the "void *" to be "void __iomem *" -DaveM ]

    Signed-off-by: Frank Lichtenheld
    Acked-by:Karsten Keil
    Signed-off-by: David S. Miller

    Frank Lichtenheld
     
  • isdn_if.writebuf_skb has an additional ack flag argument which
    was missing from sndpkt leading to the following warning:
    CC [M] drivers/isdn/sc/init.o
    drivers/isdn/sc/init.c: In function ‘sc_init’:
    drivers/isdn/sc/init.c:281: warning: assignment from incompatible pointer type

    Note that this doesn't actually do anything with the flag, it
    just fixes the warning (and probably accessing the last argument).

    Signed-off-by: Frank Lichtenheld
    Signed-off-by: David S. Miller

    Frank Lichtenheld
     

24 Oct, 2007

2 commits


20 Oct, 2007

1 commit


22 Jul, 2007

1 commit

  • Remove a menu statement and several dependencies from the Kconfig files in
    the drivers/isdn tree as they have become unnecessary by the transformation
    of CONFIG_ISDN from "menu, config" into "menuconfig".
    (Modified version of a patch originally proposed by Jan Engelhardt.)

    Signed-off-by: Tilman Schmidt
    Cc: Jan Engelhardt
    Acked-by: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tilman Schmidt
     

20 Jul, 2007

1 commit

  • There is check_reset() -- global function in drivers/isdn/sc/
    There is check_reset -- variable holding module param in aacraid driver.

    On allyesconfig they clash with:

    LD drivers/built-in.o
    drivers/isdn/built-in.o: In function `check_reset':
    : multiple definition of `check_reset'
    drivers/scsi/built-in.o:(.data+0xe458): first defined here
    ld: Warning: size of symbol `check_reset' changed from 4 in drivers/scsi/built-in.o to 219 in drivers/isdn/built-in.o
    ld: Warning: type of symbol `check_reset' changed from 1 to 2 in drivers/isdn/built-in.o

    Rename the former.

    Signed-off-by: Alexey Dobriyan
    Cc: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

22 May, 2007

1 commit

  • First thing mm.h does is including sched.h solely for can_do_mlock() inline
    function which has "current" dereference inside. By dealing with can_do_mlock()
    mm.h can be detached from sched.h which is good. See below, why.

    This patch
    a) removes unconditional inclusion of sched.h from mm.h
    b) makes can_do_mlock() normal function in mm/mlock.c
    c) exports can_do_mlock() to not break compilation
    d) adds sched.h inclusions back to files that were getting it indirectly.
    e) adds less bloated headers to some files (asm/signal.h, jiffies.h) that were
    getting them indirectly

    Net result is:
    a) mm.h users would get less code to open, read, preprocess, parse, ... if
    they don't need sched.h
    b) sched.h stops being dependency for significant number of files:
    on x86_64 allmodconfig touching sched.h results in recompile of 4083 files,
    after patch it's only 3744 (-8.3%).

    Cross-compile tested on

    all arm defconfigs, all mips defconfigs, all powerpc defconfigs,
    alpha alpha-up
    arm
    i386 i386-up i386-defconfig i386-allnoconfig
    ia64 ia64-up
    m68k
    mips
    parisc parisc-up
    powerpc powerpc-up
    s390 s390-up
    sparc sparc-up
    sparc64 sparc64-up
    um-x86_64
    x86_64 x86_64-up x86_64-defconfig x86_64-allnoconfig

    as well as my two usual configs.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

13 Feb, 2007

1 commit

  • Add proper prototypes in a header file for global code under
    drivers/isdn/sc/.

    Since the GNU C compiler is now able do tell us that caller and callee
    disagreed about the number of arguments of setup_buffers(), this patch
    also fixes this bug.

    Signed-off-by: Adrian Bunk
    Cc: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Adrian Bunk
     

09 Dec, 2006

1 commit


12 Oct, 2006

1 commit

  • pcbit: kill 'may be used uninitialized' warning. although the code does
    eventually fill the 32 bits it cares about, the variable truly is
    accessed uninitialized in each macro. Easier to just clean it up now.

    sc: fix a ton of obviously incorrect printk's (some with missing
    arguments even)

    Signed-off-by: Jeff Garzik
    Acked-by: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jeff Garzik
     

05 Oct, 2006

1 commit

  • Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
    of passing regs around manually through all ~1800 interrupt handlers in the
    Linux kernel.

    The regs pointer is used in few places, but it potentially costs both stack
    space and code to pass it around. On the FRV arch, removing the regs parameter
    from all the genirq function results in a 20% speed up of the IRQ exit path
    (ie: from leaving timer_interrupt() to leaving do_IRQ()).

    Where appropriate, an arch may override the generic storage facility and do
    something different with the variable. On FRV, for instance, the address is
    maintained in GR28 at all times inside the kernel as part of general exception
    handling.

    Having looked over the code, it appears that the parameter may be handed down
    through up to twenty or so layers of functions. Consider a USB character
    device attached to a USB hub, attached to a USB controller that posts its
    interrupts through a cascaded auxiliary interrupt controller. A character
    device driver may want to pass regs to the sysrq handler through the input
    layer which adds another few layers of parameter passing.

    I've build this code with allyesconfig for x86_64 and i386. I've runtested the
    main part of the code on FRV and i386, though I can't test most of the drivers.
    I've also done partial conversion for powerpc and MIPS - these at least compile
    with minimal configurations.

    This will affect all archs. Mostly the changes should be relatively easy.
    Take do_IRQ(), store the regs pointer at the beginning, saving the old one:

    struct pt_regs *old_regs = set_irq_regs(regs);

    And put the old one back at the end:

    set_irq_regs(old_regs);

    Don't pass regs through to generic_handle_irq() or __do_IRQ().

    In timer_interrupt(), this sort of change will be necessary:

    - update_process_times(user_mode(regs));
    - profile_tick(CPU_PROFILING, regs);
    + update_process_times(user_mode(get_irq_regs()));
    + profile_tick(CPU_PROFILING);

    I'd like to move update_process_times()'s use of get_irq_regs() into itself,
    except that i386, alone of the archs, uses something other than user_mode().

    Some notes on the interrupt handling in the drivers:

    (*) input_dev() is now gone entirely. The regs pointer is no longer stored in
    the input_dev struct.

    (*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
    something different depending on whether it's been supplied with a regs
    pointer or not.

    (*) Various IRQ handler function pointers have been moved to type
    irq_handler_t.

    Signed-Off-By: David Howells
    (cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)

    David Howells
     

03 Oct, 2006

2 commits

  • drivers/isdn/sc/event.c: In function 'indicate_status':
    drivers/isdn/sc/event.c:49: error: 'events' undeclared (first use in this function)
    drivers/isdn/sc/event.c:49: error: (Each undeclared identifier is reported only once
    drivers/isdn/sc/event.c:49: error: for each function it appears in.)
    drivers/isdn/sc/event.c:49: warning: format '%d' expects type 'int', but argument 4 has type 'ulong'

    drivers/isdn/sc/interrupt.c: In function 'interrupt_handler':
    drivers/isdn/sc/interrupt.c:97: warning: format '%x' expects type 'unsigned int', but argument 4 has type 'long unsigned int'

    drivers/isdn/sc/timer.c: In function 'check_reset':
    drivers/isdn/sc/timer.c:80: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'

    Acked-by: Karsten Keil
    Cc: Zach Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • When pr_debug() is enabled:

    drivers/isdn/sc/command.c: In function 'command':
    drivers/isdn/sc/command.c:107: error: 'commands' undeclared (first use in this function)
    drivers/isdn/sc/command.c:107: error: (Each undeclared identifier is reported only once
    drivers/isdn/sc/command.c:107: error: for each function it appears in.)
    drivers/isdn/sc/command.c:122: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'dial':
    drivers/isdn/sc/command.c:199: warning: format '%d' expects type 'int', but argument 4 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'answer':
    drivers/isdn/sc/command.c:221: warning: format '%s' expects type 'char *', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'hangup':
    drivers/isdn/sc/command.c:244: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'setl2':
    drivers/isdn/sc/command.c:265: error: 'l2protos' undeclared (first use in this function)
    drivers/isdn/sc/command.c: In function 'setl3':
    drivers/isdn/sc/command.c:297: error: 'l3protos' undeclared (first use in this function)
    drivers/isdn/sc/command.c:297: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'acceptb':
    drivers/isdn/sc/command.c:315: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'clreaz':
    drivers/isdn/sc/command.c:330: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
    drivers/isdn/sc/command.c: In function 'seteaz':
    drivers/isdn/sc/command.c:345: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'

    Cc: Zach Brown
    Acked-by: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     

03 Jul, 2006

1 commit


23 Jun, 2006

1 commit

  • Fix leak of `rcvmsg' in sc_ioctl().

    There are two returns in the switch in sc_ioctl (the SCIOCSTART case) that
    may leak `rcvmsg'. This patch fixes that by adding a kfree() call at the
    beginning of that case.

    Bug found by the coverity checker as #1098

    Eric Sesterhenn send me a patch to fix the leak(s) by adding 2 kfree()
    calls before the returns, I changed that into just a single call at the
    beginning.

    Signed-off-by: Jesper Juhl
    Cc: Karsten Keil
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jesper Juhl
     

01 Apr, 2006

1 commit


04 Feb, 2006

1 commit


09 Jan, 2006

1 commit


09 Nov, 2005

1 commit

  • This patch removes almost all inclusions of linux/version.h. The 3
    #defines are unused in most of the touched files.

    A few drivers use the simple KERNEL_VERSION(a,b,c) macro, which is
    unfortunatly in linux/version.h.

    There are also lots of #ifdef for long obsolete kernels, this was not
    touched. In a few places, the linux/version.h include was move to where
    the LINUX_VERSION_CODE was used.

    quilt vi `find * -type f -name "*.[ch]"|xargs grep -El '(UTS_RELEASE|LINUX_VERSION_CODE|KERNEL_VERSION|linux/version.h)'|grep -Ev '(/(boot|coda|drm)/|~$)'`

    search pattern:
    /UTS_RELEASE\|LINUX_VERSION_CODE\|KERNEL_VERSION\|linux\/\(utsname\|version\).h

    Signed-off-by: Olaf Hering
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Olaf Hering
     

07 Nov, 2005

1 commit


13 Sep, 2005

1 commit


26 Jun, 2005

1 commit

  • This patch contains the following possible cleanips:
    - make some needlessly global code static
    - remove the compiled but completely unused debug.c
    - remove or #if 0 the following unused global functions:
    - command.c: loopback
    - command.c: loadproc
    - init.c: irq_supported
    - packet.c: print_skb
    - shmem.c: memset_shmem
    - timer.c: trace_timer

    Signed-off-by: Adrian Bunk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Adrian Bunk
     

17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds