aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-09-27Fix pktcdvd ioctl dev_minor range checkDan Rosenberg1-1/+1
The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg <[email protected]> [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27MN10300: Default config choice GDBSTUB_TTYSM0 should be GDBSTUB_ON_TTYSM0David Howells1-1/+1
The configuration choice for the port on which the GDB stub listens has a default of GDBSTUB_TTYSM0, but this should be GDBSTUB_ON_TTYSM0 to match the option. Signed-off-by: David Howells <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds1-2/+4
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: RDMA/cxgb3: Turn off RX coalescing for iWARP connections
2010-09-27Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds27-81/+207
* master.kernel.org:/home/rmk/linux-2.6-arm: (28 commits) ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tile ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICE ARM: 6408/1: omap: Map only available sram memory ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entries ARM: pxa: remove pr_<level> uses of KERN_<level> ARM: pxa168fb: clear enable bit when not active ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configured ARM: pxa168: fix corrected reset vector ARM: pxa: Use PIO for PI2C communication on Palm27x ARM: pxa: Fix Vpac270 gpio_power for MMC ARM: 6401/1: plug a race in the alignment trap handler ARM: 6406/1: at91sam9g45: fix i2c bus speed leds: leds-ns2: fix locking ARM: dove: fix __io() definition to use bus based offset dmaengine: fix interrupt clearing for mv_xor ARM: kirkwood: Unbreak PCIe I/O port ARM: Fix build error when using KCONFIG_CONFIG ARM: 6383/1: Implement phys_mem_access_prot() to avoid attributes aliasing ARM: 6400/1: at91: fix arch_gettimeoffset fallout ARM: 6398/1: add proc info for ARM11MPCore/Cortex-A9 from ARM ...
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds1-11/+18
git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: net/9p: fix memory handling/allocation in rdma_request()
2010-09-27Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bpLinus Torvalds1-0/+3
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: Fix driver module removal
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds2-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: TOMOYO: Don't abuse sys_getpid(), sys_getppid()
2010-09-27Merge branch 'drm-intel-fixes' of ↵Linus Torvalds2-10/+7
git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915/sdvo: Handle unsupported GET_SUPPORTED_ENHANCEMENTS gracefully drm/i915/sdvo: Cleanup connector on error path drm/i915: Fix 945GM regression in e259befd
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds2-6/+14
git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove mmc: sdhci-s3c: fix incorrect spinlock usage after merge mmc: MAINTAINERS: add myself as MMC maintainer
2010-09-27Merge branch 'urgent' of ↵Linus Torvalds2-1/+7
git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: pd6729: Fix error path pcmcia: preserve configuration information if request_io fails partly
2010-09-27Merge git://git.infradead.org/iommu-2.6Linus Torvalds1-0/+27
* git://git.infradead.org/iommu-2.6: intel-iommu: Use symbolic values instead of magic numbers in Lenovo w/a intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space
2010-09-27Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds6-24/+82
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/amd-iommu: Fix rounding-bug in __unmap_single x86/amd-iommu: Work around S3 BIOS bug x86/amd-iommu: Set iommu configuration flags in enable-loop x86, setup: Fix earlyprintk=serial,0x3f8,115200 x86, setup: Fix earlyprintk=serial,ttyS0,115200
2010-09-27Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds2-1/+13
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf, x86: Catch spurious interrupts after disabling counters tracing/x86: Don't use mcount in kvmclock.c tracing/x86: Don't use mcount in pvclock.c
2010-09-27mn10300: check __get_user/__put_user results...Al Viro1-6/+6
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: get rid of set_fs(USER_DS) in sigframe setupAl Viro1-4/+0
It really has no business being there; short of a serious kernel bug we should already have USER_DS at that point. It shouldn't have been done on x86 either... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: ->restart_block.fn needs to be reset on sigreturnAl Viro1-0/+3
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: prevent double syscall restartsAl Viro1-3/+9
set ->orig_d0 to -1, same as what sigreturn does Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: avoid SIGSEGV delivery loopAl Viro1-2/+2
force_sigsegv() is there for purpose... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27alpha: __get_user/__put_user results need to be checked...Al Viro1-4/+4
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27alpha: switch osf_sigprocmask() to use of sigprocmask()Al Viro3-47/+12
get rid of a useless wrapper, while we are at it Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27RDMA/cxgb3: Turn off RX coalescing for iWARP connectionsSteve Wise1-2/+4
The HW by default has RX coalescing on. For iWARP connections, this causes a 100ms delay in connection establishement due to the ingress MPA Start message being stalled in HW. So explicitly turn RX coalescing off when setting up iWARP connections. This was causing very bad performance for NP64 gather operations using Open MPI, due to the way it sets up connections on larger jobs. Signed-off-by: Steve Wise <[email protected]> Cc: <[email protected]> Signed-off-by: Roland Dreier <[email protected]>
2010-09-27ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tileWill Deacon1-1/+7
The PL310 on the ct-ca9x4 tile for the Versatile Express does not need to add additional latency when accessing its cache RAMs. Unfortunately, the boot monitor sets this up for an 8-cycle delay on reads and writes, resulting in greatly reduced memory performance when the L2 cache is enabled. This patch sets the L2 RAM latencies to the correct value of 1 cycle on the ct-ca9x4 tile before enabling the L2 cache. Acked-by: Catalin Marinas <[email protected]> Signed-off-by: Will Deacon <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-09-27net/9p: fix memory handling/allocation in rdma_request()Davidlohr Bueso1-11/+18
Return -ENOMEM when erroring on kmalloc and fix memory leaks when returning on error. Signed-off-by: Davidlohr Bueso <[email protected]> Reviewed-by: Aneesh Kumar K.V <[email protected]> Signed-off-by: Eric Van Hensbergen <[email protected]>
2010-09-27amd64_edac: Fix driver module removalBorislav Petkov1-0/+3
f4347553b30ec66530bfe63c84530afea3803396 removed the edac polling mechanism in favor of using a notifier chain for conveying MCE information to edac. However, the module removal path didn't test whether the driver had setup the polling function workqueue at all and the rmmod process was hanging in the kernel at try_to_del_timer_sync() in the cancel_delayed_work() path, trying to cancel an uninitialized work struct. Fix that by adding a balancing check to the workqueue removal path. Signed-off-by: Borislav Petkov <[email protected]>
2010-09-27TOMOYO: Don't abuse sys_getpid(), sys_getppid()Ben Hutchings2-4/+5
System call entry functions sys_*() are never to be called from general kernel code. The fact that they aren't declared in header files should have been a clue. These functions also don't exist on Alpha since it has sys_getxpid() instead. Signed-off-by: Ben Hutchings <[email protected]> Acked-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-09-26mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_removeMarek Szyprowski1-2/+4
If not all clocks have been defined in platform data, the driver will cause a null pointer dereference when it is removed. This patch fixes this issue. Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Chris Ball <[email protected]>
2010-09-26mmc: sdhci-s3c: fix incorrect spinlock usage after mergeMarek Szyprowski1-2/+4
In the commit f522886e202a34a2191dd5d471b3c4d46410a9a0 a merge conflict in the sdhci-s3c driver been fixed. However the fix used incorrect spinlock operation - it caused a race with sdhci interrupt service. The correct way to solve it is to use spin_lock_irqsave/irqrestore() calls. Signed-off-by: Marek Szyprowski <[email protected]> Signed-off-by: Kyungmin Park <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Chris Ball <[email protected]>
2010-09-26mmc: MAINTAINERS: add myself as MMC maintainerChris Ball1-2/+6
Signed-off-by: Chris Ball <[email protected]> Cc: Pierre Ossman <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
2010-09-26pcmcia: pd6729: Fix error pathRahul Ruikar1-1/+1
In error return path call pci_disable_device() which was enabled earlier. Signed-off-by: Rahul Ruikar <[email protected]> Signed-off-by: Dominik Brodowski <[email protected]>
2010-09-25alpha: fix usp value in multithreaded coredumpsAl Viro1-1/+1
rdusp() gives us the right value only for the current thread... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-25alpha: fix hae_cache race in RESTORE_ALLAl Viro1-4/+7
We want interrupts disabled on all paths leading to RESTORE_ALL; otherwise, we are risking an IRQ coming between the updates of alpha_mv->hae_cache and *alpha_mv->hae_register and set_hae() within the IRQ getting badly confused. RESTORE_ALL used to play with disabling IRQ itself, but that got removed back in 2002, without making sure we had them disabled on all paths. It's cheaper to make sure we have them disabled than to revert to original variant... Remove the detritus left from that commit back in 2002; we used to need a reload of $0 and $1 since swpipl would change those, but doing that had become pointless when we stopped doing swpipl in there... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-25Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds1-0/+12
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: prevent merges of discard and write requests
2010-09-25Merge branch 'for-linus' of ↵Linus Torvalds7-10/+39
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs ASoC: Fix multi-componentism ASoC: Fix soc-cache buffer overflow bug ALSA: oxygen: fix analog capture on Claro halo cards ALSA: hda - Add Dell Latitude E6400 model quirk ASoC: fix clkdev API usage in sh/migor.c
2010-09-25Avoid pgoff overflow in remap_file_pagesLarry Woodman1-0/+4
Thomas Pollet noticed that the remap_file_pages() system call in fremap.c has a potential overflow in the first part of the if statement below, which could cause it to process bogus input parameters. Specifically the pgoff + size parameters could be wrap thereby preventing the system call from failing when it should. Reported-by: Thomas Pollet <[email protected]> Signed-off-by: Larry Woodman <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-25Merge branch 'fix/hda' into for-linusTakashi Iwai2-6/+17
2010-09-25Merge branch 'fix/asoc' into for-linusTakashi Iwai2-4/+16
2010-09-25ALSA: sound/pci/rme9652: prevent reading uninitialized stack memoryDan Rosenberg2-0/+2
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdsp{m}_config_info structs declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2010-09-25ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICESantosh Shilimkar4-8/+4
On Davinci SRAM is mapped as MT_DEVICE becasue of the section mapping pre-requisite instead of intended MT_MEMORY_NONCACHED Since the section mapping limitation gets fixed with first patch in this series, the MT_MEMORY_NONCACHED can be used now. Signed-off-by: Santosh Shilimkar <[email protected]> Acked-by: Kevin Hilman <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-09-25ARM: 6408/1: omap: Map only available sram memorySantosh Shilimkar1-20/+5
Currently we map 1 MB section while setting up SRAM on OMAPs Regardless of the actual memory. The physical OCM RAM available on OMAP SOCs is in order of KBs. This patch maps only available sram and cleans up some un-necessary cpu_is_xxx checks. Mapping un-available or non-accessible(secure) memory on the newer ARM processor is dangerous. Because ARM CPUs can now speculatively prefetch, we should avoid mapping any no-existing or secure memory. Signed-off-by: Santosh Shilimkar <[email protected]> Acked-by: Tony Lindgren <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-09-25ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entriesSantosh Shilimkar1-2/+15
This patch populates the L1 entries for MT_MEMORY and MT_MEMORY_NONCACHED types so that at boot-up, we can map memories outside system memory at page level granularity Previously the mapping was limiting to section level, which creates unnecessary additional mapping for which physical memory may not present. On the newer ARM with speculation, this is dangerous and can result in untraceable aborts. Signed-off-by: Santosh Shilimkar <[email protected]> Signed-off-by: Russell King <[email protected]>
2010-09-25block: prevent merges of discard and write requestsAdrian Hunter1-0/+12
Add logic to prevent two I/O requests being merged if only one of them is a discard. Ditto secure discard. Without this fix, it is possible for write requests to transform into discard requests. For example: Submit bio 1 to discard 8 sectors from sector n Submit bio 2 to write 8 sectors from sector n + 16 Submit bio 3 to write 8 sectors from sector n + 8 Bio 1 becomes request 1. Bio 2 becomes request 2. Bio 3 is merged with request 2, and then subsequently request 2 is merged with request 1 resulting in just one I/O request which discards all 24 sectors. Signed-off-by: Adrian Hunter <[email protected]> (Moved the checks above the position checks /Jens) Signed-off-by: Jens Axboe <[email protected]>
2010-09-25Merge branch 'fix' of ↵Russell King6-6/+27
git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6
2010-09-24Merge branch 'hwmon-for-linus' of ↵Linus Torvalds7-39/+50
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: x86/hwmon: pkgtemp has no dependency on PCI MAINTAINERS: Update hwmon entry x86/hwmon: register alternate sibling upon CPU removal x86/hwmon: fix initialization of pkgtemp x86/hwmon: fix initialization of coretemp x86/hwmon: don't leak device attribute file from pkgtemp_probe() and pkgtemp_remove() x86/hwmon: avoid deadlock on CPU removal in pkgtemp x86/hwmon: fix module init for hotplug-but-no-device-found case hwmon: (lis3) Fix Oops with NULL platform data
2010-09-24Merge branch 'stable' of ↵Linus Torvalds1-7/+0
git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile: remove dead code from intvec_32.S
2010-09-25ARM: pxa: remove pr_<level> uses of KERN_<level>Joe Perches1-2/+1
Signed-off-by: Joe Perches <[email protected]> Signed-off-by: Eric Miao <[email protected]>
2010-09-25ARM: pxa168fb: clear enable bit when not activeHaojian Zhuang1-2/+2
While fb isn't active, we should clear CFG_GRA_ENA bit. The existing code can't clear this bit. Signed-off-by: Haojian Zhuang <[email protected]> Acked-by: Marek Vasut <[email protected]> Signed-off-by: Eric Miao <[email protected]>
2010-09-25ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configuredEric Miao1-0/+12
When CONFIG_PXA3xx is not selected, cpu_is_pxa3xx() doesn't expand to zero, which in some places doesn't result in correct optimization. Signed-off-by: Eric Miao <[email protected]> Reported-and-tested-by: Marek Vasut <[email protected]>
2010-09-25ARM: pxa168: fix corrected reset vectorMark F. Brown1-1/+6
Reset vector for pxa168 is 0xffff_0000 not 0x0. This fix allows reboot to work Signed-off-by: Mark F. Brown <[email protected]> Signed-off-by: Eric Miao <[email protected]>
2010-09-25ARM: pxa: Use PIO for PI2C communication on Palm27xMarek Vasut1-1/+5
Original idea by: Mike Rapoport <[email protected]> Signed-off-by: Marek Vasut <[email protected]>
2010-09-25ARM: pxa: Fix Vpac270 gpio_power for MMCMarek Vasut1-0/+1
GPIO 0 is valid, yet this platform doesn't have any power GPIO for MMC. Signed-off-by: Marek Vasut <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.