aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-05-26Input: usbtouchscreen - support bigger iNexio touchscreensOndrej Zary1-1/+6
Bigger Nexio touchscreens not only send more data but also the header values are modified somewhat. Fix the header (it's a guesswork but it works at least on one 46" touchscreen with 2.00SMS firmware) and also increase rept_size. Signed-off-by: Ondrej Zary <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-26Input: ads7846 - return error on regulator_get() failureKevin Hilman1-2/+2
In probe(), if regulator_get() failed, an error code was not being returned causing the driver to be successfully bound, even though probe failed. This in turn caused the suspend, resume and remove methods to be registered and accessed via the SPI core. Since these functions all access private driver data using pointers that had been freed during the failed probe, this would lead to unpredictable behavior. This patch ensures that probe() returns an error code in this failure case so the driver is not bound. Found using lockdep and noticing the lock used in the suspend/resum path pointed to a bogus lock due to the freed memory. Signed-off-by: Kevin Hilman <[email protected]> Acked-by: Mike Frysinger <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-22Input: twl4030-vibra - correct the power down sequencePeter Ujfalusi1-1/+1
It is better to turn off the first APLL, than the codec. Signed-off-by: Peter Ujfalusi <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-22Input: enable onkey driver of max8925Haojian Zhuang3-0/+159
When ONKEY is held for 3 seconds, KEY_POWER event is reported. Signed-off-by: Haojian Zhuang <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-20Input: use ABS_CNT rather than (ABS_MAX + 1)Daniel Mack6-21/+21
Signed-off-by: Daniel Mack <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: psmouse - small formatting changes to better follow coding styleDmitry Torokhov4-95/+100
Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: synaptics - set dimensions as reported by firmwareDmitry Torokhov2-11/+27
Newer Synaptics firmware allows to query maximim dimensions reported by device, let's use this data. Tested-by: Takashi Iwai <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: elantech - relax signature checksDmitry Torokhov1-1/+19
Apparently there are Elantech touchpads that report non-zero in the 2nd byte of their signature. Adjust the detection routine so that if 2nd byte is zero and 3rd byte contains value that is not a valid report rate, we still assume that signature is valid. Tested-by: Eric Piel <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: elantech - enforce common prefix on messagesDmitry Torokhov1-35/+32
Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: wistron_btns - switch to using kmemdup()Julia Lawall1-2/+2
Use kmemdup when some other buffer is immediately copied into the allocated region. Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: usbtouchscreen - switch to using kmemdup()Julia Lawall1-3/+2
Use kmemdup when some other buffer is immediately copied into the allocated region. Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: do not force selecting i8042 on MoorestownJacob Pan2-2/+2
Moorestown does not have i8042 based keyboard controller, so give an option to deselect i8042 for non-pc mid. Signed-off-by: Jacob Pan <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: Documentation/sysrq.txt - update KEY_SYSRQ infoPaul Fox1-7/+7
While setting up sysrq operation on the XO laptop (which lacks a SysRq key), i realized that the documentation was quite out of date. Change documentation of SysRq to reflect current KEY_SYSRQ value. Signed-off-by: Paul Fox <[email protected]> Signed-off-by: Randy Dunlap <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: 88pm860x_onkey - remove invalid irq number assignmentHaojian Zhuang1-1/+0
Irq number of onkey is assigned twice. The second assignment is wrong. Signed-off-by: Haojian Zhuang <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: i8042 - add a PNP entry to the aux device listMatthew Garrett1-0/+1
Windows checks for an ALPS PS/2 device in PNP. Add it on the off-chance that there's a machine that expresses this without also providing a compatibility ID. Signed-off-by: Matthew Garrett <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: i8042 - add some extra PNP keyboard typesMatthew Garrett1-0/+13
Some Japanese machines declare their keyboard with a different PNP ID. Add it to the list of probed device IDs. While we're at it, add all the other IDs that Windows binds to - we'll probably never see them in the real world, but it doesn't hurt. Signed-off-by: Matthew Garrett <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Input: wm9712 - fix wm97xx_set_gpio() logicManuel Lauss1-1/+1
WM97XX_GPIO_HIGH is not a bitmap and should to be treated as such. Signed-off-by: Dmitry Torokhov <[email protected]>
2010-05-19Merge commit 'v2.6.34' into nextDmitry Torokhov938-6367/+13494
2010-05-16Linus 2.6.34Linus Torvalds1-1/+1
2010-05-16Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds5-81/+160
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: rtnetlink: make SR-IOV VF interface symmetric sctp: delete active ICMP proto unreachable timer when free transport tcp: fix MD5 (RFC2385) support
2010-05-16Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds4-7/+21
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: MIPS: Oprofile: Fix Loongson irq handler MIPS: N32: Use compat version for sys_ppoll. MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1
2010-05-16rtnetlink: make SR-IOV VF interface symmetricChris Wright2-53/+129
Now we have a set of nested attributes: IFLA_VFINFO_LIST (NESTED) IFLA_VF_INFO (NESTED) IFLA_VF_MAC IFLA_VF_VLAN IFLA_VF_TX_RATE This allows a single set to operate on multiple attributes if desired. Among other things, it means a dump can be replayed to set state. The current interface has yet to be released, so this seems like something to consider for 2.6.34. Signed-off-by: Chris Wright <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-05-16sctp: delete active ICMP proto unreachable timer when free transportWei Yongjun1-0/+4
transport may be free before ICMP proto unreachable timer expire, so we should delete active ICMP proto unreachable timer when transport is going away. Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Vlad Yasevich <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-05-16tcp: fix MD5 (RFC2385) supportEric Dumazet2-28/+27
TCP MD5 support uses percpu data for temporary storage. It currently disables preemption so that same storage cannot be reclaimed by another thread on same cpu. We also have to make sure a softirq handler wont try to use also same context. Various bug reports demonstrated corruptions. Fix is to disable preemption and BH. Reported-by: Bhaskar Dutta <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-05-15 MIPS: Oprofile: Fix Loongson irq handlerWu Zhangjin1-1/+1
The interrupt enable bit for the performance counters is in the Control Register $24, not in the counter register. loongson2_perfcount_handler(), we need to use Reported-by: Xu Hengyang <[email protected]> Signed-off-by: Wu Zhangjin <[email protected]> Cc: [email protected] Patchwork: http://patchwork.linux-mips.org/patch/1198/ Signed-off-by: Ralf Baechle <[email protected]> ---
2010-05-15 MIPS: N32: Use compat version for sys_ppoll.Chandrakala Chavva1-1/+1
The sys_ppoll() takes struct 'struct timespec'. This is different for the N32 and N64 ABIs. Use the compat version to do the proper conversions. Signed-off-by: David Daney <[email protected]> To: [email protected] Patchwork: http://patchwork.linux-mips.org/patch/1210/ Signed-off-by: Ralf Baechle <[email protected]> ---
2010-05-15 MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1Shane McDonald2-5/+19
In the FPU emulator code of the MIPS, the Cause bits of the FCSR register are not currently writeable by the ctc1 instruction. In odd corner cases, this can cause problems. For example, a case existed where a divide-by-zero exception was generated by the FPU, and the signal handler attempted to restore the FPU registers to their state before the exception occurred. In this particular setup, writing the old value to the FCSR register would cause another divide-by-zero exception to occur immediately. The solution is to change the ctc1 instruction emulator code to allow the Cause bits of the FCSR register to be writeable. This is the behaviour of the hardware that the code is emulating. This problem was found by Shane McDonald, but the credit for the fix goes to Kevin Kissell. In Kevin's words: I submit that the bug is indeed in that ctc_op: case of the emulator. The Cause bits (17:12) are supposed to be writable by that instruction, but the CTC1 emulation won't let them be updated by the instruction. I think that actually if you just completely removed lines 387-388 [...] things would work a good deal better. At least, it would be a more accurate emulation of the architecturally defined FPU. If I wanted to be really, really pedantic (which I sometimes do), I'd also protect the reserved bits that aren't necessarily writable. Signed-off-by: Shane McDonald <[email protected]> To: [email protected] To: [email protected] To: [email protected] Patchwork: http://patchwork.linux-mips.org/patch/1205/ Signed-off-by: Ralf Baechle <[email protected]> ---
2010-05-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstableLinus Torvalds1-0/+5
* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: check for read permission on src file in the clone ioctl
2010-05-15lib/btree: fix possible NULL pointer dereference[email protected]1-1/+2
mempool_alloc() can return null in atomic case. Signed-off-by: Denis Kirjanov <[email protected]> Cc: Joern Engel <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-05-15mmc: at91_mci: modify cache flush routinesNicolas Ferre1-1/+1
As we were using an internal dma flushing routine, this patch changes to the DMA API flush_kernel_dcache_page(). Driver is able to compile now. [[email protected]: flush_kernel_dcache_page() comes before kunmap_atomic()] Signed-off-by: Nicolas Ferre <[email protected]> Cc: James Bottomley <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-05-15Btrfs: check for read permission on src file in the clone ioctlDan Rosenberg1-0/+5
The existing code would have allowed you to clone a file that was only open for writing Signed-off-by: Chris Mason <[email protected]>
2010-05-15Merge branch 'for-linus' of ↵Linus Torvalds8-26/+49
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: JFS: Free sbi memory in error path fs/sysv: dereferencing ERR_PTR() Fix double-free in logfs Fix the regression created by "set S_DEAD on unlink()..." commit
2010-05-15Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds1-0/+3
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf record: Add a fallback to the reference relocation symbol
2010-05-15JFS: Free sbi memory in error pathJan Blunck1-7/+6
I spotted the missing kfree() while removing the BKL. [[email protected]: avoid multiple returns so it doesn't happen again] Signed-off-by: Jan Blunck <[email protected]> Cc: Dave Kleikamp <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2010-05-15fs/sysv: dereferencing ERR_PTR()Dan Carpenter1-1/+1
I moved the dir_put_page() inside the if condition so we don't dereference "page", if it's an ERR_PTR(). Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Al Viro <[email protected]>
2010-05-15Fix double-free in logfsAl Viro1-7/+7
iput() is needed *until* we'd done successful d_alloc_root() Signed-off-by: Al Viro <[email protected]>
2010-05-15Fix the regression created by "set S_DEAD on unlink()..." commitAl Viro5-11/+35
1) i_flags simply doesn't work for mount/unlink race prevention; we may have many links to file and rm on one of those obviously shouldn't prevent bind on top of another later on. To fix it right way we need to mark _dentry_ as unsuitable for mounting upon; new flag (DCACHE_CANT_MOUNT) is protected by d_flags and i_mutex on the inode in question. Set it (with dont_mount(dentry)) in unlink/rmdir/etc., check (with cant_mount(dentry)) in places in namespace.c that used to check for S_DEAD. Setting S_DEAD is still needed in places where we used to set it (for directories getting killed), since we rely on it for readdir/rmdir race prevention. 2) rename()/mount() protection has another bogosity - we unhash the target before we'd checked that it's not a mountpoint. Fixed. 3) ancient bogosity in pivot_root() - we locked i_mutex on the right directory, but checked S_DEAD on the different (and wrong) one. Noticed and fixed. Signed-off-by: Al Viro <[email protected]>
2010-05-14Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds12-35/+99
* master.kernel.org:/home/rmk/linux-2.6-arm: ARM: 6126/1: ARM mpcore_wdt: fix build failure and other fixes ARM: 6125/1: ARM TWD: move TWD registers to common header ARM: 6110/1: Fix Thumb-2 kernel builds when UACCESS_WITH_MEMCPY is enabled ARM: 6112/1: Use the Inner Shareable I-cache and BTB ops on ARMv7 SMP ARM: 6111/1: Implement read/write for ownership in the ARMv6 DMA cache ops ARM: 6106/1: Implement copy_to_user_page() for noMMU ARM: 6105/1: Fix the __arm_ioremap_caller() definition in nommu.c
2010-05-14Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds1-0/+4
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, mrst: Don't blindly access extended config space
2010-05-14profile: fix stats and data leakageHugh Dickins1-1/+3
If the kernel is large or the profiling step small, /proc/profile leaks data and readprofile shows silly stats, until readprofile -r has reset the buffer: clear the prof_buffer when it is vmalloc()ed. Signed-off-by: Hugh Dickins <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2010-05-14hughd: update email addressHugh Dickins1-1/+1
My old address will shut down in a couple of weeks: update the tree. Signed-off-by: Hugh Dickins <[email protected]> Signed-off-by: Hugh Dickins <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-05-14x86, mrst: Don't blindly access extended config spaceH. Peter Anvin1-0/+4
Do not blindly access extended configuration space unless we actively know we're on a Moorestown platform. The fixed-size BAR capability lives in the extended configuration space, and thus is not applicable if the configuration space isn't appropriately sized. This fixes booting certain VMware configurations with CONFIG_MRST=y. Moorestown will add a fake PCI-X 266 capability to advertise the presence of extended configuration space. Reported-and-tested-by: Petr Vandrovec <[email protected]> Signed-off-by: H. Peter Anvin <[email protected]> Acked-by: Jacob Pan <[email protected]> Acked-by: Jesse Barnes <[email protected]> LKML-Reference: <[email protected]>
2010-05-14Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds4-6/+18
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, cacheinfo: Turn off L3 cache index disable feature in virtualized environments x86, k8: Fix build error when K8_NB is disabled x86, amd: Check X86_FEATURE_OSVW bit before accessing OSVW MSRs x86: Fix fake apicid to node mapping for numa emulation
2010-05-14x86, cacheinfo: Turn off L3 cache index disable feature in virtualized ↵Frank Arnold1-0/+4
environments When running a quest kernel on xen we get: BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 IP: [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df PGD 0 Oops: 0000 [#1] SMP last sysfs file: CPU 0 Modules linked in: Pid: 0, comm: swapper Tainted: G W 2.6.34-rc3 #1 /HVM domU RIP: 0010:[<ffffffff8142f2fb>] [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x 2ca/0x3df RSP: 0018:ffff880002203e08 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000060 RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000 RBP: ffff880002203ed8 R08: 00000000000017c0 R09: ffff880002203e38 R10: ffff8800023d5d40 R11: ffffffff81a01e28 R12: ffff880187e6f5c0 R13: ffff880002203e34 R14: ffff880002203e58 R15: ffff880002203e68 FS: 0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000038 CR3: 0000000001a3c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 0, threadinfo ffffffff81a00000, task ffffffff81a44020) Stack: ffffffff810d7ecb ffff880002203e20 ffffffff81059140 ffff880002203e30 <0> ffffffff810d7ec9 0000000002203e40 000000000050d140 ffff880002203e70 <0> 0000000002008140 0000000000000086 ffff880040020140 ffffffff81068b8b Call Trace: <IRQ> [<ffffffff810d7ecb>] ? sync_supers_timer_fn+0x0/0x1c [<ffffffff81059140>] ? mod_timer+0x23/0x25 [<ffffffff810d7ec9>] ? arm_supers_timer+0x34/0x36 [<ffffffff81068b8b>] ? hrtimer_get_next_event+0xa7/0xc3 [<ffffffff81058e85>] ? get_next_timer_interrupt+0x19a/0x20d [<ffffffff8142fa23>] get_cpu_leaves+0x5c/0x232 [<ffffffff8106a7b1>] ? sched_clock_local+0x1c/0x82 [<ffffffff8106a9a0>] ? sched_clock_tick+0x75/0x7a [<ffffffff8107748c>] generic_smp_call_function_single_interrupt+0xae/0xd0 [<ffffffff8101f6ef>] smp_call_function_single_interrupt+0x18/0x27 [<ffffffff8100a773>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8143c468>] ? notifier_call_chain+0x14/0x63 [<ffffffff810295c6>] ? native_safe_halt+0xc/0xd [<ffffffff810114eb>] ? default_idle+0x36/0x53 [<ffffffff81008c22>] cpu_idle+0xaa/0xe4 [<ffffffff81423a9a>] rest_init+0x7e/0x80 [<ffffffff81b10dd2>] start_kernel+0x40e/0x419 [<ffffffff81b102c8>] x86_64_start_reservations+0xb3/0xb7 [<ffffffff81b103c4>] x86_64_start_kernel+0xf8/0x107 Code: 14 d5 40 ff ae 81 8b 14 02 31 c0 3b 15 47 1c 8b 00 7d 0e 48 8b 05 36 1c 8b 00 48 63 d2 48 8b 04 d0 c7 85 5c ff ff ff 00 00 00 00 <8b> 70 38 48 8d 8d 5c ff ff ff 48 8b 78 10 ba c4 01 00 00 e8 eb RIP [<ffffffff8142f2fb>] cpuid4_cache_lookup_regs+0x2ca/0x3df RSP <ffff880002203e08> CR2: 0000000000000038 ---[ end trace a7919e7f17c0a726 ]--- The L3 cache index disable feature of AMD CPUs has to be disabled if the kernel is running as guest on top of a hypervisor because northbridge devices are not available to the guest. Currently, this fixes a boot crash on top of Xen. In the future this will become an issue on KVM as well. Check if northbridge devices are present and do not enable the feature if there are none. [ hpa: backported to 2.6.34 ] Signed-off-by: Frank Arnold <[email protected]> LKML-Reference: <[email protected]> Acked-by: Borislav Petkov <[email protected]> Signed-off-by: H. Peter Anvin <[email protected]> Cc: <[email protected]>
2010-05-14x86, k8: Fix build error when K8_NB is disabledBorislav Petkov1-0/+5
K8_NB depends on PCI and when the last is disabled (allnoconfig) we fail at the final linking stage due to missing exported num_k8_northbridges. Add a header stub for that. Signed-off-by: Borislav Petkov <[email protected]> LKML-Reference: <20100503183036.GJ26107@aftab> Signed-off-by: H. Peter Anvin <[email protected]> Cc: <[email protected]>
2010-05-14Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notifyLinus Torvalds2-8/+10
* 'for-linus' of git://git.infradead.org/users/eparis/notify: inotify: don't leak user struct on inotify release inotify: race use after free/double free in inotify inode marks inotify: clean up the inotify_add_watch out path Inotify: undefined reference to `anon_inode_getfd' Manual merge to remove duplicate "select ANON_INODES" from Kconfig file
2010-05-14Merge branch 'davinci-fixes-for-linus-2' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-davinci * 'davinci-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-davinci: DA830: fix USB 2.0 clock entry
2010-05-14DA830: fix USB 2.0 clock entrySergei Shtylyov1-1/+1
DA8xx OHCI driver fails to load due to failing clk_get() call for the USB 2.0 clock. Arrange matching USB 2.0 clock by the clock name instead of the device. (Adding another CLK() entry for "ohci.0" device won't do -- in the future I'll also have to enable USB 2.0 clock to configure CPPI 4.1 module, in which case I won't have any device at all.) Signed-off-by: Sergei Shtylyov <[email protected]> Signed-off-by: Kevin Hilman <[email protected]>
2010-05-14inotify: don't leak user struct on inotify releasePavel Emelyanov1-0/+2
inotify_new_group() receives a get_uid-ed user_struct and saves the reference on group->inotify_data.user. The problem is that free_uid() is never called on it. Issue seem to be introduced by 63c882a0 (inotify: reimplement inotify using fsnotify) after 2.6.30. Signed-off-by: Pavel Emelyanov <[email protected]> Eric Paris <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Eric Paris <[email protected]>
2010-05-14inotify: race use after free/double free in inotify inode marksEric Paris1-3/+6
There is a race in the inotify add/rm watch code. A task can find and remove a mark which doesn't have all of it's references. This can result in a use after free/double free situation. Task A Task B ------------ ----------- inotify_new_watch() allocate a mark (refcnt == 1) add it to the idr inotify_rm_watch() inotify_remove_from_idr() fsnotify_put_mark() refcnt hits 0, free take reference because we are on idr [at this point it is a use after free] [time goes on] refcnt may hit 0 again, double free The fix is to take the reference BEFORE the object can be found in the idr. Signed-off-by: Eric Paris <[email protected]> Cc: <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.