| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
In the case that atomic_open calls finish_no_open() with
the dentry that was supplied to gfs2_atomic_open() an
extra reference count is required. This patch fixes that
issue preventing a bug trap triggering at umount time.
Signed-off-by: Steven Whitehouse <[email protected]>
|
|
Fix another really stupid bug - I introduced genl_set_err()
precisely to be able to adjust the group and reject invalid
ones, but then forgot to do so.
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Unfortunately, I introduced a tremendously stupid bug into
genlmsg_multicast() when doing all those multicast group
changes: it adjusts the group number, but then passes it
to genlmsg_multicast_netns() which does that again.
Somehow, my tests failed to catch this, so add a warning
into genlmsg_multicast_netns() and remove the offending
group ID adjustment.
Also add a warning to the similar code in other functions
so people who misuse them are more loudly warned.
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Salam reported a use after free bug in PF_PACKET that occurs when
we're sending out frames on a socket bound device and suddenly the
net device is being unregistered. It appears that commit 827d9780
introduced a possible race condition between {t,}packet_snd() and
packet_notifier(). In the case of a bound socket, packet_notifier()
can drop the last reference to the net_device and {t,}packet_snd()
might end up suddenly sending a packet over a freed net_device.
To avoid reverting 827d9780 and thus introducing a performance
regression compared to the current state of things, we decided to
hold a cached RCU protected pointer to the net device and maintain
it on write side via bind spin_lock protected register_prot_hook()
and __unregister_prot_hook() calls.
In {t,}packet_snd() path, we access this pointer under rcu_read_lock
through packet_cached_dev_get() that holds reference to the device
to prevent it from being freed through packet_notifier() while
we're in send path. This is okay to do as dev_put()/dev_hold() are
per-cpu counters, so this should not be a performance issue. Also,
the code simplifies a bit as we don't need need_rls_dev anymore.
Fixes: 827d978037d7 ("af-packet: Use existing netdev reference for bound sockets.")
Reported-by: Salam Noureddine <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>
Signed-off-by: Salam Noureddine <[email protected]>
Cc: Ben Greear <[email protected]>
Cc: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
If the VIF thread is still running after unbinding the Tx and Rx IRQs
in xenvif_disconnect(), the thread may attempt to raise an event which
will BUG (as the irq is unbound).
Signed-off-by: David Vrabel <[email protected]>
Acked-by: Wei Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
This removes a code line that is between a "return 0;" and an error label.
This code line can never be reached.
Found by Coverity (CID: 1130529)
Signed-off-by: Michael Opdenacker <[email protected]>
Acked-by: Johannes Berg <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:
====================
pull request: wireless 2013-11-21
Please pull this batch of fixes intended for the 3.13 stream!
For the Bluetooth bits, Gustavo says:
"A few fixes for 3.13. There is 3 fixes to the RFCOMM protocol. One
crash fix to L2CAP. A simple fix to a bad behaviour in the SMP
protocol."
On top of that...
Amitkumar Karwar sends a quintet of mwifiex fixes -- two fixes related
to failure handling, two memory leak fixes, and a NULL pointer fix.
Felix Fietkau corrects and earlier rt2x00 HT descriptor handling fix
to address a crash.
Geyslan G. Bem fixes a memory leak in brcmfmac.
Larry Finger address more pointer arithmetic errors in rtlwifi.
Luis R. Rodriguez provides a regulatory fix in the shared ath code.
Sujith Manoharan brings a couple ath9k initialization fixes.
Ujjal Roy offers one more mwifiex fix to avoid invalid memory accesses
when unloading the USB driver.
====================
Signed-off-by: David S. Miller <[email protected]>
|
|
Pablo Neira Ayuso says:
====================
netfilter fixes for net
The following patchset contains fixes for your net tree, they are:
* Remove extra quote from connlimit configuration in Kconfig, from
Randy Dunlap.
* Fix missing mss option in syn packets sent to the backend in our
new synproxy target, from Martin Topholm.
* Use window scale announced by client when sending the forged
syn to the backend, from Martin Topholm.
* Fix IPv6 address comparison in ebtables, from Luís Fernando
Cornachioni Estrozi.
* Fix wrong endianess in sequence adjustment which breaks helpers
in NAT configurations, from Phil Oester.
* Fix the error path handling of nft_compat, from me.
* Make sure the global conntrack counter is decremented after the
object has been released, also from me.
====================
Signed-off-by: David S. Miller <[email protected]>
|
|
The tools mentioned have been obsoleted long ago, replace
with the current ones.
CC: [email protected]
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Chris Mason <[email protected]>
|
|
Two new options were added in 3.12: commit and rescan_uuid_tree
CC: [email protected]
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Chris Mason <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v3.13
A bunch of device specific fixes, nothing with a general impact here.
|
|
When executing on an ACPI Hardware Reduced hardware, all the ACPI
tables are not exposed in sysfs due to the fact that FACS is
silently ignored by the kernel in the ACPI hardware reduced mode
and, moreover, the acpi_tables_sysfs_init() ACPI table walk
is buggy and stops too soon.
The acpi_tables_sysfs_init() function should rely on the acpi_status
return value from acpi_get_table_by_index() to decide whether or not
to stop the iteration (the walk should only be terminated when that
value is AE_BAD_PARAMETER). This way, when running in an ACPI Harware
Reduced environment (where the FACS table is silently ignored by the
kernel) or if some ACPI tables are not correctly memory mapped or
have bad checksums, it will still walk through the remaining tables
that may be correct.
[rjw: Changelog]
Signed-off-by: Jeremy Compostella <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
Cc: [email protected] (3.10+)
BugLink: https://bugs.launchpad.net/bugs/1253636
Signed-off-by: David Henningsson <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
|
|
Currently, each of the ACPI tables exported from
/sys/firmware/acpi/tables is of zero size:
$ LANG=C ls -ld /sys/firmware/acpi/tables/*
-r-------- 1 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/APIC
-r-------- 1 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/BOOT
-r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/DSDT
-r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/FACP
-r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/FACS
-r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/MCFG
-r-------- 1 root root 0 Nov 19 14:25 /sys/firmware/acpi/tables/SRAT
drwxr-xr-x 2 root root 0 Nov 19 09:48 /sys/firmware/acpi/tables/dynamic/
due to which, user-land tools fail reading each table. For example:
$ acpidump -f /sys/firmware/acpi/tables/SRAT
Could not get input file size: /sys/firmware/acpi/tables/SRAT
To deal with the issue, this patch assigns size of each ACPI table to
the corresponding sysfs file.
$ LANG=C ls -hld /sys/firmware/acpi/tables/*
-r-------- 1 root root 94 Nov 19 16:45 /sys/firmware/acpi/tables/APIC
-r-------- 1 root root 40 Nov 19 16:45 /sys/firmware/acpi/tables/BOOT
-r-------- 1 root root 58K Nov 19 16:55 /sys/firmware/acpi/tables/DSDT
-r-------- 1 root root 244 Nov 19 16:55 /sys/firmware/acpi/tables/FACP
-r-------- 1 root root 64 Nov 19 16:55 /sys/firmware/acpi/tables/FACS
-r-------- 1 root root 60 Nov 19 16:55 /sys/firmware/acpi/tables/MCFG
-r-------- 1 root root 168 Nov 19 16:45 /sys/firmware/acpi/tables/SRAT
drwxr-xr-x 2 root root 0 Nov 19 16:55 /sys/firmware/acpi/tables/dynamic/
Then, user-land tools work well like:
$ acpidump -f /sys/firmware/acpi/tables/SRAT
SRAT @ 0x0000000000000000
0000: 53 52 41 54 A8 00 00 00 02 65 56 4D 57 41 52 45 SRAT.....eVMWARE
0010: 4D 45 4D 50 4C 55 47 20 00 00 04 06 56 4D 57 20 MEMPLUG ....VMW
0020: 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
0030: 01 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .(..............
0040: 00 00 0A 00 00 00 00 00 00 00 00 00 01 00 00 00 ................
0050: 00 00 00 00 00 00 00 00 01 28 00 00 00 00 00 00 .........(......
0060: 00 00 10 00 00 00 00 00 00 00 F0 BF 00 00 00 00 ................
0070: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
0080: 01 28 00 00 00 00 00 00 00 00 00 00 01 00 00 00 .(..............
0090: 00 00 00 40 00 00 00 00 00 00 00 00 01 00 00 00 ...@............
00A0: 00 00 00 00 00 00 00 00 ........
Signed-off-by: HATAYAMA Daisuke <[email protected]>
Acked-by: Toshi Kani <[email protected]>
Acked-by: Zhang Rui <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
Version 20131115.
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This fix deletes any and all objects that have been attached to the
root node (via acpi_attach_data). Reported by Tomasz Nowicki.
ACPICA BZ 1026.
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This fix updates namespace node deletion to delete the entire list
of attached objects (attached via acpi_attach_data) instead of
just one of the attached items. ACPICA BZ 1024.
Tomasz Nowicki ([email protected]).
Signed-off-by: Tomasz Nowicki <[email protected]>
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
The loop terminates on a NULL resource pointer, which can never
happen since the loop simply increments a valid resource pointer.
This fix changes the loop to terminate on an end-of-buffer condition.
Problem can be seen by callers to AcpiSetCurrentResources with an
invalid or corrupted resource descriptor; or a resource descriptor
without an END_TAG descriptor.
(refined by Bob Moore)
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This patch adds protection around ACPI_CHECKSUM_ABORT so that ACPI
user space test utilities can re-define it for their own purposes
(currently used by ASLTS build environment).
This patch doesn't affect Linux kernel behavior. Lv Zheng.
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
The nesting level is really only useful during a single-thread
execution. Therefore, only enable this output for the AcpiExec
utility. Also, only emit the thread ID when executing under AcpiExec.
(Context switches are still detected and a message is emitted.)
ACPICA BZ 972.
Signed-off-by: Bob Moore <[email protected]>
Signed-off-by: Lv Zheng <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
airlied:
The lifetime changes introduced in 5bdebb183c9702a8c57a01dff09337be3de337a6
tried to use device_create, however that led to the regression where dev->type
wasn't getting set correctly. First attempt at fixing it would have led to
a race, so this undoes the device_createa work and does it all manually
making sure the dev->type is setup before we register the device.
Signed-off-by: David Herrmann <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
|
|
Since we still need to rely on a mix of device tree initialized
drivers and legacy platform data initialize drivers, let's fix
the passing of platform data to twl4030-gpio.
As the twl4030 GPIO is initialized by twl-core.c, we need to register
the auxdata for twl4030 GPIO in twl-core.c.
Signed-off-by: Tony Lindgren <[email protected]>
Signed-off-by: Lee Jones <[email protected]>
|
|
Commit [e66cf1610: GFS2: Use lockref for glocks] replaced call:
atomic_read(&gi->gl->gl_ref) == 0
with:
__lockref_is_dead(&gl->gl_lockref)
therefore changing how gl is accessed, from gi->gl to plan gl.
However, gl can be a NULL pointer, and so gi->gl needs to be
used instead (which is guaranteed not to be NULL because fo
the while loop checking that condition).
Signed-off-by: Michal Nazarewicz <[email protected]>
Signed-off-by: Steven Whitehouse <[email protected]>
|
|
The manticore keyboard requires that all usb EP are opened at least
once to be fully functional. The third EP forwards to the user space
some vendor specific information about the keyboard state, but are useless
currently for the kernel.
Opening them and closing them makes the keyboard responsive again.
Reported-and-tested-by: Adam Kulagowski <[email protected]>
Signed-off-by: Benjamin Tissoires <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
Genius Manticore Keyboard presents the same problem in its report
descriptors than Genius Gila Gaming Mouse and Genius Imperator Keyboard.
Use the same fixup.
Reported-and-tested-by: Adam Kulagowski <[email protected]>
Signed-off-by: Benjamin Tissoires <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
Using the address of 'empty_zero_page' as source address in order to
clear a page is wrong. On some architectures empty_zero_page is only the
pointer to the struct page of the empty_zero_page. Therefore the clear
page operation would copy the contents of a couple of struct pages instead
of clearing a page. For kvm only arm/arm64 are affected by this bug.
To fix this use the ZERO_PAGE macro instead which will return the struct
page address of the empty_zero_page on all architectures.
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Gleb Natapov <[email protected]>
|
|
This patch adds PID VID to support for the Wistron Inc. Optical touch panel.
Signed-off-by: KaiChung Cheng <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
Some weird remotes are not correctly creating the input device. Their
report descriptor starts with:
0x06, 0x00, 0xff, // Usage Page (Vendor Defined Page 1) 0
0xa1, 0x01, // Collection (Application) 3
whereas others (which are correctly handled) start with:
0x05, 0x0c, // Usage Page (Consumer Devices) 0
0x09, 0x01, // Usage (Consumer Control) 2
0xa1, 0x01, // Collection (Application) 4
The rest of the report descriptor is the same.
Adding the quirk HID_QUIRK_HIDINPUT_FORCE forces hid-input to allocate
the inputs, and everything should be ok.
Signed-off-by: Benjamin Tissoires <[email protected]>
Tested-by: James Henstridge <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
This patch releases a vma object when cleaning up userptr resources.
A new vma object was allocated and copied when getting userptr pages
so the new vma object should be freed properly if the userptr pages
aren't used anymore.
Signed-off-by: Inki Dae <[email protected]>
Signed-off-by: Kyungmin Park <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
|
|
into drm-fixes
The set_need_resched() removal fix and yet another fix in
ttm_bo_move_memcpy().
* 'ttm-fixes-3.13' of git://people.freedesktop.org/~thomash/linux:
drm/ttm: Remove set_need_resched from the ttm fault handler
drm/ttm: Don't move non-existing data
|
|
git://people.freedesktop.org/~thomash/linux into drm-fixes
Below is a fix for a false lockep warning,
and the vmwgfx prime implementation.
* 'vmwgfx-fixes-3.13' of git://people.freedesktop.org/~thomash/linux:
drm/vmwgfx: Make vmwgfx dma buffers prime aware
drm/vmwgfx: Make surfaces prime-aware
drm/vmwgfx: Hook up the prime ioctls
drm/ttm: Add a minimal prime implementation for ttm base objects
drm/vmwgfx: Fix false lockdep warning
drm/ttm: Allow execbuf util reserves without ticket
|
|
git://people.freedesktop.org/~danvet/drm-intel into drm-fixes
Just a small pile of fixes for bugs and a few regressions. I'm still
trying to track down a driver load hang on my g33 (which infuriatingly
doesn't happen when loading the module manually after boot), somehow
bisecting loves to go astray on this one :( And there's a (harmless)
locking WARN in the suspend code due to one of Jesse's vlv backlight
rework patches. Otherwise nothing outstanding afaik.
* tag 'drm-intel-fixes-2013-11-20' of git://people.freedesktop.org/~danvet/drm-intel:
drm/i915: Fix gen3 self-refresh watermarks
drm/i915: Replicate BIOS eDP bpp clamping hack for hsw
drm/i915: Do not enable package C8 on unsupported hardware
drm/i915: Hold pc8 lock around toggling pc8.gpu_idle
drm/i915: encoder->get_config is no longer optional
drm/i915/tv: add ->get_config callback
drm/i915: restore the early forcewake cleanup
Partially revert "drm/i915: tune the RC6 threshold for stability"
drm/i915: flush cursors harder
i915: Use 120MHz LVDS SSC clock for gen5/gen6/gen7
x86/early quirk: use gen6 stolen detection for VLV
drm/i915/dp: set sink to power down mode on dp disable
|
|
into drm-fixes
More fixes for radeon. This adds new queries for tiling on CIK, and
fixes a crash in handling acpi atif backlight events on CIK.
Some fixes for radeon for 3.13. Mostly CI stability fixes. I think
I've tracked down the stability problems with dpm on Trinity/Richland,
so I'm going to enable that by default now.
* 'drm-next-3.13' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon: hook up backlight functions for CI and KV family.
drm/radeon/cik: Add macrotile mode array query
drm/radeon/cik: Return backend map information to userspace
drm/radeon: enable DPM by default in TN asics
drm/radeon: adjust TN dpm parameters for stability (v2)
drm/radeon: use a single doorbell for cik kms compute
drm/radeon/vm: don't attempt to update ptes if ib allocation fails
drm/radeon: disable CIK CP semaphores for now
drm/radeon: allow semaphore emission to fail
drm/radeon: add semaphore trace point
radeon: workaround pinning failure on low ram gpu
radeon/i2c: do not count reg index in number of i2c byte we are writing.
drm/radeon: cypress_dpm: Fix unused variable warning when CONFIG_ACPI=n
drm: radeon: ni_dpm: Fix unused variable warning when CONFIG_ACPI=n
|
|
BIOS sets MISC_NO_PRESENCE bit wrongly to the pin config on NID 0x0f.
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
|
|
The laptop has a built-in speaker on NID 0x1a. It's an LFE only on
the right channel, so we need to provide an explicit chmap, too.
There might be other surround speakers, but they can fixed in addition
at later point, so let's fix the easier bass speaker at first.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65091
Signed-off-by: Takashi Iwai <[email protected]>
|
|
In iSCSI negotiations with initiator CHAP enabled, usernames with
trailing garbage are permitted, because the string comparison only
checks the strlen of the configured username.
e.g. "usernameXXXXX" will be permitted to match "username".
Just check one more byte so the trailing null char is also matched.
Signed-off-by: Eric Seppanen <[email protected]>
Cc: <[email protected]> #3.1+
Signed-off-by: Nicholas Bellinger <[email protected]>
|
|
extract_param() is called with max_length set to the total size of the
output buffer. It's not safe to allow a parameter length equal to the
buffer size as the terminating null would be written one byte past the
end of the output buffer.
Signed-off-by: Eric Seppanen <[email protected]>
Cc: <[email protected]> #3.1+
Signed-off-by: Nicholas Bellinger <[email protected]>
|
|
Signed-off-by: Haiyang Zhang <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
Reported-by: Fengguang Wu <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
The transaction task here is hp_sdc_tasklet() and it releases the lock.
The problem is if we aren't able to queue the transaction then we need
to release the lock ourselves.
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
Remove unnecessary work pending test before calling schedule_work(). It
has been tested in queue_work_on() already.
Signed-off-by: Xie XiuQi <[email protected]>
Reviewed-by: Tejun Heo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
Add auto-MDI/MDI-X capability for forced (autonegotiation disabled)
10/100 Mbps speeds on Vitesse VSC82x4 PHYs. Exported previously static
function genphy_setup_forced() required by the new config_aneg handler
in the Vitesse PHY module.
Signed-off-by: Madalin Bucur <[email protected]>
Signed-off-by: Shruti Kanetkar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Vitesse VSC8662 is Dual Port 10/100/1000Base-T Phy
Its register set and features are similar to other Vitesse Phys.
Signed-off-by: Sandeep Singh <[email protected]>
Signed-off-by: Andy Fleming <[email protected]>
Signed-off-by: Shruti Kanetkar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
The VSC8574 is a quad-port Gigabit Ethernet transceiver with four SerDes
interfaces for quad-port dual media capability.
Signed-off-by: Shaohui Xie <[email protected]>
Signed-off-by: Andy Fleming <[email protected]>
Signed-off-by: Shruti Kanetkar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Vitesse VSC8234 is quad port 10/100/1000BASE-T PHY
with SGMII and SERDES MAC interfaces.
Signed-off-by: Andy Fleming <[email protected]>
Signed-off-by: Kumar Gala <[email protected]>
Signed-off-by: Shruti Kanetkar <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
sockaddr_storage)
In that case it is probable that kernel code overwrote part of the
stack. So we should bail out loudly here.
The BUG_ON may be removed in future if we are sure all protocols are
conformant.
Suggested-by: Eric Dumazet <[email protected]>
Signed-off-by: Hannes Frederic Sowa <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.
This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.
Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.
Also document these changes in include/linux/net.h as suggested by David
Miller.
Changes since RFC:
Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.
With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
msg->msg_name = NULL
".
This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.
Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.
Cc: David Miller <[email protected]>
Suggested-by: Eric Dumazet <[email protected]>
Signed-off-by: Hannes Frederic Sowa <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Reflect the current status. Portions of the text taken from the
wiki pages.
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Chris Mason <[email protected]>
|
|
The data type of max_sectors in queue settings is unsigned int. But
this value is stored to the local variable whose type is unsigned short
in bio_size_ok(). This can cause unexpected result when max_sectors >
0xffff.
Cc: Chris Mason <[email protected]>
Cc: [email protected]
Signed-off-by: Akinobu Mita <[email protected]>
Signed-off-by: Chris Mason <[email protected]>
|