aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-11-11PCI hotplug: ibmphp: Add check to prevent reading beyond mapped areaSteven Rostedt1-0/+6
While testing various randconfigs with ktest.pl, I hit the following panic: BUG: unable to handle kernel paging request at f7e54b03 IP: [<c0d63409>] ibmphp_access_ebda+0x101/0x19bb Adding printks, I found that the loop that reads the ebda blocks can move out of the mapped section. ibmphp_access_ebda: start=f7e44c00 size=5120 end=f7e46000 ibmphp_access_ebda: io_mem=f7e44d80 offset=384 ibmphp_access_ebda: io_mem=f7e54b03 offset=65283 The start of the iomap was at f7e44c00 and had a size of 5120, making the end f7e46000. We start with an offset of 0x180 or 384, giving the first read at 0xf7e44d80. Reading that location yields 65283, which is much bigger than the 5120 that was allocated and makes the next read at f7e54b03 which is outside the mapped area. Perhaps this is a bug in the driver, or buggy hardware, but this patch is more about not crashing my box on start up and just giving a warning if it detects this error. This patch at least lets my box boot with just a warning. Cc: Chandru Siddalingappa <[email protected]> Signed-off-by: Steven Rostedt <[email protected]> Signed-off-by: Jesse Barnes <[email protected]>
2010-11-11hwmon: (ad7414) Return proper error code for ad7414_probe()Axel Lin1-2/+4
Return proper error if i2c_check_functionality reports the adapter does not support the capability we need. Also remove unneeded initialization for err variable. Signed-off-by: Axel Lin <[email protected]> Acked-by: Sean MacLennan <[email protected]> Signed-off-by: Guenter Roeck <[email protected]>
2010-11-11hwmon: (adt7470) Return proper error code for adt7470_probe()Axel Lin1-1/+3
Signed-off-by: Axel Lin <[email protected]> Signed-off-by: Guenter Roeck <[email protected]>
2010-11-11USB: ohci-jz4740: Fix spelling in MODULE_ALIASStefan Weil1-1/+1
platfrom -> platform Cc: David Brownell <[email protected]> Signed-off-by: Stefan Weil <[email protected]> Reviewed-by: Jesper Juhl <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference ↵Jesper Juhl1-1/+2
if kzalloc fails Crashing on a null pointer deref is never a nice thing to do. It seems to me that it's better to simply return UWB_RSV_ALLOC_NOT_FOUND if kzalloc() fails in uwb_rsv_find_best_allocation(). Signed-off-by: Jesper Juhl <[email protected]> Acked-by: David Vrabel <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11usb: core: fix information leak to userlandVasiliy Kulikov1-3/+4
Structure usbdevfs_connectinfo is copied to userland with padding byted after "slow" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11usb: misc: iowarrior: fix information leak to userlandVasiliy Kulikov1-0/+1
Structure iowarrior_info is copied to userland with padding byted between "serial" and "revision" fields uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <[email protected]> Cc: stable <[email protected]> Acked-by: Kees Cook <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11usb: misc: sisusbvga: fix information leak to userlandVasiliy Kulikov1-0/+1
Structure sisusb_info is copied to userland with "sisusb_reserved" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11usb: subtle increased memory usage in u_serialJim Sung1-14/+40
OK, the USB gadget serial driver actually has a couple of problems. On gs_open(), it always allocates and queues an additional QUEUE_SIZE (16) worth of requests, so with a loop like this: i=1 ; while echo $i > /dev/ttyGS0 ; do let i++ ; done eventually we run into OOM (Out of Memory). Technically, it is not a leak as everything gets freed up when the USB connection is broken, but not on gs_close(). With a USB device/gadget controller driver that has limited resources (e.g., Marvell has a this MAX_XDS_FOR_TR_CALLS of 64 for transmit and receive), so even after 4 stty -F /dev/ttyGS0 we cannot transmit anymore. We can still receive (not necessarily reliably) as now we have 16 * 4 = 64 descriptors/buffers ready, but the device is otherwise not usable. Signed-off-by: Jim Sung <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11USB: option: fix when the driver is loaded incorrectly for some Huawei devices.ma rui1-1/+1
When huawei datacard with PID 0x14AC is insterted into Linux system, the present kernel will load the "option" driver to all the interfaces. But actually, some interfaces run as other function and do not need "option" driver. In this path, we modify the id_tables, when the PID is 0x14ac ,VID is 0x12d1, Only when the interface's Class is 0xff,Subclass is 0xff, Pro is 0xff, it does need "option" driver. Signed-off-by: ma rui <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11USB: xhci: Use GFP_ATOMIC under spin_lockDavid Sterba1-1/+1
coccinelle check scripts/coccinelle/locks/call_kern.cocci found that in drivers/usb/host/xhci.c an allocation with GFP_KERNEL is done with locks held: xhci_resume spin_lock_irq(xhci->lock) xhci_setup_msix kmalloc(GFP_KERNEL) Change it to GFP_ATOMIC. Signed-off-by: David Sterba <[email protected]> CC: Sarah Sharp <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11usb: gadget: goku_udc: add registered flag bit, fixing buildAndy Whitcroft1-1/+2
The commit below cleaned up error handling, in part by introducing a registered flag bit. This however was not added to the device structure leding to build failures: commit 319feaabb6c7ccd90da6e3207563c265da7d21ae Author: Dan Carpenter <[email protected]> Date: Tue Oct 5 18:55:34 2010 +0200 usb: gadget: goku_udc: Fix error path Add the missing registered flag bit. Signed-off-by: Andy Whitcroft <[email protected]> Acked-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11USB: ehci/mxc: compile fixUwe Kleine-König1-5/+9
Commit 65fd427 (USB: ehci tdi : let's tdi_reset set host mode) broke the build using ARM's mx51_defconfig: CC drivers/usb/host/ehci-hcd.o In file included from drivers/usb/host/ehci-hcd.c:1166: drivers/usb/host/ehci-mxc.c: In function 'ehci_mxc_drv_probe': drivers/usb/host/ehci-mxc.c:192: error: 'ehci' undeclared (first use in this function) drivers/usb/host/ehci-mxc.c:192: error: (Each undeclared identifier is reported only once drivers/usb/host/ehci-mxc.c:192: error: for each function it appears in.) drivers/usb/host/ehci-mxc.c:117: warning: unused variable 'temp' make[3]: *** [drivers/usb/host/ehci-hcd.o] Error 1 make[2]: *** [drivers/usb/host/ehci-hcd.o] Error 2 make[1]: *** [sub-make] Error 2 make: *** [all] Error 2 Fix it together with the warning about the unused variable and use msleep instead of mdelay as requested by Alan Stern. Cc: Dinh Nguyen <[email protected]> Cc: Alan Stern <[email protected]> Signed-off-by: Uwe Kleine-König <[email protected]> Tested-by: Nguyen Dinh-R00091 <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11USB: Fix FSL USB driver on non Open Firmware systemsMarc Kleine-Budde2-2/+2
Commit 126512e3f274802ca65ebeca8660237f0361ad48 added support for FSL's USB controller on powerpc. In this commit the Open Firmware code was selected and compiled unconditionally. This breaks on ARM systems from FSL which use the same driver (.i.e. the i.MX series), because ARM don't have OF support (yet). This patch fixes the problem by only selecting the OF code on systems with Open Firmware support. Reported-by: Uwe Kleine-König <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]> Compile-Tested-by: Uwe Kleine-König <[email protected]> Acked-by: Grant Likely <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11Staging: Merge 'tidspbridge-2.6.37-rc1' into staging-linusGreg Kroah-Hartman32-572/+3471
This is a big revert of a lot of -rc1 tidspbridge patches in order to get the driver back into a working state. It also includes a OMAP patch that was approved by the OMAP maintainer. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-11block: remove unused copy_io_context()Jens Axboe2-15/+0
Reported-by: Oleg Nesterov <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2010-11-11Documentation: remove anticipatory scheduler infoRandy Dunlap3-7/+7
Remove anticipatory block I/O scheduler info from Documentation/ since the code has been deleted. Signed-off-by: Randy Dunlap <[email protected]> Reported-by: "Robert P. J. Day" <[email protected]> Cc: Jens Axboe <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2010-11-11Input: do not pass injected events back to the originating handlerDmitry Torokhov1-11/+26
Sometimes input handlers (as opposed to input devices) have a need to inject (or re-inject) events back into input core. For example sysrq filter may want to inject previously suppressed Alt-SysRq so that user can take a screen print. In this case we do not want to pass such events back to the same same handler that injected them to avoid loops. Signed-off-by: Dmitry Torokhov <[email protected]>
2010-11-11Input: pcf8574_keypad - fix error handling in pcf8574_kp_probeDan Carpenter1-13/+10
It is not allowed to call input_free_device() after calling input_unregister_device() because input devices are refcounted and unregister will free the device if we were holding he last referenc. The preferred style in input/ is to make input_register_device() the last function in the probe which can fail. That way we don't need to call input_unregister_device(). Also do not need to call input_set_drvdata() as nothing in the driver uses the data. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-11-10Input: acecad - fix a memory leak in usb_acecad_probe error pathAxel Lin1-1/+2
Add a missing usb_free_urb() in usb_acecad_probe() error path. Signed-off-by: Axel Lin <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2010-11-10Merge branch 'master' of ↵David S. Miller22-49/+117
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2010-11-10tcp: Increase TCP_MAXSEG socket option minimum.David S. Miller1-1/+1
As noted by Steve Chen, since commit f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS requested by user") we can end up with a situation where tcp_select_initial_window() does a divide by a zero (or even negative) mss value. The problem is that sometimes we effectively subtract TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss. Fix this by increasing the minimum from 8 to 64. Reported-by: Steve Chen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-10xen: do not release any memory under 1M in domain 0Ian Campbell1-7/+11
We already deliberately setup a 1-1 P2M for the region up to 1M in order to allow code which assumes this region is already mapped to work without having to convert everything to ioremap. Domain 0 should not return any apparently unused memory regions (reserved or otherwise) in this region to Xen since the e820 may not accurately reflect what the BIOS has stashed in this region. Signed-off-by: Ian Campbell <[email protected]> Signed-off-by: Jeremy Fitzhardinge <[email protected]>
2010-11-10xen: events: do not unmask event channels on resumeIan Campbell1-7/+18
The IRQ core code will take care of disabling and reenabling interrupts over suspend resume automatically, therefore we do not need to do this in the Xen event channel code. The only exception is those event channels marked IRQF_NO_SUSPEND which the IRQ core ignores. We must unmask these ourselves, taking care to obey the current IRQ_DISABLED status. Failure check for IRQ_DISABLED leads to enabling polled only event channels, such as that associated with the pv spinlocks, which must never be enabled: [ 21.970432] ------------[ cut here ]------------ [ 21.970432] kernel BUG at arch/x86/xen/spinlock.c:343! [ 21.970432] invalid opcode: 0000 [#1] SMP [ 21.970432] last sysfs file: /sys/devices/virtual/net/lo/operstate [ 21.970432] Modules linked in: [ 21.970432] [ 21.970432] Pid: 0, comm: swapper Not tainted (2.6.32.24-x86_32p-xen-01034-g787c727 #34) [ 21.970432] EIP: 0061:[<c102e209>] EFLAGS: 00010046 CPU: 3 [ 21.970432] EIP is at dummy_handler+0x3/0x7 [ 21.970432] EAX: 0000021c EBX: dfc16880 ECX: 0000001a EDX: 00000000 [ 21.970432] ESI: dfc02c00 EDI: 00000001 EBP: dfc47e10 ESP: dfc47e10 [ 21.970432] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0069 [ 21.970432] Process swapper (pid: 0, ti=dfc46000 task=dfc39440 task.ti=dfc46000) [ 21.970432] Stack: [ 21.970432] dfc47e30 c10a39f0 0000021c 00000000 00000000 dfc16880 0000021c 00000001 [ 21.970432] <0> dfc47e40 c10a4f08 0000021c 00000000 dfc47e78 c12240a7 c1839284 c1839284 [ 21.970432] <0> 00000200 00000000 00000000 f5720000 c1f3d028 c1f3d02c 00000180 dfc47e90 [ 21.970432] Call Trace: [ 21.970432] [<c10a39f0>] ? handle_IRQ_event+0x5f/0x122 [ 21.970432] [<c10a4f08>] ? handle_percpu_irq+0x2f/0x55 [ 21.970432] [<c12240a7>] ? __xen_evtchn_do_upcall+0xdb/0x15f [ 21.970432] [<c122481e>] ? xen_evtchn_do_upcall+0x20/0x30 [ 21.970432] [<c1030d47>] ? xen_do_upcall+0x7/0xc [ 21.970432] [<c102007b>] ? apic_reg_read+0xd3/0x22d [ 21.970432] [<c1002227>] ? hypercall_page+0x227/0x1005 [ 21.970432] [<c102d30b>] ? xen_force_evtchn_callback+0xf/0x14 [ 21.970432] [<c102da7c>] ? check_events+0x8/0xc [ 21.970432] [<c102da3b>] ? xen_irq_enable_direct_end+0x0/0x1 [ 21.970432] [<c105e485>] ? finish_task_switch+0x62/0xba [ 21.970432] [<c14e3f84>] ? schedule+0x808/0x89d [ 21.970432] [<c1084dc5>] ? hrtimer_start_expires+0x1a/0x22 [ 21.970432] [<c1085154>] ? tick_nohz_restart_sched_tick+0x15a/0x162 [ 21.970432] [<c102f43a>] ? cpu_idle+0x6d/0x6f [ 21.970432] [<c14db29e>] ? cpu_bringup_and_idle+0xd/0xf [ 21.970432] Code: 5d 0f 95 c0 0f b6 c0 c3 55 66 83 78 02 00 89 e5 5d 0f 95 \ c0 0f b6 c0 c3 55 b2 01 86 10 31 c0 84 d2 89 e5 0f 94 c0 5d c3 55 89 e5 <0f> 0b \ eb fe 55 80 3d 4c ce 84 c1 00 89 e5 57 56 89 c6 53 74 15 [ 21.970432] EIP: [<c102e209>] dummy_handler+0x3/0x7 SS:ESP 0069:dfc47e10 [ 21.970432] ---[ end trace c0b71f7e12cf3011 ]--- Signed-off-by: Ian Campbell <[email protected]> Signed-off-by: Jeremy Fitzhardinge <[email protected]>
2010-11-10Revert "staging: tidspbridge: replace iommu custom for opensource ↵Felipe Contreras6-135/+518
implementation" This reverts commit d95ec7e2fd5cebf2f1caf3f572fa5e0a820ac5b1. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c"Felipe Contreras4-139/+146
This reverts commit 0c10e91b6cc9d1c6a23e9eed3e0653f30b6eb3d3. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name"Felipe Contreras5-116/+141
This reverts commit 4dd1944ab7242d76534c97d5fef0ce541a2f1040. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c"Felipe Contreras2-0/+427
This reverts commit e7396e77d9e4230bf725b5807732cbca191d111f. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - fix mmufault support"Felipe Contreras3-40/+57
This reverts commit f265846db1e755c11498f6f7c011127dfcc5634a. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - remove hw directory"Felipe Contreras13-2/+1148
This reverts commit 053fdb85f56e84bff64a65601be7f72608f016da. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - move all iommu related code to a new file"Felipe Contreras7-391/+289
This reverts commit f94378f9f9a897fc08e9d12733401ae52466e408. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct"Felipe Contreras4-1/+10
This reverts commit b5a44939231d6e3b0354624289507bfa1432a7b1. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - remove reserved memory clean up"Felipe Contreras4-0/+53
This reverts commit db348ca36e5881cd1d2e5caa6eee7d0237d07a3d. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions"Felipe Contreras4-17/+197
This reverts commit b1ced160af36043ee80d354318794753b6b7c008. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - remove dmm custom module"Felipe Contreras9-6/+747
This reverts commit 2ab573487a98c06fdfb34308f641f09369d61fa2. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Revert "staging: tidspbridge - update Kconfig to select IOMMU module"Felipe Contreras1-1/+0
This reverts commit ace5a3ce40bb90f14953c5e3f73e9cf1176b1a28. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10staging: tidspbridge: hardcode SCM macros while fix is upstreamedFelipe Contreras1-1/+13
On 2.6.37-rc1, omap platform internals for SCM have changed, so the build is broken again. drivers/staging/tidspbridge/core/tiomap3430.c:26: fatal error: plat/control.h: No such file or directory This is a totally ugly layer violation, but needed until omap_ctrl_set_dsp_boot*() are provided. Signed-off-by: Felipe Contreras <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10Staging: keucr driver: fix uninitialized variable & proper memset lengthKonstantin Katuev6-31/+31
There was commented out transfer_flags initialization. And i think memset should fill entire structure, not only length of pointer to it. This makes the driver work properly now on my hardware. Signed-off-by: Konstantin Katuev <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-10omap: dsp: remove shm from normal memoryFelipe Contreras1-1/+3
Also, don't be picky about the location, which incidentally fixes the build since MEMBLOCK_REAL_LIMIT is gone on 2.6.37. arch/arm/plat-omap/devices.c: In function 'omap_dsp_reserve_sdram_memblock': arch/arm/plat-omap/devices.c:287: error: 'MEMBLOCK_REAL_LIMIT' undeclared (first use in this function) Signed-off-by: Felipe Contreras <[email protected]> Acked-by: Tony Lindgren <[email protected]> Signed-off-by: Omar Ramirez Luna <[email protected]>
2010-11-10perf, amd: Use kmalloc_node(,__GFP_ZERO) for northbridge structure allocationPeter Zijlstra1-2/+2
Jasper suggested we use the zeroing capability of the allocators instead of calling memset ourselves. Add node affinity while we're at it. Reported-by: Jesper Juhl <[email protected]> Signed-off-by: Peter Zijlstra <[email protected]> LKML-Reference: <new-submission> Signed-off-by: Ingo Molnar <[email protected]>
2010-11-10perf_events: Fix time tracking in samplesStephane Eranian2-8/+44
This patch corrects time tracking in samples. Without this patch both time_enabled and time_running are bogus when user asks for PERF_SAMPLE_READ. One uses PERF_SAMPLE_READ to sample the values of other counters in each sample. Because of multiplexing, it is necessary to know both time_enabled, time_running to be able to scale counts correctly. In this second version of the patch, we maintain a shadow copy of ctx->time which allows us to compute ctx->time without calling update_context_time() from NMI context. We avoid the issue that update_context_time() must always be called with ctx->lock held. We do not keep shadow copies of the other event timings because if the lead event is overflowing then it is active and thus it's been scheduled in via event_sched_in() in which case neither tstamp_stopped, tstamp_running can be modified. This timing logic only applies to samples when PERF_SAMPLE_READ is used. Note that this patch does not address timing issues related to sampling inheritance between tasks. This will be addressed in a future patch. With this patch, the libpfm4 example task_smpl now reports correct counts (shown on 2.4GHz Core 2): $ task_smpl -p 2400000000 -e unhalted_core_cycles:u,instructions_retired:u,baclears noploop 5 noploop for 5 seconds IIP:0x000000004006d6 PID:5596 TID:5596 TIME:466,210,211,430 STREAM_ID:33 PERIOD:2,400,000,000 ENA=1,010,157,814 RUN=1,010,157,814 NR=3 2,400,000,254 unhalted_core_cycles:u (33) 2,399,273,744 instructions_retired:u (34) 53,340 baclears (35) Signed-off-by: Stephane Eranian <[email protected]> Signed-off-by: Peter Zijlstra <[email protected]> LKML-Reference: <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2010-11-10xfs: remove incorrect assert in xfs_vm_writepageChristoph Hellwig1-3/+4
In commit 20cb52ebd1b5ca6fa8a5d9b6b1392292f5ca8a45, titled "xfs: simplify xfs_vm_writepage" I added an assert that any !mapped and uptodate buffers are not dirty. That asserts turns out to trigger a lot when running fsx on filesystems with small block sizes. The reason for that is that the assert is simply incorrect. !mapped and uptodate just mean this buffer covers a hole, and whenever we do a set_page_dirty we mark all blocks in the page dirty, no matter if they have data or not. So remove the assert, and update the comment above the condition to match reality. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Alex Elder <[email protected]>
2010-11-11APPARMOR: Fix memory leak of apparmor_init()[email protected]1-2/+4
set_init_cxt() allocted sizeof(struct aa_task_cxt) bytes for cxt, if register_security() failed, it will cause memory leak. Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: John Johansen <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-11-11APPARMOR: Fix memory leak of alloc_namespace()[email protected]1-1/+1
policy->name is a substring of policy->hname, if prefix is not NULL, it will allocted strlen(prefix) + strlen(name) + 3 bytes to policy->hname in policy_init(). use kzfree(ns->base.name) will casue memory leak if alloc_namespace() failed. Signed-off-by: Zhitong Wang <[email protected]> Signed-off-by: John Johansen <[email protected]> Signed-off-by: James Morris <[email protected]>
2010-11-10net: avoid limits overflowEric Dumazet15-38/+40
Robin Holt tried to boot a 16TB machine and found some limits were reached : sysctl_tcp_mem[2], sysctl_udp_mem[2] We can switch infrastructure to use long "instead" of "int", now atomic_long_t primitives are available for free. Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Robin Holt <[email protected]> Reviewed-by: Robin Holt <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-10net: packet: fix information leak to userlandVasiliy Kulikov1-1/+2
packet_getname_spkt() doesn't initialize all members of sa_data field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sa_data with strncpy() instead of strlcpy(). The same with packet_getname(): it doesn't initialize sll_pkttype field of sockaddr_ll. Set it to zero. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-10locks: remove dead lease error-handling codeJ. Bruce Fields1-10/+2
A minor oversight from f7347ce4ee7c65415f84be915c018473e7076f31, "fasync: re-organize fasync entry insertion to allow it under a spinlock": this cleanup-on-error was only needed to handle -ENOMEM. Now that we're preallocating it's unneeded. Signed-off-by: J. Bruce Fields <[email protected]>
2010-11-10locks: fix leak on merging leasesJ. Bruce Fields1-2/+5
We must also free the passed-in lease in the case it wasn't used because an existing lease was upgrade/downgraded or already existed. Note the nfsd caller doesn't care because it's fl_change callback returns an error in those cases. Signed-off-by: J. Bruce Fields <[email protected]>
2010-11-10filter: make sure filters dont read uninitialized memoryDavid S. Miller1-29/+35
There is a possibility malicious users can get limited information about uninitialized stack mem array. Even if sk_run_filter() result is bound to packet length (0 .. 65535), we could imagine this can be used by hostile user. Initializing mem[] array, like Dan Rosenberg suggested in his patch is expensive since most filters dont even use this array. Its hard to make the filter validation in sk_chk_filter(), because of the jumps. This might be done later. In this patch, I use a bitmap (a single long var) so that only filters using mem[] loads/stores pay the price of added security checks. For other filters, additional cost is a single instruction. [ Since we access fentry->k a lot now, cache it in a local variable and mark filter entry pointer as const. -DaveM ] Reported-by: Dan Rosenberg <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-11-10net: ax25: fix information leak to userlandVasiliy Kulikov1-1/+1
Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater field of fsa struct, also the struct has padding bytes between sax25_call and sax25_ndigis fields. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <[email protected]> Signed-off-by: David S. Miller <[email protected]>