Fix unchecked __get_user that could be tricked into generating a
memory read on an arbitrary address. The result of the read is not
returned directly but you may be able to divine some information about
it, or use the read to cause a crash on some architectures by reading
hardware state. CAN-2004-2492.
Ivan Kokshaysky [Mon, 19 Sep 2005 14:55:51 +0000 (18:55 +0400)]
[PATCH] Alpha: ISA IRQs fixup for dp264
Basically, this extends original dp264 fixup to all dp264 variations.
Here is one minor change: mask out bits 4-7 of a value assigned by SRM,
because
- newer consoles report ISA IRQs with offset 0xe0;
- even if console IRQ value is bogus, we'll have a value < 16
so it should be harmless as it won't clash with native IRQs.
Particularly this fixes USB interrupt problem on xp1000 and es40.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Acked-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
[ARM] 2917/1: Make IXP4xx mach_desc's depend on config options
Patch from Deepak Saxena
Building a kernel for IXDP425 currently includes the machine descriptors
for IXDP465 and PRPMC1100 even if those machines are not configured.
This means we can build a kernel that boots on those machines even
though the machine_is_xxx() macro will always return 0 and other bits
such as PCI won't be compiled in. This can lead to many wasted hours
wondering what you have done to your kernel to make it randomly crash
thus requireing large quantities of beer to be consumed. While I am
all for consumption of large quantities of beer, there are better
reasons to do so then stupid kernel bugs.
Signed-off-by: Deepak Saxena <dsaxena@plexity.net> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
bond_init() is not releasing rtnl_sem after register_netdevice() and before
calling unregister_netdevice() (from bond_free_all()) in the exception
path. As the device registration is not completed (dev->reg_state ==
NETREG_REGISTERING), the call to unregister_netdevice() triggers
BUG_ON(dev->reg_state != NETREG_REGISTERED).
Signed-off-by: Florin Malita <fmalita@gmail.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Adam Kropelin [Sat, 17 Sep 2005 02:28:20 +0000 (19:28 -0700)]
[PATCH] qla2xxx: Use dword accessors for PCI_ROM_ADDRESS
PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com> Cc: Andrew Vasquez <andrew.vasquez@qlogic.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Adam Kropelin [Sat, 17 Sep 2005 02:28:19 +0000 (19:28 -0700)]
[PATCH] shpchp: Use dword accessors for PCI_ROM_ADDRESS
PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com> Cc: <kristen.c.accardi@intel.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Adam Kropelin [Sat, 17 Sep 2005 02:28:18 +0000 (19:28 -0700)]
[PATCH] pciehp: Use dword accessors for PCI_ROM_ADDRESS
PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed
using pci_bus_{read,write}_config_dword(). A recent audit of drivers/
turned up several cases of byte- and word-sized accesses. The harmful
ones were fixed by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com> Cc: <kristen.c.accardi@intel.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Adam Kropelin [Sat, 17 Sep 2005 02:28:17 +0000 (19:28 -0700)]
[PATCH] ibmphp: Use dword accessors for PCI_ROM_ADDRESS
PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.
Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
[PATCH] ide: fix null request pointer for taskfile ioctl
When doing ioctl HDIO_DRIVE_TASKFILE, the ide_task_t's request pointer is
never set, but flagged_taskfile and do_rw_taskfile pass it as a parameter
to the prehandler. The kernel will oops taskfile pio-out commands because
of this (taskfile pio-in doesn't use a prehandler). This fix sets the
request pointer at the time the request is created to stop this oops.
With the new fdtable locking rules, you have to protect fdtable with either
->file_lock or rcu_read_lock/unlock(). There are some places where we
aren't doing either. This patch fixes those places.
Zach Brown [Sat, 17 Sep 2005 02:28:09 +0000 (19:28 -0700)]
[PATCH] Add smp_mb__after_clear_bit() to unlock_kiocb()
Add smp_mb__after_clear_bit() to unlock_kiocb()
AIO's use of wait_on_bit_lock()/wake_up_bit() forgot to add a barrier
between clearing its lock bit and calling wake_up_bit() so wake_up_bit()'s
unlocked waitqueue_active() can race. This puts AIO's use in line with the
others and the comment above wake_up_bit().
Signed-off-by: Zach Brown <zach.brown@oracle.com> Acked-by: Benjamin LaHaise <bcrl@linux.intel.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jean Delvare [Sat, 17 Sep 2005 02:28:08 +0000 (19:28 -0700)]
[PATCH] i2c: kill an unused i2c_adapter struct member
Kill an unused member of the i2c_adapter structure. This additionally
fixes a potential bug, because <linux/i2c.h> doesn't include
<linux/config.h>, so different files including <linux/i2c.h> could see a
different definition of the i2c_adapter structure, depending on them
including <linux/config.h> (or other header files themselves including
<linux/config.h>) before <linux/i2c.h>, or not.
Credits go to Jörn Engel for pointing me to the problem.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Al found a potential problem in epoll_create(), where the
file->private_data member was set after fd_install(). This is obviously
wrong since another thread might do a close() on that fd# before we set the
file->private_data member. This goes over 2.6.13 and passes a few basic
tests I've done here.
The driver used to allocate memory with spinlock held which has been
fixed in this patch.
The driver was printing the entire buffer when it received a invalid
entry in image_type. The fix is to only print a warning message and not
the buffer.
Usability enhancements:
It is possible that due to user error the /sys/class/firmware/dell_rbu
entries might be missing, this can happen if the user does the following
Michael Kerrisk [Sat, 17 Sep 2005 02:28:02 +0000 (19:28 -0700)]
[PATCH] PR_GET_DUMPABLE returns incorrect info
2.6.13 incorporated Alan Cox's patch for /proc/sys/fs/suid_dumpable (one
version of this patch can be found here
http://marc.theaimsgroup.com/?l=linux-kernel&m=109647550421014&w=2 ).
This patch also made corresponding changes in kernel/sys.c to change the
prctl() PR_SET_DUMPABLE operation so that the permitted range of 'arg2' was
modified from 0..1 to 0..2.
However, a corresponding change was not made for PR_GET_DUMPABLE: if the
dumpable flag is non-zero, then PR_GET_DUMPABLE always returns 1, so that
the caller can't determine the true setting of this flag.
Acked-by: Alan Cox <alan@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
[PATCH] ppc32: Add ppc_sys descriptions for PowerQUICC I devices
Added ppc_sys device and system definitions for PowerQUICC I devices. This
will allow drivers for PQI to be proper platform device drivers. Currently
sys section contains only MPC885 and MPC866. Identification should be done
with identify_ppc_sys_by_name call, with board-specific "name" string
passed, since PQI do not have any register that could identify the SOC.
Signed-off-by: Vitaly Bordug <vbordug@ru.mvista.com> Signed-off-by: Kumar Gala <kumar.gala@freescale.com> Signed-off-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Thomas Maguin [Sat, 17 Sep 2005 02:27:58 +0000 (19:27 -0700)]
[PATCH] scsi_ioctl: Add WRITE_LONG_2 as write safe command
Add WRITE_LONG_2 as write safe commands, which which allows normal users to
make a c1-, c2- and cu-scan (so called cxscan) with readcd on
cxscan-capable cd/dvd-writers
Signed-off-by: Jens Axboe <axboe@suse.de> Cc: James Bottomley <James.Bottomley@steeleye.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Andrew Morton [Sat, 17 Sep 2005 02:27:55 +0000 (19:27 -0700)]
[PATCH] x86_64: desc.h-needs smp.h
include/asm/desc.h: In function `load_LDT':
include/asm/desc.h:209: warning: implicit declaration of function `get_cpu'
include/asm/desc.h:211: warning: implicit declaration of function `put_cpu'
Jeff Dike [Sat, 17 Sep 2005 02:27:52 +0000 (19:27 -0700)]
[PATCH] uml: remove include of asm/elf.h
asm/elf.h is bad on x86_64, and i386 doesn't need it any more after Al's
cleanup.
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:51 +0000 (19:27 -0700)]
[PATCH] uml: return a real error code
do_aio used to return -1 on error instead of errno.
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:51 +0000 (19:27 -0700)]
[PATCH] uml: merge mem_user.c and mem.c
The serial UML OS-abstraction layer patch (um/kernel dir).
This joins mem_user.c and mem.c files.
Signed-off-by: Gennady Sharapov <Gennady.V.Sharapov@intel.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:50 +0000 (19:27 -0700)]
[PATCH] uml: move libc code out of mem_user.c and tempfile.c
The serial UML OS-abstraction layer patch (um/kernel dir).
This moves all system calls from mem_user.c and tempfile.c files under
os-Linux dir.
Signed-off-by: Gennady Sharapov <Gennady.V.Sharapov@intel.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:49 +0000 (19:27 -0700)]
[PATCH] uml: preserve errno in error paths
The poster child for this patch is the third tuntap_user hunk. When an ioctl
fails, it properly closes the opened file descriptor and returns. However,
the close resets errno to 0, and the 'return errno' that follows returns 0
rather than the value that ioctl set. This caused the caller to believe that
the device open succeeded and had opened file descriptor 0, which caused no
end of interesting behavior.
The rest of this patch is a pass through the UML sources looking for places
where errno could be reset before being passed back out. A common culprit is
printk, which could call write, being called before errno is returned.
In some cases, where the code ends up being much smaller, I just deleted the
printk.
There was another case where a caller of run_helper looked at errno after a
failure, rather than the return value of run_helper, which was the errno value
that it wanted.
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:48 +0000 (19:27 -0700)]
[PATCH] uml: Remove some build warnings
These ugly double-casts are the result of gdb complaining about size
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:47 +0000 (19:27 -0700)]
[PATCH] uml: Remove a useless include
linux/inet.h isn't needed, and on my system, is empty.
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:47 +0000 (19:27 -0700)]
[PATCH] uml: Remove an unused file
This removes a file which is no longer used.
Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:46 +0000 (19:27 -0700)]
[PATCH] uml: breakpoint an arbitrary thread
This patch implements a stack trace for a thread, not unlike sysrq-t does.
The advantage to this is that a break point can be placed on showreqs, so that
upon showing the stack, you jump immediately into the debugger. While sysrq-t
does the same thing, sysrq-t shows *all* threads stacks. It also doesn't work
right now. In the future, I thought it might be acceptable to make this show
all pids stacks, but perhaps leaving well enough alone and just using sysrq-t
would be okay. For now, upon receiving the stack command, UML switches
context to that thread, dumps its registers, and then switches context back to
the original thread. Since UML compacts all threads into one of 4 host
threads, this sort of mechanism could be expanded in the future to include
other debugging helpers that sysrq does not cover.
Note by jdike - The main benefit to this is that it brings an arbitrary thread
back into context, where it can be examined by gdb. The fact that it dumps it
stack is secondary. This provides the capability to examine a sleeping
thread, which has existed in tt mode, but not in skas mode until now.
Also, the other threads, that sysrq doesn't cover, can be gdb-ed directly
anyway.
Signed-off-by: Allan Graves<allan.graves@gmail.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jeff Dike [Sat, 17 Sep 2005 02:27:43 +0000 (19:27 -0700)]
[PATCH] uml: _switch_to code consolidation
This patch moves code that is in both switch_to_tt and switch_to_skas to the
top level _switch_to function, keeping us from duplicating code. It is
required for the stack trace patch to work properly.
Signed-off-by: Allan Graves <allan.graves@gmail.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Cc: Paolo Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
When an asynchronous interruption occurs during the execution of the
'critical section' within the generic interruption handling code (entry.S),
a faulty check for a userspace PSW may result in a corrupted kernel stack
pointer which subsequently triggers a stack overflow check.
Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Got confused with the crypto update. The last patch added a call to
destroy_workqueue() for a non-existent workqueue with the comment "Remove
device workqueue on module unload". This is nonsense. Remove the offending
hunk again.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Also remove the SPX entry in MAINTAINERS, forgot to do that
when I removed it.
Signed-off-by: Ian McDonald <iam4@cs.waikato.ac.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Harald Welte [Sat, 17 Sep 2005 00:00:38 +0000 (17:00 -0700)]
[NETFILTER]: Fix oops in conntrack event cache
ip_ct_refresh_acct() can be called without a valid "skb" pointer.
This used to work, since ct_add_counters() deals with that fact.
However, the recently-added event cache doesn't handle this at all.
This patch is a quick fix that is supposed to be replaced soon by a cleaner
solution during the pending redesign of the event cache.
Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
[NETFILTER] CLUSTERIP: use a bitmap to store node responsibility data
Instead of maintaining an array containing a list of nodes this instance
is responsible for let's use a simple bitmap. This provides the
following features:
* clusterip_responsible() and the add_node()/delete_node() operations
become very simple and don't need locking
* the config structure is much smaller
In spite of the completely different internal data representation the
user-space interface remains almost unchanged; the only difference is
that the proc file does not list nodes in the order they were added.
(The target info structure remains the same.)
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu> Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
[NETFILTER] CLUSTERIP: introduce reference counting for entries
The CLUSTERIP target creates a procfs entry for all different cluster
IPs. Although more than one rules can refer to a single cluster IP (and
thus a single config structure), removal of the procfs entry is done
unconditionally in destroy(). In more complicated situations involving
deferred dereferencing of the config structure by procfs and creating a
new rule with the same cluster IP it's also possible that no entry will
be created for the new rule.
This patch fixes the problem by counting the number of entries
referencing a given config structure and moving the config list
manipulation and procfs entry deletion parts to the
clusterip_config_entry_put() function.
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu> Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Jeff Garzik [Fri, 16 Sep 2005 10:01:48 +0000 (06:01 -0400)]
[libata] fix PIO completion race
Make sure we that completion is the final action we take; prior to this
change, another CPU may have changed ap->pio_task_state before we tested
it a final time.
Spotted by, and original patch by Albert Lee @ IBM.
Also includes a minor optimization: eliminate a ton of unnecessary
queue_work() calls, simply by jumping to the beginning of the FSM
function ata_pio_task().
Jay Vosburgh [Wed, 14 Sep 2005 21:52:09 +0000 (14:52 -0700)]
[PATCH] bonding: plug reference count leak
Bonding leaks route structures when the ARP monitor is
configured to send probes over VLANs.
Originally reported by Ian Abel <ian.abel@mxtelecom.com>; his
original fix was modified by Jay Vosburgh to correct coding style and to
close a leak it missed.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
[PATCH] vc: Use correct size on buffer copy in vc_resize
In the unlikely case of the new screen width much wider then the old,
use (old_row_size * new_rows) instead of new_screen_size to prevent a
buffer overrun during the copy.
[PATCH] vgacon: Fix sanity checking in vgacon_resize
Reported by: walt <wa1ter@myrealbox.com>
"I routinely switch the console font during bootup to
8x8 so I can get 50 lines per screen. Until 09 Sept,
just changing to the small font automatically gave me
all 50 lines -- but now I'm only getting 25 lines even
with the small font. The bottom half of the screen
displays the text that already scrolled off the top."
This bug is due to an erroneous check in the recently added hook,
vgacon_resize(). It checks the new height against the original number of
rows of the console. Because the original number of rows depends on both
the scanline and the font height, check it instead against the
scanline/fontheight.
[PATCH] savagefb: Fix load failure of the Twister chipset
- The Twister chipsets are actually prosavages. Reclassify them as
such and remove the S3_SAVAGE_TWISTER id.
- Fix i2c code if fb_firmware_edid() returns NULL
"A recent patch changed the way the LPAR bit is checked during early
boot. This resulted in a polarity change in a conditional branch
without changing the branch, causing at least some legacy machines to
not boot."
projects / linux-2.6 / log