summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-11-10perf trace scripting: remove system-wide param from shell scriptsTom Zanussi
Including -a unconditionally when recording doesn't allow for the option of running scripts without it. Future patches will add add it back if needed at run-time. Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com> Acked-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
2010-11-10block: remove REQ_HARDBARRIERChristoph Hellwig
REQ_HARDBARRIER is dead now, so remove the leftovers. What's left at this point is: - various checks inside the block layer. - sanity checks in bio based drivers. - now unused bio_empty_barrier helper. - Xen blockfront use of BLKIF_OP_WRITE_BARRIER - it's dead for a while, but Xen really needs to sort out it's barrier situaton. - setting of ordered tags in uas - dead code copied from old scsi drivers. - scsi different retry for barriers - it's dead and should have been removed when flushes were converted to FS requests. - blktrace handling of barriers - removed. Someone who knows blktrace better should add support for REQ_FLUSH and REQ_FUA, though. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10perf trace scripting: fix some small memory leaks and missing error checksTom Zanussi
Free the other two fields of script_desc which somehow got overlooked, free malloc'ed args in case exec fails, and add missing checks for failed mallocs. Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com> Acked-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
2010-11-10Merge branch 'for-2.6.37/drivers' into for-linusJens Axboe
Conflicts: drivers/block/cciss.c Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10ioprio: rcu_read_lock/unlock protect find_task_by_vpid call (V2)Sergey Senozhatsky
Commit 4221a9918e38b7494cee341dda7b7b4bb8c04bde "Add RCU check for find_task_by_vpid()" introduced rcu_lockdep_assert to find_task_by_pid_ns= Assertion failed in sys_ioprio_get. The patch is fixing assertion failure in ioprio_set as well. kernel/pid.c:419 invoked rcu_dereference_check() without protection! stack backtrace: Pid: 4254, comm: iotop Not tainted Call Trace: [<ffffffff810656f2>] lockdep_rcu_dereference+0xaa/0xb2 [<ffffffff81053c67>] find_task_by_pid_ns+0x4f/0x68 [<ffffffff81053c9d>] find_task_by_vpid+0x1d/0x1f [<ffffffff811104e2>] sys_ioprio_get+0x50/0x2da [<ffffffff81002182>] system_call_fastpath+0x16/0x1b V2: rcu critical section expanded according to comment by Paul E. McKenney Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10ioprio: fix RCU locking around task dereferenceDaniel J Blueman
With 2.6.37-rc1, I observe sys_ioprio_set not taking the RCU lock [1] across access to the task credentials. Inspecting the code in fs/ioprio.c, the tasklist_lock is held for read across the __task_cred call, which is presumably sufficient to prevent the task credentials becoming stale. =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- kernel/pid.c:419 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 1 1 lock held by start-stop-daem/2246: #0: (tasklist_lock){.?.?..}, at: [<ffffffff811a2dfa>] sys_ioprio_set+0x8a/0x400 stack backtrace: Pid: 2246, comm: start-stop-daem Not tainted 2.6.37-rc1-330cd+ #2 Call Trace: [<ffffffff8109f5f4>] lockdep_rcu_dereference+0xa4/0xc0 [<ffffffff81085651>] find_task_by_pid_ns+0x81/0x90 [<ffffffff8108567d>] find_task_by_vpid+0x1d/0x20 [<ffffffff811a3160>] sys_ioprio_set+0x3f0/0x400 [<ffffffff816efa79>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff81003482>] system_call_fastpath+0x16/0x1b Take the RCU lock for read across acquiring the pointer to the task credentials and dereferencing it. Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com> Fixed up by Jens to fix missing rcu_read_unlock() on mismatches. Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10block: ioctl: fix information leak to userlandVasiliy Kulikov
Structure hd_geometry is copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory. Currently there is no memset() in real implementations of getgeo() in drivers/block/, so it makes sense to have memset() in blkdev_ioctl(). Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10block: read i_size with i_size_read()Mike Snitzer
Convert direct reads of an inode's i_size to using i_size_read(). i_size_{read,write} use a seqcount to protect reads from accessing incomple writes. Concurrent i_size_write()s require mutual exclussion to protect the seqcount that is used by i_size_{read,write}. But i_size_read() callers do not need to use additional locking. Signed-off-by: Mike Snitzer <snitzer@redhat.com> Acked-by: NeilBrown <neilb@suse.de> Acked-by: Lars Ellenberg <lars.ellenberg@linbit.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10cciss: fix proc warning on attempt to remove non-existant directoryJens Axboe
Randy reports that he gets the following stack trace when removing the cciss module: [ 109.164277] Pid: 3463, comm: rmmod Not tainted 2.6.37-rc1 #7 [ 109.164280] Call Trace: [ 109.164292] [<ffffffff8107eb8d>] warn_slowpath_common+0xc6/0xf3 [ 109.164299] [<ffffffff8107ecaa>] warn_slowpath_fmt+0x5b/0x6b [ 109.164307] [<ffffffff8155175b>] ? _raw_spin_unlock+0x40/0x4b [ 109.164313] [<ffffffff8123dd1e>] remove_proc_entry+0x156/0x35e [ 109.164320] [<ffffffff812cd91b>] ? do_raw_spin_unlock+0xff/0x10f [ 109.164327] [<ffffffff8113823d>] ? trace_hardirqs_on+0x10/0x4a [ 109.164333] [<ffffffff8155162d>] ? _raw_spin_unlock_irq+0x4c/0x7b [ 109.164339] [<ffffffff8154d4d1>] ? wait_for_common+0x145/0x15e [ 109.164345] [<ffffffff81075337>] ? default_wake_function+0x0/0x22 [ 109.164357] [<ffffffffa0615a8f>] cciss_cleanup+0xa9/0xc7 [cciss] [ 109.164365] [<ffffffff810d3cb0>] sys_delete_module+0x2d6/0x368 [ 109.164371] [<ffffffff8155036b>] ? lockdep_sys_exit_thunk+0x35/0x67 [ 109.164377] [<ffffffff810fdfaf>] ? audit_syscall_entry+0x172/0x1a5 [ 109.164383] [<ffffffff815502f5>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 109.164389] [<ffffffff8100ea72>] system_call_fastpath+0x16/0x1b [ 109.164394] ---[ end trace 88e8568246ed0b1d ]--- which will happen if you don't actually have an HP CISS adapter, since it'll do an uncondional removal of a proc directory it never attempted to create in that case. Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10bio: take care not overflow page count when mapping/copying user dataJens Axboe
If the iovec is being set up in a way that causes uaddr + PAGE_SIZE to overflow, we could end up attempting to map a huge number of pages. Check for this invalid input type. Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10block: limit vec count in bio_kmalloc() and bio_alloc_map_data()Jens Axboe
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10block: take care not to overflow when calculating total iov lengthJens Axboe
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10block: check for proper length of iov entries in blk_rq_map_user_iov()Jens Axboe
Ensure that we pass down properly validated iov segments before calling into the mapping or copy functions. Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
2010-11-10x86, pvclock: Remove leftover scale_delta() functionKusanagi Kouichi
Commit 92580d64e16402762e2acc3022f065397c780425 ("x86: pvclock: Move scale_delta into common header") forgot to remove scale_delta. Signed-off-by: Kusanagi Kouichi <slash@ac.auone-net.jp> Cc: Zachary Amsden <zamsden@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Glauber Costa <glommer@redhat.com> LKML-Reference: <20101105110444.BAF6D6FC03B@msa105.auone-net.jp> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10x86, apic: Remove double #includeJesper Juhl
Remove the second <asm/atomic.h> inclusion. Signed-off-by: Jesper Juhl <jj@chaosbits.net> LKML-Reference: <alpine.LNX.2.00.1011072253360.26247@swampdragon.chaosbits.net> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10x86: Adjust section annotations in AMD Fam10 MMCONF enabling codeJan Beulich
check_enable_amd_mmconf_dmi() gets called only for the BSP, hence everything hanging off of it can be __init*. Signed-off-by: Jan Beulich <jbeulich@novell.com> Acked-by: Yinghai Lu <yinghai@kernel.org> LKML-Reference: <4CD2DE1E0200007800020990@vpn.id2.novell.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10x86, UV: Update node controller MMRsJack Steiner
A new version of the SGI UV hub node controller is being developed. A few of the MMRs (control registers) that exist on the current hub no longer exist on the new hub. Fortunately, there are alternate MMRs that are are functionally equivalent and that exist on both hubs. This patch changes the UV code to use MMRs that exist in BOTH versions of the hub node controller. Signed-off-by: Jack Steiner <steiner@sgi.com> LKML-Reference: <20101106204056.GA27584@sgi.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10perf: Fix usages of profile_cpu in builtin-top.c to use cpu_listCorey Ashford
profile_cpu was left over from an earlier implementation that supported running perf top on a single CPU. profile_cpu was no longer set by any switch and usages of it resulted in dead code. Instead, convert the code to use cpu_list, which is set by the -C <cpu_list> option. Also improved the printing of nr_cpus and cpu_list by correcting the plurals. Signed-off-by: Corey Ashford <cjashfor@linux.vnet.ibm.com> Cc: a.p.zijlstra@chello.nl Cc: acme@redhat.com LKML-Reference: <1289269245-9388-1-git-send-email-cjashfor@linux.vnet.ibm.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10x86: Remove unnecessary casts of void ptr returning alloc function return valuesJesper Juhl
The [vk][cmz]alloc(_node) family of functions return void pointers which it's completely unnecessary/pointless to cast to other pointer types since that happens implicitly. This patch removes such casts from arch/x86. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Cc: trivial@kernel.org Cc: amd64-microcode@amd64.org Cc: Andreas Herrmann <andreas.herrmann3@amd.com> LKML-Reference: <alpine.LNX.2.00.1011082310220.23697@swampdragon.chaosbits.net> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10perf, ui: Eliminate stack-smashing protection compiler complaintCyrill Gorcunov
The gcc complains about small auto-var strings being allocated from stack space. Make them const to avoid this: | CC util/ui/util.o | cc1: warnings being treated as errors | util/ui/util.c: In function ‘ui__dialog_yesno’: | util/ui/util.c:108: error: not protecting function: no buffer at least 8 bytes long | make: *** [util/ui/util.o] Error 1 The real bug is in the newtWinChoice() ABI - but that's an externality we cannot fix here, so we use this workaround. Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Acked-by: Frédéric Weisbecker <fweisbec@gmail.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> LKML-Reference: <20101106084724.GA5956@lenovo> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2010-11-10drm/ttm: Be consistent on ttm_bo_init() failuresThomas Hellstrom
Call destroy() on _all_ ttm_bo_init() failures, and make sure that behavior is documented in the function description. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-10drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once.Michel Dänzer
If ttm_bo_init() returns failure, it already destroyed the BO, so we need to retry from scratch. Signed-off-by: Michel Dänzer <daenzer@vmware.com> Tested-by: Markus Trippelsdorf <markus@trippelsdorf.de> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09Staging: wlan-ng: Fix wrong #ifdef #endif sequenceMaximiliano David Bustos
This patch fixes bug #13820 from bugzilla.kernel.org. Quote: "If ETHTOOL_GLINK is not defined, the end for switch case is not to be found." Signed-off-by: Maximiliano David Bustos <md.bustos90@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: Update parameters for cfg80211 key management operationBen Hutchings
Commit e31b82136d1adc7a599b6e99d3321e5831841f5a ("cfg80211/mac80211: allow per-station GTKs") changed the signatures of these operations but did not update the staging drivers. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: ath6kl: Fix pointer casts on 64-bit architecturesBen Hutchings
Remove unnecessary cast of firmware base address to integer before adding an offset. Fix direct use of sk_buff::network_header which is an offset rather than a pointer on 64-bit architectures. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: batman-adv: suppress false warning when changing the mac addressMarek Lindner
Whenever the mac address of an batman interface is changed check_known_mac_addr() is called to print a warning if the newly added mac address exists an another batman interface. While looping through the batman interface list check_known_mac_addr() only compares mac addresses and does not make sure they belong to different interfaces, thus always printing a warning. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: batman-adv: fix interface alternating and bonding reggressionChris Lang
55d1666b521cbed95924c8d4775fe272c103f08c incidentally disabled bonding of packets first entering the mesh along with also disabling interface alternating regardless of where the packet came from. This re-enables these options. Signed-off-by: Chris Lang <clang@gateworks.com> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09tty_ldisc: Fix BUG() on hangupPhilippe Rétornaz
A kernel BUG when bluetooth rfcomm connection drop while the associated serial port is open is sometime triggered. It seems that the line discipline can disappear between the tty_ldisc_put and tty_ldisc_get. This patch fall back to the N_TTY line discipline if the previous discipline is not available anymore. Signed-off-by: Philippe Retornaz <philippe.retornaz@epfl.ch> Acked-by: Alan Cox <alan@linux.intel.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09TTY: restore tty_ldisc_wait_idleJiri Slaby
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into a proper refcount), but we need to wait for last user to quit the ldisc before we close it in tty_set_ldisc. Otherwise weird things start to happen. There might be processes waiting in tty_read->n_tty_read on tty->read_wait for input to appear and at that moment, a change of ldisc is fatal. n_tty_close is called, it frees read_buf and the waiting process is still in the middle of reading and goes nuts after it is woken. Previously we prevented close to happen when others are in ldisc ops by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed that. So revoke the change and test whether there is 1 user (=we), and allow the close then. We can do that without ldisc/tty locks, because nobody else can open the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for everybody to leave. I don't understand why tty_ldisc_lock would be needed either when the counter is an atomic variable, so this is a lockless tty_ldisc_wait_idle. On the other hand, if we fail to wait (timeout or signal), we have to reenable the halted ldiscs, so we take ldisc lock and reuse the setup path at the end of tty_set_ldisc. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc> LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc> LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz> Cc: Alan Cox <alan@linux.intel.com> Cc: stable@kernel.org [32, 33, 36] Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09SERIAL: blacklist si3052 chipMaciej Szmigiero
[SERIAL]blacklist si3052 chip Si3052-based softmodems aren't serial ports so don't bind serial driver to them. Allows proper driver to bind to them. Signed-off-by: Maciej Szmigiero <mhej@o2.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09drivers/serial/bfin_5xx.c: Fix line continuation defectsJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Sonic Zhang <sonic.zhang@analog.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09tty: prevent DOS in the flush_to_ldiscJiri Olsa
There's a small window inside the flush_to_ldisc function, where the tty is unlocked and calling ldisc's receive_buf function. If in this window new buffer is added to the tty, the processing might never leave the flush_to_ldisc function. This scenario will hog the cpu, causing other tty processing starving, and making it impossible to interface the computer via tty. I was able to exploit this via pty interface by sending only control characters to the master input, causing the flush_to_ldisc to be scheduled, but never actually generate any output. To reproduce, please run multiple instances of following code. - SNIP #define _XOPEN_SOURCE #include <stdlib.h> #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> int main(int argc, char **argv) { int i, slave, master = getpt(); char buf[8192]; sprintf(buf, "%s", ptsname(master)); grantpt(master); unlockpt(master); slave = open(buf, O_RDWR); if (slave < 0) { perror("open slave failed"); return 1; } for(i = 0; i < sizeof(buf); i++) buf[i] = rand() % 32; while(1) { write(master, buf, sizeof(buf)); } return 0; } - SNIP The attached patch (based on -next tree) fixes this by checking on the tty buffer tail. Once it's reached, the current work is rescheduled and another could run. Signed-off-by: Jiri Olsa <jolsa@redhat.com> Cc: stable <stable@kernel.org> Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-098250: add support for Kouwell KW-L221N-2Mikulas Patocka
Add support for Kouwell KW-L221N-2 card. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09nozomi: Fix warning from the previous TIOCGCOUNT changesAlan Cox
Just remove a now unused variable Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09tty: fix warning in synclink driverAndres Salomon
During builds I see the following warning - CC [M] drivers/char/pcmcia/synclink_cs.o drivers/char/pcmcia/synclink_cs.c:2194: warning: ‘mgslpc_get_icount’ defined but not used The function is a callback meant to be assigned to get_icount (added during 0587102cf). Fix accordingly. Signed-off-by: Andres Salomon <dilinger@queued.net> Acked-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09tty: Fix formatting in tty.hAlan Cox
Someone added a new ldisc number and messed up the tabbing. Fix it before anyone else copies it. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: udlfb.c: Fix k.alloc switched argumentsJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Cc: Bernie Thompson <bernie@plugable.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: rtl8192e: fix IOMMU memory leakDaniel Lichtenberger
Unmap the rx buffer before mapping the new one in rtl8192_rx. Failing to do so quickly exhausts the IOMMU memory during downloads: [...] DMA: Out of SW-IOMMU space for 9100 bytes at device ... Using "iommu=off mem=4g" also fixes the problem because then pci_map_single does not allocate memory. Tested on my personal laptop with a RTL8192E device. Without this patch the kernel quickly runs out of IOMMU memory (downloading 5 MB of data is sufficient to trigger it), with this patch applied I haven't experienced any issues so far. Signed-off-by: Daniel Lichtenberger <daniel.lichtenberger@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09staging: vt6656: implement missing bracketsVasiliy Kulikov
Identation says that copy_to_user() should be called only iff wrq->u.essid.pointer is not zero. Also it is useless to call copy_to_user(0, ...). Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09staging: rt2870: Add new USB ID for Belkin F6D4050 v1Larry Finger
Add new USB ID for FT2870 for Belkin F6D4050 v1 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported- and Tested-by: James Long <crogonint@yahoo.com> Cc: Stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09staging: brcm80211: Maintainer changeBrett Rudley
Nohee => Dowan Signed-off-by: Brett Rudley <brudley@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09drivers/staging/brcm80211/brcmfmac/dhd_linux.c: delete double assignmentJulia Lawall
Delete successive assignments to the same location. dhd_ops_virt contains a subset of the definitions of dhd_ops_pri. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression i; @@ *i = ...; i = ...; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09drivers/staging: delete double assignmentJulia Lawall
Delete successive assignments to the same location. In three of the cases, the two assignments are identical. In the case of the file rt2860/common/cmm_aes.c, the assigned variable i is never used, so both assignments are dropped. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression i; @@ *i = ...; i = ...; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: ath6kl: Adapt API changes in cfg80211Hauke Mehrtens
The cfg80211 API changed in commit e31b82136d1adc7a599b6e99d3321e5831841f5a Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: ath6kl: ATH6KL_CFG80211 depends on CFG80211Randy Dunlap
ATH6KL_CFG80211 should depend on CFG80211 to fix build errors: ERROR: "wiphy_free" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_inform_bss_frame" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "__ieee80211_get_channel" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_get_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_unregister" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_connect_result" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_michael_mic_failure" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_ibss_joined" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_roamed" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_put_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_new" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_register" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_disconnected" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_scan_done" [drivers/staging/ath6kl/ath6kl.ko] undefined! Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Vipin Mehta <vmehta@atheros.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: bcm: use get_user() to access user pointersDan Carpenter
This fixes some places that dereference user pointers directly instead of using get_user(). Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The original code modified the struct which "arg" was pointing to. I think this was a bug in the original code and that we only wanted to write to the OutputBuffer. Also with the original code you could read as much memory as you wanted so I had to put a cap on OutputLength. The only value of OutputLength that makes sense is sizeof(LINK_STATE) so now if OutputLength is not sizeof(LINK_STATE) it returns -EINVAL. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: add some __user anotationsDan Carpenter
This silences all the sparse warnings in intel_sst_app_interface.c. It was just a matter of adding __user annotations, I didn't find any real bugs here. Quite a few of these were needed for stuff I added earlier, sorry about that. I removed a couple casts to (void *) that caused a warning like: drivers/staging/intel_sst/intel_sst_app_interface.c:606:27: warning: cast removes address space of expression For example sst_drv_ctx->mailbox is already declared as "void __iomem *mailbox" so casting it to void pointer isn't necessary and it makes sparse complain because it removes the __user attribute. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: user pointers in intel_sst_mmap_play_capture()Dan Carpenter
There were some places in intel_sst_mmap_play_capture() that dereferenced user pointers instead of copying the data to the kernel. I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are never possible in the current code. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: fixups in SNDRV_SST_STREAM_DECODEDan Carpenter
This is another patch about copying data to the kernel before using it. SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a copy_from_user() that gives us another two pointers and we have copy those. Those again give us some more pointers that we have to copy. Besides those problems, the code had a stack overflow: - struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries], - obuf_temp[param->obufs->entries]; param->ibufs->entries comes from the user. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: more dereferencing user pointersDan Carpenter
This is another patch about making a copy of the data into kernel space before using it. It is easy to trigger a kernel oops in the original code. If you passed a NULL to SNDRV_SST_SET_TARGET_DEVICE then it called BUG_ON(). And SNDRV_SST_DRIVER_INFO would let you write the information to arbitrary memory locations which is a security violation. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit (git 2.34.1) at 2025-09-29 14:02:43 +0000