1. 09 Nov, 2010 10 commits
    • Randy Dunlap's avatar
      Staging: ath6kl: ATH6KL_CFG80211 depends on CFG80211 · 32a0fdf2
      Randy Dunlap authored
      ATH6KL_CFG80211 should depend on CFG80211 to fix build errors:
      
      ERROR: "wiphy_free" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_inform_bss_frame" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "__ieee80211_get_channel" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_get_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "wiphy_unregister" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_connect_result" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_michael_mic_failure" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_ibss_joined" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_roamed" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_put_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "wiphy_new" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "wiphy_register" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_disconnected" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      ERROR: "cfg80211_scan_done" [drivers/staging/ath6kl/ath6kl.ko] undefined!
      Signed-off-by: default avatarRandy Dunlap <randy.dunlap@oracle.com>
      Cc: Vipin Mehta <vmehta@atheros.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      32a0fdf2
    • Dan Carpenter's avatar
      Staging: bcm: use get_user() to access user pointers · eccbf04a
      Dan Carpenter authored
      This fixes some places that dereference user pointers directly instead
      of using get_user().
      
      Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS.  The
      original code modified the struct which "arg" was pointing to.  I think
      this was a bug in the original code and that we only wanted to write to
      the OutputBuffer. Also with the original code you could read as much
      memory as you wanted so I had to put a cap on OutputLength.  The only
      value of OutputLength that makes sense is sizeof(LINK_STATE) so now if
      OutputLength is not sizeof(LINK_STATE) it returns -EINVAL.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      eccbf04a
    • Dan Carpenter's avatar
      Staging: sst: add some __user anotations · 4fc718a4
      Dan Carpenter authored
      This silences all the sparse warnings in intel_sst_app_interface.c.
      It was just a matter of adding __user annotations, I didn't find any
      real bugs here.  Quite a few of these were needed for stuff I added
      earlier, sorry about that.
      
      I removed a couple casts to (void *) that caused a warning like:
      	drivers/staging/intel_sst/intel_sst_app_interface.c:606:27:
      		warning: cast removes address space of expression
      For example sst_drv_ctx->mailbox is already declared as
      "void __iomem *mailbox" so casting it to void pointer isn't necessary
      and it makes sparse complain because it removes the __user attribute.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Cc: Vinod Koul <vinod.koul@intel.com>
      Cc: Alan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      4fc718a4
    • Dan Carpenter's avatar
      Staging: sst: user pointers in intel_sst_mmap_play_capture() · 08da782b
      Dan Carpenter authored
      There were some places in intel_sst_mmap_play_capture() that
      dereferenced user pointers instead of copying the data to the kernel.
      
      I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are
      never possible in the current code.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Cc: Vinod Koul <vinod.koul@intel.com>
      Cc: Alan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      08da782b
    • Dan Carpenter's avatar
      Staging: sst: fixups in SNDRV_SST_STREAM_DECODE · e9f25689
      Dan Carpenter authored
      This is another patch about copying data to the kernel before using it.
      
      SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a
      copy_from_user() that gives us another two pointers and we have copy
      those.  Those again give us some more pointers that we have to copy.
      
      Besides those problems, the code had a stack overflow:
      -	struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries],
      -		obuf_temp[param->obufs->entries];
      param->ibufs->entries comes from the user.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      e9f25689
    • Dan Carpenter's avatar
      Staging: sst: more dereferencing user pointers · bc704e31
      Dan Carpenter authored
      This is another patch about making a copy of the data into kernel space
      before using it.  It is easy to trigger a kernel oops in the original
      code.  If you passed a NULL to SNDRV_SST_SET_TARGET_DEVICE then it
      called BUG_ON().  And SNDRV_SST_DRIVER_INFO would let you write the
      information to arbitrary memory locations which is a security violation.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      bc704e31
    • Dan Carpenter's avatar
      Staging: sst: dereferencing user pointers · 3b97eed2
      Dan Carpenter authored
      This code dereferences user supplied pointers directly instead of doing
      a copy_from_user().  Some kernel configs put user and kernel memory in
      different address spaces so this code isn't portable.  Also the user
      memory could be swapped out or in this case the pointer could just be
      NULL leading to an oops.
      
      Another thing is that it makes permission tests like this sort of
      meaningless.
      	if (minor == STREAM_MODULE && rec_mute->stream_id == 0) {
      		retval = -EPERM;
      		break;
      	}
      The user could set stream_id to 1 for the test and then change it later.
      Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
      Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      3b97eed2
    • Vasiliy Kulikov's avatar
      staging: stradis: fix error handling and information leak to userland · ea07a9f2
      Vasiliy Kulikov authored
      configure_saa7146() didn't free irq on error.
      saa_open() didn't decrease reference count of saa on error.
      saa_ioctl() leaked information from the kernel stack to userland as it
      didn't fill copied structs with zeros.
      Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      ea07a9f2
    • Vasiliy Kulikov's avatar
      staging: cpia: fix camera file owner in cpia_open() · c888d4e7
      Vasiliy Kulikov authored
      Use effective UID instead of real UID for camera owner.
      There is no need to check for pending signals just before successfull
      return.  Exit in case of pending signal also leaved camera in open state.
      Signed-off-by: default avatarVasiliy Kulikov <segooon@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      c888d4e7
    • Greg Kroah-Hartman's avatar
      Staging: the MAINTAINERS git location was incorrect · 97b5519b
      Greg Kroah-Hartman authored
      The tree has moved to "staging-2.6" not "staging-next-2.6" as all of the
      staging development is now done in git, not just for the next tree.
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      97b5519b
  2. 08 Nov, 2010 15 commits
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · a7bcf21e
      Linus Torvalds authored
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: Add new ext4 inode tracepoints
        ext4: Don't call sb_issue_discard() in ext4_free_blocks()
        ext4: do not try to grab the s_umount semaphore in ext4_quota_off
        ext4: fix potential race when freeing ext4_io_page structures
        ext4: handle writeback of inodes which are being freed
        ext4: initialize the percpu counters before replaying the journal
        ext4: "ret" may be used uninitialized in ext4_lazyinit_thread()
        ext4: fix lazyinit hang after removing request
      a7bcf21e
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 · 5398a64c
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
        TTY: move .gitignore from drivers/char/ to drivers/tty/vt/
        TTY: create drivers/tty/vt and move the vt code there
        TTY: create drivers/tty and move the tty core files there
      5398a64c
    • Linus Torvalds's avatar
      Merge branch 'staging-linus' of... · 764e028e
      Linus Torvalds authored
      Merge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-next-2.6
      
      * 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-next-2.6:
        Staging: ath6kl: remove empty files that mess with 'distclean'
        staging: ath6kl: Fixing the driver to use modified mmc_host structure
        Staging: solo6x10: fix build problem
      764e028e
    • Linus Torvalds's avatar
      Merge branch 'rmobile-fixes-for-linus' of... · 934648f0
      Linus Torvalds authored
      Merge branch 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6
      
      * 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
        mmc: sh_mmcif: Convert extern inline to static inline.
        ARM: mach-shmobile: Allow GPIO chips to register IRQ mappings.
        ARM: mach-shmobile: fix sh7372 after a recent clock framework rework
        ARM: mach-shmobile: include drivers/sh/Kconfig
        ARM: mach-shmobile: ap4evb: Add HDMI sound support
        ARM: mach-shmobile: clock-sh7372: Add FSIDIV clock support
        ARM: shmobile: remove sh_timer_config clk member
      934648f0
    • Linus Torvalds's avatar
      Merge branch 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 · 8be5814c
      Linus Torvalds authored
      * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
        sh: clkfwk: Fix up checkpatch warnings.
        sh: make some needlessly global sh7724 clocks static
        sh: add clk_round_parent() to optimize parent clock rate
        sh: Simplify phys_addr_mask()/PTE_PHYS_MASK for 29/32-bit.
        sh: nommu: Support building without an uncached mapping.
        sh: nommu: use 32-bit phys mode.
        sh: mach-se: Fix up SE7206 no ioport build.
        sh: intc: Update for single IRQ reservation helper.
        sh: clkfwk: Fix up rate rounding error handling.
        sh: mach-se: Rip out superfluous 7751 PIO routines.
        sh: mach-se: Rip out superfluous 770x PIO routines.
        sh: mach-edosk7705: Kill off machtype, consolidate board def.
        sh: mach-edosk7705: update for this century, kill off PIO trapping.
        sh: mach-se: Rip out superfluous 7206 PIO routines.
        sh: mach-systemh: Kill off dead board.
        sh: mach-snapgear: Kill off machtype, consolidate board def.
        sh: mach-snapgear: Rip out superfluous PIO routines.
        sh: mach-microdev: SuperIO-relative ioport mapping.
      8be5814c
    • Theodore Ts'o's avatar
      ext4: Add new ext4 inode tracepoints · 7ff9c073
      Theodore Ts'o authored
      Add ext4_evict_inode, ext4_drop_inode, ext4_mark_inode_dirty, and
      ext4_begin_ordered_truncate()
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      7ff9c073
    • Theodore Ts'o's avatar
      ext4: Don't call sb_issue_discard() in ext4_free_blocks() · b56ff9d3
      Theodore Ts'o authored
      Commit 5c521830 (ext4: Support discard requests when running in
      no-journal mode) attempts to add sb_issue_discard() for data blocks
      (in data=writeback mode) and in no-journal mode.  Unfortunately, this
      no longer works, because in commit dd3932ed (block: remove
      BLKDEV_IFL_WAIT), sb_issue_discard() only presents a synchronous
      interface, and there are times when we call ext4_free_blocks() when we
      are are holding a spinlock, or are otherwise in an atomic context.
      
      For now, I've removed the call to sb_issue_discard() to prevent a
      deadlock or (if spinlock debugging is enabled) failures like this:
      
      BUG: scheduling while atomic: rc.sysinit/1376/0x00000002
      Pid: 1376, comm: rc.sysinit Not tainted 2.6.36-ARCH #1
      Call Trace:
      [<ffffffff810397ce>] __schedule_bug+0x5e/0x70
      [<ffffffff81403110>] schedule+0x950/0xa70
      [<ffffffff81060bad>] ? insert_work+0x7d/0x90
      [<ffffffff81060fbd>] ? queue_work_on+0x1d/0x30
      [<ffffffff81061127>] ? queue_work+0x37/0x60
      [<ffffffff8140377d>] schedule_timeout+0x21d/0x360
      [<ffffffff812031c3>] ? generic_make_request+0x2c3/0x540
      [<ffffffff81402680>] wait_for_common+0xc0/0x150
      [<ffffffff81041490>] ? default_wake_function+0x0/0x10
      [<ffffffff812034bc>] ? submit_bio+0x7c/0x100
      [<ffffffff810680a0>] ? wake_bit_function+0x0/0x40
      [<ffffffff814027b8>] wait_for_completion+0x18/0x20
      [<ffffffff8120a969>] blkdev_issue_discard+0x1b9/0x210
      [<ffffffff811ba03e>] ext4_free_blocks+0x68e/0xb60
      [<ffffffff811b1650>] ? __ext4_handle_dirty_metadata+0x110/0x120
      [<ffffffff811b098c>] ext4_ext_truncate+0x8cc/0xa70
      [<ffffffff810d713e>] ? pagevec_lookup+0x1e/0x30
      [<ffffffff81191618>] ext4_truncate+0x178/0x5d0
      [<ffffffff810eacbb>] ? unmap_mapping_range+0xab/0x280
      [<ffffffff810d8976>] vmtruncate+0x56/0x70
      [<ffffffff811925cb>] ext4_setattr+0x14b/0x460
      [<ffffffff811319e4>] notify_change+0x194/0x380
      [<ffffffff81117f80>] do_truncate+0x60/0x90
      [<ffffffff811e08fa>] ? security_inode_permission+0x1a/0x20
      [<ffffffff811eaec1>] ? tomoyo_path_truncate+0x11/0x20
      [<ffffffff81127539>] do_last+0x5d9/0x770
      [<ffffffff811278bd>] do_filp_open+0x1ed/0x680
      [<ffffffff8140644f>] ? page_fault+0x1f/0x30
      [<ffffffff81132bfc>] ? alloc_fd+0xec/0x140
      [<ffffffff81118db1>] do_sys_open+0x61/0x120
      [<ffffffff81118e8b>] sys_open+0x1b/0x20
      [<ffffffff81002e6b>] system_call_fastpath+0x16/0x1b
      
      https://bugzilla.kernel.org/show_bug.cgi?id=22302Reported-by: default avatarMathias Burén <mathias.buren@gmail.com>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Cc: jiayingz@google.com
      b56ff9d3
    • Dmitry Monakhov's avatar
      ext4: do not try to grab the s_umount semaphore in ext4_quota_off · 87009d86
      Dmitry Monakhov authored
      It's not needed to sync the filesystem, and it fixes a lock_dep complaint.
      Signed-off-by: default avatarDmitry Monakhov <dmonakhov@gmail.com>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      87009d86
    • Theodore Ts'o's avatar
      ext4: fix potential race when freeing ext4_io_page structures · 83668e71
      Theodore Ts'o authored
      Use an atomic_t and make sure we don't free the structure while we
      might still be submitting I/O for that page.
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      83668e71
    • Theodore Ts'o's avatar
      ext4: handle writeback of inodes which are being freed · f7ad6d2e
      Theodore Ts'o authored
      The following BUG can occur when an inode which is getting freed when
      it still has dirty pages outstanding, and it gets deleted (in this
      because it was the target of a rename).  In ordered mode, we need to
      make sure the data pages are written just in case we crash before the
      rename (or unlink) is committed.  If the inode is being freed then
      when we try to igrab the inode, we end up tripping the BUG_ON at
      fs/ext4/page-io.c:146.
      
      To solve this problem, we need to keep track of the number of io
      callbacks which are pending, and avoid destroying the inode until they
      have all been completed.  That way we don't have to bump the inode
      count to keep the inode from being destroyed; an approach which
      doesn't work because the count could have already been dropped down to
      zero before the inode writeback has started (at which point we're not
      allowed to bump the count back up to 1, since it's already started
      getting freed).
      
      Thanks to Dave Chinner for suggesting this approach, which is also
      used by XFS.
      
        kernel BUG at /scratch_space/linux-2.6/fs/ext4/page-io.c:146!
        Call Trace:
         [<ffffffff811075b1>] ext4_bio_write_page+0x172/0x307
         [<ffffffff811033a7>] mpage_da_submit_io+0x2f9/0x37b
         [<ffffffff811068d7>] mpage_da_map_and_submit+0x2cc/0x2e2
         [<ffffffff811069b3>] mpage_add_bh_to_extent+0xc6/0xd5
         [<ffffffff81106c66>] write_cache_pages_da+0x2a4/0x3ac
         [<ffffffff81107044>] ext4_da_writepages+0x2d6/0x44d
         [<ffffffff81087910>] do_writepages+0x1c/0x25
         [<ffffffff810810a4>] __filemap_fdatawrite_range+0x4b/0x4d
         [<ffffffff810815f5>] filemap_fdatawrite_range+0xe/0x10
         [<ffffffff81122a2e>] jbd2_journal_begin_ordered_truncate+0x7b/0xa2
         [<ffffffff8110615d>] ext4_evict_inode+0x57/0x24c
         [<ffffffff810c14a3>] evict+0x22/0x92
         [<ffffffff810c1a3d>] iput+0x212/0x249
         [<ffffffff810bdf16>] dentry_iput+0xa1/0xb9
         [<ffffffff810bdf6b>] d_kill+0x3d/0x5d
         [<ffffffff810be613>] dput+0x13a/0x147
         [<ffffffff810b990d>] sys_renameat+0x1b5/0x258
         [<ffffffff81145f71>] ? _atomic_dec_and_lock+0x2d/0x4c
         [<ffffffff810b2950>] ? cp_new_stat+0xde/0xea
         [<ffffffff810b29c1>] ? sys_newlstat+0x2d/0x38
         [<ffffffff810b99c6>] sys_rename+0x16/0x18
         [<ffffffff81002a2b>] system_call_fastpath+0x16/0x1b
      Reported-by: default avatarNick Bowler <nbowler@elliptictech.com>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Tested-by: default avatarNick Bowler <nbowler@elliptictech.com>
      f7ad6d2e
    • Paul Mundt's avatar
      65670a1b
    • Paul Mundt's avatar
      Merge branches 'sh/pio-death', 'sh/nommu', 'sh/clkfwk', 'sh/core' and... · 21e14266
      Paul Mundt authored
      Merge branches 'sh/pio-death', 'sh/nommu', 'sh/clkfwk', 'sh/core' and 'sh/intc-extension' into sh-fixes-for-linus
      21e14266
    • Paul Mundt's avatar
      sh: clkfwk: Fix up checkpatch warnings. · a766b297
      Paul Mundt authored
      The clk_round_parent() change introduced various checkpatch warnings,
      tidy them up.
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
      a766b297
    • Guennadi Liakhovetski's avatar
      sh: make some needlessly global sh7724 clocks static · d0013c9e
      Guennadi Liakhovetski authored
      These clocks are currently only used inside one .c file and are not
      declared in any headers, therefore having them global is useless.
      Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
      d0013c9e
    • Guennadi Liakhovetski's avatar
      sh: add clk_round_parent() to optimize parent clock rate · 6af26c6c
      Guennadi Liakhovetski authored
      Sometimes it is possible and reasonable to adjust the parent clock rate to
      improve precision of the child clock, e.g., if the child clock has no siblings.
      clk_round_parent() is a new addition to the SH clock-framework API, that
      implements such an optimization for child clocks with divisors, taking all
      integer values in a range.
      Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
      6af26c6c
  3. 06 Nov, 2010 7 commits
  4. 05 Nov, 2010 8 commits