1. 15 Mar, 2016 21 commits
  2. 14 Mar, 2016 5 commits
  3. 11 Mar, 2016 2 commits
  4. 10 Mar, 2016 2 commits
    • Lars-Peter Clausen's avatar
      mpt3sas: Remove unnecessary synchronize_irq() before free_irq() · 7f8b8f3f
      Lars-Peter Clausen authored
      Calling synchronize_irq() right before free_irq() is quite useless. On
      one hand the IRQ can easily fire again before free_irq() is entered, on
      the other hand free_irq() itself calls synchronize_irq() internally (in
      a race condition free way), before any state associated with the IRQ is
      freed.
      
      Patch was generated using the following semantic patch:
      // <smpl>
      @@
      expression irq;
      @@
      -synchronize_irq(irq);
       free_irq(irq, ...);
      // </smpl>
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarSreekanth Reddy <sreekanth.reddy@broadcom.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      7f8b8f3f
    • Douglas Gilbert's avatar
      sg: fix dxferp in from_to case · 5ecee0a3
      Douglas Gilbert authored
      One of the strange things that the original sg driver did was let the
      user provide both a data-out buffer (it followed the sg_header+cdb)
      _and_ specify a reply length greater than zero. What happened was that
      the user data-out buffer was copied into some kernel buffers and then
      the mid level was told a read type operation would take place with the
      data from the device overwriting the same kernel buffers. The user would
      then read those kernel buffers back into the user space.
      
      From what I can tell, the above action was broken by commit fad7f01e
      ("sg: set dxferp to NULL for READ with the older SG interface") in 2008
      and syzkaller found that out recently.
      
      Make sure that a user space pointer is passed through when data follows
      the sg_header structure and command.  Fix the abnormal case when a
      non-zero reply_len is also given.
      
      Fixes: fad7f01e
      Cc: <stable@vger.kernel.org> #v2.6.28+
      Signed-off-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
      Reviewed-by: default avatarEwan Milne <emilne@redhat.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      5ecee0a3
  5. 09 Mar, 2016 10 commits