aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'upstream-linus' of ↵Linus Torvalds2010-11-123-4/+5
|\ | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: drivers/ata/pata_octeon_cf.c: delete double assignment pata_legacy: fix CONFIG_PATA_WINBOND_VLB_MODULE test libata: fix NULL sdev dereference race in atapi_qc_complete()
| * drivers/ata/pata_octeon_cf.c: delete double assignmentJulia Lawall2010-11-121-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Delete successive assignments to the same location. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression i; @@ *i = ...; i = ...; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * pata_legacy: fix CONFIG_PATA_WINBOND_VLB_MODULE testTejun Heo2010-11-121-1/+1
| | | | | | | | | | | | | | | | | | pata_legacy is incorrectly testing PATA_WINBOND_VLB_MODULE instead of CONFIG_PATA_WINBOND_VLB_MODULE. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: "Robert P. J. Day" <rpjday@crashcourse.ca> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
| * libata: fix NULL sdev dereference race in atapi_qc_complete()Tejun Heo2010-11-121-1/+4
| | | | | | | | | | | | | | | | | | | | SCSI commands may be issued between __scsi_add_device() and dev->sdev assignment, so it's unsafe for ata_qc_complete() to dereference dev->sdev->locked without checking whether it's NULL or not. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@kernel.org Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
* | Merge branch 'staging-linus' of ↵Linus Torvalds2010-11-1265-795/+3755
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (38 commits) Revert "staging: tidspbridge: replace iommu custom for opensource implementation" Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c" Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name" Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c" Revert "staging: tidspbridge - fix mmufault support" Revert "staging: tidspbridge - remove hw directory" Revert "staging: tidspbridge - move all iommu related code to a new file" Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct" Revert "staging: tidspbridge - remove reserved memory clean up" Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions" Revert "staging: tidspbridge - remove dmm custom module" Revert "staging: tidspbridge - update Kconfig to select IOMMU module" staging: tidspbridge: hardcode SCM macros while fix is upstreamed Staging: keucr driver: fix uninitialized variable & proper memset length omap: dsp: remove shm from normal memory Staging: wlan-ng: Fix wrong #ifdef #endif sequence Staging: Update parameters for cfg80211 key management operation Staging: ath6kl: Fix pointer casts on 64-bit architectures Staging: batman-adv: suppress false warning when changing the mac address Staging: batman-adv: fix interface alternating and bonding reggression ...
| * \ Staging: Merge 'tidspbridge-2.6.37-rc1' into staging-linusGreg Kroah-Hartman2010-11-1132-572/+3471
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a big revert of a lot of -rc1 tidspbridge patches in order to get the driver back into a working state. It also includes a OMAP patch that was approved by the OMAP maintainer. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| | * | Revert "staging: tidspbridge: replace iommu custom for opensource ↵Felipe Contreras2010-11-106-135/+518
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implementation" This reverts commit d95ec7e2fd5cebf2f1caf3f572fa5e0a820ac5b1. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c"Felipe Contreras2010-11-104-139/+146
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 0c10e91b6cc9d1c6a23e9eed3e0653f30b6eb3d3. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name"Felipe Contreras2010-11-105-116/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4dd1944ab7242d76534c97d5fef0ce541a2f1040. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c"Felipe Contreras2010-11-102-0/+427
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit e7396e77d9e4230bf725b5807732cbca191d111f. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - fix mmufault support"Felipe Contreras2010-11-103-40/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit f265846db1e755c11498f6f7c011127dfcc5634a. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - remove hw directory"Felipe Contreras2010-11-1013-2/+1148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 053fdb85f56e84bff64a65601be7f72608f016da. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - move all iommu related code to a new file"Felipe Contreras2010-11-107-391/+289
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit f94378f9f9a897fc08e9d12733401ae52466e408. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct"Felipe Contreras2010-11-104-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit b5a44939231d6e3b0354624289507bfa1432a7b1. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - remove reserved memory clean up"Felipe Contreras2010-11-104-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit db348ca36e5881cd1d2e5caa6eee7d0237d07a3d. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions"Felipe Contreras2010-11-104-17/+197
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit b1ced160af36043ee80d354318794753b6b7c008. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - remove dmm custom module"Felipe Contreras2010-11-109-6/+747
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 2ab573487a98c06fdfb34308f641f09369d61fa2. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | Revert "staging: tidspbridge - update Kconfig to select IOMMU module"Felipe Contreras2010-11-101-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ace5a3ce40bb90f14953c5e3f73e9cf1176b1a28. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | staging: tidspbridge: hardcode SCM macros while fix is upstreamedFelipe Contreras2010-11-101-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On 2.6.37-rc1, omap platform internals for SCM have changed, so the build is broken again. drivers/staging/tidspbridge/core/tiomap3430.c:26: fatal error: plat/control.h: No such file or directory This is a totally ugly layer violation, but needed until omap_ctrl_set_dsp_boot*() are provided. Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| | * | omap: dsp: remove shm from normal memoryFelipe Contreras2010-11-101-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, don't be picky about the location, which incidentally fixes the build since MEMBLOCK_REAL_LIMIT is gone on 2.6.37. arch/arm/plat-omap/devices.c: In function 'omap_dsp_reserve_sdram_memblock': arch/arm/plat-omap/devices.c:287: error: 'MEMBLOCK_REAL_LIMIT' undeclared (first use in this function) Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com>
| * | | Staging: keucr driver: fix uninitialized variable & proper memset lengthKonstantin Katuev2010-11-106-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was commented out transfer_flags initialization. And i think memset should fill entire structure, not only length of pointer to it. This makes the driver work properly now on my hardware. Signed-off-by: Konstantin Katuev <kkatuev@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: wlan-ng: Fix wrong #ifdef #endif sequenceMaximiliano David Bustos2010-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes bug #13820 from bugzilla.kernel.org. Quote: "If ETHTOOL_GLINK is not defined, the end for switch case is not to be found." Signed-off-by: Maximiliano David Bustos <md.bustos90@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: Update parameters for cfg80211 key management operationBen Hutchings2010-11-092-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e31b82136d1adc7a599b6e99d3321e5831841f5a ("cfg80211/mac80211: allow per-station GTKs") changed the signatures of these operations but did not update the staging drivers. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: ath6kl: Fix pointer casts on 64-bit architecturesBen Hutchings2010-11-091-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove unnecessary cast of firmware base address to integer before adding an offset. Fix direct use of sk_buff::network_header which is an offset rather than a pointer on 64-bit architectures. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: batman-adv: suppress false warning when changing the mac addressMarek Lindner2010-11-091-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever the mac address of an batman interface is changed check_known_mac_addr() is called to print a warning if the newly added mac address exists an another batman interface. While looping through the batman interface list check_known_mac_addr() only compares mac addresses and does not make sure they belong to different interfaces, thus always printing a warning. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: batman-adv: fix interface alternating and bonding reggressionChris Lang2010-11-093-11/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 55d1666b521cbed95924c8d4775fe272c103f08c incidentally disabled bonding of packets first entering the mesh along with also disabling interface alternating regardless of where the packet came from. This re-enables these options. Signed-off-by: Chris Lang <clang@gateworks.com> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: udlfb.c: Fix k.alloc switched argumentsJoe Perches2010-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Joe Perches <joe@perches.com> Cc: Bernie Thompson <bernie@plugable.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: rtl8192e: fix IOMMU memory leakDaniel Lichtenberger2010-11-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unmap the rx buffer before mapping the new one in rtl8192_rx. Failing to do so quickly exhausts the IOMMU memory during downloads: [...] DMA: Out of SW-IOMMU space for 9100 bytes at device ... Using "iommu=off mem=4g" also fixes the problem because then pci_map_single does not allocate memory. Tested on my personal laptop with a RTL8192E device. Without this patch the kernel quickly runs out of IOMMU memory (downloading 5 MB of data is sufficient to trigger it), with this patch applied I haven't experienced any issues so far. Signed-off-by: Daniel Lichtenberger <daniel.lichtenberger@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | staging: vt6656: implement missing bracketsVasiliy Kulikov2010-11-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Identation says that copy_to_user() should be called only iff wrq->u.essid.pointer is not zero. Also it is useless to call copy_to_user(0, ...). Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | staging: rt2870: Add new USB ID for Belkin F6D4050 v1Larry Finger2010-11-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new USB ID for FT2870 for Belkin F6D4050 v1 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported- and Tested-by: James Long <crogonint@yahoo.com> Cc: Stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | staging: brcm80211: Maintainer changeBrett Rudley2010-11-092-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Nohee => Dowan Signed-off-by: Brett Rudley <brudley@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | drivers/staging/brcm80211/brcmfmac/dhd_linux.c: delete double assignmentJulia Lawall2010-11-091-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Delete successive assignments to the same location. dhd_ops_virt contains a subset of the definitions of dhd_ops_pri. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression i; @@ *i = ...; i = ...; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | drivers/staging: delete double assignmentJulia Lawall2010-11-094-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Delete successive assignments to the same location. In three of the cases, the two assignments are identical. In the case of the file rt2860/common/cmm_aes.c, the assigned variable i is never used, so both assignments are dropped. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression i; @@ *i = ...; i = ...; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: ath6kl: Adapt API changes in cfg80211Hauke Mehrtens2010-11-091-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The cfg80211 API changed in commit e31b82136d1adc7a599b6e99d3321e5831841f5a Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: ath6kl: ATH6KL_CFG80211 depends on CFG80211Randy Dunlap2010-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ATH6KL_CFG80211 should depend on CFG80211 to fix build errors: ERROR: "wiphy_free" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_inform_bss_frame" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "__ieee80211_get_channel" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_get_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_unregister" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_connect_result" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_michael_mic_failure" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_ibss_joined" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_roamed" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_put_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_new" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_register" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_disconnected" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_scan_done" [drivers/staging/ath6kl/ath6kl.ko] undefined! Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Vipin Mehta <vmehta@atheros.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: bcm: use get_user() to access user pointersDan Carpenter2010-11-091-17/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes some places that dereference user pointers directly instead of using get_user(). Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The original code modified the struct which "arg" was pointing to. I think this was a bug in the original code and that we only wanted to write to the OutputBuffer. Also with the original code you could read as much memory as you wanted so I had to put a cap on OutputLength. The only value of OutputLength that makes sense is sizeof(LINK_STATE) so now if OutputLength is not sizeof(LINK_STATE) it returns -EINVAL. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: sst: add some __user anotationsDan Carpenter2010-11-092-22/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This silences all the sparse warnings in intel_sst_app_interface.c. It was just a matter of adding __user annotations, I didn't find any real bugs here. Quite a few of these were needed for stuff I added earlier, sorry about that. I removed a couple casts to (void *) that caused a warning like: drivers/staging/intel_sst/intel_sst_app_interface.c:606:27: warning: cast removes address space of expression For example sst_drv_ctx->mailbox is already declared as "void __iomem *mailbox" so casting it to void pointer isn't necessary and it makes sparse complain because it removes the __user attribute. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: sst: user pointers in intel_sst_mmap_play_capture()Dan Carpenter2010-11-091-7/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There were some places in intel_sst_mmap_play_capture() that dereferenced user pointers instead of copying the data to the kernel. I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are never possible in the current code. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: sst: fixups in SNDRV_SST_STREAM_DECODEDan Carpenter2010-11-091-36/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is another patch about copying data to the kernel before using it. SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a copy_from_user() that gives us another two pointers and we have copy those. Those again give us some more pointers that we have to copy. Besides those problems, the code had a stack overflow: - struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries], - obuf_temp[param->obufs->entries]; param->ibufs->entries comes from the user. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: sst: more dereferencing user pointersDan Carpenter2010-11-091-29/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is another patch about making a copy of the data into kernel space before using it. It is easy to trigger a kernel oops in the original code. If you passed a NULL to SNDRV_SST_SET_TARGET_DEVICE then it called BUG_ON(). And SNDRV_SST_DRIVER_INFO would let you write the information to arbitrary memory locations which is a security violation. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: sst: dereferencing user pointersDan Carpenter2010-11-091-36/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code dereferences user supplied pointers directly instead of doing a copy_from_user(). Some kernel configs put user and kernel memory in different address spaces so this code isn't portable. Also the user memory could be swapped out or in this case the pointer could just be NULL leading to an oops. Another thing is that it makes permission tests like this sort of meaningless. if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { retval = -EPERM; break; } The user could set stream_id to 1 for the test and then change it later. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | staging: stradis: fix error handling and information leak to userlandVasiliy Kulikov2010-11-091-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configure_saa7146() didn't free irq on error. saa_open() didn't decrease reference count of saa on error. saa_ioctl() leaked information from the kernel stack to userland as it didn't fill copied structs with zeros. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | staging: cpia: fix camera file owner in cpia_open()Vasiliy Kulikov2010-11-091-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use effective UID instead of real UID for camera owner. There is no need to check for pending signals just before successfull return. Exit in case of pending signal also leaved camera in open state. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | Staging: the MAINTAINERS git location was incorrectGreg Kroah-Hartman2010-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The tree has moved to "staging-2.6" not "staging-next-2.6" as all of the staging development is now done in git, not just for the next tree. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* | | | Merge branch 'usb-linus' of ↵Linus Torvalds2010-11-1222-99/+188
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (28 commits) Revert "USB: xhci: Use GFP_ATOMIC under spin_lock" USB: ohci-jz4740: Fix spelling in MODULE_ALIAS UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference if kzalloc fails usb: core: fix information leak to userland usb: misc: iowarrior: fix information leak to userland usb: misc: sisusbvga: fix information leak to userland usb: subtle increased memory usage in u_serial USB: option: fix when the driver is loaded incorrectly for some Huawei devices. USB: xhci: Use GFP_ATOMIC under spin_lock usb: gadget: goku_udc: add registered flag bit, fixing build USB: ehci/mxc: compile fix USB: Fix FSL USB driver on non Open Firmware systems USB: the development of the usb tree is now in git usb: musb: fail unaligned DMA transfers on v1.8 and above USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial usb.h: fix ioctl kernel-doc info usb: musb: gadget: kill duplicate code in musb_gadget_queue() usb: musb: Fix handling of spurious SESSREQ usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time USB: musb: blackfin: push clkin value to platform resources ...
| * | | | Revert "USB: xhci: Use GFP_ATOMIC under spin_lock"Greg Kroah-Hartman2010-11-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ef821ae70fc35a76bdce7e07c70a1a7c2c33cdb9. The correct thing to do is to drop the spinlock, not change the GFP flag here. Thanks to Sarah for pointing out I shouldn't have taken this patch in the first place. Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: David Sterba <dsterba@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | USB: ohci-jz4740: Fix spelling in MODULE_ALIASStefan Weil2010-11-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | platfrom -> platform Cc: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Reviewed-by: Jesper Juhl <jj@chaosbits.net> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference ↵Jesper Juhl2010-11-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if kzalloc fails Crashing on a null pointer deref is never a nice thing to do. It seems to me that it's better to simply return UWB_RSV_ALLOC_NOT_FOUND if kzalloc() fails in uwb_rsv_find_best_allocation(). Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: David Vrabel <david.vrabel@csr.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | usb: core: fix information leak to userlandVasiliy Kulikov2010-11-111-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Structure usbdevfs_connectinfo is copied to userland with padding byted after "slow" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | usb: misc: iowarrior: fix information leak to userlandVasiliy Kulikov2010-11-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Structure iowarrior_info is copied to userland with padding byted between "serial" and "revision" fields uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Cc: stable <stable@kernel.org> Acked-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.1 at 2025-02-05 06:08:25 +0000