summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2010-11-09Staging: sst: user pointers in intel_sst_mmap_play_capture()Dan Carpenter
There were some places in intel_sst_mmap_play_capture() that dereferenced user pointers instead of copying the data to the kernel. I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are never possible in the current code. Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Vinod Koul <vinod.koul@intel.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: fixups in SNDRV_SST_STREAM_DECODEDan Carpenter
This is another patch about copying data to the kernel before using it. SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a copy_from_user() that gives us another two pointers and we have copy those. Those again give us some more pointers that we have to copy. Besides those problems, the code had a stack overflow: - struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries], - obuf_temp[param->obufs->entries]; param->ibufs->entries comes from the user. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: more dereferencing user pointersDan Carpenter
This is another patch about making a copy of the data into kernel space before using it. It is easy to trigger a kernel oops in the original code. If you passed a NULL to SNDRV_SST_SET_TARGET_DEVICE then it called BUG_ON(). And SNDRV_SST_DRIVER_INFO would let you write the information to arbitrary memory locations which is a security violation. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09Staging: sst: dereferencing user pointersDan Carpenter
This code dereferences user supplied pointers directly instead of doing a copy_from_user(). Some kernel configs put user and kernel memory in different address spaces so this code isn't portable. Also the user memory could be swapped out or in this case the pointer could just be NULL leading to an oops. Another thing is that it makes permission tests like this sort of meaningless. if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { retval = -EPERM; break; } The user could set stream_id to 1 for the test and then change it later. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09staging: stradis: fix error handling and information leak to userlandVasiliy Kulikov
configure_saa7146() didn't free irq on error. saa_open() didn't decrease reference count of saa on error. saa_ioctl() leaked information from the kernel stack to userland as it didn't fill copied structs with zeros. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09staging: cpia: fix camera file owner in cpia_open()Vasiliy Kulikov
Use effective UID instead of real UID for camera owner. There is no need to check for pending signals just before successfull return. Exit in case of pending signal also leaved camera in open state. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09ceph: explicitly specify page alignment in network messagesSage Weil
The alignment used for reading data into or out of pages used to be taken from the data_off field in the message header. This only worked as long as the page alignment matched the object offset, breaking direct io to non-page aligned offsets. Instead, explicitly specify the page alignment next to the page vector in the ceph_msg struct, and use that instead of the message header (which probably shouldn't be trusted). The alloc_msg callback is responsible for filling in this field properly when it sets up the page vector. Signed-off-by: Sage Weil <sage@newdream.net>
2010-11-09ceph: make page alignment explicit in osd interfaceSage Weil
We used to infer alignment of IOs within a page based on the file offset, which assumed they matched. This broke with direct IO that was not aligned to pages (e.g., 512-byte aligned IO). We were also trusting the alignment specified in the OSD reply, which could have been adjusted by the server. Explicitly specify the page alignment when setting up OSD IO requests. Signed-off-by: Sage Weil <sage@newdream.net>
2010-11-09ceph: fix comment, remove extraneous argsSage Weil
The offset/length arguments aren't used. Signed-off-by: Sage Weil <sage@newdream.net>
2010-11-09net/dst: dst_dev_event() called after other notifiersEric Dumazet
Followup of commit ef885afbf8a37689 (net: use rcu_barrier() in rollback_registered_many) dst_dev_event() scans a garbage dst list that might be feeded by various network notifiers at device dismantle time. Its important to call dst_dev_event() after other notifiers, or we might enter the infamous msleep(250) in netdev_wait_allrefs(), and wait one second before calling again call_netdevice_notifiers(NETDEV_UNREGISTER, dev) to properly remove last device references. Use priority -10 to let dst_dev_notifier be called after other network notifiers (they have the default 0 priority) Reported-by: Ben Greear <greearb@candelatech.com> Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Reported-by: Octavian Purdila <opurdila@ixiacom.com> Reported-by: Benjamin LaHaise <bcrl@kvack.org> Tested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-09iwlwifi: dont use pci_dev before it being assignWey-Yi Guy
In order to use build-in debugging macro, pci_dev in priv need to be assigned first. This fix iwl3945 driver oopsed at boot with 2.6.37-rc1 Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-11-09Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: fix a memleak in cifs_setattr_nounix() cifs: make cifs_ioctl handle NULL filp->private_data correctly
2010-11-09perf_events: Fix perf_counter_mmap() hook in mprotect()Pekka Enberg
As pointed out by Linus, commit dab5855 ("perf_counter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to merging. Fix the problem by moving perf_event_mmap() hook to mprotect_fixup(). Note: there's another successful return path from mprotect_fixup() if old flags equal to new flags. We don't, however, need to call perf_event_mmap() there because 'perf' already knows the VMA is executable. Reported-by: Dave Jones <davej@redhat.com> Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ingo Molnar <mingo@elte.hu> Reviewed-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Signed-off-by: Pekka Enberg <penberg@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-11-09x86: Address gcc4.6 "set but not used" warnings in apic.hAndi Kleen
native_apic_msr_read() and x2apic_enabled() use rdmsr(msr, low, high), but only use the low part. gcc4.6 complains about this: .../apic.h:144:11: warning: variable 'high' set but not used [-Wunused-but-set-variable] rdmsr() is just a wrapper around rdmsrl() which splits the 64bit value into low and high, so using rdmsrl() directly solves this. [tglx: Changed the variables to u64 as suggested by Cyrill. It's less confusing and has no code impact as this is 64bit only anyway. Massaged changelog as well. ] Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: x86@kernel.org Cc: Cyrill Gorcunov <gorcunov@gmail.com> LKML-Reference: <1289251229-19589-1-git-send-email-andi@firstfloor.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2010-11-09Merge branch 'musb-v2.6.37-rc2' of git://gitorious.org/usb/usb into work-linusGreg Kroah-Hartman
2010-11-09net: tipc: fix information leak to userlandKulikov Vasiliy
Structure sockaddr_tipc is copied to userland with padding bytes after "id" field in union field "name" unitialized. It leads to leaking of contents of kernel stack memory. We have to initialize them to zero. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-09[media] soc-camera: Compile fixes for mx2-cameraSascha Hauer
mx2-camera got broken during the last merge window. This patch fixes this and removes some unused variables. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09[media] SoC Camera: ov6650: minor cleanupsJanusz Krzysztofik
This is a followup patch that addresses two minor issues left in the recently added ov6650 sensor driver, as I've promised to the subsystem maintainer: - remove a pair of extra brackets, - drop useless case for not possible v4l2_mbus_pixelcode enum value of 0. Created against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09[media] SOC Camera: OMAP1: typo fixJanusz Krzysztofik
Fix an outstanding typo in the recently added driver, as requested by the subsystem maintainer. Created against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09tty: the development tree is now done in gitGreg Kroah-Hartman
So properly mark it as such in the MAINTAINERS file. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09[media] SoC Camera: OMAP1: update for recent videobuf changesJanusz Krzysztofik
Recent locking related videobuf changes has not been incorporated into the new OMAP1 camera driver. Fix it. Created and tested against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09Staging: the MAINTAINERS git location was incorrectGreg Kroah-Hartman
The tree has moved to "staging-2.6" not "staging-next-2.6" as all of the staging development is now done in git, not just for the next tree. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09USB: the development of the usb tree is now in gitGreg Kroah-Hartman
So change the MAINTAINERS file to properly reflect this. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-09[media] SoC Camera: OMAP1: update for recent framework changesJanusz Krzysztofik
The recently added OMAP1 camera driver was not ready for one video queue per device framework changes. Fix it. Created and tested against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09[media] ARM mx3_camera: check for DMA engine typeSascha Hauer
We have two dma engines in MX3 systems: The IPU and the SDMA engine. We have to check if we got a channel from the correct engine before proceeding with a channel. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Cc: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09[media] tm6000: bugfix set tv standardsStefan Ringel
bugfix set tv standards Signed-off-by: Stefan Ringel <stefan.ringel@arcor.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09r8169: fix sleeping while holding spinlock.françois romieu
As device_set_wakeup_enable can now sleep, move the call to outside the critical section. Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Acked-by: Andrew Hendry <andrew.hendry@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-09r8169: revert "Handle rxfifo errors on 8168 chips"françois romieu
The original patch helps under obscure conditions (no pun) but some 8168 do not like it. The change needs to be tightened with a specific 8168 version. This reverts commit 801e147cde02f04b5c2f42764cd43a89fc7400a2 ("r8169: Handle rxfifo errors on 8168 chips"). Regression at https://bugzilla.kernel.org/show_bug.cgi?id=20882 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Andreas Radke <a.radke@arcor.de> Cc: Matthew Garrett <mjg@redhat.com> Cc: Daniel J Blueman <daniel.blueman@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-09inet: fix ip_mc_drop_socket()Eric Dumazet
commit 8723e1b4ad9be4444 (inet: RCU changes in inetdev_by_index()) forgot one call site in ip_mc_drop_socket() We should not decrease idev refcount after inetdev_by_index() call, since refcount is not increased anymore. Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de> Reported-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-09[media] cafe_ccic: fix subdev configurationDaniel Drake
For some reason, commit 1aafeb30104a is missing one change that was included in the email submission. The sensor configuration must be passed down to the ov7670 subdev. Signed-off-by: Daniel Drake <dsd@laptop.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09cifs: fix a memleak in cifs_setattr_nounix()Suresh Jayaraman
Andrew Hendry reported a kmemleak warning in 2.6.37-rc1 while editing a text file with gedit over cifs. unreferenced object 0xffff88022ee08b40 (size 32): comm "gedit", pid 2524, jiffies 4300160388 (age 2633.655s) hex dump (first 32 bytes): 5c 2e 67 6f 75 74 70 75 74 73 74 72 65 61 6d 2d \.goutputstream- 35 42 41 53 4c 56 00 de 09 00 00 00 2c 26 78 ee 5BASLV......,&x. backtrace: [<ffffffff81504a4d>] kmemleak_alloc+0x2d/0x60 [<ffffffff81136e13>] __kmalloc+0xe3/0x1d0 [<ffffffffa0313db0>] build_path_from_dentry+0xf0/0x230 [cifs] [<ffffffffa031ae1e>] cifs_setattr+0x9e/0x770 [cifs] [<ffffffff8115fe90>] notify_change+0x170/0x2e0 [<ffffffff81145ceb>] sys_fchmod+0x10b/0x140 [<ffffffff8100c172>] system_call_fastpath+0x16/0x1b [<ffffffffffffffff>] 0xffffffffffffffff The commit 1025774c that removed inode_setattr() seems to have introduced this memleak by returning early without freeing 'full_path'. Reported-by: Andrew Hendry <andrew.hendry@gmail.com> Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de> Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-11-09mmc: sdhci: Fix crash on boot with C0 stepping Moorestown platformsJacob Pan
SDHC2 is newly added in C0 stepping of Langwell. Without the Moorestown specific quirk, the default pci_probe will be called and crash the kernel. This patch unblocks the crash problem on C0 by using the same probing function as HC1, which limits the number of slots to one. Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com> Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Chris Ball <cjb@laptop.org>
2010-11-09[media] saa7134: Fix autodetect for Behold A7 and H7 TV cardsDmitri Belimov
The entries for those cards are after the generic entries, so they don't work, in practice. Moving them to happen before the generic entres fix the issue. Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov <d.belimov@gmail.com> Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-11-09usb: musb: fail unaligned DMA transfers on v1.8 and aboveAnand Gadiyar
The Inventra DMA engine in version 1.8 and later of the MUSB controller cannot handle DMA addresses that are not aligned to a 4 byte boundary. It ends up ignoring the last two bits programmed in the DMA_ADDR register. This is a deliberate design change in the controller and is documented in the programming guide. Earlier versions of the controller could handle these accesses just fine. Fail dma_channel_program if we see an unaligned address when using the newer controllers, so that the caller can carry out the transfer using PIO mode. (Current callers already have this backup path in place). Signed-off-by: Anand Gadiyar <gadiyar@ti.com> Tested-by: Ming Lei <tom.leiming@gmail.com> Cc: Ajay Kumar Gupta <ajay.gupta@ti.com> Cc: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Felipe Balbi <balbi@ti.com>
2010-11-09Merge branch 'rmobile/core' into rmobile-fixes-for-linusPaul Mundt
2010-11-09sh: intc: Fix up initializers for gcc 4.5.Paul Mundt
The _INTC_ARRAY() initializer presently does a NULL test which blows up as a non-constant initializer under gcc 4.5. This switches over to a type test to account for NULL initializers explicitly. Signed-off-by: Paul Mundt <lethal@linux-sh.org>
2010-11-09drm/radeon/kms: fix thermal sensor reporting on rv6xxAlex Deucher
Temperature is not shifted as on newer asics. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/radeon/kms: fix bugs in ddc and cd path router codeTyson Whitehead
This is a follow on to: 2b5b1d7da9583484b3a9e7e375a90ca0e8ca07c2 (drm/radeon/kms: add support for clock/data path routers) That patch completed mux support for ddc and cd line routing between connectors. This patch fixes an indexing typo that was resulting in the atom bios router objects not always being walked, ensures the validity entries for the reused router structure are reset for every connector object walked, and corrects the masking operations used to update the mux control bits. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=31339 Signed-off-by: Tyson Whitehead <twhitehead@gmail.com> Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/radeon/kms: add support for clock/data path routersAlex Deucher
This is a follow on to: 26b5bc986423cf3887e09188cb662ed651c5374d (drm/radeon/kms: add support for router objects) That patch added support for systems that use a mux to control the ddc line routing between the connectors. This patch adds support for systems that use a mux to control the encoder clock and data path routing to the connectors. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=31339 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm: vmwgfx: fix information leak to userlandKulikov Vasiliy
Structure drm_vmw_fence_rep is copied to userland with field "pad64" uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drivers/gpu: Use vzallocJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/vmwgfx: Fix oops on failing bo pinThomas Hellstrom
When bo pin failed during modesetting, vmwgfx would try to unref a non-existing buffer object. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/ttm: Remove the CAP_SYS_ADMIN requirement for bo pinningThomas Hellstrom
This breaks vmwgfx non-root EGL clients and is a remnant from the TTM user-space interface. This test should be done in the driver. Replace the remaining placement test with a BUG_ON, since triggering it is a driver bug. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/ttm: Make sure a sync object doesn't disappear while we use itThomas Hellstrom
The sync object may disappear as soon as we release the bo::lock, so take a reference on it while we use it. One option would be to call sync_object_flush() before releasing the bo::lock, but that would put an atomic requirement on that function. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/radeon/kms: don't disable shared encoders on pre-DCE3 display blocksAlex Deucher
The A/B links aren't independantly useable on these blocks so when we disable the encoders, make sure to only disable the encoder when there is no connector using it. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=18564 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drivers/gpu/drm: Update WARN usesJoe Perches
Coalesce long formats. Align arguments. Add missing newlines. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drivers/gpu/drm/vmwgfx: Fix k.alloc switched argumentsJoe Perches
Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09DRM: ignore invalid EDID extensionsSam Tygier
Currently an invalid EDID extension will cause the whole EDID to be considered invalid. Instead just drop the invalid extensions, and return the valid ones. The base block is modified to claim to have the number valid extensions, and the check sum is updated. For my EIZO S2242W the base block is fine, but the extension block is all zeros. Without this patch I get no X and no VTs. Signed-off-by: Sam Tygier <samtygier@yahoo.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/radeon/kms: make the connector code less verboseAlex Deucher
Make more of the connector code debug only to avoid spamming the kernel logs with detect and add modes messages. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-11-09drm/ttm: remove failed ttm binding error printoutThomas Hellstrom
The driver (for example vmwgfx) may want to silently deal with the error itself. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com>