summaryrefslogtreecommitdiff
path: root/drivers/char
AgeCommit message (Collapse)Author
2012-01-09ENGR00161234-1: Enable ocotp clock for mx6qTerry Lv
Add clock enable code to driver. OCOTP driver missed code to enable clock in driver. Thus if ocotp clock is not enabled in clock.c, ocotp will not work. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00155179-2: Change imx_viim to mxs_viim.Terry Lv
This is the change for driver files. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00154889-2: Add virtual iim driverTerry Lv
Add virtual iim driver. This driver will be used by MM team. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00153373-1 OCOTP: Add missed header fileFrank Li
Add missed ocopt header file Signed-off-by: Frank Li <Frank.Li@freescale.com>
2012-01-09ENGR00139235-3: IIM(OCOPT): Enable IIM driver for iMX6QTerry Lv
Add a new driver for On-Chip OTP controller. The driver will register all the register names of all the banks to /sys/. You can use the following commands to manipulate the OTP banks: read: #cat HW_OCOTP_MAC0 write: #echo 0x11223344 > HW_OCOTP_MAC0 Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00139119: mxc_iim: add console output for iim valueTerry Lv
Add console output for iim value. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00138547: mxc_iim: can't release twice in mxc_iimTerry Lv
When open mxc_iim twice, mxc_iim can't be close twice. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00138532: mxc_iim: let mxc_iim work with dd and echoTerry Lv
mxc_iim: let mxc_iim work with dd and echo. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00138480: mxc_iim can't be open twiceTerry Lv
mxc_iim can't be open twice. The reason is that request_irq failed when open mxc_iim again. So put request_irq function to probe function. Signed-off-by: Terry Lv <r65388@freescale.com>
2012-01-09ENGR00141399-5 OCOTP: add the ocotp driverHuang Shijie
Add a new driver for On-Chip OTP controller. The driver will register all the register names of all the banks to /sys/. You can use the following commands to manipulate the OTP banks: read: #cat HW_OCOTP_MAC0 write: #echo 0x11223344 > HW_OCOTP_MAC0 Signed-off-by: Huang Shijie <b32955@freescale.com>
2012-01-09ENGR00141399-4 RNGB: add RNGB driver for 2.6.38Anish Trivedi
Add RNGB driver support by porting fsl_rngc driver from 2.6.35. Signed-off-by: Anish Trivedi <anish@freescale.com>
2012-01-09ENGR00141217-9 iim: add iim driver supportFrank Li
add iim driver for 2.6.38 Signed-off-by: Frank Li <Frank.Li@freescale.com>
2011-10-03TPM: Zero buffer after copying to userspacePeter Huewe
commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream. Since the buffer might contain security related data it might be a good idea to zero the buffer after we have copied it to userspace. This got assigned CVE-2011-1162. Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-10-03TPM: Call tpm_transmit with correct sizePeter Huewe
commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream. This patch changes the call of tpm_transmit by supplying the size of the userspace buffer instead of TPM_BUFSIZE. This got assigned CVE-2011-1161. [The first hunk didn't make sense given one could expect way less data than TPM_BUFSIZE, so added tpm_transmit boundary check over bufsiz instead The last parameter of tpm_transmit() reflects the amount of data expected from the device, and not the buffer size being supplied to it. It isn't ideal to parse it directly, so we just set it to the maximum the input buffer can handle and let the userspace API to do such job.] Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-15net: Compute protocol sequence numbers and fragment IDs using MD5.David S. Miller
Computers have become a lot faster since we compromised on the partial MD4 hash which we use currently for performance reasons. MD5 is a much safer choice, and is inline with both RFC1948 and other ISS generators (OpenBSD, Solaris, etc.) Furthermore, only having 24-bits of the sequence number be truly unpredictable is a very serious limitation. So the periodic regeneration and 8-bit counter have been removed. We compute and use a full 32-bit sequence number. For ipv6, DCCP was found to use a 32-bit truncated initial sequence number (it needs 43-bits) and that is fixed here as well. Reported-by: Dan Kaminsky <dan@doxpara.com> Tested-by: Willy Tarreau <w@1wt.eu> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-07-13agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2MChris Wilson
Konstantin Belousov found an error in the define of G4x_GMCH_SIZE_VT_2M relative to the GMCH specs, and confirmed that indeed one of his users with a Q45 reports 0xb not 0xc for a 2/2MiB GATT. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Konstantin Belousov <kostikbel@gmail.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-15drivers/char/hpet.c: fix periodic-emulation for delayed interruptsNils Carlson
When interrupts are delayed due to interrupt masking or due to other interrupts being serviced the HPET periodic-emuation would fail. This happened because given an interval t and a time for the current interrupt m we would compute the next time as t + m. This works until we are delayed for > t, in which case we would be writing a new value which is in fact in the past. This can be solved by computing the next time instead as (k * t) + m where k is large enough to be in the future. The exact computation of k is described in a comment to the code. More detail: Assuming an interval of 5 between each expected interrupt we have a normal case of t0: interrupt, read t0 from comparator, set next interrupt t0 + 5 t5: interrupt, read t5 from comparator, set next interrupt t5 + 5 t10: interrupt, read t10 from comparator, set next interrupt t10 + 5 ... So, what happens when the interrupt is serviced too late? t0: interrupt, read t0 from comparator, set next interrupt t0 + 5 t11: delayed interrupt serviced, read t5 from comparator, set next interrupt t5 + 5, which is in the past! ... counter loops ... t10: Much much later, get the next interrupt. This can happen either because we have interrupts masked for too long (some stupid driver goes on a printk rampage) or just because we are pushing the limits of the interval (too small a period), or both most probably. My solution is to read the main counter as well and set the next interrupt to occur at the right interval, for example: t0: interrupt, read t0 from comparator, set next interrupt t0 + 5 t11: delayed interrupt serviced, read t5 from comparator, set next interrupt t15 as t10 has been missed. t15: back on track. Signed-off-by: Nils Carlson <nils.carlson@ericsson.com> Cc: John Stultz <john.stultz@linaro.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-30virtio console: don't manually set or finalize VIRTIO_CONSOLE_F_MULTIPORT.Rusty Russell
That's already been done by the virtio infrastructure before the probe function is called. Reported-by: alexey.kardashevskiy@au1.ibm.com Acked-by: Amit Shah <amit.shah@redhat.com> Tested-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2011-05-26drivers/char/ppdev.c: put gotten port valueJulia Lawall
parport_find_number() calls parport_get_port() on its result, so there should be a corresponding call to parport_put_port() before dropping the reference. Similar code is found in the function register_device() in the same file. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @exists@ local idexpression struct parport * x; expression ra,rr; statement S1,S2; @@ x = parport_find_number(...) ... when != x = rr when any when != parport_put_port(x,...) when != if (...) { ... parport_put_port(x,...) ...} ( if(<+...x...+>) S1 else S2 | if(...) { ... when != x = ra when forall when != parport_put_port(x,...) *return...; } ) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-26drivers/char/mspec.c: use {k,v}zalloc to allocate memoryRakib Mullick
Let memory allocator initialize the allocated memory as null, thus remove the use of memset. Signed-off-by: Rakib Mullick <rakib.mullick@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-26ipmi: convert to seq_file interfaceAlexey Dobriyan
The ->read_proc interface is going away, convert to seq_file. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Cc:Corey Minyard <minyard@acm.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-05-25i8k: Integrate with the hwmon subsystemJean Delvare
Let i8k create an hwmon class device so that libsensors will expose the CPU temperature and fan speeds to monitoring applications. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Guenter Roeck <guenter.roeck@ericsson.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Massimo Dal Zotto <dz@debian.org>
2011-05-25i8k: Avoid lahf in 64-bit codeLuca Tettamanti
i8k uses lahf to read the flag register in 64-bit code; early x86-64 CPUs, however, lack this instruction and we get an invalid opcode exception at runtime. Use pushf to load the flag register into the stack instead. Signed-off-by: Luca Tettamanti <kronos.it@gmail.com> Reported-by: Jeff Rickman <jrickman@myamigos.us> Tested-by: Jeff Rickman <jrickman@myamigos.us> Tested-by: Harry G McGavran Jr <w5pny@arrl.net> Cc: stable@kernel.org Cc: Massimo Dal Zotto <dz@debian.org> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2011-05-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: Make struct pcmcia_device_id const, sound drivers edition staging: pcmcia: Convert pcmcia_device_id declarations to const pcmcia: Convert pcmcia_device_id declarations to const pcmcia: Make declaration and uses of struct pcmcia_device_id const pcmcia/sa1100: put sa11x0_pcmcia_hw_init[] to .devinit.data
2011-05-24Merge branch 'drm-core-next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (169 commits) drivers/gpu/drm/radeon/atom.c: fix warning drm/radeon/kms: bump kms version number drm/radeon/kms: properly set num banks for fusion asics drm/radeon/kms/atom: move dig phy init out of modesetting drm/radeon/kms/cayman: fix typo in register mask drm/radeon/kms: fix typo in spread spectrum code drm/radeon/kms: fix tile_config value reported to userspace on cayman. drm/radeon/kms: fix incorrect comparison in cayman setup code. drm/radeon/kms: add wait idle ioctl for eg->cayman drm/radeon/cayman: setup hdp to invalidate and flush when asked drm/radeon/evergreen/btc/fusion: setup hdp to invalidate and flush when asked agp/uninorth: Fix lockups with radeon KMS and >1x. drm/radeon/kms: the SS_Id field in the LCD table if for LVDS only drm/radeon/kms: properly set the CLK_REF bit for DCE3 devices drm/radeon/kms: fixup eDP connector handling drm/radeon/kms: bail early for eDP in hotplug callback drm/radeon/kms: simplify hotplug handler logic drm/radeon/kms: rewrite DP handling drm/radeon/kms/atom: add support for setting DP panel mode drm/radeon/kms: atombios.h updates for DP panel mode ...
2011-05-23Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/apm * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/apm: apm-emulation: apm_mutex breaks ACK; remove it APM: take over maintainership
2011-05-23apm-emulation: apm_mutex breaks ACK; remove itPaul Parsons
apm_mutex is locked by a process (e.g. apm -s) at the start of apm_ioctl() and remains locked while pm_suspend() is called. Any subsequent process trying to ACK the suspend (e.g. apmd) is then blocked at the start of apm_ioctl(), causing the suspend to be delayed for 5 seconds in apm_suspend_notifier() while the ACK times out. In short, ACKs don't work. The driver's data structures are sufficiently protected by assorted locks. And pm_suspend() has its own mutex to prevent reentrancy. Consequently there is no obvious requirement for apm_mutex, which evolved from earlier BKL calls. So let's remove it. Signed-off-by: Paul Parsons <lost.distance@yahoo.com> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-05-22agp/uninorth: Fix lockups with radeon KMS and >1x.Michel Dänzer
This was based on a description by Ben Herrenschmidt: > I've removed that SBA reset from the normal TLB invalidation path and > left it only once after turning AGP on. About six months ago, he said: > I did it a bit differently, but yeah, you get the idea. I'm doing a > patch series so don't bother pushing things too hard yet. But I haven't seen anything from him about this since then, and people are regularly hitting these lockups, so here we are... Signed-off-by: Michel Dänzer <daenzer@vmware.com> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Dave Airlie <airlied@gmail.com>
2011-05-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (45 commits) crypto: caam - add support for sha512 variants of existing AEAD algorithms crypto: caam - remove unused authkeylen from caam_ctx crypto: caam - fix decryption shared vs. non-shared key setting crypto: caam - platform_bus_type migration crypto: aesni-intel - fix aesni build on i386 crypto: aesni-intel - Merge with fpu.ko crypto: mv_cesa - make count_sgs() null-pointer proof crypto: mv_cesa - copy remaining bytes to SRAM only when needed crypto: mv_cesa - move digest state initialisation to a better place crypto: mv_cesa - fill inner/outer IV fields only in HMAC case crypto: mv_cesa - refactor copy_src_to_buf() crypto: mv_cesa - no need to save digest state after the last chunk crypto: mv_cesa - print a warning when registration of AES algos fail crypto: mv_cesa - drop this call to mv_hash_final from mv_hash_finup crypto: mv_cesa - the descriptor pointer register needs to be set just once crypto: mv_cesa - use ablkcipher_request_cast instead of the manual container_of crypto: caam - fix printk recursion for long error texts crypto: caam - remove unused keylen from session context hwrng: amd - enable AMD hw rnd driver for Maple PPC boards hwrng: amd - manage resource allocation ...
2011-05-20Merge remote branch 'origin/master' into mergeBenjamin Herrenschmidt
Manual merge of arch/powerpc/kernel/smp.c and add missing scheduler_ipi() call to arch/powerpc/platforms/cell/interrupt.c Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2011-05-19Merge branch 'driver-core-next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 * 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: (44 commits) debugfs: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning sysfs: remove "last sysfs file:" line from the oops messages drivers/base/memory.c: fix warning due to "memory hotplug: Speed up add/remove when blocks are larger than PAGES_PER_SECTION" memory hotplug: Speed up add/remove when blocks are larger than PAGES_PER_SECTION SYSFS: Fix erroneous comments for sysfs_update_group(). driver core: remove the driver-model structures from the documentation driver core: Add the device driver-model structures to kerneldoc Translated Documentation/email-clients.txt RAW driver: Remove call to kobject_put(). reboot: disable usermodehelper to prevent fs access efivars: prevent oops on unload when efi is not enabled Allow setting of number of raw devices as a module parameter Introduce CONFIG_GOOGLE_FIRMWARE driver: Google Memory Console driver: Google EFI SMI x86: Better comments for get_bios_ebda() x86: get_bios_ebda_length() misc: fix ti-st build issues params.c: Use new strtobool function to process boolean inputs debugfs: move to new strtobool ... Fix up trivial conflicts in fs/debugfs/file.c due to the same patch being applied twice, and an unrelated cleanup nearby.
2011-05-19Merge branch 'timers-clocksource-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-clocksource-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clocksource: convert mips to generic i8253 clocksource clocksource: convert x86 to generic i8253 clocksource clocksource: convert footbridge to generic i8253 clocksource clocksource: add common i8253 PIT clocksource blackfin: convert to clocksource_register_hz mips: convert to clocksource_register_hz/khz sparc: convert to clocksource_register_hz/khz alpha: convert to clocksource_register_hz microblaze: convert to clocksource_register_hz/khz ia64: convert to clocksource_register_hz/khz x86: Convert remaining x86 clocksources to clocksource_register_hz/khz Make clocksource name const
2011-05-19Merge branch 'merge' into nextBenjamin Herrenschmidt
2011-05-18drivercore: revert addition of of_match to struct deviceGrant Likely
Commit b826291c, "drivercore/dt: add a match table pointer to struct device" added an of_match pointer to struct device to cache the of_match_table entry discovered at driver match time. This was unsafe because matching is not an atomic operation with probing a driver. If two or more drivers are attempted to be matched to a driver at the same time, then the cached matching entry pointer could get overwritten. This patch reverts the of_match cache pointer and reworks all users to call of_match_device() directly instead. Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-05-14Merge branch 'consolidate-clksrc-i8253' of ↵Thomas Gleixner
master.kernel.org:~rmk/linux-2.6-arm into timers/clocksource Conflicts: arch/ia64/kernel/cyclone.c arch/mips/kernel/i8253.c arch/x86/kernel/i8253.c Reason: Resolve conflicts so further cleanups do not conflict further Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2011-05-13agp/intel: add Ivy Bridge supportJesse Barnes
Just use the Sandy Bridge routines. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-05-06RAW driver: Remove call to kobject_put().Robert P. J. Day
If cdev_add() fails, there is no justification for subsequently calling kobject_put(). Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-06Allow setting of number of raw devices as a module parameterJan Kara
Allow setting of maximal number of raw devices as a module parameter. This requires changing of static array into a vmalloced one (the array is going to be too large for kmalloc). Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-06pcmcia: Convert pcmcia_device_id declarations to constJoe Perches
Saves about 50KB of data. Old/new size of all objects: text data bss dec hex filename 563015 80096 130684 773795 bcea3 (TOTALS) 610916 32256 130632 773804 bceac (TOTALS) Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Kurt Van Dijck <kurt.van.dijck@eia.be> (for drivers/net/can/softing/softing_cs.c) Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2011-05-04powerpc/pseries/bsr: Remove redundant initialization of bsr dev_t declaration.Robert P. J. Day
Remove the unnecessary initialization of "dev_t bsr_dev" since it's subsequently used in an "alloc_chrdev_region()" call which uses that variable in an output-only fashion. Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2011-05-04hwrng: amd - enable AMD hw rnd driver for Maple PPC boardsDmitry Eremin-Solenikov
PPC 970FX Evaluation kit (Maple) boards bear AMD8111 southbridge. Allow this driver to be compiled in if PPC_MAPLE is selected. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> Acked-by: Matt Mackall <mpm@selenic.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2011-05-04hwrng: amd - manage resource allocationDmitry Eremin-Solenikov
As amd driver doesn't bind to PCI device, we'd better manage reource allocation on our own to disallow (possible) conflicts. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> Acked-by: Matt Mackall <mpm@selenic.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2011-04-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linusLinus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: virtio: console: Enable call to hvc_remove() on console port remove virtio_pci: Prevent double-free of pci regions after device hot-unplug virtio: Decrement avail idx on buffer detach
2011-04-21virtio: console: Enable call to hvc_remove() on console port removeAmit Shah
This call was disabled as hot-unplugging one virtconsole port led to another virtconsole port freezing. Upon testing it again, this now works, so enable it. In addition, a bug was found in qemu wherein removing a port of one type caused the guest output from another port to stop working. I doubt it was just this bug that caused it (since disabling the hvc_remove() call did allow other ports to continue working), but since it's all solved now, we're fine with hot-unplugging of virtconsole ports. Signed-off-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2011-04-21agp: fix arbitrary kernel memory writesVasiliy Kulikov
pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-04-21agp: fix OOM and buffer overflowVasiliy Kulikov
page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-04-19kmsg: properly support writev to avoid interleaved printk lines fixAndrew Morton
make `len' size_t, avoid multiple-assignments. Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Lennart Poettering <lennart@poettering.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-19printk: /dev/kmsg - properly support writev() to avoid interleaved printk() ↵Kay Sievers
lines printk: /dev/kmsg - properly support writev() to avoid interleaved printk lines We should avoid calling printk() in a loop, when we pass a single string to /dev/kmsg with writev(). Cc: Lennart Poettering <lennart@poettering.net> Signed-off-by: Kay Sievers <kay.sievers@vrfy.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-03-31Fix common misspellingsLucas De Marchi
Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
2011-03-29char/tpm: Fix unitialized usage of data bufferPeter Huewe
This patch fixes information leakage to the userspace by initializing the data buffer to zero. Reported-by: Peter Huewe <huewe.external@infineon.com> Signed-off-by: Peter Huewe <huewe.external@infineon.com> Signed-off-by: Marcel Selhorst <m.selhorst@sirrix.com> [ Also removed the silly "* sizeof(u8)". If that isn't 1, we have way deeper problems than a simple multiplication can fix. - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-17 18:52:50 +0000