Fix "use after free" / "double free" bug in ati_create_gatt_pages / ati_free_gatt_pages
Hi,
Coverity spotted a "use after free" bug in
drivers/char/agp/ati-agp.c::ati_create_gatt_pages().
The same one that was in
drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages()
The problem is this:
If "entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);"
fails, then there's a loop in the function to free all entries
allocated so far and break out of the allocation loop. That in itself
is pretty sane, but then the (now freed) 'tables' is assigned to
ati_generic_private.gatt_pages and 'retval' is set to -ENOMEM which
causes ati_free_gatt_pages(); to be called at the end of the function.
The problem with this is that ati_free_gatt_pages() will then loop
'ati_generic_private.num_tables' times and try to free each entry in
tables[] - this is bad since tables has already been freed and
furthermore it will call kfree(tables) at the end - a double free.
This patch removes the freeing loop in ati_create_gatt_pages() and
instead relies entirely on the call to ati_free_gatt_pages() to free
everything we allocated in case of an error. It also sets
ati_generic_private.num_tables to the actual number of entries
allocated instead of just using the value passed in from the caller -
this ensures that ati_free_gatt_pages() will only attempt to free
stuff that was actually allocated.
Note: I'm in no way intimate with this code and I have no way to
actually test this patch (besides compile test it), so while I've
tried to be careful in reading the code and make sure the patch
does the right thing an ACK from someone who actually knows the
code in-depth would be very much appreciated.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Dave Airlie <airlied@linux.ie>
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
drivers/mmc/core/: make 3 functions static
mmc: add missing printk levels
mmc: remove redundant debug information from sdhci and wbsd
mmc: proper debugging output in core
mmc: be more verbose about card insertions/removal
mmc: Don't hold lock when releasing an added card
mmc: add a might_sleep() to mmc_claim_host()
mmc: update kerneldoc
mmc: update header file paths
sdhci: add support to ENE-CB714
mmc: check error bits before command completion
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (21 commits)
[POWERPC] spusched: Fix initial timeslice calculation
[POWERPC] spufs: Fix incorrect initialization of cbe_spu_info.spus
[POWERPC] Fix Maple platform ISA bus
[POWERPC] Make pci_iounmap actually unmap things
[POWERPC] Add function to check if address is an IO port
[POWERPC] Fix Pegasos keyboard detection
[POWERPC] iSeries: Fix section mismatch warning in lpevents
[POWERPC] iSeries: Fix section mismatch warnings
[POWERPC] iSeries: We need vio_enable_interrupts
[POWERPC] Fix RTC and device tree on linkstation machines
[POWERPC] Add of_register_i2c_devices()
[POWERPC] Fix loop with unsigned long counter variable
[POWERPC] Fix register labels on show_regs() message for 4xx/Book-E
[POWERPC] Only allow building of BootX text support on PPC_MULTIPLATFORM
[POWERPC] Fix the ability to reset on MPC8544 DS and MPC8568 MDS boards
[POWERPC] Fix mpc7448hpc2 tsi108 device_type bug
[POWREPC] Fixup a number of modpost warnings on ppc32
[POWERPC] Fix ethernet PHY support on MPC8544 DS
[POWERPC] Don't try to allocate resources for a Freescale POWERPC PHB
Revert "[POWERPC] Don't complain if size-cells == 0 in prom_parse()"
...
Fix ThinkPad T42 poweroff failure introduced by by "PM: Introduce pm_power_off_prepare"
Commit bd804eba1c8597cbb7cd5a5f9fe886aae16a079a ("PM: Introduce
pm_power_off_prepare") caused problems in the poweroff path, as reported by
YOSHIFUJI Hideaki / 吉藤英明.
Generally, sysdev_shutdown() should be called after the ACPI preparation for
powering the system off. To make it happen, we can separate sysdev_shutdown()
from device_shutdown() and call it directly wherever necessary.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Tested-by: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The way to DEBUG_RODATA interactions with KPROBES and CPU hotplug is to
just not mark the text as being write-protected in the first place.
Both of those facilities depend on rewriting instructions.
Having "helpful" debug facilities that just cause more problem is not
being helpful. It just adds complexity and bugs. Not worth it.
Reported-by: Rafael J. Wysocki <rjw@sisk.pl> Cc: Andi Kleen <ak@suse.de> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
These are manual fixups after running Lindent. No functional change.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Len Brown <lenb@kernel.org> Cc: Adam Belay <ambx1@neo.rr.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Len Brown <lenb@kernel.org> Cc: Adam Belay <ambx1@neo.rr.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
m32r: Fix ei_tx_timeout() in drivers/net/lib8390.c
Change INT0 trigger mode from edge-sense mode to level-sense mode,
in order to fix the following timeout error:
'NETDEV WATCHDOG: eth0: transmit timed out'.
This patch is required only for the Mappi platform.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org> Cc: Hitoshi Yamamoto <hitoshiy@linux-m32r.org> Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Allow nodes to exist that only contain ZONE_MOVABLE
With the introduction of kernelcore=, a configurable zone is created on
request. In some cases, this value will be small enough that some nodes
contain only ZONE_MOVABLE. On some NUMA configurations when this occurs,
arch-independent zone-sizing will get the size of the memory holes within
the node incorrect. The value of present_pages goes negative and the boot
fails.
This patch fixes the bug in the calculation of the size of the hole. The
test case is to boot test a NUMA machine with a low value of kernelcore=
before and after the patch is applied. While this bug exists in early
kernel it cannot be triggered in practice.
This patch has been boot-tested on a variety machines with and without
kernelcore= set.
Fix link errors below by selecting FW_LOADER
LD .tmp_vmlinux1
drivers/built-in.o: In function `cyz_load_fw':
drivers/char/cyclades.c:4908: undefined reference to `request_firmware'
drivers/char/cyclades.c:4979: undefined reference to `release_firmware'
EDAC has a foundation to perform software memory scrubbing, but it requires a
per architecture (atomic_scrub) function for performing an atomic update
operation. Under X86, this is done with a
lock: add [addr],0
in the file asm-x86/edac.h
This patch provides the MIPS arch with that atomic function, atomic_scrub() in
asm-mips/edac.h
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Doug Thompson <dougthompson@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This patch fixes sysfs exit code for the EDAC PCI device in a similiar manner
and the previous fixes for EDAC_MC and EDAC_DEVICE.
It removes the old (and incorrect) completion model and uses reference counts
on per instance kobjects and on the edac core module.
This pattern was applied to the edac_mc and edac_device code, but the EDAC PCI
code was missed. In addition, this fixes a system hang after a low level
driver was unloaded. (A cleanup function was called twice, which really
screwed things up)
Cc: Greg KH <greg@kroah.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Doug Thompson <dougthompson@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This fixes a deadlock that could occur on a 'setup' and 'teardown' sequence of
the workq for a edac_mc control structure instance. A similiar fix was
previously implemented for the edac_device code.
In addition, the edac_mc device code there was missing code to allow the workq
period valu to be altered via sysfs control.
This patch adds that fix on the code, and allows for the changing of the
period value as well.
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Doug Thompson <dougthompson@xmission.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Sam Ravnborg [Thu, 26 Jul 2007 17:41:13 +0000 (10:41 -0700)]
fix 'dynreloc miscount' link error on Powerpc
Nathan Lynch <ntl@pobox.com> reported:
2.6.23-rc1 breaks the build for 64-bit powerpc for me (using
maple_defconfig):
LD vmlinux.o
powerpc64-unknown-linux-gnu-ld: dynreloc miscount for
kernel/built-in.o, section .opd
powerpc64-unknown-linux-gnu-ld: can not edit opd Bad value
make: *** [vmlinux.o] Error 1
However, I see a possibly related binutils patch:
http://article.gmane.org/gmane.comp.gnu.binutils/33650
It was tracked down to be caused by the weak prototype
declaration in mm.h:
__attribute__((weak)) const char *arch_vma_name(struct vm_area_struct *vma);
But there is no need to make the declaration weak - only the definition
needs to be marked weak. So drop the weak declaration. And in the process
drop the duplicate definition in page.h for powerpc.
Note: the arch_vma_name fix for x86_64 needs to be applied first to avoid
breaking x86_64
Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Cc: Nathan Lynch <ntl@pobox.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Eric Sandeen [Thu, 26 Jul 2007 17:41:11 +0000 (10:41 -0700)]
fix inode_table test in ext234_check_descriptors
ext[234]_check_descriptors sanity checks block group descriptor geometry at
mount time, testing whether the block bitmap, inode bitmap, and inode table
reside wholly within the blockgroup. However, the inode table test is off
by one so that if the last block in the inode table resides on the last
block of the block group, the test incorrectly fails. This is because it
tests the last block as (start + length) rather than (start + length - 1).
This can be seen by trying to mount a filesystem made such as:
Andrew Morton [Thu, 26 Jul 2007 17:41:09 +0000 (10:41 -0700)]
i2c: ds1682 warning fix
ia64:
drivers/i2c/chips/ds1682.c: In function `ds1682_show':
drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3)
drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3)
Cc: Jean Delvare <khali@linux-fr.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
In usual, migrate_pages(page,,) is called with holding mm->sem by system call.
(mm here is a mm_struct which maps the migration target page.)
This semaphore helps avoiding some race conditions.
But, if we want to migrate a page by some kernel codes, we have to avoid
some races. This patch adds check code for following race condition.
1. A page which page->mapping==NULL can be target of migration. Then, we have
to check page->mapping before calling try_to_unmap().
2. anon_vma can be freed while page is unmapped, but page->mapping remains as
it was. We drop page->mapcount to be 0. Then we cannot trust page->mapping.
So, use rcu_read_lock() to prevent anon_vma pointed by page->mapping from
being freed during migration.
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Davi fixed a missing cast in the __put_user(), that was making timerfd
return a single byte instead of the full value.
Talking with Michael about the timerfd man page, we think it'd be better to
use a u64 for the returned value, to align it with the eventfd
implementation.
This is an ABI change. The timerfd code is new in 2.6.22 and if we merge this
into 2.6.23 then we should also merge it into 2.6.22.x. That will leave a few
early 2.6.22 kernels out in the wild which might misbehave when a future
timerfd-enabled glibc is run on them.
mtk says: The difference would be that read() will only return 4 bytes, while
the application will expect 8. If the application is checking the size of
returned value, as it should, then it will be able to detect the problem (it
could even be sophisticated enough to know that if this is a 4-byte return,
then it is running on an old 2.6.22 kernel). If the application is not
checking the return from read(), then its 8-byte buffer will not be filled --
the contents of the last 4 bytes will be undefined, so the u64 value as a
whole will be junk.
CC arch/i386/kernel/acpi/cstate.o
In file included from arch/i386/kernel/acpi/cstate.c:17:
include/acpi/processor.h:88: error: expected specifier-qualifier-list before 'acpi_integer'
<-- snip -->
If you select something you must ensure that the dependencies of what
you are selecting are fulfilled.
Signed-off-by: Adrian Bunk <bunk@stusta.de> Cc: Alexey Dobriyan <adobriyan@sw.ru> Cc: Joshua Hoblitt <jhoblitt@ifa.hawaii.edu> Cc: Dave Jones <davej@redhat.com> Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com> Cc: Len Brown <lenb@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix:
linux/include/xen/page.h: In function mfn_pte:
linux/include/xen/page.h:149: error: __supported_pte_mask undeclared (first use in this function)
linux/include/xen/page.h:149: error: (Each undeclared identifier is reported only once
linux/include/xen/page.h:149: error: for each function it appears in.)
Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
A dummy inline function of register_nosave_region_late was accidentally
removed by the recent PM patch that introduced suspend notifiers.
This elimination causes the following compiler error on PPC machines.
CC arch/powerpc/sysdev/dart_iommu.o
arch/powerpc/sysdev/dart_iommu.c: In function 'iommu_init_late_dart':
arch/powerpc/sysdev/dart_iommu.c:376: error: implicit declaration of function
'register_nosave_region_late'
make[1]: *** [arch/powerpc/sysdev/dart_iommu.o] Error 1
make: *** [arch/powerpc/sysdev] Error 2
This patch fixes the problem.
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:46:19 +0000 (17:46 +0100)]
arm unaligned.h annotations
Have put_unaligned() warn if types would be wrong
for assignment, slap force-casts where needed. Cast the
result of get_unaligned to typeof(*ptr). With that in
place we get proper typechecking, both from gcc and from sparse,
including that for bitwise types.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:35:39 +0000 (17:35 +0100)]
amd64: fix get_user() on bitwise
We really need force-cast when converting to final result type;
unsigned long can be silently converted to integer types and
to pointers, but not to bitwise.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:35:09 +0000 (17:35 +0100)]
misannotation in pppol2tp
Address of auto variable is not a userland pointer. A good thing, too,
since if pppol2tp_tunnel_getsockopt() would _really_ get a userland pointer
as argument, it would be an instant roothole...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:34:59 +0000 (17:34 +0100)]
cyclone.c: silly use of volatile, __iomem fixes
u32* volatile cyclone_timer means volatile auto pointer to u32,
which is clearly not what had been intended (we never even take
the address of that variable, let alone pass it to something that
could change it behind our back). u32 volatile * is what the
authors apparently wanted to say, but in reality we don't need that
qualifier there at all - it's (properly) only passed to iomem helpers
which takes care of that stuff just fine.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:33:29 +0000 (17:33 +0100)]
ip6_tunnel - endianness annotations
Convert rel_info to host-endian before calling ip6_tnl_err().
The things become much more straightforward that way.
The key observation (and the reason why that code actually
worked) is that after ip6_tnl_err() we either immediately
bailed out or had rel_info set to 0 or had it set to host-endian
and guaranteed to hit
(rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED)
case. So inconsistent endianness didn't really lead to bugs,
but it had been subtle and prone to breakage. New variant is
saner and obviously safe.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Thu, 26 Jul 2007 16:32:49 +0000 (17:32 +0100)]
fix missing arguments in drivers/rtc/rtc-stk17ta8.c
struct bin_attribute * is needed in bin_attribute ->read()/->write()
now. Incidentally, could people please run the fscking compiler
before and after applying their patch and compare the build logs?
That (and many, many other) would be caught immediately.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Use setup_irq() instead of request_irq() to set up system timer
in 68328 timer code. With the old m68knommu irq code this
was safe, but it is not now within the generic irq framework.
Use setup_irq() instead of request_irq() to set up system timer
in ColdFire PIT timer code. With the old m68knommu irq code this
was safe, but it is not now within the generic irq framework.
m68knommu: use setup_irq() in ColdFire simple timer
Use setup_irq() instead of request_irq() to set up system timer
in ColdFire simple timer code. With the old m68knommu irq code this
was safe, but it is not now within the generic irq framework.
Use setup_irq() instead of request_irq() to set up system timer
in 68360 timer code. With the old m68knommu irq code this
was safe, but it is not now within the generic irq framework.
Nick Piggin [Thu, 26 Jul 2007 11:40:43 +0000 (13:40 +0200)]
[PATCH] sched: debug feature - make the sched-domains tree runtime-tweakable
debugging feature: make the sched-domains tree runtime-tweakable.
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ mingo@elte.hu: made it depend on CONFIG_SCHED_DEBUG & small updates ] Signed-off-by: Ingo Molnar <mingo@elte.hu>
Con Kolivas [Thu, 26 Jul 2007 11:40:43 +0000 (13:40 +0200)]
[PATCH] sched: add above_background_load() function
Add an above_background_load() function which can be used by other
subsystems to detect if there is anything besides niced tasks running.
Place it in sched.h to allow it to be compiled out if not used.
Unused for now, but it is a useful hint to the IO scheduler and to
swap-prefetch.
Signed-off-by: Con Kolivas <kernel@kolivas.org> Cc: Peter Williams <pwil3058@bigpond.net.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Ingo Molnar <mingo@elte.hu>
While learning about schedstats I found that the documentation in the tree
is old. I updated it and found some interesting stuff like schedstats
version 14 is the same as version and version 13 never saw a kernel
release! Also there are 6 fields in the current schedstats that are not
used anymore. Nick had made them irrelevant in commit 476d139c218e44e045e4bc6d4cc02b010b343939 but never removed them.
Thanks to Rick's perl script who I borrowed some of the updated descriptions
from.
Signed-off-by: Joachim Deguara <joachim.deguara@amd.com> Acked-by: Nick Piggin <npiggin@suse.de> Cc: Rick Lindsley <ricklind@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Ingo Molnar <mingo@elte.hu>
[PATCH] sched: make cpu_clock() not use the rq clock
it is enough to disable interrupts to get the precise rq-clock
of the local CPU.
this also solves an NMI watchdog regression: the NMI watchdog
calls touch_softlockup_watchdog(), which might deadlock on
rq->lock if the NMI hits an rq-locked critical section.
Avi Kivity [Thu, 26 Jul 2007 11:40:43 +0000 (13:40 +0200)]
[PATCH] sched: arch preempt notifier mechanism
This adds a general mechanism whereby a task can request the scheduler to
notify it whenever it is preempted or scheduled back in. This allows the
task to swap any special-purpose registers like the fpu or Intel's VT
registers.
Currently we calculate the first timeslice for every context
incorrectly - alloc_spu_context calls spu_set_timeslice before we set
ctx->prio so we always calculate the longest possible timeslice for the
lowest possible priority.
This patch makes sure to update the schedule-related fields before
calculating the timeslice and also makes sure we update the timeslice for
a non-running context when entering spu_run so a priority change affects
the context as soon as possible.
Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
[POWERPC] spufs: Fix incorrect initialization of cbe_spu_info.spus
We currently initialize cbe_spu_info[].spus in both init_spu_base and
spu_sched_init. The initialise in spu_sched_init clears the SPU list,
so we end up with no physical SPUs. Because of this, the spu_run
syscall will block forever.
This change removes the unnecessary initialization in spu_sched_init.
Signed-off-by: Masato Noguchi <Masato.Noguchi@jp.sony.com> Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
This patch uses the newly added functions for testing if an address is
an ISA or PCI IO port to properly unmap things in pci_iounmap that
aren't such ports. Without that, drivers using the iomap API will never
actually unmap resources, which on IBM server machines will prevent
hot-unplug of the corresponding HW adapters.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>