setup.phone and setup.eazmsn are 32 character buffers.
rcvmsg.msg_data.byte_array is a 48 character buffer.
sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars.
The rcvmsg struct comes from the memcpy_fromio() in receivemessage().
I guess that means it's data off the wire. I'm not very familiar with
this code but I don't see any reason to assume these strings are NULL
terminated.
Also it's weird that "dn" in a 50 character buffer but we only seem to
use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49
character buffer. So potentially there is still an issue there.
The important thing for now is to prevent the memory corruption.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The main motivation of this patch changing strcpy() to strlcpy().
We strcpy() to copy a 48 byte buffers into a 49 byte buffers. So at
best the last byte has leaked information, or maybe there is an
overflow? Anyway, this patch closes the information leaks by zeroing
the memory and the calls to strlcpy() prevent overflows.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Use memdup_user when user data is immediately copied into the
allocated region.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@
- to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+ to = memdup_user(from,size);
if (
- to==NULL
+ IS_ERR(to)
|| ...) {
<+... when != goto l1;
- -ENOMEM
+ PTR_ERR(to)
...+>
}
- if (copy_from_user(to, from, size) != 0) {
- <+... when != goto l2;
- -EFAULT
- ...+>
- }
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
After m68k's task_thread_info() doesn't refer to current,
it's possible to remove sched.h from interrupt.h and not break m68k!
Many thanks to Heiko Carstens for allowing this.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Fix isdn/sc/shmem.c printk format warning:
drivers/isdn/sc/shmem.c:57: warning: format '%d' expects type 'int', but argument 3 has type 'size_t'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
spid has been allocated in this function and so should be freed before
leaving it, as in the other error handling cases.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
@r exists@
expression E,E1;
statement S;
position p1,p2,p3;
@@
E =@p1 \(kmalloc\|kcalloc\|kzalloc\)(...)
... when != E = E1
if (E == NULL || ...) S
... when != E = E1
if@p2 (...) {
... when != kfree(E)
}
... when != E = E1
kfree@p3(E);
@forall@
position r.p2;
expression r.E;
int E1 != 0;
@@
* if@p2 (...) {
... when != kfree(E)
when strict
return E1; }
Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
CC [M] drivers/isdn/sc/shmem.o
drivers/isdn/sc/shmem.c: In function ‘memcpy_toshmem’:
drivers/isdn/sc/shmem.c:53: warning: passing argument 1 of ‘memcpy_toio’ makes pointer from integer without a cast
Commit 9317d4313e0cd51b2256ea9a9316f2d8561e37a8:
ISDN/sc: fix longstanding warning
claimed to fix it, but it didn't.
[ Changed the "void *" to be "void __iomem *" -DaveM ]
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.de>
Acked-by:Karsten Keil <kkeilæsuse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
isdn_if.writebuf_skb has an additional ack flag argument which
was missing from sndpkt leading to the following warning:
CC [M] drivers/isdn/sc/init.o
drivers/isdn/sc/init.c: In function ‘sc_init’:
drivers/isdn/sc/init.c:281: warning: assignment from incompatible pointer type
Note that this doesn't actually do anything with the flag, it
just fixes the warning (and probably accessing the last argument).
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/sc/shmem.c: In function 'memcpy_toshmem':
drivers/isdn/sc/shmem.c:54: warning: passing argument 1 of 'memcpy_toio' makes pointer from integer without a cast
Also, remove some unneeded braces, and add some useful whitespace.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
* pass card number to irq handler
* use card number in irq handler to avoid looping through each adapter
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
REQUEST_IRQ is never used, so delete it. In the process get rid of the
macro FREE_IRQ which makes the code unnecessarily difficult to read.
Signed-off-by: Fernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Remove a menu statement and several dependencies from the Kconfig files in
the drivers/isdn tree as they have become unnecessary by the transformation
of CONFIG_ISDN from "menu, config" into "menuconfig".
(Modified version of a patch originally proposed by Jan Engelhardt.)
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Cc: Jan Engelhardt <jengelh@computergmbh.de>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
There is check_reset() -- global function in drivers/isdn/sc/
There is check_reset -- variable holding module param in aacraid driver.
On allyesconfig they clash with:
LD drivers/built-in.o
drivers/isdn/built-in.o: In function `check_reset':
: multiple definition of `check_reset'
drivers/scsi/built-in.o:(.data+0xe458): first defined here
ld: Warning: size of symbol `check_reset' changed from 4 in drivers/scsi/built-in.o to 219 in drivers/isdn/built-in.o
ld: Warning: type of symbol `check_reset' changed from 1 to 2 in drivers/isdn/built-in.o
Rename the former.
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
First thing mm.h does is including sched.h solely for can_do_mlock() inline
function which has "current" dereference inside. By dealing with can_do_mlock()
mm.h can be detached from sched.h which is good. See below, why.
This patch
a) removes unconditional inclusion of sched.h from mm.h
b) makes can_do_mlock() normal function in mm/mlock.c
c) exports can_do_mlock() to not break compilation
d) adds sched.h inclusions back to files that were getting it indirectly.
e) adds less bloated headers to some files (asm/signal.h, jiffies.h) that were
getting them indirectly
Net result is:
a) mm.h users would get less code to open, read, preprocess, parse, ... if
they don't need sched.h
b) sched.h stops being dependency for significant number of files:
on x86_64 allmodconfig touching sched.h results in recompile of 4083 files,
after patch it's only 3744 (-8.3%).
Cross-compile tested on
all arm defconfigs, all mips defconfigs, all powerpc defconfigs,
alpha alpha-up
arm
i386 i386-up i386-defconfig i386-allnoconfig
ia64 ia64-up
m68k
mips
parisc parisc-up
powerpc powerpc-up
s390 s390-up
sparc sparc-up
sparc64 sparc64-up
um-x86_64
x86_64 x86_64-up x86_64-defconfig x86_64-allnoconfig
as well as my two usual configs.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Add proper prototypes in a header file for global code under
drivers/isdn/sc/.
Since the GNU C compiler is now able do tell us that caller and callee
disagreed about the number of arguments of setup_buffers(), this patch
also fixes this bug.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
pcbit: kill 'may be used uninitialized' warning. although the code does
eventually fill the 32 bits it cares about, the variable truly is
accessed uninitialized in each macro. Easier to just clean it up now.
sc: fix a ton of obviously incorrect printk's (some with missing
arguments even)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
of passing regs around manually through all ~1800 interrupt handlers in the
Linux kernel.
The regs pointer is used in few places, but it potentially costs both stack
space and code to pass it around. On the FRV arch, removing the regs parameter
from all the genirq function results in a 20% speed up of the IRQ exit path
(ie: from leaving timer_interrupt() to leaving do_IRQ()).
Where appropriate, an arch may override the generic storage facility and do
something different with the variable. On FRV, for instance, the address is
maintained in GR28 at all times inside the kernel as part of general exception
handling.
Having looked over the code, it appears that the parameter may be handed down
through up to twenty or so layers of functions. Consider a USB character
device attached to a USB hub, attached to a USB controller that posts its
interrupts through a cascaded auxiliary interrupt controller. A character
device driver may want to pass regs to the sysrq handler through the input
layer which adds another few layers of parameter passing.
I've build this code with allyesconfig for x86_64 and i386. I've runtested the
main part of the code on FRV and i386, though I can't test most of the drivers.
I've also done partial conversion for powerpc and MIPS - these at least compile
with minimal configurations.
This will affect all archs. Mostly the changes should be relatively easy.
Take do_IRQ(), store the regs pointer at the beginning, saving the old one:
struct pt_regs *old_regs = set_irq_regs(regs);
And put the old one back at the end:
set_irq_regs(old_regs);
Don't pass regs through to generic_handle_irq() or __do_IRQ().
In timer_interrupt(), this sort of change will be necessary:
- update_process_times(user_mode(regs));
- profile_tick(CPU_PROFILING, regs);
+ update_process_times(user_mode(get_irq_regs()));
+ profile_tick(CPU_PROFILING);
I'd like to move update_process_times()'s use of get_irq_regs() into itself,
except that i386, alone of the archs, uses something other than user_mode().
Some notes on the interrupt handling in the drivers:
(*) input_dev() is now gone entirely. The regs pointer is no longer stored in
the input_dev struct.
(*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
something different depending on whether it's been supplied with a regs
pointer or not.
(*) Various IRQ handler function pointers have been moved to type
irq_handler_t.
Signed-Off-By: David Howells <dhowells@redhat.com>
(cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
drivers/isdn/sc/event.c: In function 'indicate_status':
drivers/isdn/sc/event.c:49: error: 'events' undeclared (first use in this function)
drivers/isdn/sc/event.c:49: error: (Each undeclared identifier is reported only once
drivers/isdn/sc/event.c:49: error: for each function it appears in.)
drivers/isdn/sc/event.c:49: warning: format '%d' expects type 'int', but argument 4 has type 'ulong'
drivers/isdn/sc/interrupt.c: In function 'interrupt_handler':
drivers/isdn/sc/interrupt.c:97: warning: format '%x' expects type 'unsigned int', but argument 4 has type 'long unsigned int'
drivers/isdn/sc/timer.c: In function 'check_reset':
drivers/isdn/sc/timer.c:80: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
Acked-by: Karsten Keil <kkeil@suse.de>
Cc: Zach Brown <zach.brown@oracle.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
When pr_debug() is enabled:
drivers/isdn/sc/command.c: In function 'command':
drivers/isdn/sc/command.c:107: error: 'commands' undeclared (first use in this function)
drivers/isdn/sc/command.c:107: error: (Each undeclared identifier is reported only once
drivers/isdn/sc/command.c:107: error: for each function it appears in.)
drivers/isdn/sc/command.c:122: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'dial':
drivers/isdn/sc/command.c:199: warning: format '%d' expects type 'int', but argument 4 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'answer':
drivers/isdn/sc/command.c:221: warning: format '%s' expects type 'char *', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'hangup':
drivers/isdn/sc/command.c:244: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'setl2':
drivers/isdn/sc/command.c:265: error: 'l2protos' undeclared (first use in this function)
drivers/isdn/sc/command.c: In function 'setl3':
drivers/isdn/sc/command.c:297: error: 'l3protos' undeclared (first use in this function)
drivers/isdn/sc/command.c:297: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'acceptb':
drivers/isdn/sc/command.c:315: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'clreaz':
drivers/isdn/sc/command.c:330: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
drivers/isdn/sc/command.c: In function 'seteaz':
drivers/isdn/sc/command.c:345: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
Cc: Zach Brown <zach.brown@oracle.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Fix leak of `rcvmsg' in sc_ioctl().
There are two returns in the switch in sc_ioctl (the SCIOCSTART case) that
may leak `rcvmsg'. This patch fixes that by adding a kfree() call at the
beginning of that case.
Bug found by the coverity checker as #1098
Eric Sesterhenn send me a patch to fix the leak(s) by adding 2 kfree()
calls before the returns, I changed that into just a single call at the
beginning.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
"extern inline" -> "static inline"
Since there's no pullphone() function this patch removes the dead
prototype.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This patch removes almost all inclusions of linux/version.h. The 3
#defines are unused in most of the touched files.
A few drivers use the simple KERNEL_VERSION(a,b,c) macro, which is
unfortunatly in linux/version.h.
There are also lots of #ifdef for long obsolete kernels, this was not
touched. In a few places, the linux/version.h include was move to where
the LINUX_VERSION_CODE was used.
quilt vi `find * -type f -name "*.[ch]"|xargs grep -El '(UTS_RELEASE|LINUX_VERSION_CODE|KERNEL_VERSION|linux/version.h)'|grep -Ev '(/(boot|coda|drm)/|~$)'`
search pattern:
/UTS_RELEASE\|LINUX_VERSION_CODE\|KERNEL_VERSION\|linux\/\(utsname\|version\).h
Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Remove check_region references from comments and printk statements so that
searching for real users of this deprecated function gets easier.
Signed-off-by: Peter Osterlund <petero2@telia.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This patch contains the following possible cleanips:
- make some needlessly global code static
- remove the compiled but completely unused debug.c
- remove or #if 0 the following unused global functions:
- command.c: loopback
- command.c: loadproc
- init.c: irq_supported
- packet.c: print_skb
- shmem.c: memset_shmem
- timer.c: trace_timer
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.
Let it rip!
Dan Carpenter