match_strcpy() is a somewhat creepy function: the caller needs to make sure
that the destination buffer is big enough, and when he screws up or
forgets, match_strcpy() happily overruns the buffer.
There's exactly one customer: v9fs_parse_options(). I believe it currently
can't overflow its buffer, but that's not exactly obvious.
The source string is a substing of the mount options. The kernel silently
truncates those to PAGE_SIZE bytes, including the terminating zero. See
compat_sys_mount() and do_mount().
The destination buffer is obtained from __getname(), which allocates from
name_cachep, which is initialized by vfs_caches_init() for size PATH_MAX.
We're safe as long as PATH_MAX <= PAGE_SIZE. PATH_MAX is 4096. As far as
I know, the smallest PAGE_SIZE is also 4096.
Here's a patch that makes the code a bit more obviously correct. It
doesn't depend on PATH_MAX <= PAGE_SIZE.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: Jim Meyering <meyering@redhat.com>
Cc: "Randy.Dunlap" <rdunlap@xenotime.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
RDMA/cxgb3: Wrap the software send queue pointer as needed on flush
IB/ipath: Change ipath_devdata.ipath_sdma_status to be unsigned long
IB/ipath: Make ipath_portdata work with struct pid * not pid_t
IB/ipath: Fix RDMA read response sequence checking
IB/ipath: Fix many locking issues when switching to error state
IB/ipath: Fix RC and UC error handling
RDMA/nes: Fix up nes_lro_max_aggr module parameter
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-2.6:
Driver core: struct class remove children list
block: do_mounts - accept root=<non-existant partition>
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (22 commits)
USB: atmel_usba_udc fixes, mostly disconnect()
USB: pxa27x_udc: minor fixes
usbtest: comment on why this code "expects" negative and positive errnos
USB: remove PICDEM FS USB demo (04d8:000c) device from ldusb
USB: option: add new Dell 5520 HSDPA variant
USB: unusual_devs: Add support for GI 0401 SD-Card interface
USB: serial gadget: descriptor cleanup
USB: serial gadget: simplify endpoint handling
USB: serial gadget: remove needless data structure
USB: serial gadget: cleanup/reorg
usb: fix compile warning in isp1760
USB: do not handle device 1410:5010 in 'option' driver
USB: Fix unusual_devs.h ordering
USB: add Zoom Telephonics Model 3095F V.92 USB Mini External modem to cdc-acm
USB: Support for the ET502HS HDSPA modem in option driver
USB: Support for the ET502HS HDSPA modem
usb: fix integer as NULL pointer warnings found by sparse
USB: isp1760: fix printk format
USB: add Telstra NextG CDMA id to option driver
USB: add association.h
...
because of the class_device was removed, now do the children list removing
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Some devices, like md, may create partitions only at first access,
so allow root= to be set to a valid non-existant partition of an
existing disk. This applies only to non-initramfs root mounting.
This fixes a regression from 2.6.24 which did allow this to happen and
broke some users machines :(
Acked-by: Neil Brown <neilb@suse.de>
Tested-by: Joao Luis Meloni Assirati <assirati@nonada.if.usp.br>
Cc: stable <stable@kernel.org>
Signed-off-by: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (73 commits)
net: Fix typo in net/core/sock.c.
ppp: Do not free not yet unregistered net device.
netfilter: xt_iprange: module aliases for xt_iprange
netfilter: ctnetlink: dump conntrack ID in event messages
irda: Fix a misalign access issue. (v2)
sctp: Fix use of uninitialized pointer
cipso: Relax too much careful cipso hash function.
tcp FRTO: work-around inorder receivers
tcp FRTO: Fix fallback to conventional recovery
New maintainer for Intel ethernet adapters
DM9000: Use delayed work to update MII PHY state
DM9000: Update and fix driver debugging messages
DM9000: Add __devinit and __devexit attributes to probe and remove
sky2: fix simple define thinko
[netdrvr] sfc: sfc: Add self-test support
[netdrvr] sfc: Increment rx_reset when reported as driver event
[netdrvr] sfc: Remove unused macro EFX_XAUI_RETRAIN_MAX
[netdrvr] sfc: Fix code formatting
[netdrvr] sfc: Remove kernel-doc comments for removed members of struct efx_nic
[netdrvr] sfc: Remove garbage from comment
...
There is a possible data race in the page table walking code. After the split
ptlock patches, it actually seems to have been introduced to the core code, but
even before that I think it would have impacted some architectures (powerpc
and sparc64, at least, walk the page tables without taking locks eg. see
find_linux_pte()).
The race is as follows:
The pte page is allocated, zeroed, and its struct page gets its spinlock
initialized. The mm-wide ptl is then taken, and then the pte page is inserted
into the pagetables.
At this point, the spinlock is not guaranteed to have ordered the previous
stores to initialize the pte page with the subsequent store to put it in the
page tables. So another Linux page table walker might be walking down (without
any locks, because we have split-leaf-ptls), and find that new pte we've
inserted. It might try to take the spinlock before the store from the other
CPU initializes it. And subsequently it might read a pte_t out before stores
from the other CPU have cleared the memory.
There are also similar races in higher levels of the page tables. They
obviously don't involve the spinlock, but could see uninitialized memory.
Arch code and hardware pagetable walkers that walk the pagetables without
locks could see similar uninitialized memory problems, regardless of whether
split ptes are enabled or not.
I prefer to put the barriers in core code, because that's where the higher
level logic happens, but the page table accessors are per-arch, and open-coding
them everywhere I don't think is an option. I'll put the read-side barriers
in alpha arch code for now (other architectures perform data-dependent loads
in order).
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
read_barrie_depends has always been a noop (not a compiler barrier) on all
architectures except SMP alpha. This brings UP alpha and frv into line with all
other architectures, and fixes incorrect documentation.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Various fixes to Atmel's high speed UDC driver.
* Issue some missing disconnect() calls. Currently they are only made
when VBUS power goes away (on boards where the driver can sense such
changes), but that's not enough for gadget drivers to clean out all
the state that's needed. Missing calls were:
- After USB reset, before starting enumeration.
- When unregistering a gadget driver, before unbind().
* Don't assume gadget drivers provide disconnect callbacks; make sure
to not call through a null pointer!
* When the driver doesn't provide an unbind() callback, refuse to
unregister it.
Also remove two bogus "error" messages:
* Related to mis-handling of disconnect() ... don't emit error messages
for disconnect() handlers that disable endpoints. All of them should
be doing that; the problem is (unfixed) oddness in atmel_usba_udc.
* Don't emit a diagnostic for a curious and transient nonfatal error
that shows up sometimes with EP0.
Those messages spammed syslog, for no good reason.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Minor fixes to pxa27x udc driver :
- don't clobber driver model bus_id field
- wrong endianess fix (no functional change; cpu is little-endian)
- double udc disable fix
- resume/suspend fix (OTG hold bit)
- make driver pxa27x dependant (check cpu at runtime)
Signed-off-by: Robert Jarzmik <rjarzmik@free.fr>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On Mon, May 12, 2008 at 01:02:22AM -0700, David Brownell wrote:
> On Sunday 11 May 2008, Marcin Slusarz wrote:
> >
> > test_ctrl_queue expects (?) positive and negative errnos.
> > what is going on here?
>
> The sign is just a way to flag something:
>
> /* some faults are allowed, not required */
>
> The negative ones are required. Positive codes are optional,
> in the sense that, depending on how the peripheral happens
> to be implemented, they won't necessarily be triggered.
>
> For example, the test to fetch a device qualifier desriptor
> must succeed if the device is running at high speed. So that
> test is marked as negative. But when it's full speed, it
> could legitimately fail; marked as positive. And so on for
> other tests.
>
> Look at how the codes are *interpreted* to see it work.
Lets document it.
Based on comment from David Brownell <david-b@pacbell.net>.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Microchip has changed the PICDEM FS USB demo device (0x04d8:000c)
to use bulk transfer and not interrupt transfer. So I've updated the libusb
based program here (Post #31).
http://forum.microchip.com/tm.aspx?m=106426&mpage=2
So I believe that the in-kernel ldusb driver will no longer work with the
demo firmware. It should be removed.
Signed-off-by: Xiaofan Chen <xiaofanc@gmail.com>
Cc: Michael Hund <MHund@LD-Didactic.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
New variant of the 5520 found by Luke Sheldrick.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Bugfix some serial gadget descriptors:
- Stop mangling the low bits (controller type ID) of bcdDevice;
just use the high bits for a driver revision code.
- Serial numbers that aren't specific to individual devices
are useless; stop reporting "0" for this.
- Since it's not part of a CDC-conformant function, the "bulk only"
configuration shouldn't be using "CDC Data" as its interface class.
Switch over to using CLASS_VENDOR_SPEC (different value, 0xff).
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Switch serial gadget away from a *very* old idiom: just remember
the endpoints we'll be using, instead of looking them up by name
each time. This is a net code and data (globals) shrink.
Also fix a small memory leak in the rmmod path, by working the
same as the disconnect code.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This removes a needless data structure from the serial gadget code;
it's a small code shrink, and a larger data shrink.
Since "struct usb_request" already has a "struct list_head" reserved
for use by gadget drivers, the serial gadget code doesn't need to
allocate wrapper structs to hold that list ... it can (and should!)
just use the list_head provided for that exact use.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Some cleanup/reorg of g_serial ... simplifying it, and disentangling
its structure so morphing it into a "function" driver (combinable with
other interfaces) should be less painful.
- Remove most forward declarations
* put tty and gadget driver structs after their contents
* snug module init/exit decls next to their functions
* reordered some functions
- Other cleanup:
* convert a funky macro to an inline function
* snug up module params next to their declarations
* add missing driver.owner
* add separator lines between major driver sections
- Add comments re potential parameter/#define changes:
* only supports one port (shrank GS_NUM_PORTS)
* changing from 9600-8-N-1 affects multiple sites
- Remove net2280-specific optimization ... it was being done
way too late, can be done by net2280 module options, and in
any case doesn't matter at any sane serial data rates.
There are no behavioral changes, but the macro thing saves I-space.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Al Borchers <alborchers@steinerpoint.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/host/isp1760-if.c:275: warning: 'ret' is used uninitialized in this function
Signed-off-by: Sebastian Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This device is not a serial port, but a virtual CD-ROM device. For
example with my Novatel MC950D:
lsusb -v -d 1410:5010 | grep InterfaceClass
bInterfaceClass 8 Mass Storage
After some time (ca. 5min) or if virtual CD is ejected, device id
changes to 1410:4400:
% lsusb -v -d 1410:4400 | grep InterfaceClass
bInterfaceClass 255 Vendor Specific Class
bInterfaceClass 255 Vendor Specific Class
Variable name says that 0x5010 is a Novatel U727, but searching in
internet shows, that this device also provides virtual CD that should be
ejected before use. Product id for serial port in this case is 0x4100.
Signed-off-by: Eugeniy Meshcheryakov <eugen@debian.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes ordering problems with entries in unusual_devs.h.
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The patch below is a necessary workaround to support the Zoom Telephonics Model 3095F V.92 USB Mini External modem, which fails to initialise properly during normal probing thus:
May 3 22:53:00 imcfarla kernel: drivers/usb/class/cdc-acm.c: Zero length descriptor references
May 3 22:53:00 imcfarla kernel: cdc_acm: probe of 5-2:1.0 failed with error -22
Adding the patch below causes the probing section to be skipped, and the modem
then initialises correctly.
Signed-off-by: Iain McFarlane <iain@imcfarla.homelinux.net>
Acked-by: Oliver Neukum <oneukum@suse.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
the proposed patch allows the ET502HS HDSPA modem to be handled by the
"option" driver. It has been tested for 1 month and works reliably (no
oopses, no hangs, 300KB/s throughput).
Signed-off-by: Mauro Andreolini <andreoli@weblab.ing.unimo.it>
Signed-off-by: Matthias Urlichs <matthias@urlichs.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The attached patch allows to bypass the ZeroCD mechanism for the ET502HS
HDSPA modem, so that it can be mounted as a network device.
Signed-off-by: Mauro Andreolini <andreoli@weblab.ing.unimo.it>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/host/ohci-sm501.c:93:24: warning: Using plain integer as NULL pointer
drivers/usb/gadget/amd5536udc.c:3254:9: warning: Using plain integer as NULL pointer
drivers/usb/gadget/amd5536udc.c:3267:9: warning: Using plain integer as NULL pointer
drivers/usb/gadget/amd5536udc.c:3277:9: warning: Using plain integer as NULL pointer
drivers/usb/gadget/amd5536udc.c:3285:9: warning: Using plain integer as NULL pointer
drivers/usb/gadget/amd5536udc.c:3293:9: warning: Using plain integer as NULL pointer
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix printk format warnings in isp1760 (in linux-next):
next-20080430/drivers/usb/host/isp1760-hcd.c:994: warning: format '%d' expects type 'int', but argument 6 has type 'size_t'
next-20080430/drivers/usb/host/isp1760-hcd.c:1092: warning: format '%d' expects type 'int', but argument 3 has type 'size_t'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
As reported by Magnus Boman <captain.magnus@opensuse.org>
Cc: Magnus Boman <captain.magnus@opensuse.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This will be used by the wireless usb code, as well as potentially other
USB code.
Originally based on some .c code written by Inaky Perez-Gonzalez
<inaky.perez-gonzalez@intel.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1087d) fixes a long-standing problem in usbcore: Device,
interface, and endpoint attributes aren't added until _after_ the
creation uevent has already been broadcast.
Unfortunately there are a few attributes which cannot be created that
early. The "descriptors" attribute is binary and so must be created
separately. The power-management attributes can't be created until
the dev/power/ group exists. And the interface string can vary from
one altsetting to another, so it has to be created dynamically.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This should work on a KRZR K1m, and some other Motorola phones that do
not use the "standard" cdc ACM protocol to talk to USB hosts.
Tested-by: Jeff Garzik <jeff@garzik.org>
Cc: Jiang Dejun <a5652c@motorola.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In sock_queue_rcv_skb() (net/core/sock.c) it should be:
"Cast sk->rcvbuf ..." instead of: "Cast skb->rcvbuf ..."
Signed-off-by: Rami Rosen <ramirose@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
An error path in ppp_create_interface() lacks one and may
BUG in free_netdev() checking for proper dev->reg_state.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Using iptables 1.3.8 with kernel 2.6.25, rules which include '-m
iprange' don't automatically pull in xt_iprange module. Below patch
adds module aliases to fix that. Patch against latest -git, but seems
like a good candidate for -stable also.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Conntrack ID is not put (anymore ?) in event messages. This causes
current ulogd2 code to fail because it uses the ID to build a hash in
userspace. This hash is used to be able to output the starting time of
a connection.
Conntrack ID can be used in userspace application to maintain an easy
match between kernel connections list and userspace one. It may worth
to add it if there is no performance related issue.
[ Patrick: it was never included in events, but really should be ]
Signed-off-by: Eric Leblond <eric@inl.fr>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Replace u16ho with put/get_unaligned functions
Signed-off-by: Graf Yang <graf.yang@analog.com>
Signed-off-by: Bryan Wu <cooloney@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Introduced by c4492586 (sctp: Add address type check while process
paramaters of ASCONF chunk):
net/sctp/sm_make_chunk.c: In function 'sctp_process_asconf':
net/sctp/sm_make_chunk.c:2828: warning: 'addr_param' may be used uninitialized in this function
net/sctp/sm_make_chunk.c:2828: note: 'addr_param' was declared here
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The cipso_v4_cache is allocated to contain CIPSO_V4_CACHE_BUCKETS
buckets. The CIPSO_V4_CACHE_BUCKETS = 1 << CIPSO_V4_CACHE_BUCKETBITS,
where CIPSO_V4_CACHE_BUCKETBITS = 7.
The bucket-selection function for this hash is calculated like this:
bkt = hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
^^^
i.e. picking only 4 buckets of possible 128 :)
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
As reported by Ingo Molnar:
x86.git testing found the following build failure:
drivers/built-in.o: In function `pvr2_dvb_feed_thread':
pvrusb2-dvb.c:(.text+0x127e78): undefined reference to `dvb_dmx_swfilter'
drivers/built-in.o: In function `pvr2_dvb_adapter_exit':
pvrusb2-dvb.c:(.text+0x128357): undefined reference to `dvb_net_release'
pvrusb2-dvb.c:(.text+0x12836f): undefined reference to `dvb_dmxdev_release'
[...]
with this config:
CONFIG_VIDEO_PVRUSB2=y
CONFIG_DVB_CORE=m
i.e. pvrusb2 is built-in, dvb-core is modular.
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
- MEDIA_ATTACH now applies also for V4L;
- select a FW_LOADER dependent driver should happen only if HOTPLUG;
- apply the common tuner dependency to all tuners. This helps to avoid latter
issues.
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
If one of DVB_CORE or VIDEO_DEV is a module, the modules that can be used by
both DVB and V4L cores should also be a module, otherwise, it will break its
dependencies. This Kconfig logic implements the following:
CONFIG_VIDEO_DEV CONFIG_DVB_CORE CONFIG_VIDEO_MEDIA
N N N
N M M
N Y Y
M N M
M M M
M Y M
Y N Y
Y M M
Y Y Y
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
The current code passes a context pointer in the xc5000_config struct.
This context pointer is used in the tuner_callback function, used to
reset the device after firmware download.
The xc5000_config struct is a static structure, whose .priv member was
being assigned before calling xc5000_attach(). If there are more than
one of the same device type installed on a single system, the last one
to assign xc5000_config.priv will "win", and all others will cease to
function properly.
This patch passes the context pointer in xc5000_attach() rather that
storing it within the static struct xc5000_config.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Upon error conditions in cx18/ivtv_probe(), the code at the 'err:' label
leaves a NULL entry in cx18/ivtv_cards[]. This can cause a NULL pointer
de-reference in cx18/ivtv_v4l2_open() which is fixed by this patch.
Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Tuner, S-Video and Composite are all working for the Compro H900.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
patch 779169257208 made the variable mask unnecessary.
This patch just removes the declaration.
Signed-off-by: Hartmut Hackmann <hartmut.hackmann@t-online.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Markus Armbruster