GIT: wrapfs-3.2.y -- Wrapfs: update copyright year to 2015 (push to branch refs/heads/master)
ezk at fsl.cs.sunysb.edu
ezk at fsl.cs.sunysb.edu
Sun Dec 13 18:35:16 EST 2015
Push to branch refs/heads/master:
8fdcab6fc9f9c151ab8428eb2b68bfe776bb1723 -->
f9a389e6cc6e04414de9445867bd74d1dce71ec5
Documentation/filesystems/00-INDEX | 2 +
Documentation/filesystems/wrapfs.txt | 172 ++++++++
Documentation/sysctl/fs.txt | 18 +-
MAINTAINERS | 9 +
Makefile | 2 +-
arch/arm/mach-pxa/include/mach/pxa27x.h | 2 +-
arch/arm/mach-pxa/pxa27x.c | 2 +-
arch/m68k/include/asm/linkage.h | 30 ++
arch/mips/include/asm/atomic.h | 2 +-
arch/mips/mm/dma-default.c | 2 +-
arch/powerpc/kernel/rtas.c | 3 +
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kernel/head_64.S | 8 +
arch/x86/kernel/process_64.c | 52 ++-
arch/x86/kernel/verify_cpu.S | 12 +-
arch/x86/kvm/mmu.c | 45 ++
arch/x86/kvm/svm.c | 22 +-
arch/x86/kvm/trace.h | 1 +
arch/x86/kvm/vmx.c | 5 +-
arch/x86/xen/setup.c | 2 +-
crypto/ablkcipher.c | 2 +-
crypto/ahash.c | 3 +-
crypto/algapi.c | 2 +-
crypto/algif_hash.c | 12 +-
crypto/api.c | 6 +-
drivers/acpi/osl.c | 9 +-
drivers/base/regmap/regmap-debugfs.c | 5 +-
drivers/block/xen-blkfront.c | 3 +-
drivers/bluetooth/ath3k.c | 4 +
drivers/bluetooth/btusb.c | 2 +
drivers/firewire/ohci.c | 5 +
drivers/gpu/drm/nouveau/nouveau_gem.c | 5 +-
drivers/hid/hid-core.c | 2 +-
drivers/infiniband/core/cm.c | 10 +-
drivers/iommu/intel-iommu.c | 26 +-
drivers/md/md.c | 1 +
drivers/md/persistent-data/dm-btree-remove.c | 17 +-
drivers/md/persistent-data/dm-btree.c | 2 +-
drivers/md/raid0.c | 46 +-
drivers/md/raid1.c | 38 +-
drivers/md/raid1.h | 5 +
drivers/md/raid10.c | 42 +-
drivers/md/raid10.h | 6 +
drivers/mtd/mtd_blkdevs.c | 10 +-
drivers/mtd/mtdpart.c | 4 +-
drivers/mtd/ubi/io.c | 5 +
drivers/mtd/ubi/vtbl.c | 1 +
drivers/mtd/ubi/wl.c | 1 +
drivers/net/can/dev.c | 2 +-
drivers/net/ppp/pppoe.c | 3 +-
drivers/net/usb/asix.c | 16 +-
drivers/net/wireless/ath/ath9k/init.c | 1 +
drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +-
drivers/net/wireless/mwifiex/debugfs.c | 14 +-
drivers/pci/access.c | 27 +-
drivers/pci/quirks.c | 20 +-
drivers/power/wm831x_power.c | 6 +-
drivers/scsi/3w-9xxx.c | 28 +-
drivers/scsi/megaraid/megaraid_sas.h | 2 +
drivers/scsi/megaraid/megaraid_sas_base.c | 15 +-
drivers/scsi/mvsas/mv_sas.c | 2 +
drivers/scsi/scsi_sysfs.c | 18 +-
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
drivers/staging/rtl8712/usb_intf.c | 1 +
drivers/tty/n_tty.c | 6 +-
drivers/tty/tty_io.c | 31 +-
drivers/usb/core/quirks.c | 13 +
drivers/usb/host/xhci-pci.c | 5 +
drivers/usb/host/xhci-ring.c | 30 +-
fs/Kconfig | 1 +
fs/Makefile | 1 +
fs/binfmt_elf.c | 10 +-
fs/btrfs/ctree.h | 39 +-
fs/btrfs/file.c | 18 +-
fs/btrfs/inode.c | 91 +++-
fs/btrfs/ioctl.c | 188 ++++++--
fs/btrfs/print-tree.c | 2 +-
fs/btrfs/tree-log.c | 2 +-
fs/btrfs/xattr.c | 4 +-
fs/cachefiles/rdwr.c | 78 ++--
fs/cifs/inode.c | 39 +-
fs/exec.c | 49 ++-
fs/ext4/super.c | 12 +-
fs/fscache/netfs.c | 34 +-
fs/fscache/page.c | 2 +-
fs/jbd2/journal.c | 6 +-
fs/nfs/nfs4state.c | 2 +-
fs/splice.c | 12 +-
fs/wrapfs/Kconfig | 9 +
fs/wrapfs/Makefile | 7 +
fs/wrapfs/dentry.c | 52 +++
fs/wrapfs/file.c | 377 ++++++++++++++++
fs/wrapfs/inode.c | 619 +++++++++++++++++++++++++++
fs/wrapfs/lookup.c | 304 +++++++++++++
fs/wrapfs/main.c | 173 ++++++++
fs/wrapfs/mmap.c | 94 ++++
fs/wrapfs/super.c | 168 ++++++++
fs/wrapfs/wrapfs.h | 206 +++++++++
include/linux/acpi.h | 6 +
include/linux/jbd2.h | 1 +
include/linux/magic.h | 2 +
include/linux/sched.h | 2 +-
include/linux/skbuff.h | 6 +-
include/net/inet_common.h | 3 +-
include/sound/wm8904.h | 2 +-
kernel/events/core.c | 4 +
kernel/irq/proc.c | 19 +-
kernel/module.c | 8 +-
kernel/sched.c | 14 +-
kernel/time/clocksource.c | 2 +-
lib/devres.c | 2 +-
mm/filemap.c | 9 +-
mm/hugetlb.c | 8 +
net/core/datagram.c | 6 +-
net/core/dst.c | 2 +-
net/core/ethtool.c | 2 +-
net/core/skbuff.c | 9 +-
net/ipv4/ipmr.c | 4 +-
net/ipv4/tcp_input.c | 2 +-
net/ipv4/udp.c | 2 +-
net/ipv6/raw.c | 2 +-
net/ipv6/tunnel6.c | 12 +-
net/ipv6/udp.c | 3 +-
net/irda/irlmp.c | 2 +-
net/mac80211/mlme.c | 2 +-
net/packet/af_packet.c | 6 +-
net/rds/tcp_recv.c | 11 +-
net/rxrpc/ar-recvmsg.c | 3 +-
scripts/recordmcount.h | 2 +-
security/keys/gc.c | 10 +-
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/hda/patch_sigmatel.c | 1 +
sound/synth/emux/emux_oss.c | 3 +-
134 files changed, 3268 insertions(+), 416 deletions(-)
commit f9a389e6cc6e04414de9445867bd74d1dce71ec5
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Nov 4 01:39:26 2015 -0500
Wrapfs: update copyright year to 2015
commit bf984d288b77dad7a29cffd9ab071f2eada8466c
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Nov 4 01:39:26 2015 -0500
Wrapfs: use vfs xattr helpers
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit f9a8b8f1d5b9f3368db300502ef800f4a5b41fbd
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Aug 15 23:25:45 2014 -0400
Wrapfs: properly copy meta-data after AIO operations from lower inode
Signed-off-by: Mengyang Li <li.mengyang at stonybrook.edu>
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit b2aeab4947f8cc205ec2331f90e13022e71aca91
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Aug 11 19:03:44 2014 -0400
Wrapfs: leave placeholders for updating upper inode after AIO
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit b170fcf44116631415137f4f1e79a02305fea90c
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Sun Aug 10 03:02:42 2014 -0400
Wrapfs: protect lower_file by ref-count during aio operation
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
Signed-off-by: Mengyang Li <li.mengyang at stonybrook.edu>
commit d9960ce118df7963ad2158927f8266ca81b73bcf
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Jun 25 23:27:33 2014 -0400
Wrapfs: fix ->llseek to update upper and lower offsets
Fixes bug: xfstests generic/257. f_pos consistently is required by and
only by dir_ops->wrapfs_readdir, main_ops is not affected.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
Signed-off-by: Mengyang Li <li.mengyang at stonybrook.edu>
commit 0659f7f09cd1b9364db5b9c7c1b7f06db0ff70b3
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Jun 25 23:27:33 2014 -0400
Wrapfs: support extended attributes (xattr) operations
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
Signed-off-by: Mengyang Li <li.mengyang at stonybrook.edu>
commit fe160014eea2e35bdf37a023bc214f57e647042b
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Jun 20 20:31:38 2014 -0400
Wrapfs: support asynchronous-IO (AIO) operations
Signed-off-by: Li Mengyang <li.mengyang at stonybrook.edu>
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit a1064e11e47b5afd663915c61d4e1cd578967ee1
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Jun 20 20:31:38 2014 -0400
Wrapfs: support direct-IO (DIO) operations
Signed-off-by: Li Mengyang <li.mengyang at stonybrook.edu>
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 32b508d02407d3cdb47c2535d4d6c98e8629430c
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu May 15 00:16:03 2014 -0400
Wrapfs: implement vm_ops->page_mkwrite
Some file systems (e.g., ext4) require it. Reported by Ted Ts'o.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit e5fb0ad4a8ae4014132318800cb200334fb34f4a
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Apr 3 14:06:57 2014 -0400
Wrapfs: update documentation
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit d233d51bf54c3117891da55b61a2c5e80d507d19
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Apr 3 14:06:53 2014 -0400
Wrapfs: update maintainers
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 786faf597c456e91151883458413674e58b470d9
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Jan 21 03:20:34 2014 -0500
Wrapfs: update documentation
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 8ae884e2e52e3886ced89573c5a374d05adc1e73
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Jan 21 01:16:11 2014 -0500
Wrapfs: 2014 Copyright update
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 5375407d7f4ca4d6cb83fd4060bf1bb96d204fef
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Jun 5 01:44:31 2013 -0400
Wrapfs: copy lower inode attributes in ->ioctl
Some ioctls (e.g., EXT2_IOC_SETFLAGS) can change inode attributes, so copy
them from lower inode.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 17ff2641896019c4e4e81662b514dbe6e4044000
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Wed Jun 5 01:43:31 2013 -0400
Wrapfs: remove unnecessary call to vm_unmap in ->mmap
Code is unnecessary and causes deadlocks in newer kernels.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 9558ca8632edda48b8b492754db6d0c555683791
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Sun Jun 2 21:55:03 2013 -0400
patch copyright-2013.patch
commit 23f189f468e5701505bda38c715419ece65e0a9a
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Sun Jan 29 20:33:14 2012 -0500
Wrapfs: use set_nlink()
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 16b96ea5dd94772c5c1f60d3c6a6e3e0dab9672d
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Sep 9 00:47:49 2011 -0400
Wrapfs: drop our dentry in ->rmdir
Also clear nlinks on our inode.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit e8e546aae96323b4c26a5e106839a7c74d1697cc
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:32 2011 -0400
Wrapfs: use d_alloc_root
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit c428691ef22294ced53904bde952335ec30407d2
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:31 2011 -0400
Wrapfs: use d_set_d_op
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 562af89e42a9fcbc85529c7c15a2f765a3bfdf60
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:30 2011 -0400
Wrapfs: use updated vfs_path_lookup prototype
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 130636f799642b61128c945a828de5d7150afb94
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:30 2011 -0400
Wrapfs: ->fsync updates for new prototype
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 73b3f5277ad3bc2182d9c7841e064635ce78027f
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:29 2011 -0400
Wrapfs: support LOOKUP_RCU in ->d_revalidate
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 95dfe6ce9ea2c2aa6d1bfac6c7444cea90345668
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Sep 6 00:10:28 2011 -0400
Wrapfs: new ->permission prototype and fixes.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit f077a427631134e9f445d0955c041eaa81bc9b42
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon May 2 02:00:02 2011 -0400
Wrapfs: lookup fixes
Don't use lookup_one_len any longer (doesn't work for NFS).
Initialize lower wrapfs_dentry_info so lower_path is NULL.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 23fd3dfed555887aff52c8aec228303b62a487df
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Mar 18 13:14:28 2011 -0400
Wrapfs: remove extra debug in rmdir
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 16c5595157823f84e5e151b0e1a92c3d7965bed8
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Mar 18 12:38:01 2011 -0400
Wrapfs: checkpatch fixes
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 63341664dd16aff38378a277f2e16d075df7d3c4
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Mar 18 00:45:17 2011 -0400
Wrapfs: port to 2.6.39
Remove lock/unlock_kernel in ->fasync.
Convert from ->get_sb to ->mount op.
Remove include to smp_lock.h, added sched.h.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 683610695c8cabdd1b9801fe9d3340dabcd7dc1a
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Mar 17 23:21:55 2011 -0400
Wrapfs: copyright update for 2011
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 0aa2c2fe31fdd4c0f05e1aafbb256f56ba025419
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Mar 17 23:21:55 2011 -0400
Wrapfs: better handling of NFS silly-renamed files
In ->unlink, if we try to unlink an NFS silly-renamed file, NFS returns
-EBUSY. We have to treat it as a success and return 0 to the VFS. NFS will
remove silly-deleted files later on anyway.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 211eed0dc332df517e00f1b61add1b1c0e62a9af
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Mar 17 23:21:55 2011 -0400
Wrapfs: update parent directory inode size in inode ops
After ->unlink, ->rmdir, and ->rename, we need to copy the (possibly
changed) inode size of the parent directory(ies) where the operation took
place.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit e7c36afac40a3fbf7551cc9255becbf20f0e1fd7
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Thu Mar 17 23:21:55 2011 -0400
Wrapfs: remove unnecessary calls to copy lower inode->n_links
Removed from ->create, ->symlink, and ->mknod.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 5dd7aa68b6c16d6b6fd315ed691fc9f0632465d6
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Mar 7 23:20:33 2011 -0500
Wrapfs: ->setattr fixes
Call inode_change_ok on our inode, not lower.
Don't copy inode sizes (VFS does it).
Pass lower file in struct iattr passed to notify_change on lower inode.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 19ead9e20b6b0643eeedac0921620ae1c1a04f59
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Sun Mar 6 16:23:16 2011 -0500
Wrapfs: update ->permission prototye and code for new iperm flag
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 020d436bf4b2570c6a6c8066e9290d4c1feb532c
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Nov 12 18:15:05 2010 -0500
Wrapfs: handle maxbytes properly
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 10c16b742e3408cad0a95c4667cb7355efd325e3
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Sat Sep 11 15:49:33 2010 -0400
Wrapfs: support ->unlocked_ioctl and ->compat_ioctl
Old ->ioctl was split into ->unlocked_ioctl and ->compat_ioctl. Compat
version doesn't need to lock_kernel any longer.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 5da5f4c85466da192d58d6096469ca6a673f1bd1
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Aug 10 23:50:14 2010 -0400
Wrapfs: new vfs_statfs and ->evict_inode prototypes
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 630a232cf55164c2d9890960b4d9077eaafeded1
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Aug 6 23:37:29 2010 -0400
Wrapfs: update ->fsync prototype
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit a499bbdb9bbefb40ccbc7301a32ab6cedbe61434
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Apr 20 21:22:02 2010 -0400
Wrapfs: update documentation
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 5ecf812ffeec9d4d016e7a2b1f2c1c71f57c0b39
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Apr 20 15:32:09 2010 -0400
Wrapfs: include slab.h
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 3b626914703aaffeddb079bad19158f09fb2b3b4
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Apr 20 15:26:02 2010 -0400
Wrapfs: avoid an extra path_get/put pair in wrapfs_open
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 11e1def9812f2b36ca88eecd7aa46c4ba051f2a6
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Fri Feb 26 03:18:04 2010 -0500
Wrapfs: decrement nd_path on follow_link error
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit da6b44300726d7e977a7e64ad1e4f16a723ca8e9
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Jan 5 04:27:00 2010 -0500
Wrapfs: don't mention kernel version in modload message
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit d1f3b597abb6c330972b5926e1a6504b26956496
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Tue Jan 5 04:28:11 2010 -0500
Wrapfs/VFS: remove init_lower_nd and unexport release_lower_nd
Only wrapfs_create used it, and it is unnecessary to init a completely new
nameidata for the lower file system.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 1fbf5f4af197ed3ebd3c54df3f56c93fe525efba
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Kconfig: hook to configure Wrapfs
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 48f523087df2120426945442d0199a8df7646d99
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Makefile: hook to compile Wrapfs
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 18aa1549a79917b84fa3de8653a4674bfccf14e5
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
VFS: export release_open_intent symbol
Needed to release the resources of the lower nameidata structures that we
create and pass to lower file systems (e.g., when calling vfs_create).
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 112c539135dc9ebb630807891b10f7c08227063b
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: file system magic number
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 7103c1bddd87737a3b0e67483332c50694d02d68
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: Kconfig options
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 76362b27b21a220af30e50878de4ce7bd7f5fe56
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: main Makefile
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 8e81800f727b1eb734a1b455b4206600b003d8a5
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: vm_ops operations
Includes necessary address_space workaround ops.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit fb0cdaee3eda999f715d68d3569e38c6bbb285e8
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: mount-time and module-linkage functions
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 001a7a2d53c8ca9e06375e36aba56555bba133b9
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: lookup-related functions
Main lookup function, nameidata helpers, and stacking-interposition
functions.
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 999061245960f3d6cd7a180ccf6b81a930832899
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: file operations
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 2aafc26ea978dbaf3c663a6a420a9489e6646fae
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: dentry operations
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 5863c634eb4658af92a8ed6f2916d5f6c53fcc7f
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: inode operations
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 41423abb51be8027b0052ce6f9b497c22a9de2c5
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: superblock operations
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 7c0881b11bc8fd299bc3b07ad2c50b521624c8cc
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: main header file
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit fe1d3296e354616b916ff0cf84fd07fe774af997
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: Maintainers
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit bf36682328a92f46416fff9c7efae7df69648ec7
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Documentation: index entry for Wrapfs
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit ff5fe3f8e046b18eaea67d48c9cb09e17a251806
Author: Erez Zadok <ezk at cs.sunysb.edu>
Date: Mon Jan 4 20:45:06 2010 -0500
Wrapfs: introduction and usage documentation
Signed-off-by: Erez Zadok <ezk at cs.sunysb.edu>
commit 95afdc9fef289a42958570d5a4bcc9c939a5b5b8
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Fri Nov 27 12:48:26 2015 +0000
Linux 3.2.74
commit fcb2781782b61631db4ed31e98757795eacd31cb
Author: Christophe Leroy <christophe.leroy at c-s.fr>
Date: Wed May 6 17:26:47 2015 +0200
splice: sendfile() at once fails for big files
commit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream.
Using sendfile with below small program to get MD5 sums of some files,
it appear that big files (over 64kbytes with 4k pages system) get a
wrong MD5 sum while small files get the correct sum.
This program uses sendfile() to send a file to an AF_ALG socket
for hashing.
/* md5sum2.c */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <linux/if_alg.h>
int main(int argc, char **argv)
{
int sk = socket(AF_ALG, SOCK_SEQPACKET, 0);
struct stat st;
struct sockaddr_alg sa = {
.salg_family = AF_ALG,
.salg_type = "hash",
.salg_name = "md5",
};
int n;
bind(sk, (struct sockaddr*)&sa, sizeof(sa));
for (n = 1; n < argc; n++) {
int size;
int offset = 0;
char buf[4096];
int fd;
int sko;
int i;
fd = open(argv[n], O_RDONLY);
sko = accept(sk, NULL, 0);
fstat(fd, &st);
size = st.st_size;
sendfile(sko, fd, &offset, size);
size = read(sko, buf, sizeof(buf));
for (i = 0; i < size; i++)
printf("%2.2x", buf[i]);
printf(" %s\n", argv[n]);
close(fd);
close(sko);
}
exit(0);
}
Test below is done using official linux patch files. First result is
with a software based md5sum. Second result is with the program above.
root at vgoip:~# ls -l patch-3.6.*
-rw-r--r-- 1 root root 64011 Aug 24 12:01 patch-3.6.2.gz
-rw-r--r-- 1 root root 94131 Aug 24 12:01 patch-3.6.3.gz
root at vgoip:~# md5sum patch-3.6.*
b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
root at vgoip:~# ./md5sum2 patch-3.6.*
b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
5fd77b24e68bb24dcc72d6e57c64790e patch-3.6.3.gz
After investivation, it appears that sendfile() sends the files by blocks
of 64kbytes (16 times PAGE_SIZE). The problem is that at the end of each
block, the SPLICE_F_MORE flag is missing, therefore the hashing operation
is reset as if it was the end of the file.
This patch adds SPLICE_F_MORE to the flags when more data is pending.
With the patch applied, we get the correct sums:
root at vgoip:~# md5sum patch-3.6.*
b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
root at vgoip:~# ./md5sum2 patch-3.6.*
b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
Signed-off-by: Christophe Leroy <christophe.leroy at c-s.fr>
Signed-off-by: Jens Axboe <axboe at fb.com>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit f79c83d6c41930362bc66fc71489e92975a2facf
Author: Eric Dumazet <edumazet at google.com>
Date: Mon Nov 2 07:50:07 2015 -0800
net: avoid NULL deref in inet_ctl_sock_destroy()
[ Upstream commit 8fa677d2706d325d71dab91bf6e6512c05214e37 ]
Under low memory conditions, tcp_sk_init() and icmp_sk_init()
can both iterate on all possible cpus and call inet_ctl_sock_destroy(),
with eventual NULL pointer.
Signed-off-by: Eric Dumazet <edumazet at google.com>
Reported-by: Dmitry Vyukov <dvyukov at google.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit 33cf84ba8c25b40c7de52029efc8d4372725c95f
Author: Ani Sinha <ani at arista.com>
Date: Fri Oct 30 16:54:31 2015 -0700
ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.
[ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ]
Fixes the following kernel BUG :
BUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758
caller is __this_cpu_preempt_check+0x13/0x15
CPU: 0 PID: 2758 Comm: bash Tainted: P O 3.18.19 #2
ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000
0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800
ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8
Call Trace:
[<ffffffff81482b2a>] dump_stack+0x52/0x80
[<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1
[<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15
[<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c
[<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e
[<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810e6974>] ? pollwake+0x4d/0x51
[<ffffffff81058ac0>] ? default_wake_function+0x0/0xf
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810613d9>] ? __wake_up_common+0x45/0x77
[<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32
[<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53
[<ffffffff8139a519>] ? sock_def_readable+0x71/0x75
[<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55
[<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41
[<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86
[<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d
[<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b
[<ffffffff810d5738>] ? new_sync_read+0x82/0xaa
[<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99
[<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32
[<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f
[<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf
[<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3
[<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e
Signed-off-by: Ani Sinha <ani at arista.com>
Acked-by: Eric Dumazet <edumazet at google.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
[bwh: Backported to 3.2: ipmr doesn't implement IPSTATS_MIB_OUTOCTETS]
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit f114d9374ba3e42c86b112c8b4dbcba50a7330e7
Author: Sowmini Varadhan <sowmini.varadhan at oracle.com>
Date: Mon Oct 26 12:46:37 2015 -0400
RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv
[ Upstream commit 8ce675ff39b9958d1c10f86cf58e357efaafc856 ]
Either of pskb_pull() or pskb_trim() may fail under low memory conditions.
If rds_tcp_data_recv() ignores such failures, the application will
receive corrupted data because the skb has not been correctly
carved to the RDS datagram size.
Avoid this by handling pskb_pull/pskb_trim failure in the same
manner as the skb_clone failure: bail out of rds_tcp_data_recv(), and
retry via the deferred call to rds_send_worker() that gets set up on
ENOMEM from rds_tcp_read_sock()
Signed-off-by: Sowmini Varadhan <sowmini.varadhan at oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar at oracle.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit a8ab3e639d481658fc9da76de80485a5247c3a68
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date: Mon Oct 19 13:16:49 2015 +0300
irda: precedence bug in irlmp_seq_hb_idx()
[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ]
This is decrementing the pointer, instead of the value stored in the
pointer. KASan detects it as an out of bounds reference.
Reported-by: "Berry Cheng 程å›(æˆæ·¼)" <chengmiao.cj at alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit b208d27d457678cab6584d29c1db827a696c7f2b
Author: Jann Horn <jann at thejh.net>
Date: Wed Sep 9 15:38:28 2015 -0700
fs: if a coredump already exists, unlink and recreate with O_EXCL
commit fbb1816942c04429e85dbf4c1a080accc534299e upstream.
It was possible for an attacking user to trick root (or another user) into
writing his coredumps into an attacker-readable, pre-existing file using
rename() or link(), causing the disclosure of secret data from the victim
process' virtual memory. Depending on the configuration, it was also
possible to trick root into overwriting system files with coredumps. Fix
that issue by never writing coredumps into existing files.
Requirements for the attack:
- The attack only applies if the victim's process has a nonzero
RLIMIT_CORE and is dumpable.
- The attacker can trick the victim into coredumping into an
attacker-writable directory D, either because the core_pattern is
relative and the victim's cwd is attacker-writable or because an
absolute core_pattern pointing to a world-writable directory is used.
- The attacker has one of these:
A: on a system with protected_hardlinks=0:
execute access to a folder containing a victim-owned,
attacker-readable file on the same partition as D, and the
victim-owned file will be deleted before the main part of the attack
takes place. (In practice, there are lots of files that fulfill
this condition, e.g. entries in Debian's /var/lib/dpkg/info/.)
This does not apply to most Linux systems because most distros set
protected_hardlinks=1.
B: on a system with protected_hardlinks=1:
execute access to a folder containing a victim-owned,
attacker-readable and attacker-writable file on the same partition
as D, and the victim-owned file will be deleted before the main part
of the attack takes place.
(This seems to be uncommon.)
C: on any system, independent of protected_hardlinks:
write access to a non-sticky folder containing a victim-owned,
attacker-readable file on the same partition as D
(This seems to be uncommon.)
The basic idea is that the attacker moves the victim-owned file to where
he expects the victim process to dump its core. The victim process dumps
its core into the existing file, and the attacker reads the coredump from
it.
If the attacker can't move the file because he does not have write access
to the containing directory, he can instead link the file to a directory
he controls, then wait for the original link to the file to be deleted
(because the kernel checks that the link count of the corefile is 1).
A less reliable variant that requires D to be non-sticky works with link()
and does not require deletion of the original link: link() the file into
D, but then unlink() it directly before the kernel performs the link count
check.
On systems with protected_hardlinks=0, this variant allows an attacker to
not only gain information from coredumps, but also clobber existing,
victim-writable files with coredumps. (This could theoretically lead to a
privilege escalation.)
Signed-off-by: Jann Horn <jann at thejh.net>
Cc: Kees Cook <keescook at chromium.org>
Cc: Al Viro <viro at zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit 0677d4e0ba08de16967336dfecd45ade5b010057
Author: Kees Cook <keescook at chromium.org>
Date: Mon Jul 30 14:39:15 2012 -0700
fs: make dumpable=2 require fully qualified path
commit 9520628e8ceb69fa9a4aee6b57f22675d9e1b709 upstream.
When the suid_dumpable sysctl is set to "2", and there is no core dump
pipe defined in the core_pattern sysctl, a local user can cause core files
to be written to root-writable directories, potentially with
user-controlled content.
This means an admin can unknowningly reintroduce a variation of
CVE-2006-2451, allowing local users to gain root privileges.
$ cat /proc/sys/fs/suid_dumpable
2
$ cat /proc/sys/kernel/core_pattern
core
$ ulimit -c unlimited
$ cd /
$ ls -l core
ls: cannot access core: No such file or directory
$ touch core
touch: cannot touch `core': Permission denied
$ OHAI="evil-string-here" ping localhost >/dev/null 2>&1 &
$ pid=$!
$ sleep 1
$ kill -SEGV $pid
$ ls -l core
-rw------- 1 root kees 458752 Jun 21 11:35 core
$ sudo strings core | grep evil
OHAI=evil-string-here
While cron has been fixed to abort reading a file when there is any
parse error, there are still other sensitive directories that will read
any file present and skip unparsable lines.
Instead of introducing a suid_dumpable=3 mode and breaking all users of
mode 2, this only disables the unsafe portion of mode 2 (writing to disk
via relative path). Most users of mode 2 (e.g. Chrome OS) already use
a core dump pipe handler, so this change will not break them. For the
situations where a pipe handler is not defined but mode 2 is still
active, crash dumps will only be written to fully qualified paths. If a
relative path is defined (e.g. the default "core" pattern), dump
attempts will trigger a printk yelling about the lack of a fully
qualified path.
Signed-off-by: Kees Cook <keescook at chromium.org>
Cc: Alexander Viro <viro at zeniv.linux.org.uk>
Cc: Alan Cox <alan at linux.intel.com>
Cc: "Eric W. Biederman" <ebiederm at xmission.com>
Cc: Doug Ledford <dledford at redhat.com>
Cc: Serge Hallyn <serge.hallyn at canonical.com>
Cc: James Morris <james.l.morris at oracle.com>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
Reviewed-by: James Morris <james.l.morris at oracle.com>
commit beebd9fa9d8aeb8f1a3028acc1987c808b601e7d
Author: Maciej W. Rozycki <macro at imgtec.com>
Date: Mon Oct 26 15:48:19 2015 +0000
binfmt_elf: Don't clobber passed executable's file header
commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream.
Do not clobber the buffer space passed from `search_binary_handler' and
originally preloaded by `prepare_binprm' with the executable's file
header by overwriting it with its interpreter's file header. Instead
keep the buffer space intact and directly use the data structure locally
allocated for the interpreter's file header, fixing a bug introduced in
2.1.14 with loadable module support (linux-mips.org commit beb11695
[Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).
Adjust the amount of data read from the interpreter's file accordingly.
This was not an issue before loadable module support, because back then
`load_elf_binary' was executed only once for a given ELF executable,
whether the function succeeded or failed.
With loadable module support supported and enabled, upon a failure of
`load_elf_binary' -- which may for example be caused by architecture
code rejecting an executable due to a missing hardware feature requested
in the file header -- a module load is attempted and then the function
reexecuted by `search_binary_handler'. With the executable's file
header replaced with its interpreter's file header the executable can
then be erroneously accepted in this subsequent attempt.
Signed-off-by: Maciej W. Rozycki <macro at imgtec.com>
Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit cf1857234d83095c437e2cc8346e5a2783667cf1
Author: David Howells <dhowells at redhat.com>
Date: Wed Nov 4 15:20:42 2015 +0000
FS-Cache: Handle a write to the page immediately beyond the EOF marker
commit 102f4d900c9c8f5ed89ae4746d493fe3ebd7ba64 upstream.
Handle a write being requested to the page immediately beyond the EOF
marker on a cache object. Currently this gets an assertion failure in
CacheFiles because the EOF marker is used there to encode information about
a partial page at the EOF - which could lead to an unknown blank spot in
the file if we extend the file over it.
The problem is actually in fscache where we check the index of the page
being written against store_limit. store_limit is set to the number of
pages that we're allowed to store by fscache_set_store_limit() - which
means it's one more than the index of the last page we're allowed to store.
The problem is that we permit writing to a page with an index _equal_ to
the store limit - when we should reject that case.
Whilst we're at it, change the triggered assertion in CacheFiles to just
return -ENOBUFS instead.
The assertion failure looks something like this:
CacheFiles: Assertion failed
1000 < 7b1 is false
------------[ cut here ]------------
kernel BUG at fs/cachefiles/rdwr.c:962!
...
RIP: 0010:[<ffffffffa02c9e83>] [<ffffffffa02c9e83>] cachefiles_write_page+0x273/0x2d0 [cachefiles]
Signed-off-by: David Howells <dhowells at redhat.com>
Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
[bwh: Backported to 3.2: we don't have __kernel_write() so keep using the
open-coded equivalent]
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit 8f2746bba547a5dc23edf74b6006a0a593dfc08f
Author: Kinglong Mee <kinglongmee at gmail.com>
Date: Wed Nov 4 15:20:24 2015 +0000
FS-Cache: Don't override netfs's primary_index if registering failed
commit b130ed5998e62879a66bad08931a2b5e832da95c upstream.
Only override netfs->primary_index when registering success.
Signed-off-by: Kinglong Mee <kinglongmee at gmail.com>
Signed-off-by: David Howells <dhowells at redhat.com>
Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
[bwh: Backported to 3.2: no n_active or flags fields in fscache_cookie]
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit bdb28a40d4d09250d442c03ffe1dfe6e88126c0a
Author: Kinglong Mee <kinglongmee at gmail.com>
Date: Wed Nov 4 15:20:15 2015 +0000
FS-Cache: Increase reference of parent after registering, netfs success
commit 86108c2e34a26e4bec3c6ddb23390bf8cedcf391 upstream.
If netfs exist, fscache should not increase the reference of parent's
usage and n_children, otherwise, never be decreased.
v2: thanks David's suggest,
move increasing reference of parent if success
use kmem_cache_free() freeing primary_index directly
v3: don't move "netfs->primary_index->parent = &fscache_fsdef_index;"
Signed-off-by: Kinglong Mee <kinglongmee at gmail.com>
Signed-off-by: David Howells <dhowells at redhat.com>
Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
commit b42506c6c820764f26e3036dfd733e0401525c88
Author: Paolo Bonzini <pbonzini at redhat.com>
Date: Tue Nov 10 09:14:39 2015 +0100
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 88fd7f5..b318a78 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -163,16 +163,22 @@ This value can be used to query and set the core dump mode for setuid
or otherwise protected/tainted binaries. The modes are
0 - (default) - traditional behaviour. Any process which has changed
- privilege levels or is execute only will not be dumped
+ privilege levels or is execute only will not be dumped.
1 - (debug) - all processes dump core when possible. The core dump is
owned by the current user and no security is applied. This is
intended for system debugging situations only. Ptrace is unchecked.
+ This is insecure as it allows regular users to examine the memory
+ contents of privileged processes.
2 - (suidsafe) - any binary which normally would not be dumped is dumped
- readable by root only. This allows the end user to remove
- such a dump but not access it directly. For security reasons
- core dumps in this mode will not overwrite one another or
- other files. This mode is appropriate when administrators are
- attempting to debug problems in a normal environment.
+ anyway, but only if the "core_pattern" kernel sysctl is set to
+ either a pipe handler or a fully qualified path. (For more details
+ on this limitation, see CVE-2006-2451.) This mode is appropriate
+ when administrators are attempting to debug problems in a normal
+ environment, and either have a core dump pipe handler that knows
+ to treat privileged core dumps with care, or specific directory
+ defined for catching core dumps. If a core dump happens without
+ a pipe handler or fully qualifid path, a message will be emitted
+ to syslog warning about the lack of a correct setting.
==============================================================
diff --git a/Makefile b/Makefile
index 77ac417..89a7d05 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
VERSION = 3
PATCHLEVEL = 2
-SUBLEVEL = 72
+SUBLEVEL = 74
EXTRAVERSION =
NAME = Saber-toothed Squirrel
diff --git a/arch/arm/mach-pxa/include/mach/pxa27x.h b/arch/arm/mach-pxa/include/mach/pxa27x.h
index 7cff640..66c4cbf 100644
--- a/arch/arm/mach-pxa/include/mach/pxa27x.h
+++ b/arch/arm/mach-pxa/include/mach/pxa27x.h
@@ -21,7 +21,7 @@
extern void __init pxa27x_map_io(void);
extern void __init pxa27x_init_irq(void);
-extern int __init pxa27x_set_pwrmode(unsigned int mode);
+extern int pxa27x_set_pwrmode(unsigned int mode);
extern void pxa27x_cpu_pm_enter(suspend_state_t state);
#define pxa27x_handle_irq ichp_handle_irq
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index a9447f9..f7510b1 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -241,7 +241,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
*/
static unsigned int pwrmode = PWRMODE_SLEEP;
-int __init pxa27x_set_pwrmode(unsigned int mode)
+int pxa27x_set_pwrmode(unsigned int mode)
{
switch (mode) {
case PWRMODE_SLEEP:
diff --git a/arch/m68k/include/asm/linkage.h b/arch/m68k/include/asm/linkage.h
index 5a822bb..066e74f 100644
--- a/arch/m68k/include/asm/linkage.h
+++ b/arch/m68k/include/asm/linkage.h
@@ -4,4 +4,34 @@
#define __ALIGN .align 4
#define __ALIGN_STR ".align 4"
+/*
+ * Make sure the compiler doesn't do anything stupid with the
+ * arguments on the stack - they are owned by the *caller*, not
+ * the callee. This just fools gcc into not spilling into them,
+ * and keeps it from doing tailcall recursion and/or using the
+ * stack slots for temporaries, since they are live and "used"
+ * all the way to the end of the function.
+ */
+#define asmlinkage_protect(n, ret, args...) \
+ __asmlinkage_protect##n(ret, ##args)
+#define __asmlinkage_protect_n(ret, args...) \
+ __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
+#define __asmlinkage_protect0(ret) \
+ __asmlinkage_protect_n(ret)
+#define __asmlinkage_protect1(ret, arg1) \
+ __asmlinkage_protect_n(ret, "m" (arg1))
+#define __asmlinkage_protect2(ret, arg1, arg2) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2))
+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3))
+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4))
+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4), "m" (arg5))
+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4), "m" (arg5), "m" (arg6))
+
#endif
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 1d93f81..9d4581d 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -679,7 +679,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
* @u: ...unless v is equal to u.
*
* Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
+ * Returns true iff @v was not @u.
*/
static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
{
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 4608491..2bc2802 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -67,7 +67,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
else
#endif
#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
dma_flag = __GFP_DMA;
else
#endif
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 434a180..17dbd34 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -992,6 +992,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (!rtas.entry)
+ return -EINVAL;
+
if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
return -EFAULT;
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 93ce7e4..51f85fc 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -83,6 +83,7 @@
#define GP_VECTOR 13
#define PF_VECTOR 14
#define MF_VECTOR 16
+#define AC_VECTOR 17
#define MC_VECTOR 18
#define SELECTOR_TI_MASK (1 << 2)
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index e11e394..0f8ebf7 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -63,6 +63,9 @@ startup_64:
* tables and then reload them.
*/
+ /* Sanitize CPU configuration */
+ call verify_cpu
+
/* Compute the delta between the address I am compiled to run at and the
* address I am actually running at.
*/
@@ -160,6 +163,9 @@ ENTRY(secondary_startup_64)
* after the boot processor executes this code.
*/
+ /* Sanitize CPU configuration */
+ call verify_cpu
+
/* Enable PAE mode and PGE */
movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
movq %rax, %cr4
@@ -253,6 +259,8 @@ ENTRY(secondary_startup_64)
pushq %rax # target address in negative space
lretq
+#include "verify_cpu.S"
+
/* SMP bootup changes these two */
__REFDATA
.align 8
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 7e94abd..aaab32e 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -555,27 +555,59 @@ void set_personality_ia32(void)
current_thread_info()->status |= TS_COMPAT;
}
+/*
+ * Called from fs/proc with a reference on @p to find the function
+ * which called into schedule(). This needs to be done carefully
+ * because the task might wake up and we might look at a stack
+ * changing under us.
+ */
unsigned long get_wchan(struct task_struct *p)
{
- unsigned long stack;
- u64 fp, ip;
+ unsigned long start, bottom, top, sp, fp, ip;
int count = 0;
if (!p || p == current || p->state == TASK_RUNNING)
return 0;
- stack = (unsigned long)task_stack_page(p);
- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+
+ start = (unsigned long)task_stack_page(p);
+ if (!start)
+ return 0;
+
+ /*
+ * Layout of the stack page:
+ *
+ * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
+ * PADDING
+ * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
+ * stack
+ * ----------- bottom = start + sizeof(thread_info)
+ * thread_info
+ * ----------- start
+ *
+ * The tasks stack pointer points at the location where the
+ * framepointer is stored. The data on the stack is:
+ * ... IP FP ... IP FP
+ *
+ * We need to read FP and IP, so we need to adjust the upper
+ * bound by another unsigned long.
+ */
+ top = start + THREAD_SIZE;
+ top -= 2 * sizeof(unsigned long);
+ bottom = start + sizeof(struct thread_info);
+
+ sp = ACCESS_ONCE(p->thread.sp);
+ if (sp < bottom || sp > top)
return 0;
- fp = *(u64 *)(p->thread.sp);
+
+ fp = ACCESS_ONCE(*(unsigned long *)sp);
do {
- if (fp < (unsigned long)stack ||
- fp >= (unsigned long)stack+THREAD_SIZE)
+ if (fp < bottom || fp > top)
return 0;
- ip = *(u64 *)(fp+8);
+ ip = ACCESS_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
if (!in_sched_functions(ip))
return ip;
- fp = *(u64 *)fp;
- } while (count++ < 16);
+ fp = ACCESS_ONCE(*(unsigned long *)fp);
+ } while (count++ < 16 && p->state != TASK_RUNNING);
return 0;
}
diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
index b9242ba..4cf401f 100644
--- a/arch/x86/kernel/verify_cpu.S
+++ b/arch/x86/kernel/verify_cpu.S
@@ -34,10 +34,11 @@
#include <asm/msr-index.h>
verify_cpu:
- pushfl # Save caller passed flags
- pushl $0 # Kill any dangerous flags
- popfl
+ pushf # Save caller passed flags
+ push $0 # Kill any dangerous flags
+ popf
+#ifndef __x86_64__
pushfl # standard way to check for cpuid
popl %eax
movl %eax,%ebx
@@ -48,6 +49,7 @@ verify_cpu:
popl %eax
cmpl %eax,%ebx
jz verify_cpu_no_longmode # cpu has no cpuid
+#endif
movl $0x0,%eax # See if cpuid 1 is implemented
cpuid
@@ -130,10 +132,10 @@ verify_cpu_sse_test:
jmp verify_cpu_sse_test # try again
verify_cpu_no_longmode:
- popfl # Restore caller passed flags
+ popf # Restore caller passed flags
movl $1,%eax
ret
verify_cpu_sse_ok:
- popfl # Restore caller passed flags
+ popf # Restore caller passed flags
xorl %eax, %eax
ret
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index cac7b2b..4a949c7 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -326,6 +326,12 @@ static u64 __get_spte_lockless(u64 *sptep)
{
return ACCESS_ONCE(*sptep);
}
+
+static bool __check_direct_spte_mmio_pf(u64 spte)
+{
+ /* It is valid if the spte is zapped. */
+ return spte == 0ull;
+}
#else
union split_spte {
struct {
@@ -430,6 +436,23 @@ retry:
return spte.spte;
}
+
+static bool __check_direct_spte_mmio_pf(u64 spte)
+{
+ union split_spte sspte = (union split_spte)spte;
+ u32 high_mmio_mask = shadow_mmio_mask >> 32;
+
+ /* It is valid if the spte is zapped. */
+ if (spte == 0ull)
+ return true;
+
+ /* It is valid if the spte is being zapped. */
+ if (sspte.spte_low == 0ull &&
+ (sspte.spte_high & high_mmio_mask) == high_mmio_mask)
+ return true;
+
+ return false;
+}
#endif
static bool spte_has_volatile_bits(u64 spte)
@@ -2872,6 +2895,21 @@ static bool quickly_check_mmio_pf(struct kvm_vcpu *vcpu, u64 addr, bool direct)
return vcpu_match_mmio_gva(vcpu, addr);
}
+
+/*
+ * On direct hosts, the last spte is only allows two states
+ * for mmio page fault:
+ * - It is the mmio spte
+ * - It is zapped or it is being zapped.
+ *
+ * This function completely checks the spte when the last spte
+ * is not the mmio spte.
+ */
+static bool check_direct_spte_mmio_pf(u64 spte)
+{
+ return __check_direct_spte_mmio_pf(spte);
+}
+
static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr)
{
struct kvm_shadow_walk_iterator iterator;
@@ -2913,6 +2951,13 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct)
}
/*
+ * It's ok if the gva is remapped by other cpus on shadow guest,
+ * it's a BUG if the gfn is not a mmio page.
+ */
+ if (direct && !check_direct_spte_mmio_pf(spte))
+ return -1;
+
+ /*
* If the page table is zapped by other cpus, let CPU fault again on
* the address.
*/
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 7a2d9d6..ff3535a 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1014,6 +1014,8 @@ static void init_vmcb(struct vcpu_svm *svm)
set_exception_intercept(svm, PF_VECTOR);
set_exception_intercept(svm, UD_VECTOR);
set_exception_intercept(svm, MC_VECTOR);
+ set_exception_intercept(svm, AC_VECTOR);
+ set_exception_intercept(svm, DB_VECTOR);
set_intercept(svm, INTERCEPT_INTR);
set_intercept(svm, INTERCEPT_NMI);
@@ -1549,20 +1551,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
mark_dirty(svm->vmcb, VMCB_SEG);
}
-static void update_db_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
- clr_exception_intercept(svm, DB_VECTOR);
clr_exception_intercept(svm, BP_VECTOR);
- if (svm->nmi_singlestep)
- set_exception_intercept(svm, DB_VECTOR);
-
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
- if (vcpu->guest_debug &
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
- set_exception_intercept(svm, DB_VECTOR);
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
set_exception_intercept(svm, BP_VECTOR);
} else
@@ -1580,7 +1575,7 @@ static void svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_guest_debug *dbg)
mark_dirty(svm->vmcb, VMCB_DR);
- update_db_intercept(vcpu);
+ update_bp_intercept(vcpu);
}
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
@@ -1654,7 +1649,6 @@ static int db_interception(struct vcpu_svm *svm)
if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
svm->vmcb->save.rflags &=
~(X86_EFLAGS_TF | X86_EFLAGS_RF);
- update_db_intercept(&svm->vcpu);
}
if (svm->vcpu.guest_debug &
@@ -1689,6 +1683,12 @@ static int ud_interception(struct vcpu_svm *svm)
return 1;
}
+static int ac_interception(struct vcpu_svm *svm)
+{
+ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
+ return 1;
+}
+
static void svm_fpu_activate(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
@@ -3188,6 +3188,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm) = {
[SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception,
[SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception,
[SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception,
+ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception,
[SVM_EXIT_INTR] = intr_interception,
[SVM_EXIT_NMI] = nmi_interception,
[SVM_EXIT_SMI] = nop_on_interception,
@@ -3549,7 +3550,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
*/
svm->nmi_singlestep = true;
svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
- update_db_intercept(vcpu);
}
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 911d264..7216916 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -244,6 +244,7 @@ TRACE_EVENT(kvm_apic,
{ SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \
{ SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \
{ SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \
+ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \
{ SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \
{ SVM_EXIT_INTR, "interrupt" }, \
{ SVM_EXIT_NMI, "nmi" }, \
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 421958f..fb8c23d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1171,7 +1171,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
u32 eb;
eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
- (1u << NM_VECTOR) | (1u << DB_VECTOR);
+ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
if ((vcpu->guest_debug &
(KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
(KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
@@ -4266,6 +4266,9 @@ static int handle_exception(struct kvm_vcpu *vcpu)
ex_no = intr_info & INTR_INFO_VECTOR_MASK;
switch (ex_no) {
+ case AC_VECTOR:
+ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+ return 1;
case DB_VECTOR:
dr6 = vmcs_readl(EXIT_QUALIFICATION);
if (!(vcpu->guest_debug &
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 4d54b38..3c7b70d 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -273,7 +273,7 @@ char * __init xen_memory_setup(void)
xen_ignore_unusable(map, memmap.nr_entries);
/* Make sure the Xen-supplied memory map is well-ordered. */
- sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
+ sanitize_e820_map(map, ARRAY_SIZE(map), &memmap.nr_entries);
max_pages = xen_get_max_pages();
if (max_pages > max_pfn)
diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 9f73037..d53a30b 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -700,7 +700,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name,
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
diff --git a/crypto/ahash.c b/crypto/ahash.c
index 7fe1752..96c8e7c 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -462,7 +462,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg)
struct crypto_alg *base = &alg->halg.base;
if (alg->halg.digestsize > PAGE_SIZE / 8 ||
- alg->halg.statesize > PAGE_SIZE / 8)
+ alg->halg.statesize > PAGE_SIZE / 8 ||
+ alg->halg.statesize == 0)
return -EINVAL;
base->cra_type = &crypto_ahash_type;
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 3b9ef92..5593afd 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -342,7 +342,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval)
crypto_alg_tested(larval->alg.cra_driver_name, 0);
}
- err = wait_for_completion_interruptible(&larval->completion);
+ err = wait_for_completion_killable(&larval->completion);
WARN_ON(err);
out:
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 8502462..a68b56a 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -192,9 +192,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
struct sock *sk2;
struct alg_sock *ask2;
struct hash_ctx *ctx2;
+ bool more;
int err;
- err = crypto_ahash_export(req, state);
+ lock_sock(sk);
+ more = ctx->more;
+ err = more ? crypto_ahash_export(req, state) : 0;
+ release_sock(sk);
+
if (err)
return err;
@@ -205,7 +210,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
sk2 = newsock->sk;
ask2 = alg_sk(sk2);
ctx2 = ask2->private;
- ctx2->more = 1;
+ ctx2->more = more;
+
+ if (!more)
+ return err;
err = crypto_ahash_import(&ctx2->req, state);
if (err) {
diff --git a/crypto/api.c b/crypto/api.c
index ac80794..a5547fb 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -178,7 +178,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)
struct crypto_larval *larval = (void *)alg;
long timeout;
- timeout = wait_for_completion_interruptible_timeout(
+ timeout = wait_for_completion_killable_timeout(
&larval->completion, 60 * HZ);
alg = larval->adult;
@@ -441,7 +441,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
@@ -558,7 +558,7 @@ void *crypto_alloc_tfm(const char *alg_name,
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 7be7aa6..ec965de 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -82,6 +82,7 @@ static struct workqueue_struct *kacpid_wq;
static struct workqueue_struct *kacpi_notify_wq;
struct workqueue_struct *kacpi_hotplug_wq;
EXPORT_SYMBOL(kacpi_hotplug_wq);
+unsigned int acpi_sci_irq = INVALID_ACPI_IRQ;
struct acpi_res_list {
resource_size_t start;
@@ -566,17 +567,19 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_handler handler,
acpi_irq_handler = NULL;
return AE_NOT_ACQUIRED;
}
+ acpi_sci_irq = irq;
return AE_OK;
}
-acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler handler)
+acpi_status acpi_os_remove_interrupt_handler(u32 gsi, acpi_osd_handler handler)
{
- if (irq != acpi_gbl_FADT.sci_interrupt)
+ if (gsi != acpi_gbl_FADT.sci_interrupt || !acpi_sci_irq_valid())
return AE_BAD_PARAMETER;
- free_irq(irq, acpi_irq);
+ free_irq(acpi_sci_irq, acpi_irq);
acpi_irq_handler = NULL;
+ acpi_sci_irq = INVALID_ACPI_IRQ;
return AE_OK;
}
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index cd252e0..a7197e4 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -23,8 +23,7 @@ static struct dentry *regmap_debugfs_root;
/* Calculate the length of a fixed format */
static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
{
- snprintf(buf, buf_size, "%x", max_val);
- return strlen(buf);
+ return snprintf(NULL, 0, "%x", max_val);
}
static int regmap_open_file(struct inode *inode, struct file *file)
@@ -140,7 +139,7 @@ static ssize_t regmap_access_read_file(struct file *file,
/* If we're in the region the user is trying to read */
if (p >= *ppos) {
/* ...but not beyond it */
- if (buf_pos >= count - 1 - tot_len)
+ if (buf_pos + tot_len + 1 >= count)
break;
/* Format the register */
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 96b8cb7..857f363 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1292,7 +1292,8 @@ static void blkback_changed(struct xenbus_device *dev,
break;
/* Missed the backend's Closing state -- fallthrough */
case XenbusStateClosing:
- blkfront_closing(info);
+ if (info)
+ blkfront_closing(info);
break;
}
}
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index e9e8f3b..9fb9287 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -90,6 +90,7 @@ static struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x04CA, 0x300f) },
{ USB_DEVICE(0x04CA, 0x3010) },
{ USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0930, 0x021c) },
{ USB_DEVICE(0x0930, 0x0220) },
{ USB_DEVICE(0x0930, 0x0227) },
{ USB_DEVICE(0x0b05, 0x17d0) },
@@ -101,6 +102,7 @@ static struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x0CF3, 0x311F) },
{ USB_DEVICE(0x0cf3, 0x3121) },
{ USB_DEVICE(0x0CF3, 0x817a) },
+ { USB_DEVICE(0x0CF3, 0x817b) },
{ USB_DEVICE(0x0cf3, 0xe003) },
{ USB_DEVICE(0x0CF3, 0xE004) },
{ USB_DEVICE(0x0CF3, 0xE005) },
@@ -148,6 +150,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
@@ -159,6 +162,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0CF3, 0x817b), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c5e400b..d83c855 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -175,6 +175,7 @@ static struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
@@ -186,6 +187,7 @@ static struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 0a0225a..e6624c6 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -3547,6 +3547,11 @@ static int __devinit pci_probe(struct pci_dev *dev,
reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
+ /* JMicron JMB38x often shows 0 at first read, just ignore it */
+ if (!ohci->it_context_support) {
+ fw_notify("overriding IsoXmitIntMask\n");
+ ohci->it_context_support = 0xf;
+ }
reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
ohci->it_context_mask = ohci->it_context_support;
ohci->n_it = hweight32(ohci->it_context_mask);
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index bd0b1fc..fc64ad0 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -172,11 +172,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
struct nouveau_bo *nvbo = nouveau_gem_object(gem);
struct nouveau_vma *vma;
- if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+ if (is_power_of_2(nvbo->valid_domains))
+ rep->domain = nvbo->valid_domains;
+ else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
rep->domain = NOUVEAU_GEM_DOMAIN_GART;
else
rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
-
rep->offset = nvbo->bo.offset;
if (fpriv->vm) {
vma = nouveau_bo_vma_find(nvbo, fpriv->vm);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 64d79d2..61660f8 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1295,7 +1295,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
"Multi-Axis Controller"
};
const char *type, *bus;
- char buf[64];
+ char buf[64] = "";
unsigned int i;
int len;
int ret;
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 8b72f39..722a893 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -856,6 +856,11 @@ retest:
case IB_CM_SIDR_REQ_RCVD:
spin_unlock_irq(&cm_id_priv->lock);
cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+ spin_lock_irq(&cm.lock);
+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
+ rb_erase(&cm_id_priv->sidr_id_node,
+ &cm.remote_sidr_table);
+ spin_unlock_irq(&cm.lock);
break;
case IB_CM_REQ_SENT:
ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
@@ -3092,7 +3097,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
spin_unlock_irqrestore(&cm_id_priv->lock, flags);
spin_lock_irqsave(&cm.lock, flags);
- rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
+ rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+ RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
+ }
spin_unlock_irqrestore(&cm.lock, flags);
return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index d3da166..41b7464 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1798,13 +1798,20 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
return -ENOMEM;
/* It is large page*/
if (largepage_lvl > 1) {
+ unsigned long nr_superpages, end_pfn, lvl_pages;
+
pteval |= DMA_PTE_LARGE_PAGE;
- /* Ensure that old small page tables are removed to make room
- for superpage, if they exist. */
- dma_pte_clear_range(domain, iov_pfn,
- iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
- dma_pte_free_pagetable(domain, iov_pfn,
- iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
+ lvl_pages = lvl_to_nr_pages(largepage_lvl);
+
+ nr_superpages = sg_res / lvl_pages;
+ end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
+
+ /*
+ * Ensure that old small page tables are
+ * removed to make room for superpage(s).
+ */
+ dma_pte_clear_range(domain, iov_pfn, end_pfn);
+ dma_pte_free_pagetable(domain, iov_pfn, end_pfn);
} else {
pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
}
@@ -3565,10 +3572,15 @@ found:
for (bus = dev->bus; bus; bus = bus->parent) {
struct pci_dev *bridge = bus->self;
- if (!bridge || !pci_is_pcie(bridge) ||
+ /* If it's an integrated device, allow ATS */
+ if (!bridge)
+ return 1;
+ /* Connected via non-PCIe: no ATS */
+ if (!pci_is_pcie(bridge) ||
bridge->pcie_type == PCI_EXP_TYPE_PCI_BRIDGE)
return 0;
+ /* If we found the root port, look it up in the ATSR */
if (bridge->pcie_type == PCI_EXP_TYPE_ROOT_PORT) {
for (i = 0; i < atsru->devices_cnt; i++)
if (atsru->devices[i] == bridge)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d7e9242..0914534 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7895,6 +7895,7 @@ int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
/* Make sure they get written out promptly */
sysfs_notify_dirent_safe(rdev->sysfs_state);
set_bit(MD_CHANGE_CLEAN, &rdev->mddev->flags);
+ set_bit(MD_CHANGE_PENDING, &rdev->mddev->flags);
md_wakeup_thread(rdev->mddev->thread);
}
return rv;
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index 294eb5b..f77692b 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
{
int s;
uint32_t max_entries = le32_to_cpu(left->header.max_entries);
- unsigned target = (nr_left + nr_center + nr_right) / 3;
- BUG_ON(target > max_entries);
+ unsigned total = nr_left + nr_center + nr_right;
+ unsigned target_right = total / 3;
+ unsigned remainder = (target_right * 3) != total;
+ unsigned target_left = target_right + remainder;
+
+ BUG_ON(target_left > max_entries);
+ BUG_ON(target_right > max_entries);
if (nr_left < nr_right) {
- s = nr_left - target;
+ s = nr_left - target_left;
if (s < 0 && nr_center < -s) {
/* not enough in central node */
@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
} else
shift(left, center, s);
- shift(center, right, target - nr_right);
+ shift(center, right, target_right - nr_right);
} else {
- s = target - nr_right;
+ s = target_right - nr_right;
if (s > 0 && nr_center < s) {
/* not enough in central node */
shift(center, right, nr_center);
@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
} else
shift(center, right, s);
- shift(left, center, nr_left - target);
+ shift(left, center, nr_left - target_left);
}
*key_ptr(parent, c->index) = center->keys[0];
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 62f297a..29e423f 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -503,7 +503,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
r = new_block(s->info, &right);
if (r < 0) {
- /* FIXME: put left */
+ unlock_block(s->info, left);
return r;
}
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index d3e6f35..c0b4a21 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -88,6 +88,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
char b[BDEVNAME_SIZE];
char b2[BDEVNAME_SIZE];
struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
+ unsigned short blksize = 512;
if (!conf)
return -ENOMEM;
@@ -102,6 +103,9 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
sector_div(sectors, mddev->chunk_sectors);
rdev1->sectors = sectors * mddev->chunk_sectors;
+ blksize = max(blksize, queue_logical_block_size(
+ rdev1->bdev->bd_disk->queue));
+
list_for_each_entry(rdev2, &mddev->disks, same_set) {
pr_debug("md/raid0:%s: comparing %s(%llu)"
" with %s(%llu)\n",
@@ -138,6 +142,18 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
}
pr_debug("md/raid0:%s: FINAL %d zones\n",
mdname(mddev), conf->nr_strip_zones);
+ /*
+ * now since we have the hard sector sizes, we can make sure
+ * chunk size is a multiple of that sector size
+ */
+ if ((mddev->chunk_sectors << 9) % blksize) {
+ printk(KERN_ERR "md/raid0:%s: chunk_size of %d not multiple of block size %d\n",
+ mdname(mddev),
+ mddev->chunk_sectors << 9, blksize);
+ err = -EINVAL;
+ goto abort;
+ }
+
err = -ENOMEM;
conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
conf->nr_strip_zones, GFP_KERNEL);
@@ -186,8 +202,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
}
dev[j] = rdev1;
- disk_stack_limits(mddev->gendisk, rdev1->bdev,
- rdev1->data_offset << 9);
/* as we don't honour merge_bvec_fn, we must never risk
* violating it, so limit ->max_segments to 1, lying within
* a single page.
@@ -263,21 +277,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
mddev->queue->backing_dev_info.congested_fn = raid0_congested;
mddev->queue->backing_dev_info.congested_data = mddev;
- /*
- * now since we have the hard sector sizes, we can make sure
- * chunk size is a multiple of that sector size
- */
- if ((mddev->chunk_sectors << 9) % queue_logical_block_size(mddev->queue)) {
More information about the unionfs-cvs
mailing list