Based on a patch from Don Howard <dhoward@redhat.com>
When calling write() with a buffer larger than 512 bytes, the
driver's write buffer overflows, allowing to overwrite the EIP and
execute arbitrary code with kernel privileges.
In read(), there exists a similar problem, but coming from the device.
A malicous or buggy device sending more than 512 bytes can overflow
of the driver's read buffer, with the same effects as above.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Harald Welte <laforge@gnumonks.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
specialix, isr have 2 params
pt_regs are no longer the third parameter of isr, call sx_interrupt without
it.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes a possible race that leads to double freeing an idr index.
When the master begin to close, release_dev() is called and then
pty_close() is called:
if (tty->driver->close)
tty->driver->close(tty, filp);
This is done without helding any locks other than BKL. Inside pty_close(),
being a master close, the devpts entry will be removed:
#ifdef CONFIG_UNIX98_PTYS
if (tty->driver == ptm_driver)
devpts_pty_kill(tty->index);
#endif
But devpts_pty_kill() will call get_node() that may sleep while waiting for
&devpts_root->d_inode->i_sem. When this happens and the slave is being
opened, tty_open() just found the driver and index:
driver = get_tty_driver(device, &index);
if (!driver) {
mutex_unlock(&tty_mutex);
return -ENODEV;
}
This part of the code is already protected under tty_mute. The problem is
that the slave close already got an index. Then init_dev() is called and
blocks waiting for the same &devpts_root->d_inode->i_sem.
When the master close resumes, it removes the devpts entry, and the
relation between idr index and the tty is gone. The master then sleeps
waiting for the tty_mutex on release_dev().
Slave open resumes and found no tty for that index. As result, a NULL tty
is returned and init_dev() doesn't flow to fast_track:
/* check whether we're reopening an existing tty */
if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
tty = devpts_get_tty(idx);
if (tty && driver->subtype == PTY_TYPE_MASTER)
tty = tty->link;
} else {
tty = driver->ttys[idx];
}
if (tty) goto fast_track;
The result of this, is that a new tty will be created and init_dev() returns
sucessfull. After returning, tty_mutex is dropped and master close may resume.
Master close finds it's the only use and both sides are closing, then releases
the tty and the index. At this point, the idr index is free, but slave still
has it.
Slave open then calls pty_open() and finds that tty->link->count is 0,
because there's no master and returns error. Then tty_open() calls
release_dev() which executes without any warning, as it was a case of last
slave close when the master is already closed (master->count == 0,
slave->count == 1). The tty is then released with the already released idr
index.
This normally would only issue a warning on idr_remove() but in case of a
customer's critical application, it's never too simple:
thread1: opens master, gets index X
thread1: begin closing master
thread2: begin opening slave with index X
thread1: finishes closing master, index X released
thread3: opens master, gets index X, just released
thread2: fails opening slave, releases index X <----
thread4: opens master, gets index X, init_dev() then find an already in use
and healthy tty and fails
If no more indexes are released, ptmx_open() will keep failing, as the
first free index available is X, and it will make init_dev() fail because
you're trying to "reopen a master" which isn't valid.
The patch notices when this race happens and make init_dev() fail
imediately. The init_dev() function is called with tty_mutex held, so it's
safe to continue with tty till the end of function because release_dev()
won't make any further changes without grabbing the tty_mutex.
Without the patch, on some machines it's possible get easily idr warnings
like this one:
idr_remove called for id=15 which is not allocated.
[<c02555b9>] idr_remove+0x139/0x170
[<c02a1b62>] release_mem+0x182/0x230
[<c02a28e7>] release_dev+0x4b7/0x700
[<c02a0ea7>] tty_ldisc_enable+0x27/0x30
[<c02a1e64>] init_dev+0x254/0x580
[<c02a0d64>] check_tty_count+0x14/0xb0
[<c02a4f05>] tty_open+0x1c5/0x340
[<c02a4d40>] tty_open+0x0/0x340
[<c017388f>] chrdev_open+0xaf/0x180
[<c017c2ac>] open_namei+0x8c/0x760
[<c01737e0>] chrdev_open+0x0/0x180
[<c0167bc9>] __dentry_open+0xc9/0x210
[<c0167e2c>] do_filp_open+0x5c/0x70
[<c0167a91>] get_unused_fd+0x61/0xd0
[<c0167e93>] do_sys_open+0x53/0x100
[<c0167f97>] sys_open+0x27/0x30
[<c010303b>] syscall_call+0x7/0xb
using this test application available on:
http://www.ruivo.org/~aris/pty_sodomizer.c
Signed-off-by: Aristeu Sergio Rozanski Filho <aris@ruivo.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On Sun, Feb 04, 2007 at 04:51:38PM +0100, Eric Piel wrote:
> Hello,
>
> I've got a regression in 2.6.20-rc7 (-rc6 was fine) due to commit
> 4b95320fc4 ([AGPGART] intel_agp: restore
> graphics device's pci space early in resume).
I think the key to this failure is the last line here ..
> agpgart-intel 0000:00:00.0: resuming
> PM: Writing back config space on device 0000:00:02.0 at offset f (was 10b, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset d (was dc, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset b (was 10161025, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset 5 (was f4000000, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset 4 (was f8000008, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset 2 (was 3000011, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset 1 (was 2b00007, writing 0)
> PM: Writing back config space on device 0000:00:02.0 at offset 0 (was 11328086, writing 0)
> agpgart: Unable to remap memory.
This then blows up the next access to intel_i810_private.registers, which happens to
be intel_i810_insert_entries.
Either we need .suspend methods which unmap these regions, or we need
to skip trying to map them a second time on resume.
There's an ugly patch below which does the latter. Give it a try?
The intel-agp suspend/resume code has really grown into something
of a monster, and could use some refactoring in a big way.
Dave
From: Dave Jones <davej@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Change SysRq showBlockedTasks from sysrq-X to sysrq-W and show that in the
Help message.
It was previously done via X, but X is already used for Xmon on ppc & powerpc
platforms and this collision needs to be avoided.
All callers of register_sysrq_key() are now marked in the sysrq op/key table.
I didn't mark 'h' as Help because Help is just printed for any unknown key,
such as '?'.
Added some omitted sysrq key entries in the sysrq.txt file.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix a dangling pointer bug in ipmi_timeout_handler. A list of timedout
messages is not re-initialized before reuse, causing the head of the list
to point to freed memory.
Signed-off-by: David Barksdale <amatus@ocgnet.org>
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
[AGPGART] Add new IDs to VIA AGP.
[AGPGART] Remove pointless assignment.
[AGPGART] Remove pointless typedef in ati-agp
[AGPGART] Prevent (unlikely) memory leak in amd_create_gatt_pages()
[AGPGART] intel_agp: restore graphics device's pci space early in resume
Culled from the VIA codedrop.
Also fixes up one ID used in amd64-agp to use the
VIA part number instead of the board name in its ID.
Signed-off-by: Dave Jones <davej@redhat.com>
This seems to exist just to save people typing 'struct' a few times,
and doesn't provide any additional value.
Signed-off-by: Dave Jones <davej@redhat.com>
If we fail an alloc, unwind the previous allocs that succeeded.
Spotted-by: Alan Grimes <agrimes@speakeasy.net>
Signed-off-by: Dave Jones <davej@redhat.com>
The following patch fixes a few problems with the tlclk driver.
* bug in the select_amcb1_transmit_clock
* racy read sys call
* racy open sys call
* use of add_timer where mod_timer would be better
* change to the timer data parameter use
Signed-off-by: Mark Gross <mark.gross@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This reverts commit 99a10a60ba.
As per Hugh Dickins:
"Nadia Derbey has reported that mmap of /dev/kmem no longer works with
the kernel virtual address as offset, and Franck has confirmed that
his patch came from a misunderstanding of what an offset means to
/dev/kmem - whereas his patch description seems to say that he was
correcting the offset on a few plaforms, there was no such problem to
correct, and his patch was in fact changing its API on all platforms."
Suggested-by: Hugh Dickins <hugh@veritas.com>
Cc: Franck Bui-Huu <fbuihuu@gmail.com>
Cc: Nadia Derbey <Nadia.Derbey@bull.net>
Cc: Andi Kleen <ak@suse.de>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Currently in resuming path graphics device's pci space restore is
behind host bridge, so resume function wrongly accesses graphics
device's space. This makes resuming failure which crashed X.
here's a patch to restore device's pci space early, which makes
resuming ok with X.
Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Add a load option to intel-rng to allow skipping the FWH detection,
necessary in case the BIOS has locked read-only the firmware hub space.
Also prevent any attempt to write to firmware space if it cannot be write
enabled (apparently caused hangs on some systems not having an FWH and thus
also not having a respective RNG).
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
It would clutter up the kernel output in a situation which is legitimate before
X.org 7.2 and handled correctly by the 3D driver.
Signed-off-by: Dave Airlie <airlied@linux.ie>
Make this:
drivers/char/ip2/ip2main.c: In function 'ip2_loadmain':
drivers/char/ip2/ip2main.c:654: warning: control may reach end of non-void function 'iiSetAddress' being inlined
drivers/char/ip2/ip2main.c:808: warning: control may reach end of non-void function 'iiInitialize' being inlined
go away.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
[AGPGART] drivers/char/agp/sgi-agp.c: check kmalloc() return value
[AGPGART] Fix PCI-posting flush typo.
[AGPGART] fix detection of aperture size versus GTT size on G965
[AGPGART] Remove unnecessary flushes when inserting and removing pages.
[AGPGART] K8M890 support for amd-k8.
drivers/char/agp/sgi-agp.c: check kmalloc() return value
Signed-off-by: Amit Choudhary <amit2030@gmail.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Many spinlock recursion was in the isicom driver. Eliminate it.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
tty_driver->owner is not set, so if somebody remove mxser_module, it might
oops (and doesn't tell the user: no way, it's in use). Set the .owner value.
Cc: <osv@javad.com>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
set_param_str() cannot use kstrdup() to duplicate the parameter. That's
fine when the driver is compiled as a module but it sure is not when built
into the kernel as the kernel parameters are parsed before the kmalloc
slabs are setup.
Signed-off-by: Sebastien Dugué <sebastien.dugue@bull.net>
Acked-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Unfortunately there was a typo in one of the patches I sent,
(The one now committed to the agpgart tree).
It may cause a bus error on i810 type hardware.
Signed-off-by: Thomas Hellstrom <thomas@tungstengraphics.com>
Signed-off-by: Dave Jones <davej@redhat.com>
On the G965, the GTT size may be larger than is required to cover the
aperture. (In fact, on all hardware we've seen, the GTT is 512KB to the
aperture's 256MB). A previous commit forced the aperture size to 512MB on
G965 to match GTT, which would likely result in hangs at best if users
tried to rely on agpgart's aperture size information. Instead, we use the
resource length for the aperture size and the system's reported GTT size
when available for the GTT size.
Because the MSAC registers which had been read for aperture size detection
on i9xx chips just cause a change in the resource size, we can use generic
code for aperture detection on all i9xx.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Dave Jones <davej@redhat.com>
This patch is to speed up flipping of pages in and out of the AGP aperture as
needed by the new drm memory manager.
A number of global cache flushes are removed as well as some PCI posting flushes.
The following guidelines have been used:
1) Memory that is only mapped uncached and that has been subject to a global
cache flush after the mapping was changed to uncached does not need any more
cache flushes. Neither before binding to the aperture nor after unbinding.
2) Only do one PCI posting flush after a sequence of writes modifying page
entries in the GATT.
Signed-off-by: Thomas Hellstrom <thomas@tungstengraphics.com>
Signed-off-by: Dave Jones <davej@redhat.com>
drivers/char/rtc.c:116: warning: 'hpet_rtc_interrupt' defined but not used
Cc: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
drm drivers no longer use pci_pretty_name so we can stop defining it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Replace r300_check_offset() with generic radeon_check_offset(), which doesn't
reject valid offsets when the framebuffer area is at the very end of the card's
32 bit address space. Make radeon_check_and_fixup_offset() use
radeon_check_offset() as well.
This fixes https://bugs.freedesktop.org/show_bug.cgi?id=7697 .
Currently this driver tracks user space clients it should send signals to. In
the presenct of file descriptor passing this is appears susceptible to
confusion from pid wrap around issues.
Replacing this with a struct pid prevents us from getting confused, and
prepares for a pid namespace implementation.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
tty_ldisc_deref() should only be called when tty_ldisc_ref() succeeds
otherwise it triggers a BUG(). There's already a function
tty_ldisc_flush() that flushes properly.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
- conditionalizes procfs code upon CONFIG_PROC_FS (to reduce code size when
that option is not enabled)
- make initialization no longer fail when the procfs entry can't be
allocated (namely would initialization always have failed when
CONFIG_PROC_FS was not set)
- move the formerly file-scope static variable rtc_int_handler_ptr into
the only function using it, and makes it automatic.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Ensure RTC driver doesn't use its timer when it doesn't get to set it up
(as it cannot currently prevent other of its functions to be called from
outside when not built as a module - probably this should also be
addressed).
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
I don't see why there is a memory barrier in copy_from_read_buf() at all.
Even if it was useful spin_unlock_irqrestore implies a barrier.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Most distributions enable sysrq support but set it to 0 by default. Add a
sysrq_always_enabled boot option to always-enable sysrq keys. Useful for
debugging - without having to modify the disribution's config files (which
might not be possible if the kernel is on a live CD, etc.).
Also, while at it, clean up the sysrq interfaces.
[bunk@stusta.de: make sysrq_always_enabled_setup() static]
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Marcel Holtmann