It's really not right to use 'access_ok()', since that is meant for the
normal "get_user()" and "copy_from/to_user()" accesses, which are done
through the TLB, rather than through the page tables.
Why? access_ok() does both too few, and too many checks. Too many,
because it is meant for regular kernel accesses that will not honor the
'user' bit in the page tables, and because it honors the USER_DS vs
KERNEL_DS distinction that we shouldn't care about in GUP. And too few,
because it doesn't do the 'canonical' check on the address on x86-64,
since the TLB will do that for us.
So instead of using a function that isn't meant for this, and does
something else and much more complicated, just do the real rules: we
don't want the range to overflow, and on x86-64, we want it to be a
canonical low address (on 32-bit, all addresses are canonical).
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
With 2.6.30, the error handling code in cdrom_newpc_intr was changed
to deal with partial request failures by normally completing the 'good'
parts of a request and only 'error' the last (and presumably,
incompletely transferred) bio associated with a particular
request. In order to do this, ide_complete_rq is called over
ide_cd_error_cmd() to partially complete the rq. The block layer
does partial completion only for requests with bio's and if the
rq doesn't have one (eg 'GPCMD_READ_DISC_INFO') the request is
completed as a whole and the drive->hwif->rq pointer set to NULL
afterwards. When calling ide_complete_rq again to report
the error, this null pointer is derefenced, resulting in a kernel
crash.
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=13399.
Signed-off-by: Rainer Weikusat <rweikusat@mssgmbh.com>
Signed-off-by: Borislav Petkov <petkovbb@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c: New macro to initialize i2c address lists on the fly
i2c: Don't advertise i2c functions when not available
i2c: Use rwsem instead of mutex for board info
i2c: Add a sysfs interface to instantiate devices
i2c: Limit core locking to the necessary sections
i2c: Kill the redundant client list
i2c: Kill is_newstyle_driver
i2c: Merge i2c_attach_client into i2c_new_device
i2c: Drop i2c_probe function
i2c: Get rid of the legacy binding model
i2c: Kill client_register and client_unregister methods
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/vapier/blackfin:
Blackfin: convert page/tlb to asm-generic
Blackfin: convert types to asm-generic
Blackfin: convert irq/process to asm-generic
Blackfin: convert signal/mmap to asm-generic
Blackfin: convert locking primitives to asm-generic
Blackfin: convert termios to asm-generic
Blackfin: convert simple headers to asm-generic
Blackfin: convert socket/poll to asm-generic
Blackfin: convert user/elf to asm-generic
Blackfin: convert shm/sysv/ipc to asm-generic
Blackfin: convert asm/ioctls.h to asm-generic/ioctls.h
Blackfin: only build irqpanic.c when needed
Blackfin: pull in asm/io.h in ksyms for prototypes
Blackfin: use common test_bit() rather than __test_bit()
In moxa.c there are 32 minor numbers reserved for each device. The number
of ports actually available per device is stored in
moxa_board_conf->numPorts. This number is not considered in moxa_open().
Opening a port that is not available results in a kernel oops. This patch
adds a test to moxa_open() that prevents opening unavailable ports.
[akpm@linux-foundation.org: avoid multiple returns]
Signed-off-by: Dirk Eibach <eibach@gdsys.de>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The remove member of the pci_driver stli_pcidriver uses __devexit_p(), so
the remove function itself should be marked with __devexit. Even more so
considering the probe function is marked with __devinit.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Acked-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The bug is ancient.
If we trace the sub-thread of our natural child and this sub-thread exits,
we update parent->signal->cxxx fields. But we should not do this until
the whole thread-group exits, otherwise we account this thread (and all
other live threads) twice.
Add the task_detached() check. No need to check thread_group_empty(),
wait_consider_task()->delay_group_leader() already did this.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Roland McGrath <roland@redhat.com>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Vitaly Mayatskikh <vmayatsk@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The rtc_update_irq() might be called with irqs enabled, if a interrupt
handler was registered without IRQF_DISABLED. Use
spin_lock_irqsave/spin_unlock_irqrestore instead of spin_lock/spin_unlock.
Also update kerneldoc and drivers which do extra work to follow the
current interface spec, as suggestted by David Brownell.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds
Rainer Weikusat
Joe Perches
Krzysztof Helt
FUJITA Tomonori
Jiri Slaby
Andrew Morton
Dirk Eibach
Mike Frysinger
Roel Kluin
Oleg Nesterov
Atsushi Nemoto