Use memdup_user when user data is immediately copied into the
allocated region.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@
- to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+ to = memdup_user(from,size);
if (
- to==NULL
+ IS_ERR(to)
|| ...) {
<+... when != goto l1;
- -ENOMEM
+ PTR_ERR(to)
...+>
}
- if (copy_from_user(to, from, size) != 0) {
- <+... when != goto l2;
- -EFAULT
- ...+>
- }
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1382) changes the USB_EHCI_TT_NEWSCHED Kconfig option to
be non-experimental and to default to Y. This option has existed for
a long time, and I have not heard any complaints concerning it. By
contrast, several people have reported that their devices could be
made to work only by enabling the option.
The point of changing the default is to cause the option to be enabled
by distros that simply use the default settings for esoteric things
like this.
This change was motivated by Bugzilla #15649.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When code to manipulate the command register was refactored from
xhci_run() to xhci_start(), a debugging statement was left behind that no
longer applies. Remove that statement.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Sergei Shtylyov <sshtylyov@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1392) fixes a bug in uhci-hcd: The start_rh() routine is
supposed to be called with the private spinlock held. If an IRQ comes
in at just the wrong time, the driver will think the controller has
died when in fact it simply hasn't start yet.
The patch also addresses some issues that may prevent an URB from
being unlinked after the controller has stopped. This is an abnormal
occurrence (ordinarily the controller stops only when the entire bus
is suspended and hence there are no active URBs), so the pathways
haven't gotten much testing. These two changes may be a little more
than is strictly necessary, but clearly they won't hurt.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1391) fixes a problem that can occur when USB host
controller hardware is hot-unplugged. If no interrupts are generated
by the unplug then the HCD may not realize that the controller is
gone, and the subsequent unbind may hang waiting for interrupts that
never arrive.
The solution (for PCI-based controllers) is to call the HCD's
interrupt handler at the start of usb_hcd_pci_remove(). If the
hardware is gone, the handler will realize this when it tries to read
the controller's status register.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1390) fixes a problem that crops up when a UHCI host
controller is unbound from uhci-hcd while there are still some active
URBs. The URBs have to be unlinked when the root hub is unregistered,
and uhci-hcd relies upon root-hub status polls as part of its
unlinking procedure. But usb_hcd_poll_rh_status() won't make those
status calls if hcd->rh_registered is clear, and the flag is cleared
_before_ the unregistration takes place.
Since hcd->rh_registered is used for other things and needs to be
cleared early, the solution is to add a new flag (rh_pollable) and use
it instead. It gets cleared _after_ the root hub is unregistered.
Now that the status polls don't end too soon, we have to make sure
they also don't occur too late -- after the root hub's usb_device
structure or the HCD's private structures are deallocated. Therefore
the patch adds usb_get_device() and usb_put_device() calls to protect
the root hub structure, and it adds an extra del_timer_sync() to
prevent the root-hub timer from causing an unexpected status poll.
This additional complexity would not be needed if the HCD framework
had provided separate stop() and release() callbacks instead of just
stop(). This lack could be fixed at some future time (although it
would require changes to every host controller driver); when that
happens this patch won't be needed any more.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1389) fixes some errors in the failure pathway of
usb_add_hcd(). The actions it takes ought to be exactly the same as
those taken by usb_remove_hcd(), but they aren't.
In one case (removal of the usb_bus_attr_group), the two routines are
brought into agreement by changing usb_remove_hcd(). All the other
discrepancies are fixed by changing usb_add_hcd().
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* 'writable_limits' of git://decibel.fi.muni.cz/~xslaby/linux:
unistd: add __NR_prlimit64 syscall numbers
rlimits: implement prlimit64 syscall
rlimits: switch more rlimit syscalls to do_prlimit
rlimits: redo do_setrlimit to more generic do_prlimit
rlimits: add rlimit64 structure
rlimits: do security check under task_lock
rlimits: allow setrlimit to non-current tasks
rlimits: split sys_setrlimit
rlimits: selinux, do rlimits changes under task_lock
rlimits: make sure ->rlim_max never grows in sys_setrlimit
rlimits: add task_struct to update_rlimit_cpu
rlimits: security, add task_struct to setrlimit
Fix up various system call number conflicts. We not only added fanotify
system calls in the meantime, but asm-generic/unistd.h added a wait4
along with a range of reserved per-architecture system calls.
* git://git.infradead.org/mtd-2.6: (79 commits)
mtd: Remove obsolete <mtd/compatmac.h> include
mtd: Update copyright notices
jffs2: Update copyright notices
mtd-physmap: add support users can assign the probe type in board files
mtd: remove redwood map driver
mxc_nand: Add v3 (i.MX51) Support
mxc_nand: support 8bit ecc
mxc_nand: fix correct_data function
mxc_nand: add V1_V2 namespace to registers
mxc_nand: factor out a check_int function
mxc_nand: make some internally used functions overwriteable
mxc_nand: rework get_dev_status
mxc_nand: remove 0xe00 offset from registers
mtd: denali: Add multi connected NAND support
mtd: denali: Remove set_ecc_config function
mtd: denali: Remove unuseful code in get_xx_nand_para functions
mtd: denali: Remove device_info_tag structure
mtd: m25p80: add support for the Winbond W25Q32 SPI flash chip
mtd: m25p80: add support for the Intel/Numonyx {16,32,64}0S33B SPI flash chips
mtd: m25p80: add support for the EON EN25P{32, 64} SPI flash chips
...
Fix up trivial conflicts in drivers/mtd/maps/{Kconfig,redwood.c} due to
redwood driver removal.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bcopeland/omfs:
omfs: fix uninitialized variable warning
omfs: sanity check cluster size
omfs: refuse to mount if bitmap pointer is obviously wrong
omfs: check bounds on block numbers before passing to sb_bread
omfs: fix memory leak
* 'for-linus' of git://git.infradead.org/users/eparis/notify: (132 commits)
fanotify: use both marks when possible
fsnotify: pass both the vfsmount mark and inode mark
fsnotify: walk the inode and vfsmount lists simultaneously
fsnotify: rework ignored mark flushing
fsnotify: remove global fsnotify groups lists
fsnotify: remove group->mask
fsnotify: remove the global masks
fsnotify: cleanup should_send_event
fanotify: use the mark in handler functions
audit: use the mark in handler functions
dnotify: use the mark in handler functions
inotify: use the mark in handler functions
fsnotify: send fsnotify_mark to groups in event handling functions
fsnotify: Exchange list heads instead of moving elements
fsnotify: srcu to protect read side of inode and vfsmount locks
fsnotify: use an explicit flag to indicate fsnotify_destroy_mark has been called
fsnotify: use _rcu functions for mark list traversal
fsnotify: place marks on object in order of group memory address
vfs/fsnotify: fsnotify_close can delay the final work in fput
fsnotify: store struct file not struct path
...
Fix up trivial delete/modify conflict in fs/notify/inotify/inotify.c.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (96 commits)
no need for list_for_each_entry_safe()/resetting with superblock list
Fix sget() race with failing mount
vfs: don't hold s_umount over close_bdev_exclusive() call
sysv: do not mark superblock dirty on remount
sysv: do not mark superblock dirty on mount
btrfs: remove junk sb_dirt change
BFS: clean up the superblock usage
AFFS: wait for sb synchronization when needed
AFFS: clean up dirty flag usage
cifs: truncate fallout
mbcache: fix shrinker function return value
mbcache: Remove unused features
add f_flags to struct statfs(64)
pass a struct path to vfs_statfs
update VFS documentation for method changes.
All filesystems that need invalidate_inode_buffers() are doing that explicitly
convert remaining ->clear_inode() to ->evict_inode()
Make ->drop_inode() just return whether inode needs to be dropped
fs/inode.c:clear_inode() is gone
fs/inode.c:evict() doesn't care about delete vs. non-delete paths now
...
Fix up trivial conflicts in fs/nilfs2/super.c
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (59 commits)
igbvf.txt: Add igbvf Documentation
igb.txt: Add igb documentation
e100/e1000*/igb*/ixgb*: Add missing read memory barrier
ixgbe: fix build error with FCOE_CONFIG without DCB_CONFIG
netxen: protect tx timeout recovery by rtnl lock
isdn: gigaset: use after free
isdn: gigaset: add missing unlock
solos-pci: Fix race condition in tasklet RX handling
pkt_sched: Fix sch_sfq vs tcf_bind_filter oops
net: disable preemption before call smp_processor_id()
tcp: no md5sig option size check bug
iwlwifi: fix locking assertions
iwlwifi: fix TX tracer
isdn: fix information leak
net: Fix napi_gro_frags vs netpoll path
usbnet: remove noisy and hardly useful printk
rtl8180: avoid potential NULL deref in rtl8180_beacon_work
ath9k: Remove myself from the MAINTAINERS list
libertas: scan before assocation if no BSSID was given
libertas: fix association with some APs by using extended rates
...
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6:
tx493xide: use min_t() macro instead of min()
drivers/ide: Use memdup_user
via82cxxx: fix typo for VT6415 PCIE PATA IDE Host Controller support.
ide-cd: Do not access completed requests in the irq handler
Andrea Gelmini
Julia Lawall
Alan Stern
James Courtier-Dutton
Sarah Sharp
Nicolas Kaiser
Linus Torvalds