* [01/11] ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
@ 2010-09-18 18:44 ` Greg KH
2010-09-18 18:44 ` [02/11] ath9k_hw: fix parsing of HT40 5 GHz CTLs Greg KH
` (9 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:44 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Takashi Iwai
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 27f7ad53829f79e799a253285318bff79ece15bd upstream.
The error handling in snd_seq_oss_open() has several bad codes that
do dereferecing released pointers and double-free of kmalloc'ed data.
The object dp is release in free_devinfo() that is called via
private_free callback. The rest shouldn't touch this object any more.
The patch changes delete_port() to call kfree() in any case, and gets
rid of unnecessary calls of destructors in snd_seq_oss_open().
Fixes CVE-2010-3080.
Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
sound/core/seq/oss/seq_oss_init.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -280,13 +280,10 @@ snd_seq_oss_open(struct file *file, int
return 0;
_error:
- snd_seq_oss_writeq_delete(dp->writeq);
- snd_seq_oss_readq_delete(dp->readq);
snd_seq_oss_synth_cleanup(dp);
snd_seq_oss_midi_cleanup(dp);
- delete_port(dp);
delete_seq_queue(dp->queue);
- kfree(dp);
+ delete_port(dp);
return rc;
}
@@ -349,8 +346,10 @@ create_port(struct seq_oss_devinfo *dp)
static int
delete_port(struct seq_oss_devinfo *dp)
{
- if (dp->port < 0)
+ if (dp->port < 0) {
+ kfree(dp);
return 0;
+ }
debug_printk(("delete_port %i\n", dp->port));
return snd_seq_event_port_detach(dp->cseq, dp->port);
^ permalink raw reply [flat|nested] 13+ messages in thread* [02/11] ath9k_hw: fix parsing of HT40 5 GHz CTLs
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
2010-09-18 18:44 ` [01/11] ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() Greg KH
@ 2010-09-18 18:44 ` Greg KH
2010-09-18 18:44 ` [03/11] tracing: Do not allow llseek to set_ftrace_filter Greg KH
` (8 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:44 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Luis R. Rodriguez,
John W. Linville
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Luis R. Rodriguez <lrodriguez@atheros.com>
commit 904879748d7439a6dabdc6be9aad983e216b027d upstream.
The 5 GHz CTL indexes were not being read for all hardware
devices due to the masking out through the CTL_MODE_M mask
being one bit too short. Without this the calibrated regulatory
maximum values were not being picked up when devices operate
on 5 GHz in HT40 mode. The final output power used for Atheros
devices is the minimum between the calibrated CTL values and
what CRDA provides.
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/ath9k/ath9k.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath9k/ath9k.h
@@ -554,7 +554,7 @@ enum ath9k_cipher {
#define SD_NO_CTL 0xE0
#define NO_CTL 0xff
-#define CTL_MODE_M 7
+#define CTL_MODE_M 0xf
#define CTL_11A 0
#define CTL_11B 1
#define CTL_11G 2
^ permalink raw reply [flat|nested] 13+ messages in thread* [03/11] tracing: Do not allow llseek to set_ftrace_filter
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
2010-09-18 18:44 ` [01/11] ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() Greg KH
2010-09-18 18:44 ` [02/11] ath9k_hw: fix parsing of HT40 5 GHz CTLs Greg KH
@ 2010-09-18 18:44 ` Greg KH
2010-09-18 18:45 ` [04/11] irda: off by one Greg KH
` (7 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:44 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Chris Wright, Tavis Ormandy,
Eugene Teo, vendor-sec, Steven Rostedt
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Steven Rostedt <srostedt@redhat.com>
commit 9c55cb12c1c172e2d51e85fbb5a4796ca86b77e7 upstream.
Reading the file set_ftrace_filter does three things.
1) shows whether or not filters are set for the function tracer
2) shows what functions are set for the function tracer
3) shows what triggers are set on any functions
3 is independent from 1 and 2.
The way this file currently works is that it is a state machine,
and as you read it, it may change state. But this assumption breaks
when you use lseek() on the file. The state machine gets out of sync
and the t_show() may use the wrong pointer and cause a kernel oops.
Luckily, this will only kill the app that does the lseek, but the app
dies while holding a mutex. This prevents anyone else from using the
set_ftrace_filter file (or any other function tracing file for that matter).
A real fix for this is to rewrite the code, but that is too much for
a -rc release or stable. This patch simply disables llseek on the
set_ftrace_filter() file for now, and we can do the proper fix for the
next major release.
Reported-by: Robert Swiecki <swiecki@google.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Tavis Ormandy <taviso@google.com>
Cc: Eugene Teo <eugene@redhat.com>
Cc: vendor-sec@lst.de
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/trace/ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1456,7 +1456,7 @@ static struct file_operations ftrace_fil
.open = ftrace_filter_open,
.read = ftrace_regex_read,
.write = ftrace_filter_write,
- .llseek = ftrace_regex_lseek,
+ .llseek = no_llseek,
.release = ftrace_filter_release,
};
^ permalink raw reply [flat|nested] 13+ messages in thread* [04/11] irda: off by one
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (2 preceding siblings ...)
2010-09-18 18:44 ` [03/11] tracing: Do not allow llseek to set_ftrace_filter Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [05/11] bounce: call flush_dcache_page() after bounce_copy_vec() Greg KH
` (6 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Dan Carpenter,
David S. Miller
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Dan Carpenter <error27@gmail.com>
commit cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad upstream.
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/irda/irlan/irlan_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1100,7 +1100,7 @@ int irlan_extract_param(__u8 *buf, char
memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
le16_to_cpus(&val_len); n+=2;
- if (val_len > 1016) {
+ if (val_len >= 1016) {
IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
return -RSP_INVALID_COMMAND_FORMAT;
}
^ permalink raw reply [flat|nested] 13+ messages in thread* [05/11] bounce: call flush_dcache_page() after bounce_copy_vec()
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (3 preceding siblings ...)
2010-09-18 18:45 ` [04/11] irda: off by one Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [06/11] x86-64, compat: Test %rax for the syscall number, not %eax Greg KH
` (5 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Gary King, Tejun Heo,
Russell King, Jens Axboe
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Gary King <gking@nvidia.com>
commit ac8456d6f9a3011c824176bd6084d39e5f70a382 upstream.
I have been seeing problems on Tegra 2 (ARMv7 SMP) systems with HIGHMEM
enabled on 2.6.35 (plus some patches targetted at 2.6.36 to perform cache
maintenance lazily), and the root cause appears to be that the mm bouncing
code is calling flush_dcache_page before it copies the bounce buffer into
the bio.
The bounced page needs to be flushed after data is copied into it, to
ensure that architecture implementations can synchronize instruction and
data caches if necessary.
Signed-off-by: Gary King <gking@nvidia.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Acked-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
mm/bounce.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -114,8 +114,8 @@ static void copy_to_high_bio_irq(struct
*/
vfrom = page_address(fromvec->bv_page) + tovec->bv_offset;
- flush_dcache_page(tovec->bv_page);
bounce_copy_vec(tovec, vfrom);
+ flush_dcache_page(tovec->bv_page);
}
}
^ permalink raw reply [flat|nested] 13+ messages in thread* [06/11] x86-64, compat: Test %rax for the syscall number, not %eax
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (4 preceding siblings ...)
2010-09-18 18:45 ` [05/11] bounce: call flush_dcache_page() after bounce_copy_vec() Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [07/11] compat: Make compat_alloc_user_space() incorporate the access_ok() Greg KH
` (4 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, H. Peter Anvin,
Roland McGrath
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: H. Peter Anvin <hpa@linux.intel.com>
commit 36d001c70d8a0144ac1d038f6876c484849a74de upstream.
On 64 bits, we always, by necessity, jump through the system call
table via %rax. For 32-bit system calls, in theory the system call
number is stored in %eax, and the code was testing %eax for a valid
system call number. At one point we loaded the stored value back from
the stack to enforce zero-extension, but that was removed in checkin
d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process
will not be able to introduce a non-zero-extended number, but it can
happen via ptrace.
Instead of re-introducing the zero-extension, test what we are
actually going to use, i.e. %rax. This only adds a handful of REX
prefixes to the code.
Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/ia32/ia32entry.S | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -153,7 +153,7 @@ ENTRY(ia32_sysenter_target)
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
CFI_REMEMBER_STATE
jnz sysenter_tracesys
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja ia32_badsys
sysenter_do_call:
IA32_ARG_FIXUP
@@ -195,7 +195,7 @@ sysexit_from_sys_call:
movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
call audit_syscall_entry
movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja ia32_badsys
movl %ebx,%edi /* reload 1st syscall arg */
movl RCX-ARGOFFSET(%rsp),%esi /* reload 2nd syscall arg */
@@ -248,7 +248,7 @@ sysenter_tracesys:
call syscall_trace_enter
LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
jmp sysenter_do_call
CFI_ENDPROC
@@ -314,7 +314,7 @@ ENTRY(ia32_cstar_target)
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
CFI_REMEMBER_STATE
jnz cstar_tracesys
- cmpl $IA32_NR_syscalls-1,%eax
+ cmpq $IA32_NR_syscalls-1,%rax
ja ia32_badsys
cstar_do_call:
IA32_ARG_FIXUP 1
@@ -367,7 +367,7 @@ cstar_tracesys:
LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
RESTORE_REST
xchgl %ebp,%r9d
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
jmp cstar_do_call
END(ia32_cstar_target)
@@ -425,7 +425,7 @@ ENTRY(ia32_syscall)
orl $TS_COMPAT,TI_status(%r10)
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
jnz ia32_tracesys
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja ia32_badsys
ia32_do_call:
IA32_ARG_FIXUP
@@ -444,7 +444,7 @@ ia32_tracesys:
call syscall_trace_enter
LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
- cmpl $(IA32_NR_syscalls-1),%eax
+ cmpq $(IA32_NR_syscalls-1),%rax
ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
jmp ia32_do_call
END(ia32_syscall)
^ permalink raw reply [flat|nested] 13+ messages in thread* [07/11] compat: Make compat_alloc_user_space() incorporate the access_ok()
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (5 preceding siblings ...)
2010-09-18 18:45 ` [06/11] x86-64, compat: Test %rax for the syscall number, not %eax Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [08/11] hwmon: (f75375s) Shift control mode to the correct bit position Greg KH
` (3 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, H. Peter Anvin,
Benjamin Herrenschmidt, Chris Metcalf, David S. Miller,
Ingo Molnar, Thomas Gleixner, Tony Luck, Arnd Bergmann,
Fenghua Yu, H. Peter Anvin, Heiko Carstens, Helge Deller,
James Bottomley, Kyle McMartin, Martin Schwidefsky,
Paul Mackerras, Ralf Baechle
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: H. Peter Anvin <hpa@linux.intel.com>
commit c41d68a513c71e35a14f66d71782d27a79a81ea6 upstream.
compat_alloc_user_space() expects the caller to independently call
access_ok() to verify the returned area. A missing call could
introduce problems on some architectures.
This patch incorporates the access_ok() check into
compat_alloc_user_space() and also adds a sanity check on the length.
The existing compat_alloc_user_space() implementations are renamed
arch_compat_alloc_user_space() and are used as part of the
implementation of the new global function.
This patch assumes NULL will cause __get_user()/__put_user() to either
fail or access userspace on all architectures. This should be
followed by checking the return value of compat_access_user_space()
for NULL in the callers, at which time the access_ok() in the callers
can also be removed.
Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Chris Metcalf <cmetcalf@tilera.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Tony Luck <tony.luck@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Helge Deller <deller@gmx.de>
Cc: James Bottomley <jejb@parisc-linux.org>
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/ia64/include/asm/compat.h | 2 +-
arch/powerpc/include/asm/compat.h | 2 +-
arch/s390/include/asm/compat.h | 2 +-
arch/sparc/include/asm/compat.h | 2 +-
include/asm-mips/compat.h | 2 +-
include/asm-parisc/compat.h | 2 +-
include/asm-x86/compat.h | 2 +-
include/linux/compat.h | 2 ++
kernel/compat.c | 22 ++++++++++++++++++++++
9 files changed, 31 insertions(+), 7 deletions(-)
--- a/arch/ia64/include/asm/compat.h
+++ b/arch/ia64/include/asm/compat.h
@@ -198,7 +198,7 @@ ptr_to_compat(void __user *uptr)
}
static __inline__ void __user *
-compat_alloc_user_space (long len)
+arch_compat_alloc_user_space (long len)
{
struct pt_regs *regs = task_pt_regs(current);
return (void __user *) (((regs->r12 & 0xffffffff) & -16) - len);
--- a/arch/powerpc/include/asm/compat.h
+++ b/arch/powerpc/include/asm/compat.h
@@ -133,7 +133,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
{
struct pt_regs *regs = current->thread.regs;
unsigned long usp = regs->gpr[1];
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -163,7 +163,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
{
unsigned long stack;
--- a/arch/sparc/include/asm/compat.h
+++ b/arch/sparc/include/asm/compat.h
@@ -166,7 +166,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
{
struct pt_regs *regs = current_thread_info()->kregs;
unsigned long usp = regs->u_regs[UREG_I6];
--- a/include/asm-mips/compat.h
+++ b/include/asm-mips/compat.h
@@ -145,7 +145,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
{
struct pt_regs *regs = (struct pt_regs *)
((unsigned long) current_thread_info() + THREAD_SIZE - 32) - 1;
--- a/include/asm-parisc/compat.h
+++ b/include/asm-parisc/compat.h
@@ -146,7 +146,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static __inline__ void __user *compat_alloc_user_space(long len)
+static __inline__ void __user *arch_compat_alloc_user_space(long len)
{
struct pt_regs *regs = ¤t->thread.regs;
return (void __user *)regs->gr[30];
--- a/include/asm-x86/compat.h
+++ b/include/asm-x86/compat.h
@@ -204,7 +204,7 @@ static inline compat_uptr_t ptr_to_compa
return (u32)(unsigned long)uptr;
}
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
{
struct pt_regs *regs = task_pt_regs(current);
return (void __user *)regs->sp - len;
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -291,5 +291,7 @@ asmlinkage long compat_sys_newfstatat(un
asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
int flags, int mode);
+extern void __user *compat_alloc_user_space(unsigned long len);
+
#endif /* CONFIG_COMPAT */
#endif /* _LINUX_COMPAT_H */
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -23,6 +23,7 @@
#include <linux/timex.h>
#include <linux/migrate.h>
#include <linux/posix-timers.h>
+#include <linux/module.h>
#include <asm/uaccess.h>
@@ -1081,3 +1082,24 @@ compat_sys_sysinfo(struct compat_sysinfo
return 0;
}
+
+/*
+ * Allocate user-space memory for the duration of a single system call,
+ * in order to marshall parameters inside a compat thunk.
+ */
+void __user *compat_alloc_user_space(unsigned long len)
+{
+ void __user *ptr;
+
+ /* If len would occupy more than half of the entire compat space... */
+ if (unlikely(len > (((compat_uptr_t)~0) >> 1)))
+ return NULL;
+
+ ptr = arch_compat_alloc_user_space(len);
+
+ if (unlikely(!access_ok(VERIFY_WRITE, ptr, len)))
+ return NULL;
+
+ return ptr;
+}
+EXPORT_SYMBOL_GPL(compat_alloc_user_space);
^ permalink raw reply [flat|nested] 13+ messages in thread* [08/11] hwmon: (f75375s) Shift control mode to the correct bit position
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (6 preceding siblings ...)
2010-09-18 18:45 ` [07/11] compat: Make compat_alloc_user_space() incorporate the access_ok() Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [09/11] hwmon: (f75375s) Do not overwrite values read from registers Greg KH
` (2 subsequent siblings)
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Guillem Jover, Riku Voipio,
Jean Delvare
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Guillem Jover <guillem@hadrons.org>
commit 96f3640894012be7dd15a384566bfdc18297bc6c upstream.
The spec notes that fan0 and fan1 control mode bits are located in bits
7-6 and 5-4 respectively, but the FAN_CTRL_MODE macro was making the
bits shift by 5 instead of by 4.
Signed-off-by: Guillem Jover <guillem@hadrons.org>
Cc: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/hwmon/f75375s.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -79,7 +79,7 @@ I2C_CLIENT_INSMOD_2(f75373, f75375);
#define F75375_REG_PWM2_DROP_DUTY 0x6C
#define FAN_CTRL_LINEAR(nr) (4 + nr)
-#define FAN_CTRL_MODE(nr) (5 + ((nr) * 2))
+#define FAN_CTRL_MODE(nr) (4 + ((nr) * 2))
/*
* Data structures and manipulation thereof
^ permalink raw reply [flat|nested] 13+ messages in thread* [09/11] hwmon: (f75375s) Do not overwrite values read from registers
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (7 preceding siblings ...)
2010-09-18 18:45 ` [08/11] hwmon: (f75375s) Shift control mode to the correct bit position Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [10/11] apm_power: Add missing break statement Greg KH
2010-09-18 18:45 ` [11/11] x86-64, compat: Retruncate rax after ia32 syscall entry tracing Greg KH
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Guillem Jover, Riku Voipio,
Jean Delvare
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Guillem Jover <guillem@hadrons.org>
commit c3b327d60bbba3f5ff8fd87d1efc0e95eb6c121b upstream.
All bits in the values read from registers to be used for the next
write were getting overwritten, avoid doing so to not mess with the
current configuration.
Signed-off-by: Guillem Jover <guillem@hadrons.org>
Cc: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/hwmon/f75375s.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -298,7 +298,7 @@ static int set_pwm_enable_direct(struct
return -EINVAL;
fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
- fanmode = ~(3 << FAN_CTRL_MODE(nr));
+ fanmode &= ~(3 << FAN_CTRL_MODE(nr));
switch (val) {
case 0: /* Full speed */
@@ -350,7 +350,7 @@ static ssize_t set_pwm_mode(struct devic
mutex_lock(&data->update_lock);
conf = f75375_read8(client, F75375_REG_CONFIG1);
- conf = ~(1 << FAN_CTRL_LINEAR(nr));
+ conf &= ~(1 << FAN_CTRL_LINEAR(nr));
if (val == 0)
conf |= (1 << FAN_CTRL_LINEAR(nr)) ;
^ permalink raw reply [flat|nested] 13+ messages in thread* [10/11] apm_power: Add missing break statement
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (8 preceding siblings ...)
2010-09-18 18:45 ` [09/11] hwmon: (f75375s) Do not overwrite values read from registers Greg KH
@ 2010-09-18 18:45 ` Greg KH
2010-09-18 18:45 ` [11/11] x86-64, compat: Retruncate rax after ia32 syscall entry tracing Greg KH
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Anton Vorontsov
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Anton Vorontsov <cbouatmailru@gmail.com>
commit 1d220334d6a8a711149234dc5f98d34ae02226b8 upstream.
The missing break statement causes wrong capacity calculation for
batteries that report energy.
Reported-by: d binderman <dcb314@hotmail.com>
Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/power/apm_power.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/power/apm_power.c
+++ b/drivers/power/apm_power.c
@@ -233,6 +233,7 @@ static int calculate_capacity(enum apm_s
empty_design_prop = POWER_SUPPLY_PROP_ENERGY_EMPTY_DESIGN;
now_prop = POWER_SUPPLY_PROP_ENERGY_NOW;
avg_prop = POWER_SUPPLY_PROP_ENERGY_AVG;
+ break;
case SOURCE_VOLTAGE:
full_prop = POWER_SUPPLY_PROP_VOLTAGE_MAX;
empty_prop = POWER_SUPPLY_PROP_VOLTAGE_MIN;
^ permalink raw reply [flat|nested] 13+ messages in thread* [11/11] x86-64, compat: Retruncate rax after ia32 syscall entry tracing
2010-09-18 18:46 [00/11] 2.6.27.54-stable review Greg KH
` (9 preceding siblings ...)
2010-09-18 18:45 ` [10/11] apm_power: Add missing break statement Greg KH
@ 2010-09-18 18:45 ` Greg KH
10 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2010-09-18 18:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: stable-review, torvalds, akpm, alan, Roland McGrath,
H. Peter Anvin
2.6.27-stable review patch. If anyone has any objections, please let us know.
------------------
From: Roland McGrath <roland@redhat.com>
commit eefdca043e8391dcd719711716492063030b55ac upstream.
In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
32-bit tracee in system call entry. A %rax value set via ptrace at the
entry tracing stop gets used whole as a 32-bit syscall number, while we
only check the low 32 bits for validity.
Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
in addition to testing the full 64 bits as has already been added.
Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/ia32/ia32entry.S | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -50,7 +50,12 @@
/*
* Reload arg registers from stack in case ptrace changed them.
* We don't reload %eax because syscall_trace_enter() returned
- * the value it wants us to use in the table lookup.
+ * the %rax value we should see. Instead, we just truncate that
+ * value to 32 bits again as we did on entry from user mode.
+ * If it's a new value set by user_regset during entry tracing,
+ * this matches the normal truncation of the user-mode value.
+ * If it's -1 to make us punt the syscall, then (u32)-1 is still
+ * an appropriately invalid value.
*/
.macro LOAD_ARGS32 offset, _r9=0
.if \_r9
@@ -60,6 +65,7 @@
movl \offset+48(%rsp),%edx
movl \offset+56(%rsp),%esi
movl \offset+64(%rsp),%edi
+ movl %eax,%eax /* zero extension */
.endm
.macro CFI_STARTPROC32 simple
^ permalink raw reply [flat|nested] 13+ messages in thread