Commit graph

361607 commits

Author SHA1 Message Date
Chen Gang
9b27516fcd ACPI / porocessor: Beautify code, pr->id is u32 which is never < 0
pr->id is u32 which never < 0, so remove the redundant pr->id < 0
check from acpi_processor_add().

[rjw: Changelog]
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:39 +01:00
Syam Sidhardhan
5273a25837 ACPI / processor: Remove redundant NULL check before kfree
kfree() on a NULL pointer is a no-op, so remove a redundant NULL
pointer check in map_mat_entry().

[rjw: Changelog]
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:39 +01:00
Joe Perches
ed4cf5b23f ACPI / Sleep: Avoid interleaved message on errors
Got this dmesg log on an Acer Aspire 725.

[    0.256351] ACPI: (supports S0ACPI Exception: AE_NOT_FOUND, While evaluating Sleep State [\_S1_] (20130117/hwxface-568)
[    0.256373] ACPI Exception: AE_NOT_FOUND, While evaluating Sleep State [\_S2_] (20130117/hwxface-568)
[    0.256391]  S3 S4 S5)

Avoid this interleaving error messages.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:39 +01:00
Rafael J. Wysocki
37530f2bda PM / QoS: Remove device PM QoS sysfs attributes at the right place
Device PM QoS sysfs attributes, if present during device removal,
are removed from within device_pm_remove(), which is too late,
since dpm_sysfs_remove() has already removed the whole attribute
group they belonged to.  However, moving the removal of those
attributes to dpm_sysfs_remove() alone is not sufficient, because
in theory they still can be re-added right after being removed by it
(the device's driver is still bound to it at that point).

For this reason, move the entire desctruction of device PM QoS
constraints to dpm_sysfs_remove() and make it prevent any new
constraints from being added after it has run.  Also, move the
initialization of the power.qos field in struct device to
device_pm_init_common() and drop the no longer needed
dev_pm_qos_constraints_init().

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:12 +01:00
Rafael J. Wysocki
b81ea1b5ac PM / QoS: Fix concurrency issues and memory leaks in device PM QoS
The current device PM QoS code assumes that certain functions will
never be called in parallel with each other (for example, it is
assumed that dev_pm_qos_expose_flags() won't be called in parallel
with dev_pm_qos_hide_flags() for the same device and analogously
for the latency limit), which may be overly optimistic.  Moreover,
dev_pm_qos_expose_flags() and dev_pm_qos_expose_latency_limit()
leak memory in error code paths (req needs to be freed on errors)
and __dev_pm_qos_drop_user_request() forgets to free the request.

To fix the above issues put more things under the device PM QoS
mutex to make them mutually exclusive and add the missing freeing
of memory.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:11 +01:00
Emilio López
f5f43dcfff cpufreq: highbank: do not initialize array with a loop
As uninitialized array members will be initialized to zero, we can
avoid using a for loop by setting a value to it.

Signed-off-by: Emilio López <emilio@elopez.com.ar>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-By: Mark Langsdorf <mark.langsdorf@calxeda.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:11 +01:00
Nishanth Menon
4b87581036 PM / OPP: improve introductory documentation
Make Operating Performance Points (OPP) library introductory chapter
a little more reader-friendly. Split the chapter into two sections,
highlight the definition with an example and minor rewording to be
verbose.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:11 +01:00
Namhyung Kim
e5dde92cb2 cpufreq: Fix a typo in comment
Fix a typo in a comment in cpufreq_governor.h.

[rjw: Changelog]
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:11 +01:00
Mark Langsdorf
091930a2e6 mailbox, pl320-ipc: remove __init from probe function
Avoids a section mismatch.

Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-03-04 14:23:11 +01:00
Emmanuel Grumbach
2470b36e84 iwlwifi: mvm: don't warn on normal BAR sending
This flow happens when we get a failed single Tx response
on an AMPDU queue. In this case, the frame won't be sent
any more. So we need to move the window on the recipient
side. This is done by a BAR.

Now if we are in the following case: 10, 12 and 13 are ACKed
and 11 isn't.

 10  11  12  13.
 V   X   V   V

Then, 11 will be sent 16 times as an MPDU (as oppsed to
A-MPDU). If this failed, we are entering the flow described
above. So we need to send a BAR with ssn = 12.
But in this case, the scheduler will tell us to free frames
up to 13 (included).

So, it is perfectly possible to get a failed single Tx
response on an AMPDU queue that makes the scheduler's ssn
jump by more than 1 single packet.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:39:02 +01:00
Emmanuel Grumbach
8101a7f065 iwlwifi: mvm: update the rssi calculation
Make the rssi more accurate by taking in count per-chain AGC
values. Without this, the RSSI reports inaccurate values.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:38:21 +01:00
Emmanuel Grumbach
f9aa8dd337 iwlwifi: mvm: ignore STOP_AGG when restarting
Since the device is being restarted, all the Rx / Tx Block
Ack sessions are been wiped out by the driver. So ignore
the requests from mac80211 that stops Tx agg while
reconfiguring the device.

Note that stopping a non-existing Rx BA session is harmless,
so just honor mac80211's request.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:37:35 +01:00
Dor Shaish
de8bc6dd2d iwlwifi: mvm: Remove overriding calibrations for the 7000 family
This fix removes the override of calibration request values sent
to the FW.
Due to that, the sending of default values to now implemented
calibrations is removed.

Signed-off-by: Dor Shaish <dor.shaish@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:36:55 +01:00
Dor Shaish
6221d47cf7 iwlwifi: mvm: Take the phy_cfg from the TLV value
The phy_cfg is given from the TLV value and does not have to be
built by us.

Signed-off-by: Dor Shaish <dor.shaish@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:35:19 +01:00
Dor Shaish
e07cbb536a iwlwifi: mvm: Set valid TX antennas value before calib request
We must set the valid TX antennas number in the ucode before
sending the phy_cfg_cmd and request for calibrations.

Signed-off-by: Dor Shaish <dor.shaish@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:35:06 +01:00
Emmanuel Grumbach
715c998ff4 iwlwifi: mvm: restart the NIC of the cmd queue gets full
This situation is clearly an error situation and the only
way to recover is to restart the driver / fw.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-03-04 13:34:52 +01:00
Dan Carpenter
29240e2392 usb: gadget: u_uac1: NULL dereference on error path
We should return here with an error code instead of continuing.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 13:16:45 +02:00
Dan Carpenter
fddedd8334 usb: gadget: f_uac1: silence an info leak warning
Smatch complains that "len" could be larger than the sizeof(value)
so we could be copying garbage here.  I have changed this to match
how things are done in composite_setup().

The call tree looks like:
  composite_setup()
  --> f_audio_setup()
      --> audio_get_intf_req()

composite_setup() expects the return value to be set to
sizeof(value).

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 13:13:58 +02:00
Sachin Kamat
57ae575b8a usb: phy: omap-control-usb: Convert to devm_ioremap_resource()
Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.

Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 13:08:53 +02:00
Sachin Kamat
862421da0d usb: phy: omap-usb3: Convert to devm_ioremap_resource()
Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.

Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 13:08:48 +02:00
Sachin Kamat
a400704103 usb: phy: samsung: Convert to devm_ioremap_resource()
Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.

Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 13:08:39 +02:00
Paul Mundt
40f09f3cd6 metag: Inhibit NUMA balancing.
The metag NUMA implementation follows the SH model, using different nodes for
memories with different latencies. As such, we ensure that automated balancing
between nodes is inhibited, by way of the new ARCH_WANT_VARIABLE_LOCALITY.

Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
2013-03-04 10:29:19 +00:00
James Hogan
0010aeed7b metag: remove SET_PERSONALITY()
Commit e72837e3e7 ("default
SET_PERSONALITY() in linux/elf.h").

The above commit moved the common definition of SET_PERSONALITY() in a
bunch of the arch headers to linux/elf.h. Metag shares that common
definition so remove it from arch/metag/include/asm/elf.h too.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
2013-03-04 10:27:20 +00:00
Jiri Slaby
34dcfb8479 TTY: disable debugging warning
We added a warning to flush_to_ldisc to report cases when it is called
with a NULL tty. It was for debugging purposes and it lead to a
patchset from Peter Hurley. The patchset however did not make it to
3.9, so disable the warning now to not disturb people.

We can re-add it when the series is in and we are hunting for another
bugs.

Reported-by: David Miller <davem@davemloft.net>
Cc: stable <stable@vger.kernel.org>   # 3.8
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-04 16:52:09 +08:00
Kees Cook
290502bee2 eCryptfs: allow userspace messaging to be disabled
When the userspace messaging (for the less common case of userspace key
wrap/unwrap via ecryptfsd) is not needed, allow eCryptfs to build with
it removed. This saves on kernel code size and reduces potential attack
surface by removing the /dev/ecryptfs node.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2013-03-03 23:59:59 -08:00
Marc Kleine-Budde
1dd03d8a51 usb: otg: use try_module_get in all usb_get_phy functions and add missing module_put
In patch "5d3c28b usb: otg: add device tree support to otg library"
devm_usb_get_phy_by_phandle() was added. It uses try_module_get() to lock the
phy driver in memory. The corresponding module_put() is missing in that patch.

This patch adds try_module_get() to usb_get_phy() and usb_get_phy_dev().
Further the missing module_put() is added to usb_put_phy().

Tested-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:30 +02:00
Peter Ujfalusi
a10840c9ac usb: musb: correct Kconfig in order to avoid non compilable selection
Currently it is possible to have:

USB_MUSB_OMAP2PLUS=m
TWL4030_USB=y

which would result compile time error due to missing symbols.

With this change USB_MUSB_OMAP2PLUS and TWL4030_USB will be in sync.

Reported-by: Vincent Stehle <v-stehle@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:30 +02:00
Felipe Balbi
4ea34de761 usb: gadget: s3c2410: fix build breakage
add missing semicolon to fix compile breakage.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:29 +02:00
Felipe Balbi
bc530a7272 usb: gadget: imx_udc: fix gadget->dev registration
Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes imx_udc mistake.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:28 +02:00
Felipe Balbi
9992a9979f usb: gadget: pxa25x: fix gadget->dev registration
Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes pxa25x mistake.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:28 +02:00
Felipe Balbi
7597a49b1e usb: gadget: s3c2410: fix gadget->dev registration
Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes s3c2410 mistake.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:27 +02:00
Kishon Vijay Abraham I
56aa45adcc usb: gadget: make usb functions to load before gadget driver
The current ordering in makefile makes gadget
drivers be loaded before usb functions which
causes usb_get_function_instance() to fail when
gadget modules are statically linked to the
kernel binary.

Changed the ordering here so that USB functions
are loaded before gadget drivers.

Note that this is only a temporary solution and
a more robust fix is needed in the long run.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:26 +02:00
Felipe Balbi
fe2a4297b4 usb: gadget: pxa27x: fix gadget->dev registration
Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes pxa27x mistake.

Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:26 +02:00
Felipe Balbi
2b7dc3b1a6 usb: chipidea: register debugging sysfs on our device
Don't register anything non-generic under
the gadget's device as we don't really *own*
it.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:25 +02:00
Felipe Balbi
e5b29b25f8 usb: dwc3: gadget: remove unnecessary code
the params variables on dwc3_gadget_conndone_interrupt()
is only memset() to zero but never used in
that function, so we can safely drop the variable
and memset() call.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:25 +02:00
Felipe Balbi
d82f3e3cd8 usb: dwc3: glue layers shouldn't know about the core IP
remove inclusion of "core.h" from all glue
layers as they don't need to know details
about the core IP.

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:24 +02:00
Felipe Balbi
2c2dc89cc5 usb: dwc3: omap: fix a typo on of_device_id
s/matach/match

No functional changes

Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:23 +02:00
Felipe Balbi
d9b4330ade usb: dwc3: core: don't forget to free coherent memory
commit 3921426 (usb: dwc3: core: move
event buffer allocation out of
dwc3_core_init()) introduced a memory leak
of the coherent memory we use as event
buffers on dwc3 driver.

If the driver is compiled as a dynamically
loadable module and use constantly loads
and unloads the driver, we will continue
to leak the coherent memory allocated during
->probe() because dwc3_free_event_buffers()
is never called during ->remove().

Cc: <stable@vger.kernel.org> # v3.7 v3.8
Signed-off-by: Felipe Balbi <balbi@ti.com>
2013-03-04 09:33:22 +02:00
Mark Brown
3e78080f81 hwmon: (sht15) Check return value of regulator_enable()
Not having power is a pretty serious error so check that we are able to
enable the supply and error out if we can't.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org #3.8+; 3.0+ will need manual backport
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2013-03-03 21:45:48 -08:00
Jean Delvare
ab302bb0b8 hwmon: (adt7410) Document ADT7420 support
The adt7410 driver supports the ADT7420, but its documentation file
makes no mention of that. Add this refrence, and a brief a description
of the differences between the ADT7410 and the ADT7420.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Hartmut Knaack <knaack.h@gmx.de>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2013-03-03 21:45:48 -08:00
Guenter Roeck
f366fccd08 hwmon: (pmbus/ltc2978) Use detected chip ID to select supported functionality
We read the chip ID from the chip, use it to determine if the chip ID provided
to the driver is correct, and report it if wrong. We should also use the
correct chip ID to select supported functionality.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org # 3.2+
Acked-by: Jean Delvare <khali@linux-fr.org>
2013-03-03 21:45:47 -08:00
Guenter Roeck
dbd712c227 hwmon: (pmbus/ltc2978) Fix peak attribute handling
Peak attributes were not initialized and cleared correctly.
Also, temp2_max is only supported on page 0 and thus does not need to be
an array.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org # 3.2+
Acked-by: Jean Delvare <khali@linux-fr.org>
2013-03-03 21:45:47 -08:00
Guenter Roeck
6d21a41656 hwmon: (pmbus/ltc2978) Update datasheet links
Links to datasheets are no longer valid. Provide links to product information
instead (which provides links to the datasheets and is hopefully more
persistent).

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
2013-03-03 21:45:47 -08:00
Guenter Roeck
e3333e572f hwmon: Update my e-mail address in driver documentation
Most of the hwmon driver documentation still listed my old invalid e-mail
address. Fix it.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
2013-03-03 21:45:47 -08:00
Greg Ungerer
0371a1c5ae m68knommu: fix misnamed GPIO pin definition for ColdFire 528x CPU
Compiling for a ColdFire 528x CPU will result in:

arch/m68k/platform/coldfire/m528x.c: In function ‘m528x_uarts_init’:
arch/m68k/platform/coldfire/m528x.c:72: error: ‘MCF5282_GPIO_PUAPAR’ undeclared (first use in this function)
arch/m68k/platform/coldfire/m528x.c:72: error: (Each undeclared identifier is reported only once
arch/m68k/platform/coldfire/m528x.c:72: error: for each function it appears in.)

The MCF5282_GPIO_PUAPAR definition changed names in the ColdFire definitions
cleanup. It is now MCFGPIO_PUAPAR, so change it.

Not sure how this one got missed, 2 lines below it is the correct use of
this definition.

Signed-off-by: Greg Ungerer <gerg@uclinux.org>
2013-03-04 15:19:31 +10:00
Eric W. Biederman
7f78e03513 fs: Limit sys_mount to only request filesystem modules.
Modify the request_module to prefix the file system type with "fs-"
and add aliases to all of the filesystems that can be built as modules
to match.

A common practice is to build all of the kernel code and leave code
that is not commonly needed as modules, with the result that many
users are exposed to any bug anywhere in the kernel.

Looking for filesystems with a fs- prefix limits the pool of possible
modules that can be loaded by mount to just filesystems trivially
making things safer with no real cost.

Using aliases means user space can control the policy of which
filesystem modules are auto-loaded by editing /etc/modprobe.d/*.conf
with blacklist and alias directives.  Allowing simple, safe,
well understood work-arounds to known problematic software.

This also addresses a rare but unfortunate problem where the filesystem
name is not the same as it's module name and module auto-loading
would not work.  While writing this patch I saw a handful of such
cases.  The most significant being autofs that lives in the module
autofs4.

This is relevant to user namespaces because we can reach the request
module in get_fs_type() without having any special permissions, and
people get uncomfortable when a user specified string (in this case
the filesystem type) goes all of the way to request_module.

After having looked at this issue I don't think there is any
particular reason to perform any filtering or permission checks beyond
making it clear in the module request that we want a filesystem
module.  The common pattern in the kernel is to call request_module()
without regards to the users permissions.  In general all a filesystem
module does once loaded is call register_filesystem() and go to sleep.
Which means there is not much attack surface exposed by loading a
filesytem module unless the filesystem is mounted.  In a user
namespace filesystems are not mounted unless .fs_flags = FS_USERNS_MOUNT,
which most filesystems do not set today.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Reported-by: Kees Cook <keescook@google.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2013-03-03 19:36:31 -08:00
Eric W. Biederman
ba0e3427b0 userns: Stop oopsing in key_change_session_keyring
Dave Jones <davej@redhat.com> writes:
> Just hit this on Linus' current tree.
>
> [   89.621770] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8
> [   89.623111] IP: [<ffffffff810784b0>] commit_creds+0x250/0x2f0
> [   89.624062] PGD 122bfd067 PUD 122bfe067 PMD 0
> [   89.624901] Oops: 0000 [#1] PREEMPT SMP
> [   89.625678] Modules linked in: caif_socket caif netrom bridge hidp 8021q garp stp mrp rose llc2 af_rxrpc phonet af_key binfmt_misc bnep l2tp_ppp can_bcm l2tp_core pppoe pppox can_raw scsi_transport_iscsi ppp_generic slhc nfnetlink can ipt_ULOG ax25 decnet irda nfc rds x25 crc_ccitt appletalk atm ipx p8023 psnap p8022 llc lockd sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack nf_conntrack ip6table_filter ip6_tables btusb bluetooth snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_pcm vhost_net snd_page_alloc snd_timer tun macvtap usb_debug snd rfkill microcode macvlan edac_core pcspkr serio_raw kvm_amd soundcore kvm r8169 mii
> [   89.637846] CPU 2
> [   89.638175] Pid: 782, comm: trinity-main Not tainted 3.8.0+ #63 Gigabyte Technology Co., Ltd. GA-MA78GM-S2H/GA-MA78GM-S2H
> [   89.639850] RIP: 0010:[<ffffffff810784b0>]  [<ffffffff810784b0>] commit_creds+0x250/0x2f0
> [   89.641161] RSP: 0018:ffff880115657eb8  EFLAGS: 00010207
> [   89.641984] RAX: 00000000000003e8 RBX: ffff88012688b000 RCX: 0000000000000000
> [   89.643069] RDX: 0000000000000000 RSI: ffffffff81c32960 RDI: ffff880105839600
> [   89.644167] RBP: ffff880115657ed8 R08: 0000000000000000 R09: 0000000000000000
> [   89.645254] R10: 0000000000000001 R11: 0000000000000246 R12: ffff880105839600
> [   89.646340] R13: ffff88011beea490 R14: ffff88011beea490 R15: 0000000000000000
> [   89.647431] FS:  00007f3ac063b740(0000) GS:ffff88012b200000(0000) knlGS:0000000000000000
> [   89.648660] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [   89.649548] CR2: 00000000000000c8 CR3: 0000000122bfc000 CR4: 00000000000007e0
> [   89.650635] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   89.651723] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [   89.652812] Process trinity-main (pid: 782, threadinfo ffff880115656000, task ffff88011beea490)
> [   89.654128] Stack:
> [   89.654433]  0000000000000000 ffff8801058396a0 ffff880105839600 ffff88011beeaa78
> [   89.655769]  ffff880115657ef8 ffffffff812c7d9b ffffffff82079be0 0000000000000000
> [   89.657073]  ffff880115657f28 ffffffff8106c665 0000000000000002 ffff880115657f58
> [   89.658399] Call Trace:
> [   89.658822]  [<ffffffff812c7d9b>] key_change_session_keyring+0xfb/0x140
> [   89.659845]  [<ffffffff8106c665>] task_work_run+0xa5/0xd0
> [   89.660698]  [<ffffffff81002911>] do_notify_resume+0x71/0xb0
> [   89.661581]  [<ffffffff816c9a4a>] int_signal+0x12/0x17
> [   89.662385] Code: 24 90 00 00 00 48 8b b3 90 00 00 00 49 8b 4c 24 40 48 39 f2 75 08 e9 83 00 00 00 48 89 ca 48 81 fa 60 29 c3 81 0f 84 41 fe ff ff <48> 8b 8a c8 00 00 00 48 39 ce 75 e4 3b 82 d0 00 00 00 0f 84 4b
> [   89.667778] RIP  [<ffffffff810784b0>] commit_creds+0x250/0x2f0
> [   89.668733]  RSP <ffff880115657eb8>
> [   89.669301] CR2: 00000000000000c8
>
> My fastest trinity induced oops yet!
>
>
> Appears to be..
>
>                 if ((set_ns == subset_ns->parent)  &&
>      850:       48 8b 8a c8 00 00 00    mov    0xc8(%rdx),%rcx
>
> from the inlined cred_cap_issubset

By historical accident we have been reading trying to set new->user_ns
from new->user_ns.  Which is totally silly as new->user_ns is NULL (as
is every other field in new except session_keyring at that point).

The intent is clearly to copy all of the fields from old to new so copy
old->user_ns into  into new->user_ns.

Cc: stable@vger.kernel.org
Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Dave Jones <davej@redhat.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2013-03-03 19:35:38 -08:00
Fabio Estevam
95381f38c0 ARM: mxs: ocotp: Fix sparse warning
Include <mach/common.h> header to fix the following sparse warning:

arch/arm/mach-mxs/ocotp.c:33:11: warning: symbol 'mxs_get_ocotp' was not declared. Should it be static?

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
2013-03-04 10:07:28 +08:00
Fabio Estevam
f26b016e7a ARM: mxs: icoll: Fix sparse warning
Fix the following sparse warning:

arch/arm/mach-mxs/icoll.c:103:13: warning: symbol 'icoll_of_init' was not declared. Should it be static?

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
2013-03-04 10:07:20 +08:00
Fabio Estevam
bb39cdc52f ARM: mxs: mm: Fix sparse warning
Include <mach/common.h> header to fix the following sparse warnings:

arch/arm/mach-mxs/mm.c:43:13: warning: symbol 'mx23_map_io' was not declared. Should it be static?
arch/arm/mach-mxs/mm.c:48:13: warning: symbol 'mx28_map_io' was not declared. Should it be static?

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
2013-03-04 10:07:13 +08:00