linux/drivers/char, branch v2.6.39

drivercore: revert addition of of_match to struct device

2011-05-18T18:32:23Z

Commit b826291c, "drivercore/dt: add a match table pointer to struct device" added an of_match pointer to struct device to cache the of_match_table entry discovered at driver match time. This was unsafe because matching is not an atomic operation with probing a driver. If two or more drivers are attempted to be matched to a driver at the same time, then the cached matching entry pointer could get overwritten. This patch reverts the of_match cache pointer and reworks all users to call of_match_device() directly instead. Signed-off-by: Grant Likely

Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus

2011-04-21T16:58:42Z

* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: virtio: console: Enable call to hvc_remove() on console port remove virtio_pci: Prevent double-free of pci regions after device hot-unplug virtio: Decrement avail idx on buffer detach

virtio: console: Enable call to hvc_remove() on console port remove

2011-04-21T13:27:00Z

This call was disabled as hot-unplugging one virtconsole port led to another virtconsole port freezing. Upon testing it again, this now works, so enable it. In addition, a bug was found in qemu wherein removing a port of one type caused the guest output from another port to stop working. I doubt it was just this bug that caused it (since disabling the hvc_remove() call did allow other ports to continue working), but since it's all solved now, we're fine with hot-unplugging of virtconsole ports. Signed-off-by: Amit Shah Signed-off-by: Rusty Russell

agp: fix arbitrary kernel memory writes

2011-04-21T02:16:55Z

pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov Signed-off-by: Dave Airlie

agp: fix OOM and buffer overflow

2011-04-21T01:51:04Z

page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov Signed-off-by: Dave Airlie

Fix common misspellings

2011-03-31T14:26:23Z

Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi

char/tpm: Fix unitialized usage of data buffer

2011-03-29T16:45:34Z

This patch fixes information leakage to the userspace by initializing the data buffer to zero. Reported-by: Peter Huewe Signed-off-by: Peter Huewe Signed-off-by: Marcel Selhorst [ Also removed the silly "* sizeof(u8)". If that isn't 1, we have way deeper problems than a simple multiplication can fix. - Linus ] Signed-off-by: Linus Torvalds

drivers/char/mem.c: clean up the code

2011-03-24T02:46:40Z

Reduce the lines of code and simplify the logic. Signed-off-by: Changli Gao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drivers/char: add MSM smd_pkt driver

2011-03-24T02:46:38Z

Add smd_pkt driver which provides device interface to smd packet ports. Signed-off-by: Niranjana Vishwanathapura Cc: Brian Swetland Cc: Greg KH Cc: Alan Cox Cc: David Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drivers/char/ipmi/ipmi_si_intf.c: fix cleanup_one_si section mismatch

2011-03-24T02:46:38Z

commit d2478521afc2022 ("char/ipmi: fix OOPS caused by pnp_unregister_driver on unregistered driver") introduced a section mismatch by calling __exit cleanup_ipmi_si from __devinit init_ipmi_si. Remove __exit annotation from cleanup_ipmi_si. Signed-off-by: Sergey Senozhatsky Acked-by: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds