linux/kernel/relay.c, branch v2.6.25

relay: set an spd_release() hook for splice

2008-03-26T11:04:09Z

relay doesn't reference the pages it adds, however we need a non-NULL hook or splice_to_pipe() can oops. Signed-off-by: Jens Axboe

set relay file can not be read by pread(2)

2008-03-26T11:01:28Z

I found that relay files can be read by pread(2). I fix it, for relay files are not capable of seeking. Signed-off-by: Lai Jiangshan Signed-off-by: Jens Axboe

relay: fix subbuf_splice_actor() adding too many pages

2008-03-17T08:04:59Z

If subbuf_pages was larger than the max number of pages the pipe buffer will hold, subbuf_splice_actor() would happily go beyond the array size. Signed-off-by: Jens Axboe

relay: nopage

2008-02-06T18:41:07Z

Convert relay from nopage to fault. Remove redundant vma range checks. Switch from OOM to SIGBUS if the resource is not available. Signed-off-by: Nick Piggin Cc: Tom Zanussi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

vm audit: add VM_DONTEXPAND to mmap for drivers that need it

2008-02-04T15:55:38Z

Drivers that register a ->fault handler, but do not range-check the offset argument, must set VM_DONTEXPAND in the vm_flags in order to prevent an expanding mremap from overflowing the resource. I've audited the tree and attempted to fix these problems (usually by adding VM_DONTEXPAND where it is not obvious). Signed-off-by: Nick Piggin Signed-off-by: Linus Torvalds

whitespace fixes: relayfs

2007-10-18T21:37:24Z

Signed-off-by: Daniel Walker Cc: Tom Zanussi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Fix a use after free bug in kernel->userspace relay file support

2007-07-31T22:39:42Z

Coverity spotted what looks like a real possible case of using a variable after it has been freed. The problem is in kernel/relay.c::relay_open_buf() If the code hits "goto free_buf;" it ends up in this code : free_buf: relay_destroy_buf(buf); <--- calls kfree() on 'buf'. free_name: kfree(tmpname); end: return buf; <-- use after free of 'buf'. I read through the callers and they all handle a NULL return from this function as an error (and hitting the 'free_buf' label only happens on failure to chan->cb->create_buf_file(), so that looks like a clear error to me). The patch simply sets 'buf' to NULL after the call to relay_destroy_buf(buf); - as far as I can see that should take care of the problem. The patch also corrects a reference to a documentation file while I was at it. Note from Mathieu: the documentation reference change should have been done in a separate patch, but I guess no one will really care. Signed-off-by: Jesper Juhl Acked-by: "David J. Wilder" Tested-by: "David J. Wilder" Signed-off-by: Mathieu Desnoyers Cc: Tom Zanussi Cc: Karim Yaghmour Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

kernel/relay.c: make functions static

2007-07-19T17:04:47Z

Signed-off-by: Adrian Bunk Cc: Tom Zanussi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

relay: fixup kerneldoc comment

2007-07-13T12:14:28Z

Change comment from kerneldoc to normal. Signed-off-by: Tom Zanussi Signed-off-by: Jens Axboe

relay: fix bogus cast in subbuf_splice_actor()

2007-07-13T12:14:26Z

The current code that sets the read position in subbuf_splice_actor may give erroneous results if the buffer size isn't a power of 2. This patch fixes the problem. Signed-off-by: Tom Zanussi Signed-off-by: Jens Axboe