1. 06 6月, 2015 2 次提交
  2. 05 6月, 2015 2 次提交
    • H
      compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() · 9b7b819c
      Helge Deller 提交于
      In the functions compat_get_bitmap() and compat_put_bitmap() the
      variable nr_compat_longs stores how many compat_ulong_t words should be
      copied in a loop.
      
      The copy loop itself is this:
        if (nr_compat_longs-- > 0) {
            if (__get_user(um, umask)) return -EFAULT;
        } else {
            um = 0;
        }
      
      Since nr_compat_longs gets unconditionally decremented in each loop and
      since it's type is unsigned this could theoretically lead to out of
      bounds accesses to userspace if nr_compat_longs wraps around to
      (unsigned)(-1).
      
      Although the callers currently do not trigger out-of-bounds accesses, we
      should better implement the loop in a safe way to completely avoid such
      warp-arounds.
      Signed-off-by: NHelge Deller <deller@gmx.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      9b7b819c
    • L
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · ff25ea8f
      Linus Torvalds 提交于
      Pull dmaengine fixes from Vinod Koul:
       "We have two small fixes:
      
         - pl330 termination hang fix by Krzysztof
      
         - hsu memory leak fix by Peter"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: hsu: Fix memory leak when stopping a running transfer
        dmaengine: pl330: Fix hang on dmaengine_terminate_all on certain boards
      ff25ea8f
  3. 04 6月, 2015 5 次提交
  4. 03 6月, 2015 5 次提交
  5. 02 6月, 2015 13 次提交
  6. 01 6月, 2015 13 次提交