1. 29 9月, 2012 1 次提交
    • L
      mtdchar: fix offset overflow detection · 9c603e53
      Linus Torvalds 提交于
      Sasha Levin has been running trinity in a KVM tools guest, and was able
      to trigger the BUG_ON() at arch/x86/mm/pat.c:279 (verifying the range of
      the memory type).  The call trace showed that it was mtdchar_mmap() that
      created an invalid remap_pfn_range().
      
      The problem is that mtdchar_mmap() does various really odd and subtle
      things with the vma page offset etc, and uses the wrong types (and the
      wrong overflow) detection for it.
      
      For example, the page offset may well be 32-bit on a 32-bit
      architecture, but after shifting it up by PAGE_SHIFT, we need to use a
      potentially 64-bit resource_size_t to correctly hold the full value.
      
      Also, we need to check that the vma length plus offset doesn't overflow
      before we check that it is smaller than the length of the mtdmap region.
      
      This fixes things up and tries to make the code a bit easier to read.
      Reported-and-tested-by: NSasha Levin <levinsasha928@gmail.com>
      Acked-by: NSuresh Siddha <suresh.b.siddha@intel.com>
      Acked-by: NArtem Bityutskiy <dedekind1@gmail.com>
      Cc: David Woodhouse <dwmw2@infradead.org>
      Cc: linux-mtd@lists.infradead.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9c603e53
  2. 08 5月, 2012 1 次提交
    • W
      mtd: fix oops in dataflash driver · 7a84477c
      Will Newton 提交于
      I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
      be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
      with -1 for offset and length and a NULL buffer to test if OTP
      operations are supported. This finds its way down to otp_read in
      mtd_dataflash.c and causes an oops when memcpying the returned data
      into the NULL buf.
      
      None of the checks in otp_read catches the negative length and offset.
      Changing the length of the dummy read to 0 prevents the oops.
      
      Cc: stable@kernel.org [3.3+]
      Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
      Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>
      7a84477c
  3. 09 4月, 2012 1 次提交
  4. 01 4月, 2012 1 次提交
  5. 27 3月, 2012 1 次提交
    • A
      mtd: add leading underscore to all mtd functions · 3c3c10bb
      Artem Bityutskiy 提交于
      This patch renames all MTD functions by adding a "_" prefix:
      
      mtd->erase -> mtd->_erase
      mtd->read_oob -> mtd->_read_oob
      ...
      
      The reason is that we are re-working the MTD API and from now on it is
      an error to use MTD function pointers directly - we have a corresponding
      API call for every pointer. By adding a leading "_" we achieve the following:
      
      1. Make sure we convert every direct pointer users
      2. A leading "_" suggests that this interface is internal and it becomes
         less likely that people will use them directly
      3. Make sure all the out-of-tree modules stop compiling and the owners
         spot the big API change and amend them.
      Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
      Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>
      3c3c10bb
  6. 24 3月, 2012 1 次提交
  7. 10 1月, 2012 31 次提交
  8. 02 11月, 2011 1 次提交
  9. 21 9月, 2011 1 次提交
  10. 11 9月, 2011 1 次提交
反馈
建议
客服 返回
顶部