1. 11 10月, 2013 10 次提交
    • T
      random: speed up the fast_mix function by a factor of four · 655b2264
      Theodore Ts'o 提交于
      By mixing the entropy in chunks of 32-bit words instead of byte by
      byte, we can speed up the fast_mix function significantly.  Since it
      is called on every single interrupt, on systems with a very heavy
      interrupt load, this can make a noticeable difference.
      
      Also fix a compilation warning in add_interrupt_randomness() and avoid
      xor'ing cycles and jiffies together just in case we have an
      architecture which tries to define random_get_entropy() by returning
      jiffies.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      Reported-by: NJörn Engel <joern@logfs.org>
      655b2264
    • T
      random: cap the rate which the /dev/urandom pool gets reseeded · f5c2742c
      Theodore Ts'o 提交于
      In order to avoid draining the input pool of its entropy at too high
      of a rate, enforce a minimum time interval between reseedings of the
      urandom pool.  This is set to 60 seconds by default.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      f5c2742c
    • T
      random: optimize the entropy_store structure · c59974ae
      Theodore Ts'o 提交于
      Use smaller types to slightly shrink the size of the entropy store
      structure.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      c59974ae
    • T
      random: optimize spinlock use in add_device_randomness() · 3ef4cb2d
      Theodore Ts'o 提交于
      The add_device_randomness() function calls mix_pool_bytes() twice for
      the input pool and the non-blocking pool, for a total of four times.
      By using _mix_pool_byte() and taking the spinlock in
      add_device_randomness(), we can halve the number of times we need
      take each pool's spinlock.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      3ef4cb2d
    • T
      random: fix the tracepoint for get_random_bytes(_arch) · 5910895f
      Theodore Ts'o 提交于
      Fix a problem where get_random_bytes_arch() was calling the tracepoint
      get_random_bytes().  So add a new tracepoint for
      get_random_bytes_arch(), and make get_random_bytes() and
      get_random_bytes_arch() call their correct tracepoint.
      
      Also, add a new tracepoint for add_device_randomness()
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      5910895f
    • H
      random: account for entropy loss due to overwrites · 30e37ec5
      H. Peter Anvin 提交于
      When we write entropy into a non-empty pool, we currently don't
      account at all for the fact that we will probabilistically overwrite
      some of the entropy in that pool.  This means that unless the pool is
      fully empty, we are currently *guaranteed* to overestimate the amount
      of entropy in the pool!
      
      Assuming Shannon entropy with zero correlations we end up with an
      exponentally decaying value of new entropy added:
      
      	entropy <- entropy + (pool_size - entropy) *
      		(1 - exp(-add_entropy/pool_size))
      
      However, calculations involving fractional exponentials are not
      practical in the kernel, so apply a piecewise linearization:
      
      	  For add_entropy <= pool_size/2 then
      
      	  (1 - exp(-add_entropy/pool_size)) >= (add_entropy/pool_size)*0.7869...
      
      	  ... so we can approximate the exponential with
      	  3/4*add_entropy/pool_size and still be on the
      	  safe side by adding at most pool_size/2 at a time.
      
      In order for the loop not to take arbitrary amounts of time if a bad
      ioctl is received, terminate if we are within one bit of full.  This
      way the loop is guaranteed to terminate after no more than
      log2(poolsize) iterations, no matter what the input value is.  The
      vast majority of the time the loop will be executed exactly once.
      
      The piecewise linearization is very conservative, approaching 3/4 of
      the usable input value for small inputs, however, our entropy
      estimation is pretty weak at best, especially for small values; we
      have no handle on correlation; and the Shannon entropy measure (Rényi
      entropy of order 1) is not the correct one to use in the first place,
      but rather the correct entropy measure is the min-entropy, the Rényi
      entropy of infinite order.
      
      As such, this conservatism seems more than justified.
      
      This does introduce fractional bit values.  I have left it to have 3
      bits of fraction, so that with a pool of 2^12 bits the multiply in
      credit_entropy_bits() can still fit into an int, as 2*(3+12) < 31.  It
      is definitely possible to allow for more fractional accounting, but
      that multiply then would have to be turned into a 32*32 -> 64 multiply.
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      Signed-off-by: NTheodore Ts'o <tytso@mit.edu>
      Cc: DJ Johnston <dj.johnston@intel.com>
      30e37ec5
    • H
      random: allow fractional bits to be tracked · a283b5c4
      H. Peter Anvin 提交于
      Allow fractional bits of entropy to be tracked by scaling the entropy
      counter (fixed point).  This will be used in a subsequent patch that
      accounts for entropy lost due to overwrites.
      
      [ Modified by tytso to fix up a few missing places where the
        entropy_count wasn't properly converted from fractional bits to
        bits. ]
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      Signed-off-by: NTheodore Ts'o <tytso@mit.edu>
      a283b5c4
    • H
      random: statically compute poolbitshift, poolbytes, poolbits · 9ed17b70
      H. Peter Anvin 提交于
      Use a macro to statically compute poolbitshift (will be used in a
      subsequent patch), poolbytes, and poolbits.  On virtually all
      architectures the cost of a memory load with an offset is the same as
      the one of a memory load.
      
      It is still possible for this to generate worse code since the C
      compiler doesn't know the fixed relationship between these fields, but
      that is somewhat unlikely.
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      Signed-off-by: NTheodore Ts'o <tytso@mit.edu>
      9ed17b70
    • T
      random: mix in architectural randomness earlier in extract_buf() · 85a1f777
      Theodore Ts'o 提交于
      Previously if CPU chip had a built-in random number generator (i.e.,
      RDRAND on newer x86 chips), we mixed it in at the very end of
      extract_buf() using an XOR operation.
      
      We now mix it in right after the calculate a hash across the entire
      pool.  This has the advantage that any contribution of entropy from
      the CPU's HWRNG will get mixed back into the pool.  In addition, it
      means that if the HWRNG has any defects (either accidentally or
      maliciously introduced), this will be mitigated via the non-linear
      transform of the SHA-1 hash function before we hand out generated
      output.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      85a1f777
    • T
      random: allow architectures to optionally define random_get_entropy() · 61875f30
      Theodore Ts'o 提交于
      Allow architectures which have a disabled get_cycles() function to
      provide a random_get_entropy() function which provides a fine-grained,
      rapidly changing counter that can be used by the /dev/random driver.
      
      For example, an architecture might have a rapidly changing register
      used to control random TLB cache eviction, or DRAM refresh that
      doesn't meet the requirements of get_cycles(), but which is good
      enough for the needs of the random driver.
      Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
      Cc: stable@vger.kernel.org
      61875f30
  2. 23 9月, 2013 1 次提交
  3. 01 8月, 2013 1 次提交
    • A
      parisc: agp/parisc-agp: allow binding of user memory to the AGP GART · 06f0cce4
      Alex Ivanov 提交于
      Allow binding of user memory to the AGP GART on systems with HP
      Quicksilver AGP bus. This resolves 'bind memory failed' error seen in
      dmesg:
      
       [29.365973] [TTM] AGP Bind memory failed.
       …
       [29.367030] [drm] Forcing AGP to PCI mode
      
      The system doesn't more fail to bind the memory, and hence not falling
      back to the PCI mode (if other failures aren't detected).
      
      This is just a simple write down from the following patches:
      agp/amd-k7: Allow binding user memory to the AGP GART
      agp/hp-agp: Allow binding user memory to the AGP GART
      Signed-off-by: NAlex Ivanov <gnidorah@p0n4ik.tk>
      Cc: <stable@vger.kernel.org> # 3.10
      Signed-off-by: NHelge Deller <deller@gmx.de>
      06f0cce4
  4. 29 7月, 2013 5 次提交
    • A
      virtio: console: return -ENODEV on all read operations after unplug · 96f97a83
      Amit Shah 提交于
      If a port gets unplugged while a user is blocked on read(), -ENODEV is
      returned.  However, subsequent read()s returned 0, indicating there's no
      host-side connection (but not indicating the device went away).
      
      This also happened when a port was unplugged and the user didn't have
      any blocking operation pending.  If the user didn't monitor the SIGIO
      signal, they won't have a chance to find out if the port went away.
      
      Fix by returning -ENODEV on all read()s after the port gets unplugged.
      write() already behaves this way.
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: NAmit Shah <amit.shah@redhat.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      96f97a83
    • A
      virtio: console: fix raising SIGIO after port unplug · 92d34538
      Amit Shah 提交于
      SIGIO should be sent when a port gets unplugged.  It should only be sent
      to prcesses that have the port opened, and have asked for SIGIO to be
      delivered.  We were clearing out guest_connected before calling
      send_sigio_to_port(), resulting in a sigio not getting sent to
      processes.
      
      Fix by setting guest_connected to false after invoking the sigio
      function.
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: NAmit Shah <amit.shah@redhat.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      92d34538
    • A
      virtio: console: clean up port data immediately at time of unplug · ea3768b4
      Amit Shah 提交于
      We used to keep the port's char device structs and the /sys entries
      around till the last reference to the port was dropped.  This is
      actually unnecessary, and resulted in buggy behaviour:
      
      1. Open port in guest
      2. Hot-unplug port
      3. Hot-plug a port with the same 'name' property as the unplugged one
      
      This resulted in hot-plug being unsuccessful, as a port with the same
      name already exists (even though it was unplugged).
      
      This behaviour resulted in a warning message like this one:
      
      -------------------8<---------------------------------------
      WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xc9/0x130() (Not tainted)
      Hardware name: KVM
      sysfs: cannot create duplicate filename
      '/devices/pci0000:00/0000:00:04.0/virtio0/virtio-ports/vport0p1'
      
      Call Trace:
       [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0
       [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50
       [<ffffffff811f2319>] ? sysfs_add_one+0xc9/0x130
       [<ffffffff811f23e8>] ? create_dir+0x68/0xb0
       [<ffffffff811f2469>] ? sysfs_create_dir+0x39/0x50
       [<ffffffff81273129>] ? kobject_add_internal+0xb9/0x260
       [<ffffffff812733d8>] ? kobject_add_varg+0x38/0x60
       [<ffffffff812734b4>] ? kobject_add+0x44/0x70
       [<ffffffff81349de4>] ? get_device_parent+0xf4/0x1d0
       [<ffffffff8134b389>] ? device_add+0xc9/0x650
      
      -------------------8<---------------------------------------
      
      Instead of relying on guest applications to release all references to
      the ports, we should go ahead and unregister the port from all the core
      layers.  Any open/read calls on the port will then just return errors,
      and an unplug/plug operation on the host will succeed as expected.
      
      This also caused buggy behaviour in case of the device removal (not just
      a port): when the device was removed (which means all ports on that
      device are removed automatically as well), the ports with active
      users would clean up only when the last references were dropped -- and
      it would be too late then to be referencing char device pointers,
      resulting in oopses:
      
      -------------------8<---------------------------------------
      PID: 6162   TASK: ffff8801147ad500  CPU: 0   COMMAND: "cat"
       #0 [ffff88011b9d5a90] machine_kexec at ffffffff8103232b
       #1 [ffff88011b9d5af0] crash_kexec at ffffffff810b9322
       #2 [ffff88011b9d5bc0] oops_end at ffffffff814f4a50
       #3 [ffff88011b9d5bf0] die at ffffffff8100f26b
       #4 [ffff88011b9d5c20] do_general_protection at ffffffff814f45e2
       #5 [ffff88011b9d5c50] general_protection at ffffffff814f3db5
          [exception RIP: strlen+2]
          RIP: ffffffff81272ae2  RSP: ffff88011b9d5d00  RFLAGS: 00010246
          RAX: 0000000000000000  RBX: ffff880118901c18  RCX: 0000000000000000
          RDX: ffff88011799982c  RSI: 00000000000000d0  RDI: 3a303030302f3030
          RBP: ffff88011b9d5d38   R8: 0000000000000006   R9: ffffffffa0134500
          R10: 0000000000001000  R11: 0000000000001000  R12: ffff880117a1cc10
          R13: 00000000000000d0  R14: 0000000000000017  R15: ffffffff81aff700
          ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
       #6 [ffff88011b9d5d00] kobject_get_path at ffffffff8126dc5d
       #7 [ffff88011b9d5d40] kobject_uevent_env at ffffffff8126e551
       #8 [ffff88011b9d5dd0] kobject_uevent at ffffffff8126e9eb
       #9 [ffff88011b9d5de0] device_del at ffffffff813440c7
      
      -------------------8<---------------------------------------
      
      So clean up when we have all the context, and all that's left to do when
      the references to the port have dropped is to free up the port struct
      itself.
      
      CC: <stable@vger.kernel.org>
      Reported-by: Nchayang <chayang@redhat.com>
      Reported-by: NYOGANANTH SUBRAMANIAN <anantyog@in.ibm.com>
      Reported-by: NFuXiangChun <xfu@redhat.com>
      Reported-by: NQunfang Zhang <qzhang@redhat.com>
      Reported-by: NSibiao Luo <sluo@redhat.com>
      Signed-off-by: NAmit Shah <amit.shah@redhat.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      ea3768b4
    • A
      virtio: console: fix race in port_fops_open() and port unplug · 671bdea2
      Amit Shah 提交于
      Between open() being called and processed, the port can be unplugged.
      Check if this happened, and bail out.
      
      A simple test script to reproduce this is:
      
      while true; do for i in $(seq 1 100); do echo $i > /dev/vport0p3; done; done;
      
      This opens and closes the port a lot of times; unplugging the port while
      this is happening triggers the bug.
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: NAmit Shah <amit.shah@redhat.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      671bdea2
    • A
      virtio: console: fix race with port unplug and open/close · 057b82be
      Amit Shah 提交于
      There's a window between find_port_by_devt() returning a port and us
      taking a kref on the port, where the port could get unplugged.  Fix it
      by taking the reference in find_port_by_devt() itself.
      
      Problem reported and analyzed by Mateusz Guzik.
      
      CC: <stable@vger.kernel.org>
      Reported-by: NMateusz Guzik <mguzik@redhat.com>
      Signed-off-by: NAmit Shah <amit.shah@redhat.com>
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      057b82be
  5. 23 7月, 2013 2 次提交
    • Y
      virtio/console: Add pipe_lock/unlock for splice_write · 2b4fbf02
      Yoshihiro YUNOMAE 提交于
      Add pipe_lock/unlock for splice_write to avoid oops by following competition:
      
      (1) An application gets fds of a trace buffer, virtio-serial, pipe.
      (2) The application does fork()
      (3) The processes execute splice_read(trace buffer) and
          splice_write(virtio-serial) via same pipe.
      
              <parent>                   <child>
        get fds of a trace buffer,
               virtio-serial, pipe
                |
              fork()----------create--------+
                |                           |
            splice(read)                    |           ---+
            splice(write)                   |              +-- no competition
                |                       splice(read)       |
                |                       splice(write)   ---+
                |                           |
            splice(read)                    |
            splice(write)               splice(read)    ------ competition
                |                       splice(write)
      
      Two processes share a pipe_inode_info structure. If the child execute
      splice(read) when the parent tries to execute splice(write), the
      structure can be broken. Existing virtio-serial driver does not get
      lock for the structure in splice_write, so this competition will induce
      oops.
      
      <oops messages>
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
       IP: [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
       PGD 7223e067 PUD 72391067 PMD 0
       Oops: 0000 [#1] SMP
       Modules linked in: lockd bnep bluetooth rfkill sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd soundcore pcspkr virtio_net virtio_balloon i2c_piix4 i2c_core microcode uinput floppy
       CPU: 0 PID: 1072 Comm: compete-test Not tainted 3.10.0ws+ #55
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
       task: ffff880071b98000 ti: ffff88007b55e000 task.ti: ffff88007b55e000
       RIP: 0010:[<ffffffff811a6b5f>]  [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
       RSP: 0018:ffff88007b55fd78  EFLAGS: 00010287
       RAX: 0000000000000000 RBX: ffff88007b55fe20 RCX: 0000000000000000
       RDX: 0000000000001000 RSI: ffff88007a95ba30 RDI: ffff880036f9e6c0
       RBP: ffff88007b55fda8 R08: 00000000000006ec R09: ffff880077626708
       R10: 0000000000000003 R11: ffffffff8139ca59 R12: ffff88007a95ba30
       R13: 0000000000000000 R14: ffffffff8139dd00 R15: ffff880036f9e6c0
       FS:  00007f2e2e3a0740(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
       CR2: 0000000000000018 CR3: 0000000071bd1000 CR4: 00000000000006f0
       DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
       Stack:
        ffffffff8139ca59 ffff88007b55fe20 ffff880036f9e6c0 ffffffff8139dd00
        ffff8800776266c0 ffff880077626708 ffff88007b55fde8 ffffffff811a6e8e
        ffff88007b55fde8 ffffffff8139ca59 ffff880036f9e6c0 ffff88007b55fe20
       Call Trace:
        [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0
        [<ffffffff8139dd00>] ? virtcons_restore+0x100/0x100
        [<ffffffff811a6e8e>] __splice_from_pipe+0x7e/0x90
        [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0
        [<ffffffff8139d739>] port_fops_splice_write+0xe9/0x140
        [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120
        [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0
        [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110
        [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0
        [<ffffffff8161facf>] tracesys+0xdd/0xe2
       Code: 49 8b 87 80 00 00 00 4c 8d 24 d0 8b 53 04 41 8b 44 24 0c 4d 8b 6c 24 10 39 d0 89 03 76 02 89 13 49 8b 44 24 10 4c 89 e6 4c 89 ff <ff> 50 18 85 c0 0f 85 aa 00 00 00 48 89 da 4c 89 e6 4c 89 ff 41
       RIP  [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130
        RSP <ffff88007b55fd78>
       CR2: 0000000000000018
       ---[ end trace 24572beb7764de59 ]---
      
      V2: Fix a locking problem for error
      V3: Add Reviewed-by lines and stable@ line in sign-off area
      Signed-off-by: NYoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
      Reviewed-by: NAmit Shah <amit.shah@redhat.com>
      Reviewed-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      2b4fbf02
    • Y
      virtio/console: Quit from splice_write if pipe->nrbufs is 0 · 68c034fe
      Yoshihiro YUNOMAE 提交于
      Quit from splice_write if pipe->nrbufs is 0 for avoiding oops in virtio-serial.
      
      When an application was doing splice from a kernel buffer to virtio-serial on
      a guest, the application received signal(SIGINT). This situation will normally
      happen, but the kernel executed a kernel panic by oops as follows:
      
       BUG: unable to handle kernel paging request at ffff882071c8ef28
       IP: [<ffffffff812de48f>] sg_init_table+0x2f/0x50
       PGD 1fac067 PUD 0
       Oops: 0000 [#1] SMP
       Modules linked in: lockd sunrpc bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd microcode virtio_balloon virtio_net pcspkr soundcore i2c_piix4 i2c_core uinput floppy
       CPU: 1 PID: 908 Comm: trace-cmd Not tainted 3.10.0+ #49
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
       task: ffff880071c64650 ti: ffff88007bf24000 task.ti: ffff88007bf24000
       RIP: 0010:[<ffffffff812de48f>]  [<ffffffff812de48f>] sg_init_table+0x2f/0x50
       RSP: 0018:ffff88007bf25dd8  EFLAGS: 00010286
       RAX: 0000001fffffffe0 RBX: ffff882071c8ef28 RCX: 0000000000000000
       RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880071c8ef48
       RBP: ffff88007bf25de8 R08: ffff88007fd15d40 R09: ffff880071c8ef48
       R10: ffffea0001c71040 R11: ffffffff8139c555 R12: 0000000000000000
       R13: ffff88007506a3c0 R14: ffff88007c862500 R15: ffff880071c8ef00
       FS:  00007f0a3646c740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: ffff882071c8ef28 CR3: 000000007acbb000 CR4: 00000000000006e0
       DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
       Stack:
        ffff880071c8ef48 ffff88007bf25e20 ffff88007bf25e88 ffffffff8139d6fa
        ffff88007bf25e28 ffffffff8127a3f4 0000000000000000 0000000000000000
        ffff880071c8ef48 0000100000000000 0000000000000003 ffff88007bf25e08
       Call Trace:
        [<ffffffff8139d6fa>] port_fops_splice_write+0xaa/0x130
        [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120
        [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0
        [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110
        [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0
        [<ffffffff8161f8c2>] system_call_fastpath+0x16/0x1b
       Code: c1 e2 05 48 89 e5 48 83 ec 10 4c 89 65 f8 41 89 f4 31 f6 48 89 5d f0 48 89 fb e8 8d ce ff ff 41 8d 44 24 ff 48 c1 e0 05 48 01 c3 <48> 8b 03 48 83 e0 fe 48 83 c8 02 48 89 03 48 8b 5d f0 4c 8b 65
       RIP  [<ffffffff812de48f>] sg_init_table+0x2f/0x50
        RSP <ffff88007bf25dd8>
       CR2: ffff882071c8ef28
       ---[ end trace 86323505eb42ea8f ]---
      
      It seems to induce pagefault in sg_init_tabel() when pipe->nrbufs is equal to
      zero. This may happen in a following situation:
      
      (1) The application normally does splice(read) from a kernel buffer, then does
          splice(write) to virtio-serial.
      (2) The application receives SIGINT when is doing splice(read), so splice(read)
          is failed by EINTR. However, the application does not finish the operation.
      (3) The application tries to do splice(write) without pipe->nrbufs.
      (4) The virtio-console driver tries to touch scatterlist structure sgl in
          sg_init_table(), but the region is out of bound.
      
      To avoid the case, a kernel should check whether pipe->nrbufs is empty or not
      when splice_write is executed in the virtio-console driver.
      
      V3: Add Reviewed-by lines and stable@ line in sign-off area.
      Signed-off-by: NYoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
      Reviewed-by: NAmit Shah <amit.shah@redhat.com>
      Reviewed-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Cc: Amit Shah <amit.shah@redhat.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
      68c034fe
  6. 10 7月, 2013 1 次提交
  7. 04 7月, 2013 1 次提交
    • Z
      /dev/oldmem: Remove the interface · a11edb59
      Zhang Yanfei 提交于
      /dev/oldmem provides the interface for us to access the "old memory" in
      the dump-capture kernel.  Unfortunately, no one actually uses this
      interface.
      
      And this interface could actually cause some real problems if used on ia64
      where the cached/uncached accesses are mixed.  See the discussion from the
      link: https://lkml.org/lkml/2013/4/12/386.
      
      So Eric suggested that we should remove /dev/oldmem as an unused piece of
      code.
      
      [akpm@linux-foundation.org: mention /dev/oldmem obsolescence in devices.txt]
      Suggested-by: N"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: NZhang Yanfei <zhangyanfei@cn.fujitsu.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Dave Hansen <dave@sr71.net>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Matt Fleming <matt.fleming@intel.com>
      Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Tony Luck <tony.luck@intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      a11edb59
  8. 29 6月, 2013 2 次提交
  9. 28 6月, 2013 3 次提交
  10. 27 6月, 2013 1 次提交
  11. 25 6月, 2013 1 次提交
    • T
      char: misc: assign file->private_data in all cases · 585d98e0
      Thomas Petazzoni 提交于
      In fa1f68db ("drivers: misc: pass miscdevice pointer via file
      private data"), the misc driver infrastructure was changed to assigned
      file->private_data as a pointer to the 'struct miscdevice' that
      corresponds to the device being opened.
      
      However, this assignment was only done when the misc driver was
      declaring a driver-specific ->open() operation in its
      file_operations. This doesn't make sense, as the driver may not
      necessarily have a custom ->open() operation, and might still be
      interested in having file->private_data properly set for use in its
      ->read() and write() operations.
      
      Therefore, we move the assignment of file->private_data outside of the
      condition that tests whether a driver-specific ->open() operation was
      defined.
      Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Acked-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      585d98e0
  12. 21 6月, 2013 1 次提交
  13. 19 6月, 2013 1 次提交
    • A
      hwrng: bcm2835: fix MODULE_LICENSE tag · 22e8099f
      Arnd Bergmann 提交于
      The MODULE_LICENSE macro invocation must use either "GPL" or "GPL v2",
      but not "GPLv2" in order to be detected by the module loader.
      
      This fixes the allmodconfig build error:
      
      FATAL: modpost: GPL-incompatible module bcm2835-rng.ko uses GPL-only symbol 'platform_driver_unregister'
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Acked-by: NLubomir Rintel <lkundrak@v3.sk>
      Cc: Dom Cobley <popcornmix@gmail.com>
      Cc: Stephen Warren <swarren@wwwdotorg.org>
      Cc: Matt Mackall <mpm@selenic.com>
      Cc: linux-rpi-kernel@lists.infradead.org
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      22e8099f
  14. 18 6月, 2013 1 次提交
  15. 11 6月, 2013 1 次提交
  16. 07 6月, 2013 1 次提交
  17. 06 6月, 2013 1 次提交
    • G
      PCI: Convert alloc_pci_dev(void) to pci_alloc_dev(bus) · 8b1fce04
      Gu Zheng 提交于
      Use the new pci_alloc_dev(bus) to replace the existing using of
      alloc_pci_dev(void).
      
      [bhelgaas: drop pci_bus ref later in pci_release_dev()]
      Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
      Signed-off-by: NJiang Liu <jiang.liu@huawei.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: David Airlie <airlied@linux.ie>
      Cc: Neela Syam Kolli <megaraidlinux@lsi.com>
      Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
      Cc: Yinghai Lu <yinghai@kernel.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      8b1fce04
  18. 05 6月, 2013 2 次提交
  19. 04 6月, 2013 2 次提交
  20. 31 5月, 2013 1 次提交
    • A
      drm, agpgart: Use pgprot_writecombine for AGP maps and make the MTRR optional · f435046d
      Andy Lutomirski 提交于
      I'm not sure I understand the intent of the previous behavior.  mmap
      on /dev/agpgart and DRM_AGP maps had no cache flags set, so they
      would be fully cacheable.  But the DRM code (most of the time) would
      add a write-combining MTRR that would change the effective memory
      type to WC.
      
      The new behavior just requests WC explicitly for all AGP maps.
      
      If there is any code out there that expects cacheable access to the
      AGP aperture (because the drm driver doesn't request an MTRR or
      because it's using /dev/agpgart directly), then it will now end up
      with a UC or WC mapping, depending on the architecture and PAT
      availability.  But cacheable access to the aperture seems like it's
      asking for trouble, because, AIUI, the aperture is an alias of RAM.
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: NAndy Lutomirski <luto@amacapital.net>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      f435046d
  21. 30 5月, 2013 1 次提交