2009-01-15 19:58:07

by Greg KH

[permalink] [raw]
Subject: [patch 00/94] 2.6.28.1 stable review

This is the start of the stable review cycle for the 2.6.28.1 release.
There are 94 patches in this series, all will be posted as a response to
this one. If anyone has any issues with these being applied, please let
us know. If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line. If you wish to be a reviewer, please email [email protected] to
add your name to the list. If you want to be off the reviewer list,
also email us.

Responses should be made by Saturday, January 17, 20:00:00 UTC.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.28.1-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h


Makefile | 2 +-
arch/Kconfig | 3 +
arch/alpha/kernel/entry.S | 8 +-
arch/alpha/kernel/systbls.S | 2 +-
arch/arm/kernel/calls.S | 2 +-
arch/cris/arch-v10/kernel/entry.S | 2 +-
arch/cris/arch-v32/kernel/entry.S | 2 +-
arch/h8300/kernel/syscalls.S | 2 +-
arch/ia64/ia32/ia32_entry.S | 2 +-
arch/ia64/include/asm/unistd.h | 2 +-
arch/ia64/kernel/entry.S | 2 +-
arch/ia64/kernel/sys_ia64.c | 2 +-
arch/m68k/kernel/entry.S | 2 +-
arch/m68knommu/kernel/syscalltable.S | 2 +-
arch/mips/kernel/scall32-o32.S | 2 +-
arch/mn10300/kernel/entry.S | 2 +-
arch/powerpc/Kconfig | 1 +
arch/powerpc/include/asm/systbl.h | 2 +-
arch/powerpc/platforms/pseries/Kconfig | 2 +-
arch/s390/Kconfig | 1 +
arch/s390/kernel/compat_wrapper.S | 4 +-
arch/s390/kernel/entry.h | 16 ++--
arch/s390/kernel/process.c | 9 +-
arch/s390/kernel/signal.c | 19 ++--
arch/s390/kernel/sys_s390.c | 35 ++++---
arch/s390/kernel/syscalls.S | 12 +-
arch/sh/include/asm/syscalls_32.h | 6 +-
arch/sh/kernel/sys_sh32.c | 2 +-
arch/sh/kernel/syscalls_32.S | 4 +-
arch/sh/kernel/syscalls_64.S | 2 +-
arch/sparc/kernel/entry.S | 4 +-
arch/sparc/kernel/systbls.S | 4 +-
arch/sparc64/kernel/syscalls.S | 2 +-
arch/sparc64/kernel/systbls.S | 4 +-
arch/x86/Kconfig | 2 +-
arch/x86/kernel/cpu/addon_cpuid_features.c | 8 ++
arch/x86/kernel/cpu/intel.c | 8 +-
arch/x86/kernel/head64.c | 2 +-
arch/x86/kernel/head_64.S | 2 +-
arch/x86/kernel/syscall_table_32.S | 2 +-
arch/x86/kernel/tlb_uv.c | 9 --
arch/x86/mm/fault.c | 2 +-
drivers/dma/ioat_dma.c | 13 +-
drivers/hid/hid-sony.c | 2 +-
drivers/ide/tx4938ide.c | 4 +-
drivers/ide/tx4939ide.c | 10 ++-
drivers/md/bitmap.c | 8 +-
drivers/md/dm-log.c | 5 +
drivers/md/dm-raid1.c | 6 +-
drivers/net/wireless/ath5k/phy.c | 4 +-
drivers/net/wireless/ath5k/reset.c | 4 +-
drivers/net/wireless/ath9k/recv.c | 5 +-
drivers/net/wireless/iwlwifi/iwl-agn.c | 12 +--
drivers/net/wireless/iwlwifi/iwl-rx.c | 29 +++--
drivers/pci/syscall.c | 12 +--
drivers/scsi/eata.c | 15 ++-
drivers/scsi/ibmvscsi/ibmvfc.c | 25 +++--
drivers/scsi/ibmvscsi/ibmvfc.h | 6 +-
drivers/scsi/mvsas.c | 2 +-
drivers/scsi/pcmcia/aha152x_stub.c | 2 +-
drivers/usb/host/isp1760-if.c | 113 +++++++++++--------
drivers/usb/misc/emi26.c | 2 +-
drivers/usb/storage/unusual_devs.h | 23 ++++-
fs/affs/file.c | 2 +-
fs/afs/write.c | 2 +-
fs/aio.c | 22 ++--
fs/buffer.c | 6 +-
fs/cifs/cifs_dfs_ref.c | 48 ++++++--
fs/cifs/file.c | 2 +-
fs/compat.c | 6 +-
fs/dcache.c | 7 +-
fs/dcookies.c | 10 ++-
fs/ecryptfs/inode.c | 3 +-
fs/ecryptfs/mmap.c | 2 +-
fs/eventfd.c | 5 +-
fs/eventpoll.c | 18 ++--
fs/exec.c | 2 +-
fs/ext3/inode.c | 2 +-
fs/ext3/namei.c | 3 +-
fs/ext4/inode.c | 4 +-
fs/ext4/namei.c | 3 +-
fs/fcntl.c | 11 +-
fs/filesystems.c | 2 +-
fs/fuse/file.c | 4 +-
fs/gfs2/ops_address.c | 2 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/inotify_user.c | 9 +-
fs/ioctl.c | 2 +-
fs/ioprio.c | 5 +-
fs/jffs2/file.c | 2 +-
fs/libfs.c | 2 +-
fs/locks.c | 2 +-
fs/minix/dir.c | 2 +-
fs/namei.c | 48 ++++----
fs/namespace.c | 13 +-
fs/nfs/file.c | 2 +-
fs/nfs/read.c | 6 -
fs/nfsctl.c | 4 +-
fs/open.c | 82 ++++++++------
fs/pipe.c | 4 +-
fs/quota.c | 3 +-
fs/read_write.c | 49 ++++++---
fs/readdir.c | 9 +-
fs/reiserfs/inode.c | 2 +-
fs/select.c | 29 +++---
fs/signalfd.c | 8 +-
fs/smbfs/file.c | 2 +-
fs/splice.c | 12 +-
fs/stat.c | 38 ++++---
fs/super.c | 2 +-
fs/sync.c | 32 ++++-
fs/timerfd.c | 10 +-
fs/ubifs/file.c | 9 +-
fs/utimes.c | 11 +-
fs/xattr.c | 53 ++++-----
include/linux/compat.h | 13 ++
include/linux/fs.h | 5 +-
include/linux/mm.h | 1 -
include/linux/pagemap.h | 3 +-
include/linux/radix-tree.h | 2 +-
include/linux/syscalls.h | 171 +++++++++++++++++++---------
include/linux/time.h | 1 +
ipc/mqueue.c | 28 +++---
ipc/msg.c | 12 +-
ipc/sem.c | 18 ++-
ipc/shm.c | 8 +-
kernel/acct.c | 2 +-
kernel/capability.c | 4 +-
kernel/cgroup.c | 6 +-
kernel/exec_domain.c | 3 +-
kernel/exit.c | 17 ++--
kernel/fork.c | 4 +-
kernel/futex.c | 17 ++--
kernel/hrtimer.c | 4 +-
kernel/itimer.c | 7 +-
kernel/kexec.c | 5 +-
kernel/module.c | 10 +-
kernel/posix-timers.c | 43 +++----
kernel/printk.c | 7 +-
kernel/ptrace.c | 2 +-
kernel/sched.c | 30 +++---
kernel/sched_clock.c | 5 +-
kernel/signal.c | 59 ++++------
kernel/sys.c | 72 ++++++------
kernel/sys_ni.c | 1 +
kernel/sysctl.c | 4 +-
kernel/time.c | 14 +-
kernel/time/timekeeping.c | 7 +-
kernel/timer.c | 18 ++--
kernel/trace/ring_buffer.c | 19 +++-
kernel/uid16.c | 39 ++++---
mm/fadvise.c | 18 +++-
mm/filemap.c | 22 +++-
mm/fremap.c | 4 +-
mm/madvise.c | 2 +-
mm/mempolicy.c | 24 ++--
mm/migrate.c | 8 +-
mm/mincore.c | 4 +-
mm/mlock.c | 8 +-
mm/mmap.c | 4 +-
mm/mprotect.c | 4 +-
mm/mremap.c | 6 +-
mm/msync.c | 2 +-
mm/nommu.c | 10 +-
mm/swapfile.c | 4 +-
mm/vmalloc.c | 5 +-
net/socket.c | 63 +++++-----
security/device_cgroup.c | 3 +
security/keys/keyctl.c | 22 ++--
sound/pci/hda/patch_analog.c | 5 +-
sound/pci/hda/patch_sigmatel.c | 2 +
sound/usb/caiaq/caiaq-device.h | 1 +
sound/usb/caiaq/caiaq-midi.c | 32 +++---
173 files changed, 1167 insertions(+), 872 deletions(-)


2009-01-15 20:00:39

by Greg KH

[permalink] [raw]
Subject: [patch 01/94] ALSA: hda - Add quirk for another HP dv7

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 69dfaefee4a2dfdfee3488a306403fe1e51f0be5 upstream.

Added the model=hp-m4 quirk for another HP dv7 (103c:30fc) with IDT
92HD71b* codec.

Reference: Novell bnc#461108
https://bugzilla.novell.com/show_bug.cgi?id=461108

Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
sound/pci/hda/patch_sigmatel.c | 2 ++
1 file changed, 2 insertions(+)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1720,6 +1720,8 @@ static struct snd_pci_quirk stac92hd71bx
"HP dv5", STAC_HP_M4),
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30f4,
"HP dv7", STAC_HP_M4),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
+ "HP dv7", STAC_HP_M4),
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
"unknown HP", STAC_HP_M4),
SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,

2009-01-15 20:01:24

by Greg KH

[permalink] [raw]
Subject: [patch 02/94] ALSA: hda - Add quirk for HP6730B laptop

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 11d518e07d700eeb5bcec36bfd5f501e405230dd upstream.

Added model=laptop for HP 6730B laptop with AD1984A codec.
Reference: Novell bnc#457909
https://bugzilla.novell.com/show_bug.cgi?id=457909

Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
sound/pci/hda/patch_analog.c | 1 +
1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3861,6 +3861,7 @@ static const char *ad1884a_models[AD1884
static struct snd_pci_quirk ad1884a_cfg_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x3030, "HP", AD1884A_MOBILE),
SND_PCI_QUIRK(0x103c, 0x3056, "HP", AD1884A_MOBILE),
+ SND_PCI_QUIRK(0x103c, 0x30e6, "HP 6730b", AD1884A_LAPTOP),
SND_PCI_QUIRK(0x103c, 0x30e7, "HP EliteBook 8530p", AD1884A_LAPTOP),
SND_PCI_QUIRK(0x103c, 0x3614, "HP 6730s", AD1884A_LAPTOP),
SND_PCI_QUIRK(0x17aa, 0x20ac, "Thinkpad X300", AD1884A_THINKPAD),

2009-01-15 20:01:50

by Greg KH

[permalink] [raw]
Subject: [patch 03/94] ALSA: caiaq - Fix Oops with MIDI

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit f3f80a9205da74fa56d613f4c14b88b6e4e6caa8 upstream.

The snd-usb-caiaq driver causes Oops occasionally when accessing MIDI
devices. This patch fixes the Oops and invalid URB submission errors
as well.

Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
sound/usb/caiaq/caiaq-device.h | 1 +
sound/usb/caiaq/caiaq-midi.c | 32 ++++++++++++++++++--------------
2 files changed, 19 insertions(+), 14 deletions(-)

--- a/sound/usb/caiaq/caiaq-device.h
+++ b/sound/usb/caiaq/caiaq-device.h
@@ -75,6 +75,7 @@ struct snd_usb_caiaqdev {
wait_queue_head_t ep1_wait_queue;
wait_queue_head_t prepare_wait_queue;
int spec_received, audio_parm_answer;
+ int midi_out_active;

char vendor_name[CAIAQ_USB_STR_LEN];
char product_name[CAIAQ_USB_STR_LEN];
--- a/sound/usb/caiaq/caiaq-midi.c
+++ b/sound/usb/caiaq/caiaq-midi.c
@@ -59,6 +59,11 @@ static int snd_usb_caiaq_midi_output_ope

static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substream)
{
+ struct snd_usb_caiaqdev *dev = substream->rmidi->private_data;
+ if (dev->midi_out_active) {
+ usb_kill_urb(&dev->midi_out_urb);
+ dev->midi_out_active = 0;
+ }
return 0;
}

@@ -69,7 +74,8 @@ static void snd_usb_caiaq_midi_send(stru

dev->midi_out_buf[0] = EP1_CMD_MIDI_WRITE;
dev->midi_out_buf[1] = 0; /* port */
- len = snd_rawmidi_transmit_peek(substream, dev->midi_out_buf+3, EP1_BUFSIZE-3);
+ len = snd_rawmidi_transmit(substream, dev->midi_out_buf + 3,
+ EP1_BUFSIZE - 3);

if (len <= 0)
return;
@@ -79,24 +85,24 @@ static void snd_usb_caiaq_midi_send(stru

ret = usb_submit_urb(&dev->midi_out_urb, GFP_ATOMIC);
if (ret < 0)
- log("snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed, %d\n",
- substream, ret);
+ log("snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed,"
+ "ret=%d, len=%d\n",
+ substream, ret, len);
+ else
+ dev->midi_out_active = 1;
}

static void snd_usb_caiaq_midi_output_trigger(struct snd_rawmidi_substream *substream, int up)
{
struct snd_usb_caiaqdev *dev = substream->rmidi->private_data;

- if (dev->midi_out_substream != NULL)
- return;
-
- if (!up) {
+ if (up) {
+ dev->midi_out_substream = substream;
+ if (!dev->midi_out_active)
+ snd_usb_caiaq_midi_send(dev, substream);
+ } else {
dev->midi_out_substream = NULL;
- return;
}
-
- dev->midi_out_substream = substream;
- snd_usb_caiaq_midi_send(dev, substream);
}


@@ -161,16 +167,14 @@ int snd_usb_caiaq_midi_init(struct snd_u
void snd_usb_caiaq_midi_output_done(struct urb* urb)
{
struct snd_usb_caiaqdev *dev = urb->context;
- char *buf = urb->transfer_buffer;

+ dev->midi_out_active = 0;
if (urb->status != 0)
return;

if (!dev->midi_out_substream)
return;

- snd_rawmidi_transmit_ack(dev->midi_out_substream, buf[2]);
- dev->midi_out_substream = NULL;
snd_usb_caiaq_midi_send(dev, dev->midi_out_substream);
}

2009-01-15 20:04:41

by Greg KH

[permalink] [raw]
Subject: [patch 07/94] CIFS: make sure that DFS pathnames are properly formed

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steve French <[email protected]>

commit c6fbba0546d3ead18d4a623e76e28bcbaa66a325 upstream.

The paths in a DFS request are supposed to only have a single preceding
backslash, but we are sending them with a double backslash. This is
exposing a bug in Windows where it also sends a path in the response
that has a double backslash.

The existing code that builds the mount option string however expects a
double backslash prefix in a couple of places when it tries to use the
path returned by build_path_from_dentry. Fix compose_mount_options to
expect properly formed DFS paths (single backslash at front).

Also clean up error handling in that function. There was a possible
NULL pointer dereference and situations where a partially built option
string would be returned.

Tested against Samba 3.0.28-ish server and Samba 3.3 and Win2k8.

Signed-off-by: Jeff Layton <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/cifs/cifs_dfs_ref.c | 48 ++++++++++++++++++++++++++++++++++++------------
1 file changed, 36 insertions(+), 12 deletions(-)

--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -122,7 +122,7 @@ static char *compose_mount_options(const
char **devname)
{
int rc;
- char *mountdata;
+ char *mountdata = NULL;
int md_len;
char *tkn_e;
char *srvIP = NULL;
@@ -136,10 +136,9 @@ static char *compose_mount_options(const
*devname = cifs_get_share_name(ref->node_name);
rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
if (rc != 0) {
- cERROR(1, ("%s: Failed to resolve server part of %s to IP",
- __func__, *devname));
- mountdata = ERR_PTR(rc);
- goto compose_mount_options_out;
+ cERROR(1, ("%s: Failed to resolve server part of %s to IP: %d",
+ __func__, *devname, rc));;
+ goto compose_mount_options_err;
}
/* md_len = strlen(...) + 12 for 'sep+prefixpath='
* assuming that we have 'unc=' and 'ip=' in
@@ -149,8 +148,8 @@ static char *compose_mount_options(const
strlen(ref->node_name) + 12;
mountdata = kzalloc(md_len+1, GFP_KERNEL);
if (mountdata == NULL) {
- mountdata = ERR_PTR(-ENOMEM);
- goto compose_mount_options_out;
+ rc = -ENOMEM;
+ goto compose_mount_options_err;
}

/* copy all options except of unc,ip,prefixpath */
@@ -197,18 +196,32 @@ static char *compose_mount_options(const

/* find & copy prefixpath */
tkn_e = strchr(ref->node_name + 2, '\\');
- if (tkn_e == NULL) /* invalid unc, missing share name*/
- goto compose_mount_options_out;
+ if (tkn_e == NULL) {
+ /* invalid unc, missing share name*/
+ rc = -EINVAL;
+ goto compose_mount_options_err;
+ }

+ /*
+ * this function gives us a path with a double backslash prefix. We
+ * require a single backslash for DFS. Temporarily increment fullpath
+ * to put it in the proper form and decrement before freeing it.
+ */
fullpath = build_path_from_dentry(dentry);
+ if (!fullpath) {
+ rc = -ENOMEM;
+ goto compose_mount_options_err;
+ }
+ ++fullpath;
tkn_e = strchr(tkn_e + 1, '\\');
- if (tkn_e || strlen(fullpath) - (ref->path_consumed)) {
+ if (tkn_e || (strlen(fullpath) - ref->path_consumed)) {
strncat(mountdata, &sep, 1);
strcat(mountdata, "prefixpath=");
if (tkn_e)
strcat(mountdata, tkn_e + 1);
- strcat(mountdata, fullpath + (ref->path_consumed));
+ strcat(mountdata, fullpath + ref->path_consumed);
}
+ --fullpath;
kfree(fullpath);

/*cFYI(1,("%s: parent mountdata: %s", __func__,sb_mountdata));*/
@@ -217,6 +230,11 @@ static char *compose_mount_options(const
compose_mount_options_out:
kfree(srvIP);
return mountdata;
+
+compose_mount_options_err:
+ kfree(mountdata);
+ mountdata = ERR_PTR(rc);
+ goto compose_mount_options_out;
}


@@ -309,13 +327,19 @@ cifs_dfs_follow_mountpoint(struct dentry
goto out_err;
}

+ /*
+ * The MSDFS spec states that paths in DFS referral requests and
+ * responses must be prefixed by a single '\' character instead of
+ * the double backslashes usually used in the UNC. This function
+ * gives us the latter, so we must adjust the result.
+ */
full_path = build_path_from_dentry(dentry);
if (full_path == NULL) {
rc = -ENOMEM;
goto out_err;
}

- rc = get_dfs_path(xid, ses , full_path, cifs_sb->local_nls,
+ rc = get_dfs_path(xid, ses , full_path + 1, cifs_sb->local_nls,
&num_referrals, &referrals,
cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);

2009-01-15 20:05:13

by Greg KH

[permalink] [raw]
Subject: [patch 08/94] ring-buffer: prevent false positive warning

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steven Rostedt <[email protected]>

commit 98db8df777438e16ad0f44a0fba05ebbdb73db8d upstream.

Impact: eliminate false WARN_ON message

If an interrupt goes off after the setting of the local variable
tail_page and before incrementing the write index of that page,
the interrupt could push the commit forward to the next page.

Later a check is made to see if interrupts pushed the buffer around
the entire ring buffer by comparing the next page to the last commited
page. This can produce a false positive if the interrupt had pushed
the commit page forward as stated above.

Thanks to Jiaying Zhang for finding this race.

Reported-by: Jiaying Zhang <[email protected]>
Signed-off-by: Steven Rostedt <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
kernel/trace/ring_buffer.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -880,12 +880,15 @@ static struct ring_buffer_event *
__rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
unsigned type, unsigned long length, u64 *ts)
{
- struct buffer_page *tail_page, *head_page, *reader_page;
+ struct buffer_page *tail_page, *head_page, *reader_page, *commit_page;
unsigned long tail, write;
struct ring_buffer *buffer = cpu_buffer->buffer;
struct ring_buffer_event *event;
unsigned long flags;

+ commit_page = cpu_buffer->commit_page;
+ /* we just need to protect against interrupts */
+ barrier();
tail_page = cpu_buffer->tail_page;
write = local_add_return(length, &tail_page->write);
tail = write - length;
@@ -909,7 +912,7 @@ __rb_reserve_next(struct ring_buffer_per
* it all the way around the buffer, bail, and warn
* about it.
*/
- if (unlikely(next_page == cpu_buffer->commit_page)) {
+ if (unlikely(next_page == commit_page)) {
WARN_ON_ONCE(1);
goto out_unlock;
}

2009-01-15 20:02:56

by Greg KH

[permalink] [raw]
Subject: [patch 05/94] x86: fix intel x86_64 llc_shared_map/cpu_llc_id anomolies

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Suresh Siddha <[email protected]>

commit 345077cd98ff5532b2d1158013c3fec7b1ae85ec upstream.

Impact: fix wrong cache sharing detection on platforms supporting > 8 bit apicid's

In the presence of extended topology eumeration leaf 0xb provided
by cpuid, 32bit extended initial_apicid in cpuinfo_x86 struct will be
updated by detect_extended_topology(). At this instance, we should also
reinit the apicid (which could also potentially be extended to 32bit).

With out this there will potentially be duplicate apicid's populated in the
per cpu's cpuinfo_x86 struct, resulting in wrong cache sharing topology etc
detected by init_intel_cacheinfo().

Reported-by: Dimitri Sivanich <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Acked-by: Dimitri Sivanich <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/kernel/cpu/addon_cpuid_features.c | 8 ++++++++
arch/x86/kernel/cpu/intel.c | 8 +++++++-
2 files changed, 15 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/addon_cpuid_features.c
+++ b/arch/x86/kernel/cpu/addon_cpuid_features.c
@@ -120,9 +120,17 @@ void __cpuinit detect_extended_topology(
c->cpu_core_id = phys_pkg_id(c->initial_apicid, ht_mask_width)
& core_select_mask;
c->phys_proc_id = phys_pkg_id(c->initial_apicid, core_plus_mask_width);
+ /*
+ * Reinit the apicid, now that we have extended initial_apicid.
+ */
+ c->apicid = phys_pkg_id(c->initial_apicid, 0);
#else
c->cpu_core_id = phys_pkg_id(ht_mask_width) & core_select_mask;
c->phys_proc_id = phys_pkg_id(core_plus_mask_width);
+ /*
+ * Reinit the apicid, now that we have extended initial_apicid.
+ */
+ c->apicid = phys_pkg_id(0);
#endif
c->x86_max_cores = (core_level_siblings / smp_num_siblings);

--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -242,6 +242,13 @@ static void __cpuinit init_intel(struct

intel_workarounds(c);

+ /*
+ * Detect the extended topology information if available. This
+ * will reinitialise the initial_apicid which will be used
+ * in init_intel_cacheinfo()
+ */
+ detect_extended_topology(c);
+
l2 = init_intel_cacheinfo(c);
if (c->cpuid_level > 9) {
unsigned eax = cpuid_eax(10);
@@ -313,7 +320,6 @@ static void __cpuinit init_intel(struct

#endif

- detect_extended_topology(c);
if (!cpu_has(c, X86_FEATURE_XTOPOLOGY)) {
/*
* let's use the legacy cpuid vector 0x1 and 0x4 for topology

2009-01-15 20:05:46

by Greg KH

[permalink] [raw]
Subject: [patch 09/94] ring-buffer: fix dangling commit race

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steven Rostedt <[email protected]>

commit a8ccf1d6f60e3e6ae63122e02378cd4d40dd4aac upstream.

Impact: fix stuck trace-buffers

If an interrupt comes in during the rb_set_commit_to_write and
pushes the tail page forward just at the right time, the commit
updates will miss the adding of the interrupt data. This will
cause the commit pointer to cease from moving forward.

Thanks to Jiaying Zhang for finding this race.

Reported-by: Jiaying Zhang <[email protected]>
Signed-off-by: Steven Rostedt <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
kernel/trace/ring_buffer.c | 12 ++++++++++++
1 file changed, 12 insertions(+)

--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -769,6 +769,7 @@ rb_set_commit_to_write(struct ring_buffe
* back to us). This allows us to do a simple loop to
* assign the commit to the tail.
*/
+ again:
while (cpu_buffer->commit_page != cpu_buffer->tail_page) {
cpu_buffer->commit_page->commit =
cpu_buffer->commit_page->write;
@@ -783,6 +784,17 @@ rb_set_commit_to_write(struct ring_buffe
cpu_buffer->commit_page->write;
barrier();
}
+
+ /* again, keep gcc from optimizing */
+ barrier();
+
+ /*
+ * If an interrupt came in just after the first while loop
+ * and pushed the tail page forward, we will be left with
+ * a dangling commit that will never go forward.
+ */
+ if (unlikely(cpu_buffer->commit_page != cpu_buffer->tail_page))
+ goto again;
}

static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer)

2009-01-15 20:03:32

by Greg KH

[permalink] [raw]
Subject: [patch 06/94] x86: default to SWIOTLB=y on x86_64

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Joerg Roedel <[email protected]>

commit a1afd01c175324656d0e8f1c82ea94b474953c04 upstream.

Impact: fixes korg bugzilla 11980

A kernel for a 64bit x86 system should always contain the swiotlb code
in case it is booted on a machine without any hardware IOMMU supported
by the kernel and more than 4GB of RAM. This patch changes Kconfig to
always compile swiotlb into the kernel for x86_64.

Signed-off-by: Joerg Roedel <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -569,7 +569,7 @@ config AMD_IOMMU

# need this always selected by IOMMU for the VIA workaround
config SWIOTLB
- bool
+ def_bool y if X86_64
help
Support for software bounce buffers used on x86-64 systems
which don't have a hardware IOMMU (e.g. the current generation

2009-01-15 20:06:44

by Greg KH

[permalink] [raw]
Subject: [patch 11/94] tx493[89]ide: Fix length for __ide_flush_dcache_range

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Atsushi Nemoto <[email protected]>

commit f26f6ceacaaf017a677138cbca7ab076b565ca87 upstream.

This fixes data corruption on PIO mode.

Signed-off-by: Atsushi Nemoto <[email protected]>
Cc: [email protected]
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/ide/tx4938ide.c | 4 ++--
drivers/ide/tx4939ide.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/ide/tx4938ide.c
+++ b/drivers/ide/tx4938ide.c
@@ -181,7 +181,7 @@ static void tx4938ide_input_data_swap(id

while (count--)
*ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
- __ide_flush_dcache_range((unsigned long)buf, count * 2);
+ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
}

static void tx4938ide_output_data_swap(ide_drive_t *drive, struct request *rq,
@@ -195,7 +195,7 @@ static void tx4938ide_output_data_swap(i
__raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
ptr++;
}
- __ide_flush_dcache_range((unsigned long)buf, count * 2);
+ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
}

static const struct ide_tp_ops tx4938ide_tp_ops = {
--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -558,7 +558,7 @@ static void tx4939ide_input_data_swap(id

while (count--)
*ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
- __ide_flush_dcache_range((unsigned long)buf, count * 2);
+ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
}

static void tx4939ide_output_data_swap(ide_drive_t *drive, struct request *rq,
@@ -572,7 +572,7 @@ static void tx4939ide_output_data_swap(i
__raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
ptr++;
}
- __ide_flush_dcache_range((unsigned long)buf, count * 2);
+ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
}

static const struct ide_tp_ops tx4939ide_tp_ops = {

2009-01-15 20:06:17

by Greg KH

[permalink] [raw]
Subject: [patch 10/94] iwlwifi: use GFP_KERNEL to allocate Rx SKB memory

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Zhu Yi <[email protected]>

commit f1bc4ac61f2c08515afd80c6dc3962aa6d0b138b upstream.

Previously we allocate Rx SKB with GFP_ATOMIC flag. This is because we need
to hold a spinlock to protect the two rx_used and rx_free lists operation
in the rxq.

spin_lock();
...
element = rxq->rx_used.next;
element->skb = alloc_skb(..., GFP_ATOMIC);
list_del(element);
list_add_tail(&element->list, &rxq->rx_free);
...
spin_unlock();

After spliting the rx_used delete and rx_free insert into two operations,
we don't require the skb allocation in an atomic context any more (the
function itself is scheduled in a workqueue).

spin_lock();
...
element = rxq->rx_used.next;
list_del(element);
...
spin_unlock();
...
element->skb = alloc_skb(..., GFP_KERNEL);
...
spin_lock()
...
list_add_tail(&element->list, &rxq->rx_free);
...
spin_unlock();

This patch should fix the "iwlagn: Can not allocate SKB buffers" warning
we see recently.

Signed-off-by: Zhu Yi <[email protected]>
Acked-by: Tomas Winkler <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/iwlwifi/iwl-agn.c | 12 +-----------
drivers/net/wireless/iwlwifi/iwl-rx.c | 29 +++++++++++++++++++----------
2 files changed, 20 insertions(+), 21 deletions(-)

--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1334,16 +1334,6 @@ static void iwl_setup_rx_handlers(struct
priv->cfg->ops->lib->rx_handler_setup(priv);
}

-/*
- * this should be called while priv->lock is locked
-*/
-static void __iwl_rx_replenish(struct iwl_priv *priv)
-{
- iwl_rx_allocate(priv);
- iwl_rx_queue_restock(priv);
-}
-
-
/**
* iwl_rx_handle - Main entry function for receiving responses from uCode
*
@@ -1451,7 +1441,7 @@ void iwl_rx_handle(struct iwl_priv *priv
count++;
if (count >= 8) {
priv->rxq.read = i;
- __iwl_rx_replenish(priv);
+ iwl_rx_queue_restock(priv);
count = 0;
}
}
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -245,25 +245,31 @@ void iwl_rx_allocate(struct iwl_priv *pr
struct list_head *element;
struct iwl_rx_mem_buffer *rxb;
unsigned long flags;
- spin_lock_irqsave(&rxq->lock, flags);
- while (!list_empty(&rxq->rx_used)) {
+
+ while (1) {
+ spin_lock_irqsave(&rxq->lock, flags);
+
+ if (list_empty(&rxq->rx_used)) {
+ spin_unlock_irqrestore(&rxq->lock, flags);
+ return;
+ }
element = rxq->rx_used.next;
rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+ list_del(element);
+
+ spin_unlock_irqrestore(&rxq->lock, flags);

/* Alloc a new receive buffer */
rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
- __GFP_NOWARN | GFP_ATOMIC);
+ GFP_KERNEL);
if (!rxb->skb) {
- if (net_ratelimit())
- printk(KERN_CRIT DRV_NAME
- ": Can not allocate SKB buffers\n");
+ printk(KERN_CRIT DRV_NAME
+ "Can not allocate SKB buffers\n");
/* We don't reschedule replenish work here -- we will
* call the restock method and if it still needs
* more buffers it will schedule replenish */
break;
}
- priv->alloc_rxb_skb++;
- list_del(element);

/* Get physical address of RB/SKB */
rxb->real_dma_addr = pci_map_single(
@@ -277,12 +283,15 @@ void iwl_rx_allocate(struct iwl_priv *pr
rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);

+ spin_lock_irqsave(&rxq->lock, flags);
+
list_add_tail(&rxb->list, &rxq->rx_free);
rxq->free_count++;
+ priv->alloc_rxb_skb++;
+
+ spin_unlock_irqrestore(&rxq->lock, flags);
}
- spin_unlock_irqrestore(&rxq->lock, flags);
}
-EXPORT_SYMBOL(iwl_rx_allocate);

void iwl_rx_replenish(struct iwl_priv *priv)
{

2009-01-15 20:07:30

by Greg KH

[permalink] [raw]
Subject: [patch 12/94] tx4939ide: Do not use zero count PRD entry

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Atsushi Nemoto <[email protected]>

commit a0fce792b55b260589c3d77293a224e84395ec07 upstream.

This fixes data corruption on some heavy load.

Signed-off-by: Atsushi Nemoto <[email protected]>
Cc: [email protected]
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/ide/tx4939ide.c | 6 ++++++
1 file changed, 6 insertions(+)

--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -259,6 +259,12 @@ static int tx4939ide_build_dmatable(ide_
bcount = 0x10000 - (cur_addr & 0xffff);
if (bcount > cur_len)
bcount = cur_len;
+ /*
+ * This workaround for zero count seems required.
+ * (standard ide_build_dmatable do it too)
+ */
+ if ((bcount & 0xffff) == 0x0000)
+ bcount = 0x8000;
*table++ = bcount & 0xffff;
*table++ = cur_addr;
cur_addr += bcount;

2009-01-15 20:02:24

by Greg KH

[permalink] [raw]
Subject: [patch 04/94] ALSA: hda - Fix typos for AD1882 codecs

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Clemens Fruhwirth <[email protected]>

commit c247ed6f5205f9feebd276c4cbe45018b10f19fa upstream.

Fixed typos of codec-id checks for AD1882/AD1882A.

Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
sound/pci/hda/patch_analog.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -4222,13 +4222,13 @@ static int patch_ad1882(struct hda_codec
spec->num_adc_nids = ARRAY_SIZE(ad1882_adc_nids);
spec->adc_nids = ad1882_adc_nids;
spec->capsrc_nids = ad1882_capsrc_nids;
- if (codec->vendor_id == 0x11d1882)
+ if (codec->vendor_id == 0x11d41882)
spec->input_mux = &ad1882_capture_source;
else
spec->input_mux = &ad1882a_capture_source;
spec->num_mixers = 2;
spec->mixers[0] = ad1882_base_mixers;
- if (codec->vendor_id == 0x11d1882)
+ if (codec->vendor_id == 0x11d41882)
spec->mixers[1] = ad1882_loopback_mixers;
else
spec->mixers[1] = ad1882a_loopback_mixers;

2009-01-15 20:08:33

by Greg KH

[permalink] [raw]
Subject: [patch 13/94] SCSI: eata: fix the data buffer accessors conversion regression

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: FUJITA Tomonori <[email protected]>

commit 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e upstream.

This fixes the regression introduced by the commit
58e2a02eb18393e76a469580fedf7caec190eb5e (eata: convert to use the
data buffer accessors), reported:

http://marc.info/?t=122987621300006&r=1&w=2

- fix DMA_NONE handling in map_dma()

- this driver can't use scsi_dma_map since host->shost_gendev.parent
is not set properly (it uses scsi_register).

Signed-off-by: FUJITA Tomonori <[email protected]>
Reported-by: Arthur Marsh <[email protected]>
Tested-by: Arthur Marsh <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/scsi/eata.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/scsi/eata.c
+++ b/drivers/scsi/eata.c
@@ -1626,8 +1626,15 @@ static void map_dma(unsigned int i, stru

cpp->sense_len = SCSI_SENSE_BUFFERSIZE;

- count = scsi_dma_map(SCpnt);
- BUG_ON(count < 0);
+ if (!scsi_sg_count(SCpnt)) {
+ cpp->data_len = 0;
+ return;
+ }
+
+ count = pci_map_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
+ pci_dir);
+ BUG_ON(!count);
+
scsi_for_each_sg(SCpnt, sg, count, k) {
cpp->sglist[k].address = H2DEV(sg_dma_address(sg));
cpp->sglist[k].num_bytes = H2DEV(sg_dma_len(sg));
@@ -1655,7 +1662,9 @@ static void unmap_dma(unsigned int i, st
pci_unmap_single(ha->pdev, DEV2H(cpp->sense_addr),
DEV2H(cpp->sense_len), PCI_DMA_FROMDEVICE);

- scsi_dma_unmap(SCpnt);
+ if (scsi_sg_count(SCpnt))
+ pci_unmap_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
+ pci_dir);

if (!DEV2H(cpp->data_len))
pci_dir = PCI_DMA_BIDIRECTIONAL;

2009-01-15 20:09:03

by Greg KH

[permalink] [raw]
Subject: [patch 14/94] USB: emi26: fix oops on load

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Marcin Slusarz <[email protected]>

commit 327d74f6b65ddc8a042c43c11fdd4be0bb354668 upstream.

Fix oops introduced by commit ae93a55bf948753de0bb8e43fa9c027f786abb05
(emi26: use request_firmware()):

usb 1-1: new full speed USB device using uhci_hcd and address 2
usb 1-1: configuration #1 chosen from 1 choice
emi26 - firmware loader 1-1:1.0: emi26_probe start
usb 1-1: firmware: requesting emi26/loader.fw
usb 1-1: firmware: requesting emi26/bitstream.fw
usb 1-1: firmware: requesting emi26/firmware.fw
usb 1-1: emi26_set_reset - 1
usb 1-1: emi26_set_reset - 0
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading
Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic

Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG
EIP: 0060:[<f80dc487>] EFLAGS: 00010206 CPU: 0
EIP is at emi26_probe+0x2f7/0x620 [emi26]
EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000
ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000)
Stack:
0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0
0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0
f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000
Call Trace:
[<c01c6262>] sysfs_add_one+0x12/0x50
[<fbacb290>] usb_probe_interface+0xa0/0x140 [usbcore]
[<c01c70bf>] sysfs_create_link+0xf/0x20
[<c02dead2>] driver_probe_device+0x82/0x180
[<fbac9eeb>] usb_match_id+0x3b/0x50 [usbcore]
[<c02dec4e>] __driver_attach+0x7e/0x80
[<c02de27a>] bus_for_each_dev+0x3a/0x60
[<c02de956>] driver_attach+0x16/0x20
[<c02debd0>] __driver_attach+0x0/0x80
[<c02de7b1>] bus_add_driver+0x1a1/0x220
[<c02dee4d>] driver_register+0x4d/0x120
[<c024e622>] idr_get_empty_slot+0xf2/0x290
[<fbacab71>] usb_register_driver+0x81/0x100 [usbcore]
[<f806c000>] emi26_init+0x0/0x14 [emi26]
[<c0101126>] do_one_initcall+0x36/0x1b0
[<c01c5e70>] sysfs_ilookup_test+0x0/0x10
[<c0197a61>] ifind+0x31/0x90
[<c01c6229>] __sysfs_add_one+0x59/0x80
[<c01c64e4>] sysfs_addrm_finish+0x14/0x1c0
[<c0175ca3>] __vunmap+0xa3/0xd0
[<c014b854>] load_module+0x1544/0x1640
[<c014b9d7>] sys_init_module+0x87/0x1b0
[<c0187f41>] sys_read+0x41/0x70
[<c01032a5>] sysenter_do_call+0x12/0x21
[<c03d0000>] wait_for_common+0x40/0x110
Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00
EIP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc
---[ end trace 2eefa13825431230 ]---

After the last "package" of firmware data is sent to the device, we dereference
NULL pointer (on access to rec->addr). Fix it.

Reported--by: David Flatz <[email protected]>
Tested-by: David Flatz <[email protected]>
Signed-off-by: Marcin Slusarz <[email protected]>
Cc: David Woodhouse <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/misc/emi26.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/misc/emi26.c
+++ b/drivers/usb/misc/emi26.c
@@ -160,7 +160,7 @@ static int emi26_load_firmware (struct u
err("%s - error loading firmware: error = %d", __func__, err);
goto wraperr;
}
- } while (i > 0);
+ } while (rec);

/* Assert reset (stop the CPU in the EMI) */
err = emi26_set_reset(dev,1);

2009-01-15 20:09:39

by Greg KH

[permalink] [raw]
Subject: [patch 15/94] x86, UV: remove erroneous BAU initialization

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Cliff Wickman <[email protected]>

commit 46814dded1b972a07b1609d81632eef3009fbb10 upstream.

Impact: fix crash on x86/UV

UV is the SGI "UltraViolet" machine, which is x86_64 based.
BAU is the "Broadcast Assist Unit", used for TLB shootdown in UV.

This patch removes the allocation and initialization of an unused table.

This table is left over from a development test mode. It is unused in
the present code.

And it was incorrectly initialized: 8 entries allocated but 17 initialized,
causing slab corruption.

This patch should go into 2.6.27 and 2.6.28 as well as the current tree.

Diffed against 2.6.28 (linux-next, 12/30/08)

Signed-off-by: Cliff Wickman <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/kernel/tlb_uv.c | 9 ---------
1 file changed, 9 deletions(-)

--- a/arch/x86/kernel/tlb_uv.c
+++ b/arch/x86/kernel/tlb_uv.c
@@ -586,7 +586,6 @@ static int __init uv_ptc_init(void)
static struct bau_control * __init uv_table_bases_init(int blade, int node)
{
int i;
- int *ip;
struct bau_msg_status *msp;
struct bau_control *bau_tabp;

@@ -603,13 +602,6 @@ static struct bau_control * __init uv_ta
bau_cpubits_clear(&msp->seen_by, (int)
uv_blade_nr_possible_cpus(blade));

- bau_tabp->watching =
- kmalloc_node(sizeof(int) * DEST_NUM_RESOURCES, GFP_KERNEL, node);
- BUG_ON(!bau_tabp->watching);
-
- for (i = 0, ip = bau_tabp->watching; i < DEST_Q_SIZE; i++, ip++)
- *ip = 0;
-
uv_bau_table_bases[blade] = bau_tabp;

return bau_tabp;
@@ -632,7 +624,6 @@ uv_table_bases_finish(int blade, int nod
bcp->bau_msg_head = bau_tablesp->va_queue_first;
bcp->va_queue_first = bau_tablesp->va_queue_first;
bcp->va_queue_last = bau_tablesp->va_queue_last;
- bcp->watching = bau_tablesp->watching;
bcp->msg_statuses = bau_tablesp->msg_statuses;
bcp->descriptor_base = adp;
}

2009-01-15 20:10:05

by Greg KH

[permalink] [raw]
Subject: [patch 16/94] x86: fix incorrect __read_mostly on _boot_cpu_pda

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ravikiran G Thirumalai <[email protected]>

commit 26799a63110dcbe81291ea53178f6b4810d07424 upstream.

The pda rework (commit 3461b0af025251bbc6b3d56c821c6ac2de6f7209)
to remove static boot cpu pdas introduced a performance bug.

_boot_cpu_pda is the actual pda used by the boot cpu and is definitely
not "__read_mostly" and ended up polluting the read mostly section with
writes. This bug caused regression of about 8-10% on certain syscall
intensive workloads.

Signed-off-by: Ravikiran Thirumalai <[email protected]>
Acked-by: Mike Travis <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/kernel/head64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -26,7 +26,7 @@
#include <asm/bios_ebda.h>

/* boot cpu pda */
-static struct x8664_pda _boot_cpu_pda __read_mostly;
+static struct x8664_pda _boot_cpu_pda;

#ifdef CONFIG_SMP
/*

2009-01-15 20:10:44

by Greg KH

[permalink] [raw]
Subject: [patch 17/94] vmalloc.c: fix flushing in vmap_page_range()

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Adam Lackorzynski <[email protected]>

commit 2e4e27c7d082b2198b63041310609d7191185a9d upstream.

The flush_cache_vmap in vmap_page_range() is called with the end of the
range twice. The following patch fixes this for me.

Signed-off-by: Adam Lackorzynski <[email protected]>
Cc: Nick Piggin <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
mm/vmalloc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -151,11 +151,12 @@ static int vmap_pud_range(pgd_t *pgd, un
*
* Ie. pte at addr+N*PAGE_SIZE shall point to pfn corresponding to pages[N]
*/
-static int vmap_page_range(unsigned long addr, unsigned long end,
+static int vmap_page_range(unsigned long start, unsigned long end,
pgprot_t prot, struct page **pages)
{
pgd_t *pgd;
unsigned long next;
+ unsigned long addr = start;
int err = 0;
int nr = 0;

@@ -167,7 +168,7 @@ static int vmap_page_range(unsigned long
if (err)
break;
} while (pgd++, addr = next, addr != end);
- flush_cache_vmap(addr, end);
+ flush_cache_vmap(start, end);

if (unlikely(err))
return err;

2009-01-15 20:11:53

by Greg KH

[permalink] [raw]
Subject: [patch 19/94] cgroups: fix a race between cgroup_clone and umount

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Li Zefan <[email protected]>

commit 7b574b7b0124ed344911f5d581e9bc2d83bbeb19 upstream.

The race is calling cgroup_clone() while umounting the ns cgroup subsys,
and thus cgroup_clone() might access invalid cgroup_fs, or kill_sb() is
called after cgroup_clone() created a new dir in it.

The BUG I triggered is BUG_ON(root->number_of_cgroups != 1);

------------[ cut here ]------------
kernel BUG at kernel/cgroup.c:1093!
invalid opcode: 0000 [#1] SMP
...
Process umount (pid: 5177, ti=e411e000 task=e40c4670 task.ti=e411e000)
...
Call Trace:
[<c0493df7>] ? deactivate_super+0x3f/0x51
[<c04a3600>] ? mntput_no_expire+0xb3/0xdd
[<c04a3ab2>] ? sys_umount+0x265/0x2ac
[<c04a3b06>] ? sys_oldumount+0xd/0xf
[<c0403911>] ? sysenter_do_call+0x12/0x31
...
EIP: [<c0456e76>] cgroup_kill_sb+0x23/0xe0 SS:ESP 0068:e411ef2c
---[ end trace c766c1be3bf944ac ]---

Cc: Serge E. Hallyn <[email protected]>
Signed-off-by: Li Zefan <[email protected]>
Cc: Paul Menage <[email protected]>
Cc: "Serge E. Hallyn" <[email protected]>
Cc: Balbir Singh <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
kernel/cgroup.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2942,7 +2942,11 @@ int cgroup_clone(struct task_struct *tsk
parent = task_cgroup(tsk, subsys->subsys_id);

/* Pin the hierarchy */
- atomic_inc(&parent->root->sb->s_active);
+ if (!atomic_inc_not_zero(&parent->root->sb->s_active)) {
+ /* We race with the final deactivate_super() */
+ mutex_unlock(&cgroup_mutex);
+ return 0;
+ }

/* Keep the cgroup alive */
get_css_set(cg);

2009-01-15 20:11:20

by Greg KH

[permalink] [raw]
Subject: [patch 18/94] fs: symlink write_begin allocation context fix

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nick Piggin <[email protected]>

commit 54566b2c1594c2326a645a3551f9d989f7ba3c5e upstream.

With the write_begin/write_end aops, page_symlink was broken because it
could no longer pass a GFP_NOFS type mask into the point where the
allocations happened. They are done in write_begin, which would always
assume that the filesystem can be entered from reclaim. This bug could
cause filesystem deadlocks.

The funny thing with having a gfp_t mask there is that it doesn't really
allow the caller to arbitrarily tinker with the context in which it can be
called. It couldn't ever be GFP_ATOMIC, for example, because it needs to
take the page lock. The only thing any callers care about is __GFP_FS
anyway, so turn that into a single flag.

Add a new flag for write_begin, AOP_FLAG_NOFS. Filesystems can now act on
this flag in their write_begin function. Change __grab_cache_page to
accept a nofs argument as well, to honour that flag (while we're there,
change the name to grab_cache_page_write_begin which is more instructive
and does away with random leading underscores).

This is really a more flexible way to go in the end anyway -- if a
filesystem happens to want any extra allocations aside from the pagecache
ones in ints write_begin function, it may now use GFP_KERNEL (rather than
GFP_NOFS) for common case allocations (eg. ocfs2_alloc_write_ctxt, for a
random example).

[[email protected]: fix ubifs]
[[email protected]: fix fuse]
Signed-off-by: Nick Piggin <[email protected]>
Reviewed-by: KOSAKI Motohiro <[email protected]>
Signed-off-by: KOSAKI Motohiro <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
[ Cleaned up the calling convention: just pass in the AOP flags
untouched to the grab_cache_page_write_begin() function. That
just simplifies everybody, and may even allow future expansion of the
logic. - Linus ]
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/affs/file.c | 2 +-
fs/afs/write.c | 2 +-
fs/buffer.c | 4 ++--
fs/cifs/file.c | 2 +-
fs/ecryptfs/mmap.c | 2 +-
fs/ext3/inode.c | 2 +-
fs/ext3/namei.c | 3 +--
fs/ext4/inode.c | 4 ++--
fs/ext4/namei.c | 3 +--
fs/fuse/file.c | 4 ++--
fs/gfs2/ops_address.c | 2 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/jffs2/file.c | 2 +-
fs/libfs.c | 2 +-
fs/namei.c | 13 +++++++++----
fs/nfs/file.c | 2 +-
fs/reiserfs/inode.c | 2 +-
fs/smbfs/file.c | 2 +-
fs/ubifs/file.c | 9 +++++----
include/linux/fs.h | 5 ++++-
include/linux/pagemap.h | 3 ++-
mm/filemap.c | 13 +++++++++----
22 files changed, 49 insertions(+), 36 deletions(-)

--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -628,7 +628,7 @@ static int affs_write_begin_ofs(struct f
}

index = pos >> PAGE_CACHE_SHIFT;
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -144,7 +144,7 @@ int afs_write_begin(struct file *file, s
candidate->state = AFS_WBACK_PENDING;
init_waitqueue_head(&candidate->waitq);

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page) {
kfree(candidate);
return -ENOMEM;
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1988,7 +1988,7 @@ int block_write_begin(struct file *file,
page = *pagep;
if (page == NULL) {
ownpage = 1;
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page) {
status = -ENOMEM;
goto out;
@@ -2494,7 +2494,7 @@ int nobh_write_begin(struct file *file,
from = pos & (PAGE_CACHE_SIZE - 1);
to = from + len;

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2073,7 +2073,7 @@ static int cifs_write_begin(struct file

cFYI(1, ("write_begin from %lld len %d", (long long)pos, len));

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page) {
rc = -ENOMEM;
goto out;
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -288,7 +288,7 @@ static int ecryptfs_write_begin(struct f
loff_t prev_page_end_size;
int rc = 0;

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1160,7 +1160,7 @@ static int ext3_write_begin(struct file
to = from + len;

retry:
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2170,8 +2170,7 @@ retry:
* We have a transaction open. All is sweetness. It also sets
* i_size in generic_commit_write().
*/
- err = __page_symlink(inode, symname, l,
- mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
+ err = __page_symlink(inode, symname, l, 1);
if (err) {
drop_nlink(inode);
ext3_mark_inode_dirty(handle, inode);
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1345,7 +1345,7 @@ retry:
goto out;
}

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page) {
ext4_journal_stop(handle);
ret = -ENOMEM;
@@ -2549,7 +2549,7 @@ retry:
goto out;
}

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page) {
ext4_journal_stop(handle);
ret = -ENOMEM;
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2208,8 +2208,7 @@ retry:
* We have a transaction open. All is sweetness. It also sets
* i_size in generic_commit_write().
*/
- err = __page_symlink(inode, symname, l,
- mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
+ err = __page_symlink(inode, symname, l, 1);
if (err) {
clear_nlink(inode);
ext4_mark_inode_dirty(handle, inode);
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -646,7 +646,7 @@ static int fuse_write_begin(struct file
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;

- *pagep = __grab_cache_page(mapping, index);
+ *pagep = grab_cache_page_write_begin(mapping, index, flags);
if (!*pagep)
return -ENOMEM;
return 0;
@@ -779,7 +779,7 @@ static ssize_t fuse_fill_write_pages(str
break;

err = -ENOMEM;
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, 0);
if (!page)
break;

--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -675,7 +675,7 @@ static int gfs2_write_begin(struct file
goto out_trans_fail;

error = -ENOMEM;
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
*pagep = page;
if (unlikely(!page))
goto out_endtrans;
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -501,7 +501,7 @@ int hostfs_write_begin(struct file *file
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;

- *pagep = __grab_cache_page(mapping, index);
+ *pagep = grab_cache_page_write_begin(mapping, index, flags);
if (!*pagep)
return -ENOMEM;
return 0;
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -132,7 +132,7 @@ static int jffs2_write_begin(struct file
uint32_t pageofs = index << PAGE_CACHE_SHIFT;
int ret = 0;

- pg = __grab_cache_page(mapping, index);
+ pg = grab_cache_page_write_begin(mapping, index, flags);
if (!pg)
return -ENOMEM;
*pagep = pg;
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -360,7 +360,7 @@ int simple_write_begin(struct file *file
index = pos >> PAGE_CACHE_SHIFT;
from = pos & (PAGE_CACHE_SIZE - 1);

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2786,18 +2786,23 @@ void page_put_link(struct dentry *dentry
}
}

-int __page_symlink(struct inode *inode, const char *symname, int len,
- gfp_t gfp_mask)
+/*
+ * The nofs argument instructs pagecache_write_begin to pass AOP_FLAG_NOFS
+ */
+int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
{
struct address_space *mapping = inode->i_mapping;
struct page *page;
void *fsdata;
int err;
char *kaddr;
+ unsigned int flags = AOP_FLAG_UNINTERRUPTIBLE;
+ if (nofs)
+ flags |= AOP_FLAG_NOFS;

retry:
err = pagecache_write_begin(NULL, mapping, 0, len-1,
- AOP_FLAG_UNINTERRUPTIBLE, &page, &fsdata);
+ flags, &page, &fsdata);
if (err)
goto fail;

@@ -2821,7 +2826,7 @@ fail:
int page_symlink(struct inode *inode, const char *symname, int len)
{
return __page_symlink(inode, symname, len,
- mapping_gfp_mask(inode->i_mapping));
+ !(mapping_gfp_mask(inode->i_mapping) & __GFP_FS));
}

const struct inode_operations page_symlink_inode_operations = {
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -354,7 +354,7 @@ static int nfs_write_begin(struct file *
file->f_path.dentry->d_name.name,
mapping->host->i_ino, len, (long long) pos);

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2556,7 +2556,7 @@ static int reiserfs_write_begin(struct f
}

index = pos >> PAGE_CACHE_SHIFT;
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
--- a/fs/smbfs/file.c
+++ b/fs/smbfs/file.c
@@ -297,7 +297,7 @@ static int smb_write_begin(struct file *
struct page **pagep, void **fsdata)
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;
- *pagep = __grab_cache_page(mapping, index);
+ *pagep = grab_cache_page_write_begin(mapping, index, flags);
if (!*pagep)
return -ENOMEM;
return 0;
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -219,7 +219,8 @@ static void release_existing_page_budget
}

static int write_begin_slow(struct address_space *mapping,
- loff_t pos, unsigned len, struct page **pagep)
+ loff_t pos, unsigned len, struct page **pagep,
+ unsigned flags)
{
struct inode *inode = mapping->host;
struct ubifs_info *c = inode->i_sb->s_fs_info;
@@ -247,7 +248,7 @@ static int write_begin_slow(struct addre
if (unlikely(err))
return err;

- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (unlikely(!page)) {
ubifs_release_budget(c, &req);
return -ENOMEM;
@@ -438,7 +439,7 @@ static int ubifs_write_begin(struct file
return -EROFS;

/* Try out the fast-path part first */
- page = __grab_cache_page(mapping, index);
+ page = grab_cache_page_write_begin(mapping, index, flags);
if (unlikely(!page))
return -ENOMEM;

@@ -483,7 +484,7 @@ static int ubifs_write_begin(struct file
unlock_page(page);
page_cache_release(page);

- return write_begin_slow(mapping, pos, len, pagep);
+ return write_begin_slow(mapping, pos, len, pagep, flags);
}

/*
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -414,6 +414,9 @@ enum positive_aop_returns {

#define AOP_FLAG_UNINTERRUPTIBLE 0x0001 /* will not do a short write */
#define AOP_FLAG_CONT_EXPAND 0x0002 /* called from cont_expand */
+#define AOP_FLAG_NOFS 0x0004 /* used by filesystem to direct
+ * helper code (eg buffer layer)
+ * to clear GFP_FS from alloc */

/*
* oh the beauties of C type declarations.
@@ -2023,7 +2026,7 @@ extern int page_readlink(struct dentry *
extern void *page_follow_link_light(struct dentry *, struct nameidata *);
extern void page_put_link(struct dentry *, struct nameidata *, void *);
extern int __page_symlink(struct inode *inode, const char *symname, int len,
- gfp_t gfp_mask);
+ int nofs);
extern int page_symlink(struct inode *inode, const char *symname, int len);
extern const struct inode_operations page_symlink_inode_operations;
extern int generic_readlink(struct dentry *, char __user *, int);
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -241,7 +241,8 @@ unsigned find_get_pages_contig(struct ad
unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
int tag, unsigned int nr_pages, struct page **pages);

-struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index);
+struct page *grab_cache_page_write_begin(struct address_space *mapping,
+ pgoff_t index, unsigned flags);

/*
* Returns locked page at given index in given cache, creating it if needed.
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2140,19 +2140,24 @@ EXPORT_SYMBOL(generic_file_direct_write)
* Find or create a page at the given pagecache position. Return the locked
* page. This function is specifically for buffered writes.
*/
-struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index)
+struct page *grab_cache_page_write_begin(struct address_space *mapping,
+ pgoff_t index, unsigned flags)
{
int status;
struct page *page;
+ gfp_t gfp_notmask = 0;
+ if (flags & AOP_FLAG_NOFS)
+ gfp_notmask = __GFP_FS;
repeat:
page = find_lock_page(mapping, index);
if (likely(page))
return page;

- page = page_cache_alloc(mapping);
+ page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~gfp_notmask);
if (!page)
return NULL;
- status = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
+ status = add_to_page_cache_lru(page, mapping, index,
+ GFP_KERNEL & ~gfp_notmask);
if (unlikely(status)) {
page_cache_release(page);
if (status == -EEXIST)
@@ -2161,7 +2166,7 @@ repeat:
}
return page;
}
-EXPORT_SYMBOL(__grab_cache_page);
+EXPORT_SYMBOL(grab_cache_page_write_begin);

static ssize_t generic_perform_write(struct file *file,
struct iov_iter *i, loff_t pos)

2009-01-15 20:13:15

by Greg KH

[permalink] [raw]
Subject: [patch 20/94] dm raid1: fix error count

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jonathan Brassow <[email protected]>

commit d460c65a6a9ec9e0d284864ec3a9a2d1b73f0e43 upstream.

Always increase the error count when I/O on a leg of a mirror fails.

The error count is used to decide whether to select an alternative
mirror leg. If the target doesn't use the "handle_errors" feature, the
error count is not updated and the bio can get requeued forever by the
read callback.

Fix it by increasing error_count before the handle_errors feature
checking.

Signed-off-by: Milan Broz <[email protected]>
Signed-off-by: Jonathan Brassow <[email protected]>
Signed-off-by: Alasdair G Kergon <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/md/dm-raid1.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -197,9 +197,6 @@ static void fail_mirror(struct mirror *m
struct mirror_set *ms = m->ms;
struct mirror *new;

- if (!errors_handled(ms))
- return;
-
/*
* error_count is used for nothing more than a
* simple way to tell if a device has encountered
@@ -210,6 +207,9 @@ static void fail_mirror(struct mirror *m
if (test_and_set_bit(error_type, &m->error_type))
return;

+ if (!errors_handled(ms))
+ return;
+
if (m != get_default_mirror(ms))
goto out;

2009-01-15 20:13:37

by Greg KH

[permalink] [raw]
Subject: [patch 21/94] dm log: fix dm_io_client leak on error paths

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takahiro Yasui <[email protected]>

commit c7a2bd19b7c1e0bd2c7604c53d2583e91e536948 upstream.

In create_log_context function, dm_io_client_destroy function needs
to be called, when memory allocation of disk_header, sync_bits and
recovering_bits failed, but dm_io_client_destroy is not called.

Signed-off-by: Takahiro Yasui <[email protected]>
Acked-by: Jonathan Brassow <[email protected]>
Signed-off-by: Alasdair G Kergon <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/md/dm-log.c | 5 +++++
1 file changed, 5 insertions(+)

--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -467,6 +467,7 @@ static int create_log_context(struct dm_
lc->disk_header = vmalloc(buf_size);
if (!lc->disk_header) {
DMWARN("couldn't allocate disk log buffer");
+ dm_io_client_destroy(lc->io_req.client);
kfree(lc);
return -ENOMEM;
}
@@ -482,6 +483,8 @@ static int create_log_context(struct dm_
DMWARN("couldn't allocate sync bitset");
if (!dev)
vfree(lc->clean_bits);
+ else
+ dm_io_client_destroy(lc->io_req.client);
vfree(lc->disk_header);
kfree(lc);
return -ENOMEM;
@@ -495,6 +498,8 @@ static int create_log_context(struct dm_
vfree(lc->sync_bits);
if (!dev)
vfree(lc->clean_bits);
+ else
+ dm_io_client_destroy(lc->io_req.client);
vfree(lc->disk_header);
kfree(lc);
return -ENOMEM;

2009-01-15 20:14:06

by Greg KH

[permalink] [raw]
Subject: [patch 22/94] minix: fix add links wrong position calculation

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Evgeniy Dushistov <[email protected]>

commit d6b54841f4ddd836c886d1e6ac381cf309ee98a3 upstream.

Fix the add link method. The oosition in the directory was calculated in
wrong way - it had the incorrect shift direction.

[[email protected]: coding-style fixes]
Signed-off-by: Evgeniy Dushistov <[email protected]>
Cc: Nick Piggin <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/minix/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/minix/dir.c
+++ b/fs/minix/dir.c
@@ -280,7 +280,7 @@ int minix_add_link(struct dentry *dentry
return -EINVAL;

got_it:
- pos = (page->index >> PAGE_CACHE_SHIFT) + p - (char*)page_address(page);
+ pos = page_offset(page) + p - (char *)page_address(page);
err = __minix_write_begin(NULL, page->mapping, pos, sbi->s_dirsize,
AOP_FLAG_UNINTERRUPTIBLE, &page, NULL);
if (err)

2009-01-15 20:14:47

by Greg KH

[permalink] [raw]
Subject: [patch 23/94] md: fix bitmap-on-external-file bug.

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: NeilBrown <[email protected]>

commit 538452700d95480c16e7aa6b10ff77cd937d33f4 upstream.

commit a2ed9615e3222645007fc19991aedf30eed3ecfd
fixed a bug with 'internal' bitmaps, but in the process broke
'in a file' bitmaps. So they are broken in 2.6.28

This fixes it, and needs to go in 2.6.28-stable.

Signed-off-by: NeilBrown <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/md/bitmap.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -964,9 +964,11 @@ static int bitmap_init_from_disk(struct
*/
page = bitmap->sb_page;
offset = sizeof(bitmap_super_t);
- read_sb_page(bitmap->mddev, bitmap->offset,
- page,
- index, count);
+ if (!file)
+ read_sb_page(bitmap->mddev,
+ bitmap->offset,
+ page,
+ index, count);
} else if (file) {
page = read_page(file, index, bitmap, count);
offset = 0;

2009-01-15 20:15:32

by Greg KH

[permalink] [raw]
Subject: [patch 24/94] sched_clock: prevent scd->clock from moving backwards, take #2

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Thomas Gleixner <[email protected]>

commit 1c5745aa380efb6417b5681104b007c8612fb496 upstream.

Redo:

5b7dba4: sched_clock: prevent scd->clock from moving backwards

which had to be reverted due to s2ram hangs:

ca7e716: Revert "sched_clock: prevent scd->clock from moving backwards"

... this time with resume restoring GTOD later in the sequence
taken into account as well.

The "timekeeping_suspended" flag is not very nice but we cannot call into
GTOD before it has been properly resumed and the scheduler will run very
early in the resume sequence.

Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/linux/time.h | 1 +
kernel/sched_clock.c | 5 ++++-
kernel/time/timekeeping.c | 7 +++++--
3 files changed, 10 insertions(+), 3 deletions(-)

--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -105,6 +105,7 @@ extern unsigned long read_persistent_clo
extern int update_persistent_clock(struct timespec now);
extern int no_sync_cmos_clock __read_mostly;
void timekeeping_init(void);
+extern int timekeeping_suspended;

unsigned long get_seconds(void);
struct timespec current_kernel_time(void);
--- a/kernel/sched_clock.c
+++ b/kernel/sched_clock.c
@@ -124,7 +124,7 @@ static u64 __update_sched_clock(struct s

clock = scd->tick_gtod + delta;
min_clock = wrap_max(scd->tick_gtod, scd->clock);
- max_clock = scd->tick_gtod + TICK_NSEC;
+ max_clock = wrap_max(scd->clock, scd->tick_gtod + TICK_NSEC);

clock = wrap_max(clock, min_clock);
clock = wrap_min(clock, max_clock);
@@ -227,6 +227,9 @@ EXPORT_SYMBOL_GPL(sched_clock_idle_sleep
*/
void sched_clock_idle_wakeup_event(u64 delta_ns)
{
+ if (timekeeping_suspended)
+ return;
+
sched_clock_tick();
touch_softlockup_watchdog();
}
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -46,6 +46,9 @@ struct timespec xtime __attribute__ ((al
struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
static unsigned long total_sleep_time; /* seconds */

+/* flag for if timekeeping is suspended */
+int __read_mostly timekeeping_suspended;
+
static struct timespec xtime_cache __attribute__ ((aligned (16)));
void update_xtime_cache(u64 nsec)
{
@@ -92,6 +95,8 @@ void getnstimeofday(struct timespec *ts)
unsigned long seq;
s64 nsecs;

+ WARN_ON(timekeeping_suspended);
+
do {
seq = read_seqbegin(&xtime_lock);

@@ -299,8 +304,6 @@ void __init timekeeping_init(void)
write_sequnlock_irqrestore(&xtime_lock, flags);
}

-/* flag for if timekeeping is suspended */
-static int timekeeping_suspended;
/* time in seconds when suspend began */
static unsigned long timekeeping_suspend_time;

2009-01-15 20:16:14

by Greg KH

[permalink] [raw]
Subject: [patch 25/94] devices cgroup: allow mkfifo

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Serge E. Hallyn <[email protected]>

commit 0b82ac37b889ec881b645860da3775118effb3ca upstream.

The devcgroup_inode_permission() hook in the devices whitelist cgroup has
always bypassed access checks on fifos. But the mknod hook did not. The
devices whitelist is only about block and char devices, and fifos can't
even be added to the whitelist, so fifos can't be created at all except by
tasks which have 'a' in their whitelist (meaning they have access to all
devices).

Fix the behavior by bypassing access checks to mkfifo.

Signed-off-by: Serge E. Hallyn <[email protected]>
Cc: Li Zefan <[email protected]>
Cc: Pavel Emelyanov <[email protected]>
Cc: Paul Menage <[email protected]>
Cc: Lai Jiangshan <[email protected]>
Cc: KOSAKI Motohiro <[email protected]>
Cc: James Morris <[email protected]>
Reported-by: Daniel Lezcano <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
security/device_cgroup.c | 3 +++
1 file changed, 3 insertions(+)

--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -513,6 +513,9 @@ int devcgroup_inode_mknod(int mode, dev_
struct dev_cgroup *dev_cgroup;
struct dev_whitelist_item *wh;

+ if (!S_ISBLK(mode) && !S_ISCHR(mode))
+ return 0;
+
rcu_read_lock();

dev_cgroup = task_devcgroup(current);

2009-01-15 20:17:20

by Greg KH

[permalink] [raw]
Subject: [patch 26/94] SCSI: aha152x_cs: Fix regression that keeps driver from using shared interrupts

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Larry Finger <[email protected]>

commit 58607b30fc0f2230a189500112c7a7cca02804cf upstream.

At some point since 2.6.22, the aha152x_cs driver stopped working and
started erring on load with the following messages:

kernel: pcmcia: request for exclusive IRQ could not be fulfilled.
kernel: pcmcia: the driver needs updating to supported shared IRQ lines.

With the following change, the driver works with shared IRQs.

Signed-off-by: Larry Finger <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/scsi/pcmcia/aha152x_stub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/pcmcia/aha152x_stub.c
+++ b/drivers/scsi/pcmcia/aha152x_stub.c
@@ -114,7 +114,7 @@ static int aha152x_probe(struct pcmcia_d
link->io.NumPorts1 = 0x20;
link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
link->io.IOAddrLines = 10;
- link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+ link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
link->irq.IRQInfo1 = IRQ_LEVEL_ID;
link->conf.Attributes = CONF_ENABLE_IRQ;
link->conf.IntType = INT_MEMORY_AND_IO;

2009-01-15 20:17:46

by Greg KH

[permalink] [raw]
Subject: [patch 27/94] ioat: fix self test for multi-channel case

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Williams <[email protected]>

commit b9bdcbba010c2e49c8f837ea7a49fe006b636f41 upstream.

In the multiple device case we need to re-arm the completion and protect
against concurrent self-tests. The printk from the test callback is
removed as it can arbitrarily delay completion of the test.

Cc: Maciej Sosnowski <[email protected]>
Signed-off-by: Dan Williams <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/dma/ioat_dma.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1341,12 +1341,11 @@ static void ioat_dma_start_null_desc(str
*/
#define IOAT_TEST_SIZE 2000

-DECLARE_COMPLETION(test_completion);
static void ioat_dma_test_callback(void *dma_async_param)
{
- printk(KERN_ERR "ioatdma: ioat_dma_test_callback(%p)\n",
- dma_async_param);
- complete(&test_completion);
+ struct completion *cmp = dma_async_param;
+
+ complete(cmp);
}

/**
@@ -1363,6 +1362,7 @@ static int ioat_dma_self_test(struct ioa
dma_addr_t dma_dest, dma_src;
dma_cookie_t cookie;
int err = 0;
+ struct completion cmp;

src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
if (!src)
@@ -1402,8 +1402,9 @@ static int ioat_dma_self_test(struct ioa
}

async_tx_ack(tx);
+ init_completion(&cmp);
tx->callback = ioat_dma_test_callback;
- tx->callback_param = (void *)0x8086;
+ tx->callback_param = &cmp;
cookie = tx->tx_submit(tx);
if (cookie < 0) {
dev_err(&device->pdev->dev,
@@ -1413,7 +1414,7 @@ static int ioat_dma_self_test(struct ioa
}
device->common.device_issue_pending(dma_chan);

- wait_for_completion_timeout(&test_completion, msecs_to_jiffies(3000));
+ wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));

if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
!= DMA_SUCCESS) {

2009-01-15 20:18:31

by Greg KH

[permalink] [raw]
Subject: [patch 28/94] USB: isp1760: use a specific PLX bridge instead of any bdridge

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

commit 6c0735687d37e25a65866823881bcbf39a6a023f upstream.

this driver can't handle (of course) any brdige class devices. So we
now are just active on one specific bridge which should be only the
isp1761 chip behind a PLX bridge.

Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
Tested-by: Karl Bongers <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/host/isp1760-if.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)

--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -268,12 +268,16 @@ static void isp1761_pci_shutdown(struct
printk(KERN_ERR "ips1761_pci_shutdown\n");
}

-static const struct pci_device_id isp1760_plx [] = { {
- /* handle any USB 2.0 EHCI controller */
- PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_OTHER << 8) | (0x06 << 16)), ~0),
- .driver_data = 0,
-},
-{ /* end: all zeroes */ }
+static const struct pci_device_id isp1760_plx [] = {
+ {
+ .class = PCI_CLASS_BRIDGE_OTHER << 8,
+ .class_mask = ~0,
+ .vendor = PCI_VENDOR_ID_PLX,
+ .device = 0x5406,
+ .subvendor = PCI_VENDOR_ID_PLX,
+ .subdevice = 0x9054,
+ },
+ { }
};
MODULE_DEVICE_TABLE(pci, isp1760_plx);

2009-01-15 20:18:56

by Greg KH

[permalink] [raw]
Subject: [patch 29/94] USB: isp1760: Fix probe in PCI glue code

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Karl Bongers <[email protected]>

commit 6013bbbab0dcbc43bcf9dd70beeab2a0b1ec5ea7 upstream.

Contains fixes so probe on x86 PCI runs, apparently I'm first to try
this. Several fixes to memory access to probe host scratch register.
Previously would bug check on chip_addr var used uninitialized.
Scratch reg write failed in one instance due to 16-bit initial access
mode, so added "& 0x0000ffff" to the readl as fix.
Includes some general cleanup - remove global vars, organize memory map
resource use.

Signed-off-by: Karl Bongers <[email protected]>
Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/host/isp1760-if.c | 97 +++++++++++++++++++++++-------------------
1 file changed, 55 insertions(+), 42 deletions(-)

--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -129,23 +129,23 @@ static struct of_platform_driver isp1760
#endif

#ifdef CONFIG_PCI
-static u32 nxp_pci_io_base;
-static u32 iolength;
-static u32 pci_mem_phy0;
-static u32 length;
-static u8 __iomem *chip_addr;
-static u8 __iomem *iobase;
-
static int __devinit isp1761_pci_probe(struct pci_dev *dev,
const struct pci_device_id *id)
{
u8 latency, limit;
__u32 reg_data;
int retry_count;
- int length;
- int status = 1;
struct usb_hcd *hcd;
unsigned int devflags = 0;
+ int ret_status = 0;
+
+ resource_size_t pci_mem_phy0;
+ resource_size_t memlength;
+
+ u8 __iomem *chip_addr;
+ u8 __iomem *iobase;
+ resource_size_t nxp_pci_io_base;
+ resource_size_t iolength;

if (usb_disabled())
return -ENODEV;
@@ -168,26 +168,30 @@ static int __devinit isp1761_pci_probe(s
iobase = ioremap_nocache(nxp_pci_io_base, iolength);
if (!iobase) {
printk(KERN_ERR "ioremap #1\n");
- release_mem_region(nxp_pci_io_base, iolength);
- return -ENOMEM;
+ ret_status = -ENOMEM;
+ goto cleanup1;
}
/* Grab the PLX PCI shared memory of the ISP 1761 we need */
pci_mem_phy0 = pci_resource_start(dev, 3);
- length = pci_resource_len(dev, 3);
-
- if (length < 0xffff) {
- printk(KERN_ERR "memory length for this resource is less than "
- "required\n");
- release_mem_region(nxp_pci_io_base, iolength);
- iounmap(iobase);
- return -ENOMEM;
+ memlength = pci_resource_len(dev, 3);
+ if (memlength < 0xffff) {
+ printk(KERN_ERR "memory length for this resource is wrong\n");
+ ret_status = -ENOMEM;
+ goto cleanup2;
}

- if (!request_mem_region(pci_mem_phy0, length, "ISP-PCI")) {
+ if (!request_mem_region(pci_mem_phy0, memlength, "ISP-PCI")) {
printk(KERN_ERR "host controller already in use\n");
- release_mem_region(nxp_pci_io_base, iolength);
- iounmap(iobase);
- return -EBUSY;
+ ret_status = -EBUSY;
+ goto cleanup2;
+ }
+
+ /* map available memory */
+ chip_addr = ioremap_nocache(pci_mem_phy0,memlength);
+ if (!chip_addr) {
+ printk(KERN_ERR "Error ioremap failed\n");
+ ret_status = -ENOMEM;
+ goto cleanup3;
}

/* bad pci latencies can contribute to overruns */
@@ -210,39 +214,54 @@ static int __devinit isp1761_pci_probe(s
* */
writel(0xface, chip_addr + HC_SCRATCH_REG);
udelay(100);
- reg_data = readl(chip_addr + HC_SCRATCH_REG);
+ reg_data = readl(chip_addr + HC_SCRATCH_REG) & 0x0000ffff;
retry_count--;
}

+ iounmap(chip_addr);
+
/* Host Controller presence is detected by writing to scratch register
* and reading back and checking the contents are same or not
*/
if (reg_data != 0xFACE) {
dev_err(&dev->dev, "scratch register mismatch %x\n", reg_data);
- goto clean;
+ ret_status = -ENOMEM;
+ goto cleanup3;
}

pci_set_master(dev);

- status = readl(iobase + 0x68);
- status |= 0x900;
- writel(status, iobase + 0x68);
+ /* configure PLX PCI chip to pass interrupts */
+#define PLX_INT_CSR_REG 0x68
+ reg_data = readl(iobase + PLX_INT_CSR_REG);
+ reg_data |= 0x900;
+ writel(reg_data, iobase + PLX_INT_CSR_REG);

dev->dev.dma_mask = NULL;
- hcd = isp1760_register(pci_mem_phy0, length, dev->irq,
+ hcd = isp1760_register(pci_mem_phy0, memlength, dev->irq,
IRQF_SHARED | IRQF_DISABLED, &dev->dev, dev_name(&dev->dev),
devflags);
- if (!IS_ERR(hcd)) {
- pci_set_drvdata(dev, hcd);
- return 0;
+ if (IS_ERR(hcd)) {
+ ret_status = -ENODEV;
+ goto cleanup3;
}
-clean:
- status = -ENODEV;
+
+ /* done with PLX IO access */
iounmap(iobase);
- release_mem_region(pci_mem_phy0, length);
release_mem_region(nxp_pci_io_base, iolength);
- return status;
+
+ pci_set_drvdata(dev, hcd);
+ return 0;
+
+cleanup3:
+ release_mem_region(pci_mem_phy0, memlength);
+cleanup2:
+ iounmap(iobase);
+cleanup1:
+ release_mem_region(nxp_pci_io_base, iolength);
+ return ret_status;
}
+
static void isp1761_pci_remove(struct pci_dev *dev)
{
struct usb_hcd *hcd;
@@ -255,12 +274,6 @@ static void isp1761_pci_remove(struct pc
usb_put_hcd(hcd);

pci_disable_device(dev);
-
- iounmap(iobase);
- iounmap(chip_addr);
-
- release_mem_region(nxp_pci_io_base, iolength);
- release_mem_region(pci_mem_phy0, length);
}

static void isp1761_pci_shutdown(struct pci_dev *dev)

2009-01-15 20:19:30

by Greg KH

[permalink] [raw]
Subject: [patch 30/94] USB: unusual_devs.h additions for Pentax K10D

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Daniel Drake <[email protected]>

commit e3f47f89a57ef115755184a8b3f03a47ee227418 upstream.

Jaak Ristioja reported problems with his Pentax K10D camera:
https://bugs.gentoo.org/show_bug.cgi?id=250406

/proc/bus/usb/devices:
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=0a17 ProdID=006e Rev= 1.00
S: Manufacturer=PENTAX Corporation
S: Product=K10D
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=100ms
The number of reported sectors is off-by-one.

Signed-off-by: Daniel Drake <[email protected]>
Cc: Kadianakis George <[email protected]>
Signed-off-by: Phil Dibowitz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1425,6 +1425,13 @@ UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xff
US_SC_DEVICE, US_PR_DEVICE, NULL,
US_FL_FIX_INQUIRY ),

+/* Reported by Jaak Ristioja <[email protected]> */
+UNUSUAL_DEV( 0x0a17, 0x006e, 0x0100, 0x0100,
+ "Pentax",
+ "K10D",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
/* These are virtual windows driver CDs, which the zd1211rw driver
* automatically converts into WLAN devices. */
UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,

2009-01-15 20:19:56

by Greg KH

[permalink] [raw]
Subject: [patch 31/94] inotify: fix type errors in interfaces

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Michael Kerrisk <[email protected]>

commit 4ae8978cf92a96257cd8998a49e781be83571d64 upstream.

The problems lie in the types used for some inotify interfaces, both at the kernel level and at the glibc level. This mail addresses the kernel problem. I will follow up with some suggestions for glibc changes.

For the sys_inotify_rm_watch() interface, the type of the 'wd' argument is
currently 'u32', it should be '__s32' . That is Robert's suggestion, and
is consistent with the other declarations of watch descriptors in the
kernel source, in particular, the inotify_event structure in
include/linux/inotify.h:

struct inotify_event {
__s32 wd; /* watch descriptor */
__u32 mask; /* watch mask */
__u32 cookie; /* cookie to synchronize two events */
__u32 len; /* length (including nulls) of name */
char name[0]; /* stub for possible name */
};

The patch makes the changes needed for inotify_rm_watch().

Signed-off-by: Michael Kerrisk <[email protected]>
Cc: Robert Love <[email protected]>
Cc: Vegard Nossum <[email protected]>
Cc: Ulrich Drepper <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/inotify_user.c | 2 +-
include/linux/syscalls.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -704,7 +704,7 @@ fput_and_out:
return ret;
}

-asmlinkage long sys_inotify_rm_watch(int fd, u32 wd)
+asmlinkage long sys_inotify_rm_watch(int fd, __s32 wd)
{
struct file *filp;
struct inotify_device *dev;
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -549,7 +549,7 @@ asmlinkage long sys_inotify_init(void);
asmlinkage long sys_inotify_init1(int flags);
asmlinkage long sys_inotify_add_watch(int fd, const char __user *path,
u32 mask);
-asmlinkage long sys_inotify_rm_watch(int fd, u32 wd);
+asmlinkage long sys_inotify_rm_watch(int fd, __s32 wd);

asmlinkage long sys_spu_run(int fd, __u32 __user *unpc,
__u32 __user *ustatus);

2009-01-15 20:21:15

by Greg KH

[permalink] [raw]
Subject: [patch 32/94] [PATCH 01/44] [CVE-2009-0029] Move compat system call declarations to compat header file

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 4c696ba7982501d43dea11dbbaabd2aa8a19cc42 upstream.

Move declarations to correct header file.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
include/linux/compat.h | 13 +++++++++++++
include/linux/syscalls.h | 12 ------------
2 files changed, 13 insertions(+), 12 deletions(-)

--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -280,5 +280,18 @@ asmlinkage long compat_sys_timerfd_setti
asmlinkage long compat_sys_timerfd_gettime(int ufd,
struct compat_itimerspec __user *otmr);

+asmlinkage long compat_sys_move_pages(pid_t pid, unsigned long nr_page,
+ __u32 __user *pages,
+ const int __user *nodes,
+ int __user *status,
+ int flags);
+asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename,
+ struct compat_timeval __user *t);
+asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user * filename,
+ struct compat_stat __user *statbuf,
+ int flag);
+asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
+ int flags, int mode);
+
#endif /* CONFIG_COMPAT */
#endif /* _LINUX_COMPAT_H */
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -530,11 +530,6 @@ asmlinkage long sys_move_pages(pid_t pid
const int __user *nodes,
int __user *status,
int flags);
-asmlinkage long compat_sys_move_pages(pid_t pid, unsigned long nr_page,
- __u32 __user *pages,
- const int __user *nodes,
- int __user *status,
- int flags);
asmlinkage long sys_mbind(unsigned long start, unsigned long len,
unsigned long mode,
unsigned long __user *nmask,
@@ -583,13 +578,6 @@ asmlinkage long sys_readlinkat(int dfd,
int bufsiz);
asmlinkage long sys_utimensat(int dfd, char __user *filename,
struct timespec __user *utimes, int flags);
-asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename,
- struct compat_timeval __user *t);
-asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user * filename,
- struct compat_stat __user *statbuf,
- int flag);
-asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
- int flags, int mode);
asmlinkage long sys_unshare(unsigned long unshare_flags);

asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,

2009-01-15 20:21:45

by Greg KH

[permalink] [raw]
Subject: [patch 33/94] [PATCH 02/44] [CVE-2009-0029] Convert all system calls to return a long

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 2ed7c03ec17779afb4fcfa3b8c61df61bd4879ba upstream.

Convert all system calls to return a long. This should be a NOP since all
converted types should have the same size anyway.
With the exception of sys_exit_group which returned void. But that doesn't
matter since the system call doesn't return.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/read_write.c | 18 +++++-----
fs/xattr.c | 12 +++----
include/linux/syscalls.h | 79 +++++++++++++++++++++++------------------------
ipc/mqueue.c | 2 -
kernel/exit.c | 4 +-
kernel/signal.c | 2 -
kernel/timer.c | 2 -
mm/filemap.c | 2 -
mm/mmap.c | 2 -
mm/mremap.c | 2 -
mm/nommu.c | 2 -
11 files changed, 64 insertions(+), 63 deletions(-)

--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -134,7 +134,7 @@ loff_t vfs_llseek(struct file *file, lof
}
EXPORT_SYMBOL(vfs_llseek);

-asmlinkage off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
+asmlinkage long sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
{
off_t retval;
struct file * file;
@@ -356,7 +356,7 @@ static inline void file_pos_write(struct
file->f_pos = pos;
}

-asmlinkage ssize_t sys_read(unsigned int fd, char __user * buf, size_t count)
+asmlinkage long sys_read(unsigned int fd, char __user * buf, size_t count)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -373,7 +373,7 @@ asmlinkage ssize_t sys_read(unsigned int
return ret;
}

-asmlinkage ssize_t sys_write(unsigned int fd, const char __user * buf, size_t count)
+asmlinkage long sys_write(unsigned int fd, const char __user * buf, size_t count)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -390,7 +390,7 @@ asmlinkage ssize_t sys_write(unsigned in
return ret;
}

-asmlinkage ssize_t sys_pread64(unsigned int fd, char __user *buf,
+asmlinkage long sys_pread64(unsigned int fd, char __user *buf,
size_t count, loff_t pos)
{
struct file *file;
@@ -411,7 +411,7 @@ asmlinkage ssize_t sys_pread64(unsigned
return ret;
}

-asmlinkage ssize_t sys_pwrite64(unsigned int fd, const char __user *buf,
+asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf,
size_t count, loff_t pos)
{
struct file *file;
@@ -659,7 +659,7 @@ ssize_t vfs_writev(struct file *file, co

EXPORT_SYMBOL(vfs_writev);

-asmlinkage ssize_t
+asmlinkage long
sys_readv(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
{
struct file *file;
@@ -680,7 +680,7 @@ sys_readv(unsigned long fd, const struct
return ret;
}

-asmlinkage ssize_t
+asmlinkage long
sys_writev(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
{
struct file *file;
@@ -799,7 +799,7 @@ out:
return retval;
}

-asmlinkage ssize_t sys_sendfile(int out_fd, int in_fd, off_t __user *offset, size_t count)
+asmlinkage long sys_sendfile(int out_fd, int in_fd, off_t __user *offset, size_t count)
{
loff_t pos;
off_t off;
@@ -818,7 +818,7 @@ asmlinkage ssize_t sys_sendfile(int out_
return do_sendfile(out_fd, in_fd, NULL, count, 0);
}

-asmlinkage ssize_t sys_sendfile64(int out_fd, int in_fd, loff_t __user *offset, size_t count)
+asmlinkage long sys_sendfile64(int out_fd, int in_fd, loff_t __user *offset, size_t count)
{
loff_t pos;
ssize_t ret;
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -349,7 +349,7 @@ getxattr(struct dentry *d, const char __
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_getxattr(const char __user *pathname, const char __user *name,
void __user *value, size_t size)
{
@@ -364,7 +364,7 @@ sys_getxattr(const char __user *pathname
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_lgetxattr(const char __user *pathname, const char __user *name, void __user *value,
size_t size)
{
@@ -379,7 +379,7 @@ sys_lgetxattr(const char __user *pathnam
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_fgetxattr(int fd, const char __user *name, void __user *value, size_t size)
{
struct file *f;
@@ -424,7 +424,7 @@ listxattr(struct dentry *d, char __user
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_listxattr(const char __user *pathname, char __user *list, size_t size)
{
struct path path;
@@ -438,7 +438,7 @@ sys_listxattr(const char __user *pathnam
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_llistxattr(const char __user *pathname, char __user *list, size_t size)
{
struct path path;
@@ -452,7 +452,7 @@ sys_llistxattr(const char __user *pathna
return error;
}

-asmlinkage ssize_t
+asmlinkage long
sys_flistxattr(int fd, char __user *list, size_t size)
{
struct file *f;
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -77,7 +77,7 @@ asmlinkage long sys_times(struct tms __u

asmlinkage long sys_gettid(void);
asmlinkage long sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp);
-asmlinkage unsigned long sys_alarm(unsigned int seconds);
+asmlinkage long sys_alarm(unsigned int seconds);
asmlinkage long sys_getpid(void);
asmlinkage long sys_getppid(void);
asmlinkage long sys_getuid(void);
@@ -166,7 +166,7 @@ asmlinkage long sys_kexec_load(unsigned
unsigned long flags);

asmlinkage long sys_exit(int error_code);
-asmlinkage void sys_exit_group(int error_code);
+asmlinkage long sys_exit_group(int error_code);
asmlinkage long sys_wait4(pid_t pid, int __user *stat_addr,
int options, struct rusage __user *ru);
asmlinkage long sys_waitid(int which, pid_t pid,
@@ -196,7 +196,7 @@ asmlinkage long sys_tkill(int pid, int s
asmlinkage long sys_rt_sigqueueinfo(int pid, int sig, siginfo_t __user *uinfo);
asmlinkage long sys_sgetmask(void);
asmlinkage long sys_ssetmask(int newmask);
-asmlinkage unsigned long sys_signal(int sig, __sighandler_t handler);
+asmlinkage long sys_signal(int sig, __sighandler_t handler);
asmlinkage long sys_pause(void);

asmlinkage long sys_sync(void);
@@ -246,29 +246,29 @@ asmlinkage long sys_lsetxattr(const char
const void __user *value, size_t size, int flags);
asmlinkage long sys_fsetxattr(int fd, const char __user *name,
const void __user *value, size_t size, int flags);
-asmlinkage ssize_t sys_getxattr(const char __user *path, const char __user *name,
- void __user *value, size_t size);
-asmlinkage ssize_t sys_lgetxattr(const char __user *path, const char __user *name,
- void __user *value, size_t size);
-asmlinkage ssize_t sys_fgetxattr(int fd, const char __user *name,
- void __user *value, size_t size);
-asmlinkage ssize_t sys_listxattr(const char __user *path, char __user *list,
- size_t size);
-asmlinkage ssize_t sys_llistxattr(const char __user *path, char __user *list,
- size_t size);
-asmlinkage ssize_t sys_flistxattr(int fd, char __user *list, size_t size);
+asmlinkage long sys_getxattr(const char __user *path, const char __user *name,
+ void __user *value, size_t size);
+asmlinkage long sys_lgetxattr(const char __user *path, const char __user *name,
+ void __user *value, size_t size);
+asmlinkage long sys_fgetxattr(int fd, const char __user *name,
+ void __user *value, size_t size);
+asmlinkage long sys_listxattr(const char __user *path, char __user *list,
+ size_t size);
+asmlinkage long sys_llistxattr(const char __user *path, char __user *list,
+ size_t size);
+asmlinkage long sys_flistxattr(int fd, char __user *list, size_t size);
asmlinkage long sys_removexattr(const char __user *path,
const char __user *name);
asmlinkage long sys_lremovexattr(const char __user *path,
const char __user *name);
asmlinkage long sys_fremovexattr(int fd, const char __user *name);

-asmlinkage unsigned long sys_brk(unsigned long brk);
+asmlinkage long sys_brk(unsigned long brk);
asmlinkage long sys_mprotect(unsigned long start, size_t len,
unsigned long prot);
-asmlinkage unsigned long sys_mremap(unsigned long addr,
- unsigned long old_len, unsigned long new_len,
- unsigned long flags, unsigned long new_addr);
+asmlinkage long sys_mremap(unsigned long addr,
+ unsigned long old_len, unsigned long new_len,
+ unsigned long flags, unsigned long new_addr);
asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
unsigned long prot, unsigned long pgoff,
unsigned long flags);
@@ -321,10 +321,10 @@ asmlinkage long sys_io_submit(aio_contex
struct iocb __user * __user *);
asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
struct io_event __user *result);
-asmlinkage ssize_t sys_sendfile(int out_fd, int in_fd,
- off_t __user *offset, size_t count);
-asmlinkage ssize_t sys_sendfile64(int out_fd, int in_fd,
- loff_t __user *offset, size_t count);
+asmlinkage long sys_sendfile(int out_fd, int in_fd,
+ off_t __user *offset, size_t count);
+asmlinkage long sys_sendfile64(int out_fd, int in_fd,
+ loff_t __user *offset, size_t count);
asmlinkage long sys_readlink(const char __user *path,
char __user *buf, int bufsiz);
asmlinkage long sys_creat(const char __user *pathname, int mode);
@@ -368,26 +368,25 @@ asmlinkage long sys_utime(char __user *f
struct utimbuf __user *times);
asmlinkage long sys_utimes(char __user *filename,
struct timeval __user *utimes);
-asmlinkage off_t sys_lseek(unsigned int fd, off_t offset,
- unsigned int origin);
+asmlinkage long sys_lseek(unsigned int fd, off_t offset,
+ unsigned int origin);
asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high,
unsigned long offset_low, loff_t __user *result,
unsigned int origin);
-asmlinkage ssize_t sys_read(unsigned int fd, char __user *buf,
- size_t count);
-asmlinkage ssize_t sys_readahead(int fd, loff_t offset, size_t count);
-asmlinkage ssize_t sys_readv(unsigned long fd,
- const struct iovec __user *vec,
- unsigned long vlen);
-asmlinkage ssize_t sys_write(unsigned int fd, const char __user *buf,
- size_t count);
-asmlinkage ssize_t sys_writev(unsigned long fd,
- const struct iovec __user *vec,
- unsigned long vlen);
-asmlinkage ssize_t sys_pread64(unsigned int fd, char __user *buf,
- size_t count, loff_t pos);
-asmlinkage ssize_t sys_pwrite64(unsigned int fd, const char __user *buf,
- size_t count, loff_t pos);
+asmlinkage long sys_read(unsigned int fd, char __user *buf, size_t count);
+asmlinkage long sys_readahead(int fd, loff_t offset, size_t count);
+asmlinkage long sys_readv(unsigned long fd,
+ const struct iovec __user *vec,
+ unsigned long vlen);
+asmlinkage long sys_write(unsigned int fd, const char __user *buf,
+ size_t count);
+asmlinkage long sys_writev(unsigned long fd,
+ const struct iovec __user *vec,
+ unsigned long vlen);
+asmlinkage long sys_pread64(unsigned int fd, char __user *buf,
+ size_t count, loff_t pos);
+asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf,
+ size_t count, loff_t pos);
asmlinkage long sys_getcwd(char __user *buf, unsigned long size);
asmlinkage long sys_mkdir(const char __user *pathname, int mode);
asmlinkage long sys_chdir(const char __user *filename);
@@ -476,7 +475,7 @@ asmlinkage long sys_shmctl(int shmid, in
asmlinkage long sys_mq_open(const char __user *name, int oflag, mode_t mode, struct mq_attr __user *attr);
asmlinkage long sys_mq_unlink(const char __user *name);
asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *msg_ptr, size_t msg_len, unsigned int msg_prio, const struct timespec __user *abs_timeout);
-asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *msg_ptr, size_t msg_len, unsigned int __user *msg_prio, const struct timespec __user *abs_timeout);
+asmlinkage long sys_mq_timedreceive(mqd_t mqdes, char __user *msg_ptr, size_t msg_len, unsigned int __user *msg_prio, const struct timespec __user *abs_timeout);
asmlinkage long sys_mq_notify(mqd_t mqdes, const struct sigevent __user *notification);
asmlinkage long sys_mq_getsetattr(mqd_t mqdes, const struct mq_attr __user *mqstat, struct mq_attr __user *omqstat);

--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -904,7 +904,7 @@ out:
return ret;
}

-asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
+asmlinkage long sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
size_t msg_len, unsigned int __user *u_msg_prio,
const struct timespec __user *u_abs_timeout)
{
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1184,9 +1184,11 @@ do_group_exit(int exit_code)
* wait4()-ing process will get the correct exit code - even if this
* thread is not the thread group leader.
*/
-asmlinkage void sys_exit_group(int error_code)
+asmlinkage long sys_exit_group(int error_code)
{
do_group_exit((error_code & 0xff) << 8);
+ /* NOTREACHED */
+ return 0;
}

static struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2538,7 +2538,7 @@ sys_ssetmask(int newmask)
/*
* For backwards compatibility. Functionality superseded by sigaction.
*/
-asmlinkage unsigned long
+asmlinkage long
sys_signal(int sig, __sighandler_t handler)
{
struct k_sigaction new_sa, old_sa;
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1144,7 +1144,7 @@ void do_timer(unsigned long ticks)
* For backwards compatibility? This can be done in libc so Alpha
* and all newer ports shouldn't need it.
*/
-asmlinkage unsigned long sys_alarm(unsigned int seconds)
+asmlinkage long sys_alarm(unsigned int seconds)
{
return alarm_setitimer(seconds);
}
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1366,7 +1366,7 @@ do_readahead(struct address_space *mappi
return 0;
}

-asmlinkage ssize_t sys_readahead(int fd, loff_t offset, size_t count)
+asmlinkage long sys_readahead(int fd, loff_t offset, size_t count)
{
ssize_t ret;
struct file *file;
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -245,7 +245,7 @@ static struct vm_area_struct *remove_vma
return next;
}

-asmlinkage unsigned long sys_brk(unsigned long brk)
+asmlinkage long sys_brk(unsigned long brk)
{
unsigned long rlim, retval;
unsigned long newbrk, oldbrk;
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -420,7 +420,7 @@ out_nc:
return ret;
}

-asmlinkage unsigned long sys_mremap(unsigned long addr,
+asmlinkage long sys_mremap(unsigned long addr,
unsigned long old_len, unsigned long new_len,
unsigned long flags, unsigned long new_addr)
{
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -377,7 +377,7 @@ EXPORT_SYMBOL(vm_insert_page);
* to a regular file. in this case, the unmapping will need
* to invoke file system routines that need the global lock.
*/
-asmlinkage unsigned long sys_brk(unsigned long brk)
+asmlinkage long sys_brk(unsigned long brk)
{
struct mm_struct *mm = current->mm;

2009-01-15 20:22:18

by Greg KH

[permalink] [raw]
Subject: [patch 36/94] [PATCH 05/44] [CVE-2009-0029] Make sys_pselect7 static

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit c9da9f2129d6a421c32e334a83770a9e67f7feac upstream.

Not a single architecture has wired up sys_pselect7 plus it is the
only system call with seven parameters. Just make it static and
rename it to do_pselect which will do the work for sys_pselect6.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/compat.c | 6 +++---
fs/select.c | 8 ++++----
2 files changed, 7 insertions(+), 7 deletions(-)

--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1697,7 +1697,7 @@ asmlinkage long compat_sys_select(int n,
}

#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
+static long do_compat_pselect(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *outp, compat_ulong_t __user *exp,
struct compat_timespec __user *tsp, compat_sigset_t __user *sigmask,
compat_size_t sigsetsize)
@@ -1763,8 +1763,8 @@ asmlinkage long compat_sys_pselect6(int
(compat_size_t __user *)(sig+sizeof(up))))
return -EFAULT;
}
- return compat_sys_pselect7(n, inp, outp, exp, tsp, compat_ptr(up),
- sigsetsize);
+ return do_compat_pselect(n, inp, outp, exp, tsp, compat_ptr(up),
+ sigsetsize);
}

asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
--- a/fs/select.c
+++ b/fs/select.c
@@ -532,9 +532,9 @@ asmlinkage long sys_select(int n, fd_set
}

#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
- fd_set __user *exp, struct timespec __user *tsp,
- const sigset_t __user *sigmask, size_t sigsetsize)
+static long do_pselect(int n, fd_set __user *inp, fd_set __user *outp,
+ fd_set __user *exp, struct timespec __user *tsp,
+ const sigset_t __user *sigmask, size_t sigsetsize)
{
sigset_t ksigmask, sigsaved;
struct timespec ts, end_time, *to = NULL;
@@ -600,7 +600,7 @@ asmlinkage long sys_pselect6(int n, fd_s
return -EFAULT;
}

- return sys_pselect7(n, inp, outp, exp, tsp, up, sigsetsize);
+ return do_pselect(n, inp, outp, exp, tsp, up, sigsetsize);
}
#endif /* HAVE_SET_RESTORE_SIGMASK */

2009-01-15 20:22:41

by Greg KH

[permalink] [raw]
Subject: [patch 35/94] [PATCH 04/44] [CVE-2009-0029] Remove __attribute__((weak)) from sys_pipe/sys_pipe2

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 1134723e96f6e2abcf8bfd7a2d1c96fcc323ef35 upstream.

Remove __attribute__((weak)) from common code sys_pipe implemantation.
IA64, ALPHA, SUPERH (32bit) and SPARC (32bit) have own implemantations
with the same name. Just rename them.
For sys_pipe2 there is no architecture specific implementation.

Cc: Richard Henderson <[email protected]>
Cc: David S. Miller <[email protected]>
Cc: Paul Mundt <[email protected]>
Cc: Tony Luck <[email protected]>
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/alpha/kernel/entry.S | 8 ++++----
arch/alpha/kernel/systbls.S | 2 +-
arch/ia64/ia32/ia32_entry.S | 2 +-
arch/ia64/include/asm/unistd.h | 2 +-
arch/ia64/kernel/entry.S | 2 +-
arch/ia64/kernel/sys_ia64.c | 2 +-
arch/s390/kernel/entry.h | 1 -
arch/sh/include/asm/syscalls_32.h | 6 +++---
arch/sh/kernel/sys_sh32.c | 2 +-
arch/sh/kernel/syscalls_32.S | 2 +-
arch/sparc/kernel/entry.S | 4 ++--
arch/sparc/kernel/systbls.S | 2 +-
arch/sparc64/kernel/syscalls.S | 2 +-
arch/sparc64/kernel/systbls.S | 4 ++--
fs/pipe.c | 4 ++--
15 files changed, 22 insertions(+), 23 deletions(-)

--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -894,9 +894,9 @@ sys_getxpid:
.end sys_getxpid

.align 4
- .globl sys_pipe
- .ent sys_pipe
-sys_pipe:
+ .globl sys_alpha_pipe
+ .ent sys_alpha_pipe
+sys_alpha_pipe:
lda $sp, -16($sp)
stq $26, 0($sp)
.prologue 0
@@ -914,7 +914,7 @@ sys_pipe:
stq $1, 80+16($sp)
1: lda $sp, 16($sp)
ret
-.end sys_pipe
+.end sys_alpha_pipe

.align 4
.globl sys_execve
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -52,7 +52,7 @@ sys_call_table:
.quad sys_setpgid
.quad alpha_ni_syscall /* 40 */
.quad sys_dup
- .quad sys_pipe
+ .quad sys_alpha_pipe
.quad osf_set_program_attributes
.quad alpha_ni_syscall
.quad sys_open /* 45 */
--- a/arch/ia64/ia32/ia32_entry.S
+++ b/arch/ia64/ia32/ia32_entry.S
@@ -220,7 +220,7 @@ ia32_syscall_table:
data8 sys_mkdir
data8 sys_rmdir /* 40 */
data8 sys_dup
- data8 sys_pipe
+ data8 sys_ia64_pipe
data8 compat_sys_times
data8 sys_ni_syscall /* old prof syscall holder */
data8 sys32_brk /* 45 */
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -364,7 +364,7 @@ struct pt_regs;
struct sigaction;
long sys_execve(char __user *filename, char __user * __user *argv,
char __user * __user *envp, struct pt_regs *regs);
-asmlinkage long sys_pipe(void);
+asmlinkage long sys_ia64_pipe(void);
asmlinkage long sys_rt_sigaction(int sig,
const struct sigaction __user *act,
struct sigaction __user *oact,
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1442,7 +1442,7 @@ sys_call_table:
data8 sys_mkdir // 1055
data8 sys_rmdir
data8 sys_dup
- data8 sys_pipe
+ data8 sys_ia64_pipe
data8 sys_times
data8 ia64_brk // 1060
data8 sys_setgid
--- a/arch/ia64/kernel/sys_ia64.c
+++ b/arch/ia64/kernel/sys_ia64.c
@@ -154,7 +154,7 @@ out:
* and r9) as this is faster than doing a copy_to_user().
*/
asmlinkage long
-sys_pipe (void)
+sys_ia64_pipe (void)
{
struct pt_regs *regs = task_pt_regs(current);
int fd[2];
--- a/arch/s390/kernel/entry.h
+++ b/arch/s390/kernel/entry.h
@@ -30,7 +30,6 @@ struct fadvise64_64_args;
struct old_sigaction;
struct sel_arg_struct;

-long sys_pipe(unsigned long __user *fildes);
long sys_mmap2(struct mmap_arg_struct __user *arg);
long old_mmap(struct mmap_arg_struct __user *arg);
long sys_ipc(uint call, int first, unsigned long second,
--- a/arch/sh/include/asm/syscalls_32.h
+++ b/arch/sh/include/asm/syscalls_32.h
@@ -36,9 +36,9 @@ asmlinkage int sys_sigreturn(unsigned lo
asmlinkage int sys_rt_sigreturn(unsigned long r4, unsigned long r5,
unsigned long r6, unsigned long r7,
struct pt_regs __regs);
-asmlinkage int sys_pipe(unsigned long r4, unsigned long r5,
- unsigned long r6, unsigned long r7,
- struct pt_regs __regs);
+asmlinkage int sys_sh_pipe(unsigned long r4, unsigned long r5,
+ unsigned long r6, unsigned long r7,
+ struct pt_regs __regs);
asmlinkage ssize_t sys_pread_wrapper(unsigned int fd, char __user *buf,
size_t count, long dummy, loff_t pos);
asmlinkage ssize_t sys_pwrite_wrapper(unsigned int fd, const char __user *buf,
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -58,7 +58,7 @@ ENTRY(sys_call_table)
.long sys_mkdir
.long sys_rmdir /* 40 */
.long sys_dup
- .long sys_pipe
+ .long sys_sh_pipe
.long sys_times
.long sys_ni_syscall /* old prof syscall holder */
.long sys_brk /* 45 */
--- a/arch/sh/kernel/sys_sh32.c
+++ b/arch/sh/kernel/sys_sh32.c
@@ -22,7 +22,7 @@
* sys_pipe() is the normal C calling standard for creating
* a pipe. It's not the way Unix traditionally does this, though.
*/
-asmlinkage int sys_pipe(unsigned long r4, unsigned long r5,
+asmlinkage int sys_sh_pipe(unsigned long r4, unsigned long r5,
unsigned long r6, unsigned long r7,
struct pt_regs __regs)
{
--- a/arch/sparc64/kernel/syscalls.S
+++ b/arch/sparc64/kernel/syscalls.S
@@ -20,7 +20,7 @@ execve_merge:
add %sp, PTREGS_OFF, %o0

.align 32
-sys_pipe:
+sys_sparc_pipe:
ba,pt %xcc, sparc_pipe
add %sp, PTREGS_OFF, %o0
sys_nis_syscall:
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -26,7 +26,7 @@ sys_call_table32:
/*25*/ .word sys32_vmsplice, compat_sys_ptrace, sys_alarm, sys32_sigaltstack, sys_pause
/*30*/ .word compat_sys_utime, sys_lchown, sys_fchown, sys32_access, sys32_nice
.word sys_chown, sys_sync, sys32_kill, compat_sys_newstat, sys32_sendfile
-/*40*/ .word compat_sys_newlstat, sys_dup, sys_pipe, compat_sys_times, sys_getuid
+/*40*/ .word compat_sys_newlstat, sys_dup, sys_sparc_pipe, compat_sys_times, sys_getuid
.word sys32_umount, sys_setgid16, sys_getgid16, sys32_signal, sys_geteuid16
/*50*/ .word sys_getegid16, sys_acct, sys_nis_syscall, sys_getgid, compat_sys_ioctl
.word sys32_reboot, sys32_mmap2, sys_symlink, sys32_readlink, sys32_execve
@@ -100,7 +100,7 @@ sys_call_table:
/*25*/ .word sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
/*30*/ .word sys_utime, sys_nis_syscall, sys_nis_syscall, sys_access, sys_nice
.word sys_nis_syscall, sys_sync, sys_kill, sys_newstat, sys_sendfile64
-/*40*/ .word sys_newlstat, sys_dup, sys_pipe, sys_times, sys_nis_syscall
+/*40*/ .word sys_newlstat, sys_dup, sys_sparc_pipe, sys_times, sys_nis_syscall
.word sys_umount, sys_setgid, sys_getgid, sys_signal, sys_geteuid
/*50*/ .word sys_getegid, sys_acct, sys_memory_ordering, sys_nis_syscall, sys_ioctl
.word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys_execve
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -1088,8 +1088,8 @@ sunos_execv:
ld [%sp + STACKFRAME_SZ + PT_I0], %o0

.align 4
- .globl sys_pipe
-sys_pipe:
+ .globl sys_sparc_pipe
+sys_sparc_pipe:
mov %o7, %l5
add %sp, STACKFRAME_SZ, %o0 ! pt_regs *regs arg
call sparc_pipe
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -24,7 +24,7 @@ sys_call_table:
/*25*/ .long sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_pause
/*30*/ .long sys_utime, sys_lchown, sys_fchown, sys_access, sys_nice
/*35*/ .long sys_chown, sys_sync, sys_kill, sys_newstat, sys_sendfile
-/*40*/ .long sys_newlstat, sys_dup, sys_pipe, sys_times, sys_getuid
+/*40*/ .long sys_newlstat, sys_dup, sys_sparc_pipe, sys_times, sys_getuid
/*45*/ .long sys_umount, sys_setgid16, sys_getgid16, sys_signal, sys_geteuid16
/*50*/ .long sys_getegid16, sys_acct, sys_nis_syscall, sys_getgid, sys_ioctl
/*55*/ .long sys_reboot, sys_mmap2, sys_symlink, sys_readlink, sys_execve
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1048,7 +1048,7 @@ int do_pipe(int *fd)
* sys_pipe() is the normal C calling standard for creating
* a pipe. It's not the way Unix traditionally does this, though.
*/
-asmlinkage long __weak sys_pipe2(int __user *fildes, int flags)
+asmlinkage long sys_pipe2(int __user *fildes, int flags)
{
int fd[2];
int error;
@@ -1064,7 +1064,7 @@ asmlinkage long __weak sys_pipe2(int __u
return error;
}

-asmlinkage long __weak sys_pipe(int __user *fildes)
+asmlinkage long sys_pipe(int __user *fildes)
{
return sys_pipe2(fildes, 0);
}

2009-01-15 20:23:10

by Greg KH

[permalink] [raw]
Subject: [patch 34/94] [PATCH 03/44] [CVE-2009-0029] Rename old_readdir to sys_old_readdir

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit e55380edf68796d75bf41391a781c68ee678587d upstream.

This way it matches the generic system call name convention.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/arm/kernel/calls.S | 2 +-
arch/cris/arch-v10/kernel/entry.S | 2 +-
arch/cris/arch-v32/kernel/entry.S | 2 +-
arch/h8300/kernel/syscalls.S | 2 +-
arch/m68k/kernel/entry.S | 2 +-
arch/m68knommu/kernel/syscalltable.S | 2 +-
arch/mips/kernel/scall32-o32.S | 2 +-
arch/mn10300/kernel/entry.S | 2 +-
arch/powerpc/include/asm/systbl.h | 2 +-
arch/sh/kernel/syscalls_32.S | 2 +-
arch/sh/kernel/syscalls_64.S | 2 +-
arch/sparc/kernel/systbls.S | 2 +-
arch/x86/kernel/syscall_table_32.S | 2 +-
fs/readdir.c | 2 +-
include/linux/syscalls.h | 2 ++
15 files changed, 16 insertions(+), 14 deletions(-)

--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -98,7 +98,7 @@
CALL(sys_uselib)
CALL(sys_swapon)
CALL(sys_reboot)
- CALL(OBSOLETE(old_readdir)) /* used by libc4 */
+ CALL(OBSOLETE(sys_old_readdir)) /* used by libc4 */
/* 90 */ CALL(OBSOLETE(old_mmap)) /* used by libc4 */
CALL(sys_munmap)
CALL(sys_truncate)
--- a/arch/cris/arch-v10/kernel/entry.S
+++ b/arch/cris/arch-v10/kernel/entry.S
@@ -691,7 +691,7 @@ sys_call_table:
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/cris/arch-v32/kernel/entry.S
+++ b/arch/cris/arch-v32/kernel/entry.S
@@ -614,7 +614,7 @@ sys_call_table:
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/h8300/kernel/syscalls.S
+++ b/arch/h8300/kernel/syscalls.S
@@ -103,7 +103,7 @@ SYMBOL_NAME_LABEL(sys_call_table)
.long SYMBOL_NAME(sys_uselib)
.long SYMBOL_NAME(sys_swapon)
.long SYMBOL_NAME(sys_reboot)
- .long SYMBOL_NAME(old_readdir)
+ .long SYMBOL_NAME(sys_old_readdir)
.long SYMBOL_NAME(old_mmap) /* 90 */
.long SYMBOL_NAME(sys_munmap)
.long SYMBOL_NAME(sys_truncate)
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -513,7 +513,7 @@ sys_call_table:
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/m68knommu/kernel/syscalltable.S
+++ b/arch/m68knommu/kernel/syscalltable.S
@@ -107,7 +107,7 @@ ENTRY(sys_call_table)
.long sys_uselib
.long sys_ni_syscall /* sys_swapon */
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -398,7 +398,7 @@ einval: li v0, -ENOSYS
sys sys_uselib 1
sys sys_swapon 2
sys sys_reboot 3
- sys old_readdir 3
+ sys sys_old_readdir 3
sys old_mmap 6 /* 4090 */
sys sys_munmap 2
sys sys_truncate 2
--- a/arch/mn10300/kernel/entry.S
+++ b/arch/mn10300/kernel/entry.S
@@ -478,7 +478,7 @@ ENTRY(sys_call_table)
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -92,7 +92,7 @@ COMPAT_SYS_SPU(readlink)
SYSCALL(uselib)
SYSCALL(swapon)
SYSCALL(reboot)
-SYSX(sys_ni_syscall,compat_sys_old_readdir,old_readdir)
+SYSX(sys_ni_syscall,compat_sys_old_readdir,sys_old_readdir)
SYSCALL_SPU(mmap)
SYSCALL_SPU(munmap)
SYSCALL_SPU(truncate)
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -105,7 +105,7 @@ ENTRY(sys_call_table)
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/sh/kernel/syscalls_64.S
+++ b/arch/sh/kernel/syscalls_64.S
@@ -109,7 +109,7 @@ sys_call_table:
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -56,7 +56,7 @@ sys_call_table:
/*185*/ .long sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sys_newuname
/*190*/ .long sys_init_module, sys_personality, sparc_remap_file_pages, sys_epoll_create, sys_epoll_ctl
/*195*/ .long sys_epoll_wait, sys_ioprio_set, sys_getppid, sparc_sigaction, sys_sgetmask
-/*200*/ .long sys_ssetmask, sys_sigsuspend, sys_newlstat, sys_uselib, old_readdir
+/*200*/ .long sys_ssetmask, sys_sigsuspend, sys_newlstat, sys_uselib, sys_old_readdir
/*205*/ .long sys_readahead, sys_socketcall, sys_syslog, sys_lookup_dcookie, sys_fadvise64
/*210*/ .long sys_fadvise64_64, sys_tgkill, sys_waitpid, sys_swapoff, sys_sysinfo
/*215*/ .long sys_ipc, sys_sigreturn, sys_clone, sys_ioprio_get, sys_adjtimex
--- a/arch/x86/kernel/syscall_table_32.S
+++ b/arch/x86/kernel/syscall_table_32.S
@@ -88,7 +88,7 @@ ENTRY(sys_call_table)
.long sys_uselib
.long sys_swapon
.long sys_reboot
- .long old_readdir
+ .long sys_old_readdir
.long old_mmap /* 90 */
.long sys_munmap
.long sys_truncate
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -102,7 +102,7 @@ efault:
return -EFAULT;
}

-asmlinkage long old_readdir(unsigned int fd, struct old_linux_dirent __user * dirent, unsigned int count)
+asmlinkage long sys_old_readdir(unsigned int fd, struct old_linux_dirent __user * dirent, unsigned int count)
{
int error;
struct file * file;
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -54,6 +54,7 @@ struct compat_stat;
struct compat_timeval;
struct robust_list_head;
struct getcpu_cache;
+struct old_linux_dirent;

#include <linux/types.h>
#include <linux/aio_abi.h>
@@ -608,6 +609,7 @@ asmlinkage long sys_timerfd_gettime(int
asmlinkage long sys_eventfd(unsigned int count);
asmlinkage long sys_eventfd2(unsigned int count, int flags);
asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len);
+asmlinkage long sys_old_readdir(unsigned int, struct old_linux_dirent __user *, unsigned int);

int kernel_execve(const char *filename, char *const argv[], char *const envp[]);

2009-01-15 20:24:19

by Greg KH

[permalink] [raw]
Subject: [patch 37/94] [PATCH 06/44] [CVE-2009-0029] Make sys_syslog a conditional system call

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit f627a741d24f12955fa2d9f8831c3b12860635bd upstream.

Remove the -ENOSYS implementation for !CONFIG_PRINTK and use
the cond_syscall infrastructure instead.

Acked-by: Kyle McMartin <[email protected]>
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/printk.c | 5 -----
kernel/sys_ni.c | 1 +
2 files changed, 1 insertion(+), 5 deletions(-)

--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -742,11 +742,6 @@ EXPORT_SYMBOL(vprintk);

#else

-asmlinkage long sys_syslog(int type, char __user *buf, int len)
-{
- return -ENOSYS;
-}
-
static void call_console_drivers(unsigned start, unsigned end)
{
}
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -131,6 +131,7 @@ cond_syscall(sys_io_destroy);
cond_syscall(sys_io_submit);
cond_syscall(sys_io_cancel);
cond_syscall(sys_io_getevents);
+cond_syscall(sys_syslog);

/* arch-specific weak syscall entries */
cond_syscall(sys_pciconfig_read);

2009-01-15 20:25:22

by Greg KH

[permalink] [raw]
Subject: [patch 38/94] [PATCH 07/44] [CVE-2009-0029] System call wrapper infrastructure

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 1a94bc34768e463a93cb3751819709ab0ea80a01 upstream.

From: Martin Schwidefsky <[email protected]>

By selecting HAVE_SYSCALL_WRAPPERS architectures can activate
system call wrappers in order to sign extend system call arguments.

All architectures where the ABI defines that the caller of a function
has to perform sign extension probably need this.

Reported-by: Christian Borntraeger <[email protected]>
Acked-by: Ralf Baechle <[email protected]>
Signed-off-by: Martin Schwidefsky <[email protected]>
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/Kconfig | 3 ++
include/linux/syscalls.h | 62 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 65 insertions(+)

--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -60,6 +60,9 @@ config HAVE_EFFICIENT_UNALIGNED_ACCESS
See Documentation/unaligned-memory-access.txt for more
information on the topic of unaligned memory accesses.

+config HAVE_SYSCALL_WRAPPERS
+ bool
+
config KRETPROBES
def_bool y
depends on KPROBES && HAVE_KRETPROBES
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -66,6 +66,68 @@ struct old_linux_dirent;
#include <linux/quota.h>
#include <linux/key.h>

+#define __SC_DECL1(t1, a1) t1 a1
+#define __SC_DECL2(t2, a2, ...) t2 a2, __SC_DECL1(__VA_ARGS__)
+#define __SC_DECL3(t3, a3, ...) t3 a3, __SC_DECL2(__VA_ARGS__)
+#define __SC_DECL4(t4, a4, ...) t4 a4, __SC_DECL3(__VA_ARGS__)
+#define __SC_DECL5(t5, a5, ...) t5 a5, __SC_DECL4(__VA_ARGS__)
+#define __SC_DECL6(t6, a6, ...) t6 a6, __SC_DECL5(__VA_ARGS__)
+
+#define __SC_LONG1(t1, a1) long a1
+#define __SC_LONG2(t2, a2, ...) long a2, __SC_LONG1(__VA_ARGS__)
+#define __SC_LONG3(t3, a3, ...) long a3, __SC_LONG2(__VA_ARGS__)
+#define __SC_LONG4(t4, a4, ...) long a4, __SC_LONG3(__VA_ARGS__)
+#define __SC_LONG5(t5, a5, ...) long a5, __SC_LONG4(__VA_ARGS__)
+#define __SC_LONG6(t6, a6, ...) long a6, __SC_LONG5(__VA_ARGS__)
+
+#define __SC_CAST1(t1, a1) (t1) a1
+#define __SC_CAST2(t2, a2, ...) (t2) a2, __SC_CAST1(__VA_ARGS__)
+#define __SC_CAST3(t3, a3, ...) (t3) a3, __SC_CAST2(__VA_ARGS__)
+#define __SC_CAST4(t4, a4, ...) (t4) a4, __SC_CAST3(__VA_ARGS__)
+#define __SC_CAST5(t5, a5, ...) (t5) a5, __SC_CAST4(__VA_ARGS__)
+#define __SC_CAST6(t6, a6, ...) (t6) a6, __SC_CAST5(__VA_ARGS__)
+
+#define __SC_TEST(type) BUILD_BUG_ON(sizeof(type) > sizeof(long))
+#define __SC_TEST1(t1, a1) __SC_TEST(t1)
+#define __SC_TEST2(t2, a2, ...) __SC_TEST(t2); __SC_TEST1(__VA_ARGS__)
+#define __SC_TEST3(t3, a3, ...) __SC_TEST(t3); __SC_TEST2(__VA_ARGS__)
+#define __SC_TEST4(t4, a4, ...) __SC_TEST(t4); __SC_TEST3(__VA_ARGS__)
+#define __SC_TEST5(t5, a5, ...) __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
+#define __SC_TEST6(t6, a6, ...) __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
+
+#define SYSCALL_DEFINE0(name) asmlinkage long sys_##name(void)
+#define SYSCALL_DEFINE1(...) SYSCALL_DEFINEx(1, __VA_ARGS__)
+#define SYSCALL_DEFINE2(...) SYSCALL_DEFINEx(2, __VA_ARGS__)
+#define SYSCALL_DEFINE3(...) SYSCALL_DEFINEx(3, __VA_ARGS__)
+#define SYSCALL_DEFINE4(...) SYSCALL_DEFINEx(4, __VA_ARGS__)
+#define SYSCALL_DEFINE5(...) SYSCALL_DEFINEx(5, __VA_ARGS__)
+#define SYSCALL_DEFINE6(...) SYSCALL_DEFINEx(6, __VA_ARGS__)
+
+#define SYSCALL_ALIAS(alias, name) \
+ asm ("\t.globl " #alias "\n\t.set " #alias ", " #name)
+
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+
+#define SYSCALL_DEFINE(name) static inline long SYSC_##name
+#define SYSCALL_DEFINEx(x, name, ...) \
+ asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__)); \
+ static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__)); \
+ asmlinkage long SyS_##name(__SC_LONG##x(__VA_ARGS__)) \
+ { \
+ __SC_TEST##x(__VA_ARGS__); \
+ return (long) SYSC_##name(__SC_CAST##x(__VA_ARGS__)); \
+ } \
+ SYSCALL_ALIAS(sys_##name, SyS_##name); \
+ static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__))
+
+#else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
+
+#define SYSCALL_DEFINE(name) asmlinkage long sys_##name
+#define SYSCALL_DEFINEx(x, name, ...) \
+ asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__))
+
+#endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
+
asmlinkage long sys_time(time_t __user *tloc);
asmlinkage long sys_stime(time_t __user *tptr);
asmlinkage long sys_gettimeofday(struct timeval __user *tv,

2009-01-15 20:25:52

by Greg KH

[permalink] [raw]
Subject: [patch 39/94] [PATCH 08/44] [CVE-2009-0029] powerpc: Enable syscall wrappers for 64-bit

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Benjamin Herrenschmidt <[email protected]>

commit ee6a093222549ac0c72cfd296c69fa5e7d6daa34 upstream.

This enables the use of syscall wrappers to do proper sign extension
for 64-bit programs.

Signed-off-by: Benjamin Herrenschmidt <[email protected]>
Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/powerpc/Kconfig | 1 +
include/linux/syscalls.h | 6 ++++++
2 files changed, 7 insertions(+)

--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -121,6 +121,7 @@ config PPC
select HAVE_DMA_ATTRS if PPC64
select USE_GENERIC_SMP_HELPERS if SMP
select HAVE_OPROFILE
+ select HAVE_SYSCALL_WRAPPERS if PPC64

config EARLY_PRINTK
bool
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -103,8 +103,14 @@ struct old_linux_dirent;
#define SYSCALL_DEFINE5(...) SYSCALL_DEFINEx(5, __VA_ARGS__)
#define SYSCALL_DEFINE6(...) SYSCALL_DEFINEx(6, __VA_ARGS__)

+#ifdef CONFIG_PPC64
+#define SYSCALL_ALIAS(alias, name) \
+ asm ("\t.globl " #alias "\n\t.set " #alias ", " #name "\n" \
+ "\t.globl ." #alias "\n\t.set ." #alias ", ." #name)
+#else
#define SYSCALL_ALIAS(alias, name) \
asm ("\t.globl " #alias "\n\t.set " #alias ", " #name)
+#endif

#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS

2009-01-15 20:26:29

by Greg KH

[permalink] [raw]
Subject: [patch 40/94] [PATCH 09/44] [CVE-2009-0029] s390: enable system call wrappers

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit ed6bb6194350dc6ae97a65dbf2d621a3dbe6bbe9 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/s390/Kconfig | 1 +
1 file changed, 1 insertion(+)

--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -70,6 +70,7 @@ mainmenu "Linux Kernel Configuration"

config S390
def_bool y
+ select HAVE_SYSCALL_WRAPPERS
select HAVE_OPROFILE
select HAVE_KPROBES
select HAVE_KRETPROBES

2009-01-15 20:26:51

by Greg KH

[permalink] [raw]
Subject: [patch 41/94] [PATCH 10/44] [CVE-2009-0029] System call wrapper special cases

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 6673e0c3fbeaed2cd08e2fd4a4aa97382d6fedb0 upstream.

System calls with an unsigned long long argument can't be converted with
the standard wrappers since that would include a cast to long, which in
turn means that we would lose the upper 32 bit on 32 bit architectures.
Also semctl can't use the standard wrapper since it has a 'union'
parameter.

So we handle them as special case and add some extra wrappers instead.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/dcookies.c | 10 ++++++++--
fs/open.c | 27 ++++++++++++++++++++++++---
fs/read_write.c | 24 ++++++++++++++++++++----
fs/sync.c | 26 ++++++++++++++++++++++----
ipc/sem.c | 9 ++++++++-
mm/fadvise.c | 18 ++++++++++++++++--
mm/filemap.c | 9 ++++++++-
7 files changed, 106 insertions(+), 17 deletions(-)

--- a/fs/dcookies.c
+++ b/fs/dcookies.c
@@ -140,7 +140,7 @@ out:
/* And here is where the userspace process can look up the cookie value
* to retrieve the path.
*/
-asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
+SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len)
{
unsigned long cookie = (unsigned long)cookie64;
int err = -EINVAL;
@@ -193,7 +193,13 @@ out:
mutex_unlock(&dcookie_mutex);
return err;
}
-
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_lookup_dcookie(u64 cookie64, long buf, long len)
+{
+ return SYSC_lookup_dcookie(cookie64, (char __user *) buf, (size_t) len);
+}
+SYSCALL_ALIAS(sys_lookup_dcookie, SyS_lookup_dcookie);
+#endif

static int dcookie_init(void)
{
--- a/fs/open.c
+++ b/fs/open.c
@@ -346,21 +346,35 @@ asmlinkage long sys_ftruncate(unsigned i

/* LFS versions of truncate are only needed on 32 bit machines */
#if BITS_PER_LONG == 32
-asmlinkage long sys_truncate64(const char __user * path, loff_t length)
+SYSCALL_DEFINE(truncate64)(const char __user * path, loff_t length)
{
return do_sys_truncate(path, length);
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_truncate64(long path, loff_t length)
+{
+ return SYSC_truncate64((const char __user *) path, length);
+}
+SYSCALL_ALIAS(sys_truncate64, SyS_truncate64);
+#endif

-asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
+SYSCALL_DEFINE(ftruncate64)(unsigned int fd, loff_t length)
{
long ret = do_sys_ftruncate(fd, length, 0);
/* avoid REGPARM breakage on x86: */
asmlinkage_protect(2, ret, fd, length);
return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_ftruncate64(long fd, loff_t length)
+{
+ return SYSC_ftruncate64((unsigned int) fd, length);
+}
+SYSCALL_ALIAS(sys_ftruncate64, SyS_ftruncate64);
#endif
+#endif /* BITS_PER_LONG == 32 */

-asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len)
+SYSCALL_DEFINE(fallocate)(int fd, int mode, loff_t offset, loff_t len)
{
struct file *file;
struct inode *inode;
@@ -417,6 +431,13 @@ out_fput:
out:
return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_fallocate(long fd, long mode, loff_t offset, loff_t len)
+{
+ return SYSC_fallocate((int)fd, (int)mode, offset, len);
+}
+SYSCALL_ALIAS(sys_fallocate, SyS_fallocate);
+#endif

/*
* access() needs to use the real uid/gid, not the effective uid/gid.
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -390,8 +390,8 @@ asmlinkage long sys_write(unsigned int f
return ret;
}

-asmlinkage long sys_pread64(unsigned int fd, char __user *buf,
- size_t count, loff_t pos)
+SYSCALL_DEFINE(pread64)(unsigned int fd, char __user *buf,
+ size_t count, loff_t pos)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -410,9 +410,17 @@ asmlinkage long sys_pread64(unsigned int

return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_pread64(long fd, long buf, long count, loff_t pos)
+{
+ return SYSC_pread64((unsigned int) fd, (char __user *) buf,
+ (size_t) count, pos);
+}
+SYSCALL_ALIAS(sys_pread64, SyS_pread64);
+#endif

-asmlinkage long sys_pwrite64(unsigned int fd, const char __user *buf,
- size_t count, loff_t pos)
+SYSCALL_DEFINE(pwrite64)(unsigned int fd, const char __user *buf,
+ size_t count, loff_t pos)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -431,6 +439,14 @@ asmlinkage long sys_pwrite64(unsigned in

return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_pwrite64(long fd, long buf, long count, loff_t pos)
+{
+ return SYSC_pwrite64((unsigned int) fd, (const char __user *) buf,
+ (size_t) count, pos);
+}
+SYSCALL_ALIAS(sys_pwrite64, SyS_pwrite64);
+#endif

/*
* Reduce an iovec's length in-place. Return the resulting number of segments
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -175,8 +175,8 @@ asmlinkage long sys_fdatasync(unsigned i
* already-instantiated disk blocks, there are no guarantees here that the data
* will be available after a crash.
*/
-asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
- unsigned int flags)
+SYSCALL_DEFINE(sync_file_range)(int fd, loff_t offset, loff_t nbytes,
+ unsigned int flags)
{
int ret;
struct file *file;
@@ -236,14 +236,32 @@ out_put:
out:
return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_sync_file_range(long fd, loff_t offset, loff_t nbytes,
+ long flags)
+{
+ return SYSC_sync_file_range((int) fd, offset, nbytes,
+ (unsigned int) flags);
+}
+SYSCALL_ALIAS(sys_sync_file_range, SyS_sync_file_range);
+#endif

/* It would be nice if people remember that not all the world's an i386
when they introduce new system calls */
-asmlinkage long sys_sync_file_range2(int fd, unsigned int flags,
- loff_t offset, loff_t nbytes)
+SYSCALL_DEFINE(sync_file_range2)(int fd, unsigned int flags,
+ loff_t offset, loff_t nbytes)
{
return sys_sync_file_range(fd, offset, nbytes, flags);
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_sync_file_range2(long fd, long flags,
+ loff_t offset, loff_t nbytes)
+{
+ return SYSC_sync_file_range2((int) fd, (unsigned int) flags,
+ offset, nbytes);
+}
+SYSCALL_ALIAS(sys_sync_file_range2, SyS_sync_file_range2);
+#endif

/*
* `endbyte' is inclusive
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -887,7 +887,7 @@ out_up:
return err;
}

-asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg)
+SYSCALL_DEFINE(semctl)(int semid, int semnum, int cmd, union semun arg)
{
int err = -EINVAL;
int version;
@@ -923,6 +923,13 @@ asmlinkage long sys_semctl (int semid, i
return -EINVAL;
}
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_semctl(int semid, int semnum, int cmd, union semun arg)
+{
+ return SYSC_semctl((int) semid, (int) semnum, (int) cmd, arg);
+}
+SYSCALL_ALIAS(sys_semctl, SyS_semctl);
+#endif

/* If the task doesn't already have a undo_list, then allocate one
* here. We guarantee there is only one thread using this undo list,
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -24,7 +24,7 @@
* POSIX_FADV_WILLNEED could set PG_Referenced, and POSIX_FADV_NOREUSE could
* deactivate the pages and clear PG_Referenced.
*/
-asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
+SYSCALL_DEFINE(fadvise64_64)(int fd, loff_t offset, loff_t len, int advice)
{
struct file *file = fget(fd);
struct address_space *mapping;
@@ -126,12 +126,26 @@ out:
fput(file);
return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_fadvise64_64(long fd, loff_t offset, loff_t len, long advice)
+{
+ return SYSC_fadvise64_64((int) fd, offset, len, (int) advice);
+}
+SYSCALL_ALIAS(sys_fadvise64_64, SyS_fadvise64_64);
+#endif

#ifdef __ARCH_WANT_SYS_FADVISE64

-asmlinkage long sys_fadvise64(int fd, loff_t offset, size_t len, int advice)
+SYSCALL_DEFINE(fadvise64)(int fd, loff_t offset, size_t len, int advice)
{
return sys_fadvise64_64(fd, offset, len, advice);
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_fadvise64(long fd, loff_t offset, long len, long advice)
+{
+ return SYSC_fadvise64((int) fd, offset, (size_t)len, (int)advice);
+}
+SYSCALL_ALIAS(sys_fadvise64, SyS_fadvise64);
+#endif

#endif
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1366,7 +1366,7 @@ do_readahead(struct address_space *mappi
return 0;
}

-asmlinkage long sys_readahead(int fd, loff_t offset, size_t count)
+SYSCALL_DEFINE(readahead)(int fd, loff_t offset, size_t count)
{
ssize_t ret;
struct file *file;
@@ -1385,6 +1385,13 @@ asmlinkage long sys_readahead(int fd, lo
}
return ret;
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_readahead(long fd, loff_t offset, long count)
+{
+ return SYSC_readahead((int) fd, offset, (size_t) count);
+}
+SYSCALL_ALIAS(sys_readahead, SyS_readahead);
+#endif

#ifdef CONFIG_MMU
/**

2009-01-15 20:27:38

by Greg KH

[permalink] [raw]
Subject: [patch 42/94] [PATCH 11/44] [CVE-2009-0029] System call wrappers part 01

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/hrtimer.c | 4 ++--
kernel/sys.c | 2 +-
kernel/time.c | 14 +++++++-------
kernel/timer.c | 6 +++---
4 files changed, 13 insertions(+), 13 deletions(-)

--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1628,8 +1628,8 @@ out:
return ret;
}

-asmlinkage long
-sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
+SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
+ struct timespec __user *, rmtp)
{
struct timespec tu;

--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -869,7 +869,7 @@ void do_sys_times(struct tms *tms)
tms->tms_cstime = cputime_to_clock_t(cstime);
}

-asmlinkage long sys_times(struct tms __user * tbuf)
+SYSCALL_DEFINE1(times, struct tms __user *, tbuf)
{
if (tbuf) {
struct tms tmp;
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -59,7 +59,7 @@ EXPORT_SYMBOL(sys_tz);
* why not move it into the appropriate arch directory (for those
* architectures that need it).
*/
-asmlinkage long sys_time(time_t __user * tloc)
+SYSCALL_DEFINE1(time, time_t __user *, tloc)
{
time_t i = get_seconds();

@@ -77,7 +77,7 @@ asmlinkage long sys_time(time_t __user *
* architectures that need it).
*/

-asmlinkage long sys_stime(time_t __user *tptr)
+SYSCALL_DEFINE1(stime, time_t __user *, tptr)
{
struct timespec tv;
int err;
@@ -97,8 +97,8 @@ asmlinkage long sys_stime(time_t __user

#endif /* __ARCH_WANT_SYS_TIME */

-asmlinkage long sys_gettimeofday(struct timeval __user *tv,
- struct timezone __user *tz)
+SYSCALL_DEFINE2(gettimeofday, struct timeval __user *, tv,
+ struct timezone __user *, tz)
{
if (likely(tv != NULL)) {
struct timeval ktv;
@@ -182,8 +182,8 @@ int do_sys_settimeofday(struct timespec
return 0;
}

-asmlinkage long sys_settimeofday(struct timeval __user *tv,
- struct timezone __user *tz)
+SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
+ struct timezone __user *, tz)
{
struct timeval user_tv;
struct timespec new_ts;
@@ -203,7 +203,7 @@ asmlinkage long sys_settimeofday(struct
return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
}

-asmlinkage long sys_adjtimex(struct timex __user *txc_p)
+SYSCALL_DEFINE1(adjtimex, struct timex __user *, txc_p)
{
struct timex txc; /* Local copy of parameter */
int ret;
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1144,7 +1144,7 @@ void do_timer(unsigned long ticks)
* For backwards compatibility? This can be done in libc so Alpha
* and all newer ports shouldn't need it.
*/
-asmlinkage long sys_alarm(unsigned int seconds)
+SYSCALL_DEFINE1(alarm, unsigned int, seconds)
{
return alarm_setitimer(seconds);
}
@@ -1167,7 +1167,7 @@ asmlinkage long sys_alarm(unsigned int s
*
* This is SMP safe as current->tgid does not change.
*/
-asmlinkage long sys_getpid(void)
+SYSCALL_DEFINE0(getpid)
{
return task_tgid_vnr(current);
}
@@ -1323,7 +1323,7 @@ signed long __sched schedule_timeout_uni
EXPORT_SYMBOL(schedule_timeout_uninterruptible);

/* Thread ID - the internal kernel "pid" */
-asmlinkage long sys_gettid(void)
+SYSCALL_DEFINE0(gettid)
{
return task_pid_vnr(current);
}

2009-01-15 20:28:16

by Greg KH

[permalink] [raw]
Subject: [patch 43/94] [PATCH 12/44] [CVE-2009-0029] System call wrappers part 02

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit dbf040d9d1cbf1ef6250bdb095c5c118950bcde8 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/sys.c | 10 +++++-----
kernel/timer.c | 10 +++++-----
2 files changed, 10 insertions(+), 10 deletions(-)

--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -733,7 +733,7 @@ asmlinkage long sys_setresuid(uid_t ruid
return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RES);
}

-asmlinkage long sys_getresuid(uid_t __user *ruid, uid_t __user *euid, uid_t __user *suid)
+SYSCALL_DEFINE3(getresuid, uid_t __user *, ruid, uid_t __user *, euid, uid_t __user *, suid)
{
int retval;

@@ -784,7 +784,7 @@ asmlinkage long sys_setresgid(gid_t rgid
return 0;
}

-asmlinkage long sys_getresgid(gid_t __user *rgid, gid_t __user *egid, gid_t __user *sgid)
+SYSCALL_DEFINE3(getresgid, gid_t __user *, rgid, gid_t __user *, egid, gid_t __user *, sgid)
{
int retval;

@@ -964,7 +964,7 @@ out:
return err;
}

-asmlinkage long sys_getpgid(pid_t pid)
+SYSCALL_DEFINE1(getpgid, pid_t, pid)
{
struct task_struct *p;
struct pid *grp;
@@ -994,14 +994,14 @@ out:

#ifdef __ARCH_WANT_SYS_GETPGRP

-asmlinkage long sys_getpgrp(void)
+SYSCALL_DEFINE0(getpgrp)
{
return sys_getpgid(0);
}

#endif

-asmlinkage long sys_getsid(pid_t pid)
+SYSCALL_DEFINE1(getsid, pid_t, pid)
{
struct task_struct *p;
struct pid *sid;
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1178,7 +1178,7 @@ SYSCALL_DEFINE0(getpid)
* value of ->real_parent under rcu_read_lock(), see
* release_task()->call_rcu(delayed_put_task_struct).
*/
-asmlinkage long sys_getppid(void)
+SYSCALL_DEFINE0(getppid)
{
int pid;

@@ -1189,25 +1189,25 @@ asmlinkage long sys_getppid(void)
return pid;
}

-asmlinkage long sys_getuid(void)
+SYSCALL_DEFINE0(getuid)
{
/* Only we change this so SMP safe */
return current->uid;
}

-asmlinkage long sys_geteuid(void)
+SYSCALL_DEFINE0(geteuid)
{
/* Only we change this so SMP safe */
return current->euid;
}

-asmlinkage long sys_getgid(void)
+SYSCALL_DEFINE0(getgid)
{
/* Only we change this so SMP safe */
return current->gid;
}

-asmlinkage long sys_getegid(void)
+SYSCALL_DEFINE0(getegid)
{
/* Only we change this so SMP safe */
return current->egid;

2009-01-15 20:28:46

by Greg KH

[permalink] [raw]
Subject: [patch 45/94] [PATCH 14/44] [CVE-2009-0029] System call wrappers part 04

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit b290ebe2c46d01b742b948ce03f09e8a3efb9a92 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/acct.c | 2 +-
kernel/capability.c | 4 ++--
kernel/exec_domain.c | 3 +--
kernel/itimer.c | 2 +-
kernel/signal.c | 7 +++----
kernel/sys.c | 6 +++---
6 files changed, 11 insertions(+), 13 deletions(-)

--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -277,7 +277,7 @@ static int acct_on(char *name)
* should be written. If the filename is NULL, accounting will be
* shutdown.
*/
-asmlinkage long sys_acct(const char __user *name)
+SYSCALL_DEFINE1(acct, const char __user *, name)
{
int error;

--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -348,7 +348,7 @@ EXPORT_SYMBOL(cap_set_effective);
*
* Returns 0 on success and < 0 on error.
*/
-asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
+SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
{
int ret = 0;
pid_t pid;
@@ -425,7 +425,7 @@ asmlinkage long sys_capget(cap_user_head
*
* Returns 0 on success and < 0 on error.
*/
-asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
+SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
{
struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
unsigned i, tocopy;
--- a/kernel/exec_domain.c
+++ b/kernel/exec_domain.c
@@ -209,8 +209,7 @@ static int __init proc_execdomains_init(
module_init(proc_execdomains_init);
#endif

-asmlinkage long
-sys_personality(u_long personality)
+SYSCALL_DEFINE1(personality, u_long, personality)
{
u_long old = current->personality;

--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -100,7 +100,7 @@ int do_getitimer(int which, struct itime
return 0;
}

-asmlinkage long sys_getitimer(int which, struct itimerval __user *value)
+SYSCALL_DEFINE2(getitimer, int, which, struct itimerval __user *, value)
{
int error = -EFAULT;
struct itimerval get_buffer;
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2413,8 +2413,7 @@ out:

#ifdef __ARCH_WANT_SYS_SIGPENDING

-asmlinkage long
-sys_sigpending(old_sigset_t __user *set)
+SYSCALL_DEFINE1(sigpending, old_sigset_t __user *, set)
{
return do_sigpending(set, sizeof(*set));
}
@@ -2425,8 +2424,8 @@ sys_sigpending(old_sigset_t __user *set)
/* Some platforms have their own version with special arguments others
support only sys_rt_sigprocmask. */

-asmlinkage long
-sys_sigprocmask(int how, old_sigset_t __user *set, old_sigset_t __user *oset)
+SYSCALL_DEFINE3(sigprocmask, int, how, old_sigset_t __user *, set,
+ old_sigset_t __user *, oset)
{
int error;
old_sigset_t old_set, new_set;
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -893,7 +893,7 @@ SYSCALL_DEFINE1(times, struct tms __user
* Auch. Had to add the 'did_exec' flag to conform completely to POSIX.
* LBT 04.03.94
*/
-asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
+SYSCALL_DEFINE2(setpgid, pid_t, pid, pid_t, pgid)
{
struct task_struct *p;
struct task_struct *group_leader = current->group_leader;
@@ -1029,7 +1029,7 @@ out:
return retval;
}

-asmlinkage long sys_setsid(void)
+SYSCALL_DEFINE0(setsid)
{
struct task_struct *group_leader = current->group_leader;
struct pid *sid = task_pid(group_leader);
@@ -1266,7 +1266,7 @@ out:
* without another task interfering.
*/

-asmlinkage long sys_setgroups(int gidsetsize, gid_t __user *grouplist)
+SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
{
struct group_info *group_info;
int retval;

2009-01-15 20:29:47

by Greg KH

[permalink] [raw]
Subject: [patch 46/94] [PATCH 15/44] [CVE-2009-0029] System call wrappers part 05

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 362e9c07c7220c0a78c88826fc0d2bf7e4a4bb68 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/itimer.c | 5 ++---
kernel/posix-timers.c | 43 +++++++++++++++++++------------------------
2 files changed, 21 insertions(+), 27 deletions(-)

--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -260,9 +260,8 @@ unsigned int alarm_setitimer(unsigned in
return it_old.it_value.tv_sec;
}

-asmlinkage long sys_setitimer(int which,
- struct itimerval __user *value,
- struct itimerval __user *ovalue)
+SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
+ struct itimerval __user *, ovalue)
{
struct itimerval set_buffer, get_buffer;
int error;
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -470,10 +470,9 @@ static void release_posix_timer(struct k

/* Create a POSIX.1b interval timer. */

-asmlinkage long
-sys_timer_create(const clockid_t which_clock,
- struct sigevent __user *timer_event_spec,
- timer_t __user * created_timer_id)
+SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
+ struct sigevent __user *, timer_event_spec,
+ timer_t __user *, created_timer_id)
{
struct k_itimer *new_timer;
int error, new_timer_id;
@@ -659,8 +658,8 @@ common_timer_get(struct k_itimer *timr,
}

/* Get the time remaining on a POSIX.1b interval timer. */
-asmlinkage long
-sys_timer_gettime(timer_t timer_id, struct itimerspec __user *setting)
+SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
+ struct itimerspec __user *, setting)
{
struct k_itimer *timr;
struct itimerspec cur_setting;
@@ -689,8 +688,7 @@ sys_timer_gettime(timer_t timer_id, stru
* the call back to do_schedule_next_timer(). So all we need to do is
* to pick up the frozen overrun.
*/
-asmlinkage long
-sys_timer_getoverrun(timer_t timer_id)
+SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id)
{
struct k_itimer *timr;
int overrun;
@@ -758,10 +756,9 @@ common_timer_set(struct k_itimer *timr,
}

/* Set a POSIX.1b interval timer */
-asmlinkage long
-sys_timer_settime(timer_t timer_id, int flags,
- const struct itimerspec __user *new_setting,
- struct itimerspec __user *old_setting)
+SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
+ const struct itimerspec __user *, new_setting,
+ struct itimerspec __user *, old_setting)
{
struct k_itimer *timr;
struct itimerspec new_spec, old_spec;
@@ -814,8 +811,7 @@ static inline int timer_delete_hook(stru
}

/* Delete a POSIX.1b interval timer. */
-asmlinkage long
-sys_timer_delete(timer_t timer_id)
+SYSCALL_DEFINE1(timer_delete, timer_t, timer_id)
{
struct k_itimer *timer;
unsigned long flags;
@@ -903,8 +899,8 @@ int do_posix_clock_nonanosleep(const clo
}
EXPORT_SYMBOL_GPL(do_posix_clock_nonanosleep);

-asmlinkage long sys_clock_settime(const clockid_t which_clock,
- const struct timespec __user *tp)
+SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
+ const struct timespec __user *, tp)
{
struct timespec new_tp;

@@ -916,8 +912,8 @@ asmlinkage long sys_clock_settime(const
return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
}

-asmlinkage long
-sys_clock_gettime(const clockid_t which_clock, struct timespec __user *tp)
+SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
+ struct timespec __user *,tp)
{
struct timespec kernel_tp;
int error;
@@ -933,8 +929,8 @@ sys_clock_gettime(const clockid_t which_

}

-asmlinkage long
-sys_clock_getres(const clockid_t which_clock, struct timespec __user *tp)
+SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
+ struct timespec __user *, tp)
{
struct timespec rtn_tp;
int error;
@@ -963,10 +959,9 @@ static int common_nsleep(const clockid_t
which_clock);
}

-asmlinkage long
-sys_clock_nanosleep(const clockid_t which_clock, int flags,
- const struct timespec __user *rqtp,
- struct timespec __user *rmtp)
+SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
+ const struct timespec __user *, rqtp,
+ struct timespec __user *, rmtp)
{
struct timespec t;

2009-01-15 20:30:32

by Greg KH

[permalink] [raw]
Subject: [patch 44/94] [PATCH 13/44] [CVE-2009-0029] System call wrappers part 03

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit ae1251ab785f6da87219df8352ffdac68bba23e4 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/sys.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)

--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -470,7 +470,7 @@ void ctrl_alt_del(void)
* SMP: There are not races, the GIDs are checked only by filesystem
* operations (as far as semantic preservation is concerned).
*/
-asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
+SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
{
int old_rgid = current->gid;
int old_egid = current->egid;
@@ -519,7 +519,7 @@ asmlinkage long sys_setregid(gid_t rgid,
*
* SMP: Same implicit races as above.
*/
-asmlinkage long sys_setgid(gid_t gid)
+SYSCALL_DEFINE1(setgid, gid_t, gid)
{
int old_egid = current->egid;
int retval;
@@ -589,7 +589,7 @@ static int set_user(uid_t new_ruid, int
* 100% compatible with BSD. A program which uses just setuid() will be
* 100% compatible with POSIX with saved IDs.
*/
-asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
+SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
{
int old_ruid, old_euid, old_suid, new_ruid, new_euid;
int retval;
@@ -651,7 +651,7 @@ asmlinkage long sys_setreuid(uid_t ruid,
* will allow a root program to temporarily drop privileges and be able to
* regain them by swapping the real and effective uid.
*/
-asmlinkage long sys_setuid(uid_t uid)
+SYSCALL_DEFINE1(setuid, uid_t, uid)
{
int old_euid = current->euid;
int old_ruid, old_suid, new_suid;
@@ -690,7 +690,7 @@ asmlinkage long sys_setuid(uid_t uid)
* This function implements a generic ability to update ruid, euid,
* and suid. This allows you to implement the 4.4 compatible seteuid().
*/
-asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
+SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
{
int old_ruid = current->uid;
int old_euid = current->euid;
@@ -747,7 +747,7 @@ SYSCALL_DEFINE3(getresuid, uid_t __user
/*
* Same as above, but for rgid, egid, sgid.
*/
-asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
+SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
{
int retval;

@@ -802,7 +802,7 @@ SYSCALL_DEFINE3(getresgid, gid_t __user
* whatever uid it wants to). It normally shadows "euid", except when
* explicitly set by setfsuid() or for access..
*/
-asmlinkage long sys_setfsuid(uid_t uid)
+SYSCALL_DEFINE1(setfsuid, uid_t, uid)
{
int old_fsuid;

@@ -831,7 +831,7 @@ asmlinkage long sys_setfsuid(uid_t uid)
/*
* Samma p? svenska..
*/
-asmlinkage long sys_setfsgid(gid_t gid)
+SYSCALL_DEFINE1(setfsgid, gid_t, gid)
{
int old_fsgid;

@@ -1233,7 +1233,7 @@ int set_current_groups(struct group_info

EXPORT_SYMBOL(set_current_groups);

-asmlinkage long sys_getgroups(int gidsetsize, gid_t __user *grouplist)
+SYSCALL_DEFINE2(getgroups, int, gidsetsize, gid_t __user *, grouplist)
{
int i = 0;

2009-01-15 20:30:57

by Greg KH

[permalink] [raw]
Subject: [patch 47/94] [PATCH 16/44] [CVE-2009-0029] System call wrappers part 06

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 5add95d4f7cf08f6f62510f19576992912387501 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/sched.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)

--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5025,7 +5025,7 @@ int can_nice(const struct task_struct *p
* sys_setpriority is a more generic, but much slower function that
* does similar things.
*/
-asmlinkage long sys_nice(int increment)
+SYSCALL_DEFINE1(nice, int, increment)
{
long nice, retval;

@@ -5317,8 +5317,8 @@ do_sched_setscheduler(pid_t pid, int pol
* @policy: new policy.
* @param: structure containing the new RT priority.
*/
-asmlinkage long
-sys_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
+SYSCALL_DEFINE3(sched_setscheduler, pid_t, pid, int, policy,
+ struct sched_param __user *, param)
{
/* negative values for policy are not valid */
if (policy < 0)
@@ -5332,7 +5332,7 @@ sys_sched_setscheduler(pid_t pid, int po
* @pid: the pid in question.
* @param: structure containing the new RT priority.
*/
-asmlinkage long sys_sched_setparam(pid_t pid, struct sched_param __user *param)
+SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
{
return do_sched_setscheduler(pid, -1, param);
}
@@ -5341,7 +5341,7 @@ asmlinkage long sys_sched_setparam(pid_t
* sys_sched_getscheduler - get the policy (scheduling class) of a thread
* @pid: the pid in question.
*/
-asmlinkage long sys_sched_getscheduler(pid_t pid)
+SYSCALL_DEFINE1(sched_getscheduler, pid_t, pid)
{
struct task_struct *p;
int retval;
@@ -5366,7 +5366,7 @@ asmlinkage long sys_sched_getscheduler(p
* @pid: the pid in question.
* @param: structure containing the RT priority.
*/
-asmlinkage long sys_sched_getparam(pid_t pid, struct sched_param __user *param)
+SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
{
struct sched_param lp;
struct task_struct *p;
@@ -5474,8 +5474,8 @@ static int get_user_cpu_mask(unsigned lo
* @len: length in bytes of the bitmask pointed to by user_mask_ptr
* @user_mask_ptr: user-space pointer to the new cpu mask
*/
-asmlinkage long sys_sched_setaffinity(pid_t pid, unsigned int len,
- unsigned long __user *user_mask_ptr)
+SYSCALL_DEFINE3(sched_setaffinity, pid_t, pid, unsigned int, len,
+ unsigned long __user *, user_mask_ptr)
{
cpumask_t new_mask;
int retval;
@@ -5519,8 +5519,8 @@ out_unlock:
* @len: length in bytes of the bitmask pointed to by user_mask_ptr
* @user_mask_ptr: user-space pointer to hold the current cpu mask
*/
-asmlinkage long sys_sched_getaffinity(pid_t pid, unsigned int len,
- unsigned long __user *user_mask_ptr)
+SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
+ unsigned long __user *, user_mask_ptr)
{
int ret;
cpumask_t mask;
@@ -5544,7 +5544,7 @@ asmlinkage long sys_sched_getaffinity(pi
* This function yields the current CPU to other tasks. If there are no
* other threads running on this CPU then this function will return.
*/
-asmlinkage long sys_sched_yield(void)
+SYSCALL_DEFINE0(sched_yield)
{
struct rq *rq = this_rq_lock();

@@ -5685,7 +5685,7 @@ long __sched io_schedule_timeout(long ti
* this syscall returns the maximum rt_priority that can be used
* by a given scheduling class.
*/
-asmlinkage long sys_sched_get_priority_max(int policy)
+SYSCALL_DEFINE1(sched_get_priority_max, int, policy)
{
int ret = -EINVAL;

@@ -5710,7 +5710,7 @@ asmlinkage long sys_sched_get_priority_m
* this syscall returns the minimum rt_priority that can be used
* by a given scheduling class.
*/
-asmlinkage long sys_sched_get_priority_min(int policy)
+SYSCALL_DEFINE1(sched_get_priority_min, int, policy)
{
int ret = -EINVAL;

2009-01-15 20:31:30

by Greg KH

[permalink] [raw]
Subject: [patch 48/94] [PATCH 17/44] [CVE-2009-0029] System call wrappers part 07

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 754fe8d297bfae7b77f7ce866e2fb0c5fb186506 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/exit.c | 8 ++++----
kernel/kexec.c | 5 ++---
kernel/sched.c | 4 ++--
kernel/signal.c | 2 +-
kernel/sys.c | 7 ++++---
net/socket.c | 2 +-
6 files changed, 14 insertions(+), 14 deletions(-)

--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1143,7 +1143,7 @@ NORET_TYPE void complete_and_exit(struct

EXPORT_SYMBOL(complete_and_exit);

-asmlinkage long sys_exit(int error_code)
+SYSCALL_DEFINE1(exit, int, error_code)
{
do_exit((error_code&0xff)<<8);
}
@@ -1184,7 +1184,7 @@ do_group_exit(int exit_code)
* wait4()-ing process will get the correct exit code - even if this
* thread is not the thread group leader.
*/
-asmlinkage long sys_exit_group(int error_code)
+SYSCALL_DEFINE1(exit_group, int, error_code)
{
do_group_exit((error_code & 0xff) << 8);
/* NOTREACHED */
@@ -1796,8 +1796,8 @@ asmlinkage long sys_waitid(int which, pi
return ret;
}

-asmlinkage long sys_wait4(pid_t upid, int __user *stat_addr,
- int options, struct rusage __user *ru)
+SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
+ int, options, struct rusage __user *, ru)
{
struct pid *pid = NULL;
enum pid_type type;
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -934,9 +934,8 @@ struct kimage *kexec_crash_image;

static DEFINE_MUTEX(kexec_mutex);

-asmlinkage long sys_kexec_load(unsigned long entry, unsigned long nr_segments,
- struct kexec_segment __user *segments,
- unsigned long flags)
+SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
+ struct kexec_segment __user *, segments, unsigned long, flags)
{
struct kimage **dest_image, *image;
int result;
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5735,8 +5735,8 @@ SYSCALL_DEFINE1(sched_get_priority_min,
* this syscall writes the default timeslice value of a given process
* into the user-space timespec buffer. A value of '0' means infinity.
*/
-asmlinkage
-long sys_sched_rr_get_interval(pid_t pid, struct timespec __user *interval)
+SYSCALL_DEFINE4(sched_rr_get_interval, pid_t, pid,
+ struct timespec __user *, interval)
{
struct task_struct *p;
unsigned int time_slice;
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1940,7 +1940,7 @@ EXPORT_SYMBOL(unblock_all_signals);
* System call entry points.
*/

-asmlinkage long sys_restart_syscall(void)
+SYSCALL_DEFINE0(restart_syscall)
{
struct restart_block *restart = &current_thread_info()->restart_block;
return restart->fn(restart);
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -137,7 +137,7 @@ out:
return error;
}

-asmlinkage long sys_setpriority(int which, int who, int niceval)
+SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
{
struct task_struct *g, *p;
struct user_struct *user;
@@ -201,7 +201,7 @@ out:
* has been offset by 20 (ie it returns 40..1 instead of -20..19)
* to stay compatible.
*/
-asmlinkage long sys_getpriority(int which, int who)
+SYSCALL_DEFINE2(getpriority, int, which, int, who)
{
struct task_struct *g, *p;
struct user_struct *user;
@@ -347,7 +347,8 @@ EXPORT_SYMBOL_GPL(kernel_power_off);
*
* reboot doesn't sync: do that yourself before calling this.
*/
-asmlinkage long sys_reboot(int magic1, int magic2, unsigned int cmd, void __user * arg)
+SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
+ void __user *, arg)
{
char buffer[256];

--- a/net/socket.c
+++ b/net/socket.c
@@ -1797,7 +1797,7 @@ out_put:
* Shutdown a socket.
*/

-asmlinkage long sys_shutdown(int fd, int how)
+SYSCALL_DEFINE2(shutdown, int, fd, int, how)
{
int err, fput_needed;
struct socket *sock;

2009-01-15 20:31:57

by Greg KH

[permalink] [raw]
Subject: [patch 49/94] [PATCH 18/44] [CVE-2009-0029] System call wrappers part 08

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 17da2bd90abf428523de0fb98f7075e00e3ed42e upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/exit.c | 7 +++----
kernel/fork.c | 2 +-
kernel/futex.c | 6 +++---
kernel/module.c | 10 ++++------
kernel/sched.c | 2 +-
kernel/signal.c | 18 +++++++-----------
6 files changed, 19 insertions(+), 26 deletions(-)

--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1755,9 +1755,8 @@ end:
return retval;
}

-asmlinkage long sys_waitid(int which, pid_t upid,
- struct siginfo __user *infop, int options,
- struct rusage __user *ru)
+SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
+ infop, int, options, struct rusage __user *, ru)
{
struct pid *pid = NULL;
enum pid_type type;
@@ -1834,7 +1833,7 @@ SYSCALL_DEFINE4(wait4, pid_t, upid, int
* sys_waitpid() remains for compatibility. waitpid() should be
* implemented by calling sys_wait4() from libc.a.
*/
-asmlinkage long sys_waitpid(pid_t pid, int __user *stat_addr, int options)
+SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options)
{
return sys_wait4(pid, stat_addr, options, NULL);
}
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -894,7 +894,7 @@ static void copy_flags(unsigned long clo
clear_freeze_flag(p);
}

-asmlinkage long sys_set_tid_address(int __user *tidptr)
+SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
{
current->clear_child_tid = tidptr;

--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2039,9 +2039,9 @@ long do_futex(u32 __user *uaddr, int op,
}


-asmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,
- struct timespec __user *utime, u32 __user *uaddr2,
- u32 val3)
+SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
+ struct timespec __user *, utime, u32 __user *, uaddr2,
+ u32, val3)
{
struct timespec ts;
ktime_t t, *tp = NULL;
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -743,8 +743,8 @@ static void wait_for_zero_refcount(struc
mutex_lock(&module_mutex);
}

-asmlinkage long
-sys_delete_module(const char __user *name_user, unsigned int flags)
+SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+ unsigned int, flags)
{
struct module *mod;
char name[MODULE_NAME_LEN];
@@ -2288,10 +2288,8 @@ static noinline struct module *load_modu
}

/* This is where the real work happens */
-asmlinkage long
-sys_init_module(void __user *umod,
- unsigned long len,
- const char __user *uargs)
+SYSCALL_DEFINE3(init_module, void __user *, umod,
+ unsigned long, len, const char __user *, uargs)
{
struct module *mod;
int ret = 0;
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5735,7 +5735,7 @@ SYSCALL_DEFINE1(sched_get_priority_min,
* this syscall writes the default timeslice value of a given process
* into the user-space timespec buffer. A value of '0' means infinity.
*/
-SYSCALL_DEFINE4(sched_rr_get_interval, pid_t, pid,
+SYSCALL_DEFINE2(sched_rr_get_interval, pid_t, pid,
struct timespec __user *, interval)
{
struct task_struct *p;
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1993,8 +1993,8 @@ int sigprocmask(int how, sigset_t *set,
return error;
}

-asmlinkage long
-sys_rt_sigprocmask(int how, sigset_t __user *set, sigset_t __user *oset, size_t sigsetsize)
+SYSCALL_DEFINE4(rt_sigprocmask, int, how, sigset_t __user *, set,
+ sigset_t __user *, oset, size_t, sigsetsize)
{
int error = -EINVAL;
sigset_t old_set, new_set;
@@ -2053,8 +2053,7 @@ out:
return error;
}

-asmlinkage long
-sys_rt_sigpending(sigset_t __user *set, size_t sigsetsize)
+SYSCALL_DEFINE2(rt_sigpending, sigset_t __user *, set, size_t, sigsetsize)
{
return do_sigpending(set, sigsetsize);
}
@@ -2125,11 +2124,9 @@ int copy_siginfo_to_user(siginfo_t __use

#endif

-asmlinkage long
-sys_rt_sigtimedwait(const sigset_t __user *uthese,
- siginfo_t __user *uinfo,
- const struct timespec __user *uts,
- size_t sigsetsize)
+SYSCALL_DEFINE4(rt_sigtimedwait, const sigset_t __user *, uthese,
+ siginfo_t __user *, uinfo, const struct timespec __user *, uts,
+ size_t, sigsetsize)
{
int ret, sig;
sigset_t these;
@@ -2202,8 +2199,7 @@ sys_rt_sigtimedwait(const sigset_t __use
return ret;
}

-asmlinkage long
-sys_kill(pid_t pid, int sig)
+SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
{
struct siginfo info;

2009-01-15 20:33:52

by Greg KH

[permalink] [raw]
Subject: [patch 50/94] [PATCH 19/44] [CVE-2009-0029] System call wrappers part 09

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit a5f8fa9e9ba5ef3305e147f41ad6e1e84ac1f0bd upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/sync.c | 6 +++---
kernel/signal.c | 21 ++++++++-------------
2 files changed, 11 insertions(+), 16 deletions(-)

--- a/fs/sync.c
+++ b/fs/sync.c
@@ -36,7 +36,7 @@ static void do_sync(unsigned long wait)
laptop_sync_completion();
}

-asmlinkage long sys_sync(void)
+SYSCALL_DEFINE0(sync)
{
do_sync(1);
return 0;
@@ -118,12 +118,12 @@ static long __do_fsync(unsigned int fd,
return ret;
}

-asmlinkage long sys_fsync(unsigned int fd)
+SYSCALL_DEFINE1(fsync, unsigned int, fd)
{
return __do_fsync(fd, 0);
}

-asmlinkage long sys_fdatasync(unsigned int fd)
+SYSCALL_DEFINE1(fdatasync, unsigned int, fd)
{
return __do_fsync(fd, 1);
}
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2258,7 +2258,7 @@ static int do_tkill(pid_t tgid, pid_t pi
* exists but it's not belonging to the target process anymore. This
* method solves the problem of threads exiting and PIDs getting reused.
*/
-asmlinkage long sys_tgkill(pid_t tgid, pid_t pid, int sig)
+SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid_t, pid, int, sig)
{
/* This is only valid for single tasks */
if (pid <= 0 || tgid <= 0)
@@ -2270,8 +2270,7 @@ asmlinkage long sys_tgkill(pid_t tgid, p
/*
* Send a signal to only one task, even if it's a CLONE_THREAD task.
*/
-asmlinkage long
-sys_tkill(pid_t pid, int sig)
+SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig)
{
/* This is only valid for single tasks */
if (pid <= 0)
@@ -2280,8 +2279,8 @@ sys_tkill(pid_t pid, int sig)
return do_tkill(0, pid, sig);
}

-asmlinkage long
-sys_rt_sigqueueinfo(pid_t pid, int sig, siginfo_t __user *uinfo)
+SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
+ siginfo_t __user *, uinfo)
{
siginfo_t info;

@@ -2505,15 +2504,13 @@ out:
/*
* For backwards compatibility. Functionality superseded by sigprocmask.
*/
-asmlinkage long
-sys_sgetmask(void)
+SYSCALL_DEFINE0(sgetmask)
{
/* SMP safe */
return current->blocked.sig[0];
}

-asmlinkage long
-sys_ssetmask(int newmask)
+SYSCALL_DEFINE1(ssetmask, int, newmask)
{
int old;

@@ -2533,8 +2530,7 @@ sys_ssetmask(int newmask)
/*
* For backwards compatibility. Functionality superseded by sigaction.
*/
-asmlinkage long
-sys_signal(int sig, __sighandler_t handler)
+SYSCALL_DEFINE2(signal, int, sig, __sighandler_t, handler)
{
struct k_sigaction new_sa, old_sa;
int ret;
@@ -2551,8 +2547,7 @@ sys_signal(int sig, __sighandler_t handl

#ifdef __ARCH_WANT_SYS_PAUSE

-asmlinkage long
-sys_pause(void)
+SYSCALL_DEFINE0(pause)
{
current->state = TASK_INTERRUPTIBLE;
schedule();

2009-01-15 20:34:26

by Greg KH

[permalink] [raw]
Subject: [patch 51/94] [PATCH 20/44] [CVE-2009-0029] System call wrappers part 10

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit bdc480e3bef6eb0e7071770834cbdda7e30a5436 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/buffer.c | 2 +-
fs/namespace.c | 9 ++++-----
fs/open.c | 12 +++++-------
fs/stat.c | 2 +-
4 files changed, 11 insertions(+), 14 deletions(-)

--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3177,7 +3177,7 @@ void block_sync_page(struct page *page)
* Use of bdflush() is deprecated and will be removed in a future kernel.
* The `pdflush' kernel threads fully replace bdflush daemons and this call.
*/
-asmlinkage long sys_bdflush(int func, long data)
+SYSCALL_DEFINE2(bdflush, int, func, long, data)
{
static int msg_count;

--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1128,7 +1128,7 @@ static int do_umount(struct vfsmount *mn
* unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
*/

-asmlinkage long sys_umount(char __user * name, int flags)
+SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
{
struct path path;
int retval;
@@ -1160,7 +1160,7 @@ out:
/*
* The 2.0 compatible umount. No flags.
*/
-asmlinkage long sys_oldumount(char __user * name)
+SYSCALL_DEFINE1(oldumount, char __user *, name)
{
return sys_umount(name, 0);
}
@@ -2045,9 +2045,8 @@ struct mnt_namespace *copy_mnt_ns(unsign
return new_ns;
}

-asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
- char __user * type, unsigned long flags,
- void __user * data)
+SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
+ char __user *, type, unsigned long, flags, void __user *, data)
{
int retval;
unsigned long data_page;
--- a/fs/open.c
+++ b/fs/open.c
@@ -122,7 +122,7 @@ static int vfs_statfs64(struct dentry *d
return 0;
}

-asmlinkage long sys_statfs(const char __user *pathname, struct statfs __user * buf)
+SYSCALL_DEFINE2(statfs, const char __user *, pathname, struct statfs __user *, buf)
{
struct path path;
int error;
@@ -138,8 +138,7 @@ asmlinkage long sys_statfs(const char __
return error;
}

-
-asmlinkage long sys_statfs64(const char __user *pathname, size_t sz, struct statfs64 __user *buf)
+SYSCALL_DEFINE3(statfs64, const char __user *, pathname, size_t, sz, struct statfs64 __user *, buf)
{
struct path path;
long error;
@@ -157,8 +156,7 @@ asmlinkage long sys_statfs64(const char
return error;
}

-
-asmlinkage long sys_fstatfs(unsigned int fd, struct statfs __user * buf)
+SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct statfs __user *, buf)
{
struct file * file;
struct statfs tmp;
@@ -287,7 +285,7 @@ out:
return error;
}

-asmlinkage long sys_truncate(const char __user * path, unsigned long length)
+SYSCALL_DEFINE2(truncate, const char __user *, path, unsigned long, length)
{
/* on 32-bit boxen it will cut the range 2^31--2^32-1 off */
return do_sys_truncate(path, (long)length);
@@ -336,7 +334,7 @@ out:
return error;
}

-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
+SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
{
long ret = do_sys_ftruncate(fd, length, 1);
/* avoid REGPARM breakage on x86: */
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -152,7 +152,7 @@ static int cp_old_stat(struct kstat *sta
return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
}

-asmlinkage long sys_stat(char __user * filename, struct __old_kernel_stat __user * statbuf)
+SYSCALL_DEFINE2(stat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_stat_fd(AT_FDCWD, filename, &stat);

2009-01-15 20:34:56

by Greg KH

[permalink] [raw]
Subject: [patch 52/94] [PATCH 21/44] [CVE-2009-0029] System call wrappers part 11

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 257ac264d69017270fbc3cf5536953525db4076c upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/open.c | 2 +-
fs/stat.c | 20 ++++++++++++--------
fs/super.c | 2 +-
3 files changed, 14 insertions(+), 10 deletions(-)

--- a/fs/open.c
+++ b/fs/open.c
@@ -174,7 +174,7 @@ out:
return error;
}

-asmlinkage long sys_fstatfs64(unsigned int fd, size_t sz, struct statfs64 __user *buf)
+SYSCALL_DEFINE3(fstatfs64, unsigned int, fd, size_t, sz, struct statfs64 __user *, buf)
{
struct file * file;
struct statfs64 tmp;
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -162,7 +162,8 @@ SYSCALL_DEFINE2(stat, char __user *, fil

return error;
}
-asmlinkage long sys_lstat(char __user * filename, struct __old_kernel_stat __user * statbuf)
+
+SYSCALL_DEFINE2(lstat, char __user *, filename, struct __old_kernel_stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
@@ -172,7 +173,8 @@ asmlinkage long sys_lstat(char __user *

return error;
}
-asmlinkage long sys_fstat(unsigned int fd, struct __old_kernel_stat __user * statbuf)
+
+SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_fstat(fd, &stat);
@@ -235,7 +237,7 @@ static int cp_new_stat(struct kstat *sta
return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
}

-asmlinkage long sys_newstat(char __user *filename, struct stat __user *statbuf)
+SYSCALL_DEFINE2(newstat, char __user *, filename, struct stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_stat_fd(AT_FDCWD, filename, &stat);
@@ -246,7 +248,7 @@ asmlinkage long sys_newstat(char __user
return error;
}

-asmlinkage long sys_newlstat(char __user *filename, struct stat __user *statbuf)
+SYSCALL_DEFINE2(newlstat, char __user *, filename, struct stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_lstat_fd(AT_FDCWD, filename, &stat);
@@ -280,7 +282,7 @@ out:
}
#endif

-asmlinkage long sys_newfstat(unsigned int fd, struct stat __user *statbuf)
+SYSCALL_DEFINE2(newfstat, unsigned int, fd, struct stat __user *, statbuf)
{
struct kstat stat;
int error = vfs_fstat(fd, &stat);
@@ -365,7 +367,7 @@ static long cp_new_stat64(struct kstat *
return copy_to_user(statbuf,&tmp,sizeof(tmp)) ? -EFAULT : 0;
}

-asmlinkage long sys_stat64(char __user * filename, struct stat64 __user * statbuf)
+SYSCALL_DEFINE2(stat64, char __user *, filename, struct stat64 __user *, statbuf)
{
struct kstat stat;
int error = vfs_stat(filename, &stat);
@@ -375,7 +377,8 @@ asmlinkage long sys_stat64(char __user *

return error;
}
-asmlinkage long sys_lstat64(char __user * filename, struct stat64 __user * statbuf)
+
+SYSCALL_DEFINE2(lstat64, char __user *, filename, struct stat64 __user *, statbuf)
{
struct kstat stat;
int error = vfs_lstat(filename, &stat);
@@ -385,7 +388,8 @@ asmlinkage long sys_lstat64(char __user

return error;
}
-asmlinkage long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)
+
+SYSCALL_DEFINE2(fstat64, unsigned long, fd, struct stat64 __user *, statbuf)
{
struct kstat stat;
int error = vfs_fstat(fd, &stat);
--- a/fs/super.c
+++ b/fs/super.c
@@ -534,7 +534,7 @@ rescan:
return NULL;
}

-asmlinkage long sys_ustat(unsigned dev, struct ustat __user * ubuf)
+SYSCALL_DEFINE2(ustat, unsigned, dev, struct ustat __user *, ubuf)
{
struct super_block *s;
struct ustat tmp;

2009-01-15 20:35:34

by Greg KH

[permalink] [raw]
Subject: [patch 53/94] [PATCH 22/44] [CVE-2009-0029] System call wrappers part 12

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 64fd1de3d821659ac0a3004fd5ee1de59e64af30 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/xattr.c | 46 +++++++++++++++++++++-------------------------
1 file changed, 21 insertions(+), 25 deletions(-)

--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -251,9 +251,9 @@ setxattr(struct dentry *d, const char __
return error;
}

-asmlinkage long
-sys_setxattr(const char __user *pathname, const char __user *name,
- const void __user *value, size_t size, int flags)
+SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
+ const char __user *, name, const void __user *, value,
+ size_t, size, int, flags)
{
struct path path;
int error;
@@ -270,9 +270,9 @@ sys_setxattr(const char __user *pathname
return error;
}

-asmlinkage long
-sys_lsetxattr(const char __user *pathname, const char __user *name,
- const void __user *value, size_t size, int flags)
+SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
+ const char __user *, name, const void __user *, value,
+ size_t, size, int, flags)
{
struct path path;
int error;
@@ -289,9 +289,8 @@ sys_lsetxattr(const char __user *pathnam
return error;
}

-asmlinkage long
-sys_fsetxattr(int fd, const char __user *name, const void __user *value,
- size_t size, int flags)
+SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
+ const void __user *,value, size_t, size, int, flags)
{
struct file *f;
struct dentry *dentry;
@@ -349,9 +348,8 @@ getxattr(struct dentry *d, const char __
return error;
}

-asmlinkage long
-sys_getxattr(const char __user *pathname, const char __user *name,
- void __user *value, size_t size)
+SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
+ const char __user *, name, void __user *, value, size_t, size)
{
struct path path;
ssize_t error;
@@ -364,9 +362,8 @@ sys_getxattr(const char __user *pathname
return error;
}

-asmlinkage long
-sys_lgetxattr(const char __user *pathname, const char __user *name, void __user *value,
- size_t size)
+SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
+ const char __user *, name, void __user *, value, size_t, size)
{
struct path path;
ssize_t error;
@@ -379,8 +376,8 @@ sys_lgetxattr(const char __user *pathnam
return error;
}

-asmlinkage long
-sys_fgetxattr(int fd, const char __user *name, void __user *value, size_t size)
+SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
+ void __user *, value, size_t, size)
{
struct file *f;
ssize_t error = -EBADF;
@@ -424,8 +421,8 @@ listxattr(struct dentry *d, char __user
return error;
}

-asmlinkage long
-sys_listxattr(const char __user *pathname, char __user *list, size_t size)
+SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
+ size_t, size)
{
struct path path;
ssize_t error;
@@ -438,8 +435,8 @@ sys_listxattr(const char __user *pathnam
return error;
}

-asmlinkage long
-sys_llistxattr(const char __user *pathname, char __user *list, size_t size)
+SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
+ size_t, size)
{
struct path path;
ssize_t error;
@@ -452,8 +449,7 @@ sys_llistxattr(const char __user *pathna
return error;
}

-asmlinkage long
-sys_flistxattr(int fd, char __user *list, size_t size)
+SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
{
struct file *f;
ssize_t error = -EBADF;
@@ -485,8 +481,8 @@ removexattr(struct dentry *d, const char
return vfs_removexattr(d, kname);
}

-asmlinkage long
-sys_removexattr(const char __user *pathname, const char __user *name)
+SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
+ const char __user *, name)
{
struct path path;
int error;

2009-01-15 20:36:01

by Greg KH

[permalink] [raw]
Subject: [patch 54/94] [PATCH 23/44] [CVE-2009-0029] System call wrappers part 13

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 6a6160a7b5c27b3c38651baef92a14fa7072b3c1 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/xattr.c | 7 +++----
mm/fremap.c | 4 ++--
mm/mlock.c | 4 ++--
mm/mmap.c | 4 ++--
mm/mprotect.c | 4 ++--
mm/mremap.c | 6 +++---
mm/msync.c | 2 +-
mm/nommu.c | 10 +++++-----
8 files changed, 20 insertions(+), 21 deletions(-)

--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -499,8 +499,8 @@ SYSCALL_DEFINE2(removexattr, const char
return error;
}

-asmlinkage long
-sys_lremovexattr(const char __user *pathname, const char __user *name)
+SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
+ const char __user *, name)
{
struct path path;
int error;
@@ -517,8 +517,7 @@ sys_lremovexattr(const char __user *path
return error;
}

-asmlinkage long
-sys_fremovexattr(int fd, const char __user *name)
+SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
{
struct file *f;
struct dentry *dentry;
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -120,8 +120,8 @@ static int populate_range(struct mm_stru
* and the vma's default protection is used. Arbitrary protections
* might be implemented in the future.
*/
-asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
- unsigned long prot, unsigned long pgoff, unsigned long flags)
+SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
+ unsigned long, prot, unsigned long, pgoff, unsigned long, flags)
{
struct mm_struct *mm = current->mm;
struct address_space *mapping;
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -529,7 +529,7 @@ static int do_mlock(unsigned long start,
return error;
}

-asmlinkage long sys_mlock(unsigned long start, size_t len)
+SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
{
unsigned long locked;
unsigned long lock_limit;
@@ -557,7 +557,7 @@ asmlinkage long sys_mlock(unsigned long
return error;
}

-asmlinkage long sys_munlock(unsigned long start, size_t len)
+SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
{
int ret;

--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -245,7 +245,7 @@ static struct vm_area_struct *remove_vma
return next;
}

-asmlinkage long sys_brk(unsigned long brk)
+SYSCALL_DEFINE1(brk, unsigned long, brk)
{
unsigned long rlim, retval;
unsigned long newbrk, oldbrk;
@@ -1949,7 +1949,7 @@ int do_munmap(struct mm_struct *mm, unsi

EXPORT_SYMBOL(do_munmap);

-asmlinkage long sys_munmap(unsigned long addr, size_t len)
+SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
{
int ret;
struct mm_struct *mm = current->mm;
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -219,8 +219,8 @@ fail:
return error;
}

-asmlinkage long
-sys_mprotect(unsigned long start, size_t len, unsigned long prot)
+SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+ unsigned long, prot)
{
unsigned long vm_flags, nstart, end, tmp, reqprot;
struct vm_area_struct *vma, *prev;
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -420,9 +420,9 @@ out_nc:
return ret;
}

-asmlinkage long sys_mremap(unsigned long addr,
- unsigned long old_len, unsigned long new_len,
- unsigned long flags, unsigned long new_addr)
+SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
+ unsigned long, new_len, unsigned long, flags,
+ unsigned long, new_addr)
{
unsigned long ret;

--- a/mm/msync.c
+++ b/mm/msync.c
@@ -28,7 +28,7 @@
* So by _not_ starting I/O in MS_ASYNC we provide complete flexibility to
* applications.
*/
-asmlinkage long sys_msync(unsigned long start, size_t len, int flags)
+SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
{
unsigned long end;
struct mm_struct *mm = current->mm;
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -377,7 +377,7 @@ EXPORT_SYMBOL(vm_insert_page);
* to a regular file. in this case, the unmapping will need
* to invoke file system routines that need the global lock.
*/
-asmlinkage long sys_brk(unsigned long brk)
+SYSCALL_DEFINE1(brk, unsigned long, brk)
{
struct mm_struct *mm = current->mm;

@@ -1192,7 +1192,7 @@ int do_munmap(struct mm_struct *mm, unsi
}
EXPORT_SYMBOL(do_munmap);

-asmlinkage long sys_munmap(unsigned long addr, size_t len)
+SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
{
int ret;
struct mm_struct *mm = current->mm;
@@ -1283,9 +1283,9 @@ unsigned long do_mremap(unsigned long ad
}
EXPORT_SYMBOL(do_mremap);

-asmlinkage unsigned long sys_mremap(unsigned long addr,
- unsigned long old_len, unsigned long new_len,
- unsigned long flags, unsigned long new_addr)
+SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
+ unsigned long, new_len, unsigned long, flags,
+ unsigned long, new_addr)
{
unsigned long ret;

2009-01-15 20:36:36

by Greg KH

[permalink] [raw]
Subject: [patch 55/94] [PATCH 24/44] [CVE-2009-0029] System call wrappers part 14

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 3480b25743cb7404928d57efeaa3d085708b04c2 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/namei.c | 8 ++++----
fs/namespace.c | 4 ++--
fs/open.c | 2 +-
mm/madvise.c | 2 +-
mm/mincore.c | 4 ++--
mm/mlock.c | 4 ++--
6 files changed, 12 insertions(+), 12 deletions(-)

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2020,7 +2020,7 @@ out_unlock:
return error;
}

-asmlinkage long sys_mknod(const char __user *filename, int mode, unsigned dev)
+SYSCALL_DEFINE3(mknod, const char __user *, filename, int, mode, unsigned, dev)
{
return sys_mknodat(AT_FDCWD, filename, mode, dev);
}
@@ -2293,7 +2293,7 @@ asmlinkage long sys_unlinkat(int dfd, co
return do_unlinkat(dfd, pathname);
}

-asmlinkage long sys_unlink(const char __user *pathname)
+SYSCALL_DEFINE1(unlink, const char __user *, pathname)
{
return do_unlinkat(AT_FDCWD, pathname);
}
@@ -2357,7 +2357,7 @@ out_putname:
return error;
}

-asmlinkage long sys_symlink(const char __user *oldname, const char __user *newname)
+SYSCALL_DEFINE2(symlink, const char __user *, oldname, const char __user *, newname)
{
return sys_symlinkat(oldname, AT_FDCWD, newname);
}
@@ -2456,7 +2456,7 @@ out:
return error;
}

-asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
+SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname)
{
return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
}
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2171,8 +2171,8 @@ static void chroot_fs_refs(struct path *
* though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
* first.
*/
-asmlinkage long sys_pivot_root(const char __user * new_root,
- const char __user * put_old)
+SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+ const char __user *, put_old)
{
struct vfsmount *tmp;
struct path new, old, parent_path, root_parent, root;
--- a/fs/open.c
+++ b/fs/open.c
@@ -574,7 +574,7 @@ out:
return error;
}

-asmlinkage long sys_chroot(const char __user * filename)
+SYSCALL_DEFINE1(chroot, const char __user *, filename)
{
struct path path;
int error;
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -281,7 +281,7 @@ madvise_vma(struct vm_area_struct *vma,
* -EBADF - map exists, but area maps something that isn't a file.
* -EAGAIN - a kernel resource was temporarily unavailable.
*/
-asmlinkage long sys_madvise(unsigned long start, size_t len_in, int behavior)
+SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
{
unsigned long end, tmp;
struct vm_area_struct * vma, *prev;
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -177,8 +177,8 @@ none_mapped:
* mapped
* -EAGAIN - A kernel resource was temporarily unavailable.
*/
-asmlinkage long sys_mincore(unsigned long start, size_t len,
- unsigned char __user * vec)
+SYSCALL_DEFINE3(mincore, unsigned long, start, size_t, len,
+ unsigned char __user *, vec)
{
long retval;
unsigned long pages;
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -594,7 +594,7 @@ out:
return 0;
}

-asmlinkage long sys_mlockall(int flags)
+SYSCALL_DEFINE1(mlockall, int, flags)
{
unsigned long lock_limit;
int ret = -EINVAL;
@@ -622,7 +622,7 @@ out:
return ret;
}

-asmlinkage long sys_munlockall(void)
+SYSCALL_DEFINE0(munlockall)
{
int ret;

2009-01-15 20:37:08

by Greg KH

[permalink] [raw]
Subject: [patch 56/94] [PATCH 25/44] [CVE-2009-0029] System call wrappers part 15

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit a26eab2400f0477bfac0255600552394855016f7 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/fcntl.c | 11 ++++++-----
fs/ioctl.c | 2 +-
fs/namei.c | 2 +-
fs/open.c | 4 ++--
4 files changed, 10 insertions(+), 9 deletions(-)

--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -50,7 +50,7 @@ static int get_close_on_exec(unsigned in
return res;
}

-asmlinkage long sys_dup3(unsigned int oldfd, unsigned int newfd, int flags)
+SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
{
int err = -EBADF;
struct file * file, *tofree;
@@ -113,7 +113,7 @@ out_unlock:
return err;
}

-asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
+SYSCALL_DEFINE2(dup2, unsigned int, oldfd, unsigned int, newfd)
{
if (unlikely(newfd == oldfd)) { /* corner case */
struct files_struct *files = current->files;
@@ -126,7 +126,7 @@ asmlinkage long sys_dup2(unsigned int ol
return sys_dup3(oldfd, newfd, 0);
}

-asmlinkage long sys_dup(unsigned int fildes)
+SYSCALL_DEFINE1(dup, unsigned int, fildes)
{
int ret = -EBADF;
struct file *file = fget(fildes);
@@ -334,7 +334,7 @@ static long do_fcntl(int fd, unsigned in
return err;
}

-asmlinkage long sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg)
+SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
{
struct file *filp;
long err = -EBADF;
@@ -357,7 +357,8 @@ out:
}

#if BITS_PER_LONG == 32
-asmlinkage long sys_fcntl64(unsigned int fd, unsigned int cmd, unsigned long arg)
+SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
+ unsigned long, arg)
{
struct file * filp;
long err;
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -472,7 +472,7 @@ int do_vfs_ioctl(struct file *filp, unsi
return error;
}

-asmlinkage long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
+SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
{
struct file *filp;
int error = -EBADF;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2696,7 +2696,7 @@ exit:
return error;
}

-asmlinkage long sys_rename(const char __user *oldname, const char __user *newname)
+SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newname)
{
return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
}
--- a/fs/open.c
+++ b/fs/open.c
@@ -599,7 +599,7 @@ out:
return error;
}

-asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
+SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
{
struct inode * inode;
struct dentry * dentry;
@@ -663,7 +663,7 @@ out:
return error;
}

-asmlinkage long sys_chmod(const char __user *filename, mode_t mode)
+SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
{
return sys_fchmodat(AT_FDCWD, filename, mode);
}

2009-01-15 20:37:42

by Greg KH

[permalink] [raw]
Subject: [patch 57/94] [PATCH 26/44] [CVE-2009-0029] System call wrappers part 16

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 002c8976ee537724b20a5e179d9b349309438836 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/aio.c | 22 +++++++++++-----------
fs/locks.c | 2 +-
fs/open.c | 2 +-
fs/read_write.c | 4 ++--
fs/stat.c | 4 ++--
5 files changed, 17 insertions(+), 17 deletions(-)

--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1258,7 +1258,7 @@ static void io_destroy(struct kioctx *io
* pointer is passed for ctxp. Will fail with -ENOSYS if not
* implemented.
*/
-asmlinkage long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp)
+SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
{
struct kioctx *ioctx = NULL;
unsigned long ctx;
@@ -1296,7 +1296,7 @@ out:
* implemented. May fail with -EFAULT if the context pointed to
* is invalid.
*/
-asmlinkage long sys_io_destroy(aio_context_t ctx)
+SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
{
struct kioctx *ioctx = lookup_ioctx(ctx);
if (likely(NULL != ioctx)) {
@@ -1650,8 +1650,8 @@ out_put_req:
* are available to queue any iocbs. Will return 0 if nr is 0. Will
* fail with -ENOSYS if not implemented.
*/
-asmlinkage long sys_io_submit(aio_context_t ctx_id, long nr,
- struct iocb __user * __user *iocbpp)
+SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr,
+ struct iocb __user * __user *, iocbpp)
{
struct kioctx *ctx;
long ret = 0;
@@ -1725,8 +1725,8 @@ static struct kiocb *lookup_kiocb(struct
* invalid. May fail with -EAGAIN if the iocb specified was not
* cancelled. Will fail with -ENOSYS if not implemented.
*/
-asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
- struct io_event __user *result)
+SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
+ struct io_event __user *, result)
{
int (*cancel)(struct kiocb *iocb, struct io_event *res);
struct kioctx *ctx;
@@ -1787,11 +1787,11 @@ asmlinkage long sys_io_cancel(aio_contex
* will be updated if not NULL and the operation blocks. Will fail
* with -ENOSYS if not implemented.
*/
-asmlinkage long sys_io_getevents(aio_context_t ctx_id,
- long min_nr,
- long nr,
- struct io_event __user *events,
- struct timespec __user *timeout)
+SYSCALL_DEFINE5(io_getevents, aio_context_t, ctx_id,
+ long, min_nr,
+ long, nr,
+ struct io_event __user *, events,
+ struct timespec __user *, timeout)
{
struct kioctx *ioctx = lookup_ioctx(ctx_id);
long ret = -EINVAL;
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1564,7 +1564,7 @@ EXPORT_SYMBOL(flock_lock_file_wait);
* %LOCK_MAND can be combined with %LOCK_READ or %LOCK_WRITE to allow other
* processes read and write access respectively.
*/
-asmlinkage long sys_flock(unsigned int fd, unsigned int cmd)
+SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
{
struct file *filp;
struct file_lock *lock;
--- a/fs/open.c
+++ b/fs/open.c
@@ -1081,7 +1081,7 @@ asmlinkage long sys_openat(int dfd, cons
* For backward compatibility? Maybe this should be moved
* into arch/i386 instead?
*/
-asmlinkage long sys_creat(const char __user * pathname, int mode)
+SYSCALL_DEFINE2(creat, const char __user *, pathname, int, mode)
{
return sys_open(pathname, O_CREAT | O_WRONLY | O_TRUNC, mode);
}
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -815,7 +815,7 @@ out:
return retval;
}

-asmlinkage long sys_sendfile(int out_fd, int in_fd, off_t __user *offset, size_t count)
+SYSCALL_DEFINE4(sendfile, int, out_fd, int, in_fd, off_t __user *, offset, size_t, count)
{
loff_t pos;
off_t off;
@@ -834,7 +834,7 @@ asmlinkage long sys_sendfile(int out_fd,
return do_sendfile(out_fd, in_fd, NULL, count, 0);
}

-asmlinkage long sys_sendfile64(int out_fd, int in_fd, loff_t __user *offset, size_t count)
+SYSCALL_DEFINE4(sendfile64, int, out_fd, int, in_fd, loff_t __user *, offset, size_t, count)
{
loff_t pos;
ssize_t ret;
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -320,8 +320,8 @@ asmlinkage long sys_readlinkat(int dfd,
return error;
}

-asmlinkage long sys_readlink(const char __user *path, char __user *buf,
- int bufsiz)
+SYSCALL_DEFINE3(readlink, const char __user *, path, char __user *, buf,
+ int, bufsiz)
{
return sys_readlinkat(AT_FDCWD, path, buf, bufsiz);
}

2009-01-15 20:38:06

by Greg KH

[permalink] [raw]
Subject: [patch 58/94] [PATCH 27/44] [CVE-2009-0029] System call wrappers part 17

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit ca013e945b1ba5828b151ee646946f1297b67a4c upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/open.c | 16 +++++++---------
kernel/uid16.c | 6 +++---
2 files changed, 10 insertions(+), 12 deletions(-)

--- a/fs/open.c
+++ b/fs/open.c
@@ -522,7 +522,7 @@ out:
return res;
}

-asmlinkage long sys_access(const char __user *filename, int mode)
+SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
{
return sys_faccessat(AT_FDCWD, filename, mode);
}
@@ -693,7 +693,7 @@ static int chown_common(struct dentry *
return error;
}

-asmlinkage long sys_chown(const char __user * filename, uid_t user, gid_t group)
+SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
{
struct path path;
int error;
@@ -737,7 +737,7 @@ out:
return error;
}

-asmlinkage long sys_lchown(const char __user * filename, uid_t user, gid_t group)
+SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
{
struct path path;
int error;
@@ -756,8 +756,7 @@ out:
return error;
}

-
-asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
+SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
{
struct file * file;
int error = -EBADF;
@@ -1048,7 +1047,7 @@ long do_sys_open(int dfd, const char __u
return fd;
}

-asmlinkage long sys_open(const char __user *filename, int flags, int mode)
+SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, int, mode)
{
long ret;

@@ -1117,7 +1116,7 @@ EXPORT_SYMBOL(filp_close);
* releasing the fd. This ensures that one clone task can't release
* an fd while another clone is opening it.
*/
-asmlinkage long sys_close(unsigned int fd)
+SYSCALL_DEFINE1(close, unsigned int, fd)
{
struct file * filp;
struct files_struct *files = current->files;
@@ -1150,14 +1149,13 @@ out_unlock:
spin_unlock(&files->file_lock);
return -EBADF;
}
-
EXPORT_SYMBOL(sys_close);

/*
* This routine simulates a hangup on the tty, to arrange that users
* are given clean terminals at login time.
*/
-asmlinkage long sys_vhangup(void)
+SYSCALL_DEFINE0(vhangup)
{
if (capable(CAP_SYS_TTY_CONFIG)) {
tty_vhangup_self();
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -17,7 +17,7 @@

#include <asm/uaccess.h>

-asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gid_t group)
+SYSCALL_DEFINE3(chown16, const char __user *, filename, old_uid_t, user, old_gid_t, group)
{
long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
/* avoid REGPARM breakage on x86: */
@@ -25,7 +25,7 @@ asmlinkage long sys_chown16(const char _
return ret;
}

-asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_gid_t group)
+SYSCALL_DEFINE3(lchown16, const char __user *, filename, old_uid_t, user, old_gid_t, group)
{
long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
/* avoid REGPARM breakage on x86: */
@@ -33,7 +33,7 @@ asmlinkage long sys_lchown16(const char
return ret;
}

-asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
+SYSCALL_DEFINE3(fchown16, unsigned int, fd, old_uid_t, user, old_gid_t, group)
{
long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
/* avoid REGPARM breakage on x86: */

2009-01-15 20:38:34

by Greg KH

[permalink] [raw]
Subject: [patch 59/94] [PATCH 28/44] [CVE-2009-0029] System call wrappers part 18

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit a6b42e83f249aad723589b2bdf6d1dfb2b0997c8 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/uid16.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)

--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -41,7 +41,7 @@ SYSCALL_DEFINE3(fchown16, unsigned int,
return ret;
}

-asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
+SYSCALL_DEFINE2(setregid16, old_gid_t, rgid, old_gid_t, egid)
{
long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
/* avoid REGPARM breakage on x86: */
@@ -49,7 +49,7 @@ asmlinkage long sys_setregid16(old_gid_t
return ret;
}

-asmlinkage long sys_setgid16(old_gid_t gid)
+SYSCALL_DEFINE1(setgid16, old_gid_t, gid)
{
long ret = sys_setgid(low2highgid(gid));
/* avoid REGPARM breakage on x86: */
@@ -57,7 +57,7 @@ asmlinkage long sys_setgid16(old_gid_t g
return ret;
}

-asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
+SYSCALL_DEFINE2(setreuid16, old_uid_t, ruid, old_uid_t, euid)
{
long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
/* avoid REGPARM breakage on x86: */
@@ -65,7 +65,7 @@ asmlinkage long sys_setreuid16(old_uid_t
return ret;
}

-asmlinkage long sys_setuid16(old_uid_t uid)
+SYSCALL_DEFINE1(setuid16, old_uid_t, uid)
{
long ret = sys_setuid(low2highuid(uid));
/* avoid REGPARM breakage on x86: */
@@ -73,7 +73,7 @@ asmlinkage long sys_setuid16(old_uid_t u
return ret;
}

-asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
+SYSCALL_DEFINE3(setresuid16, old_uid_t, ruid, old_uid_t, euid, old_uid_t, suid)
{
long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
low2highuid(suid));
@@ -82,7 +82,7 @@ asmlinkage long sys_setresuid16(old_uid_
return ret;
}

-asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user *euid, old_uid_t __user *suid)
+SYSCALL_DEFINE3(getresuid16, old_uid_t __user *, ruid, old_uid_t __user *, euid, old_uid_t __user *, suid)
{
int retval;

@@ -93,7 +93,7 @@ asmlinkage long sys_getresuid16(old_uid_
return retval;
}

-asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
+SYSCALL_DEFINE3(setresgid16, old_gid_t, rgid, old_gid_t, egid, old_gid_t, sgid)
{
long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
low2highgid(sgid));
@@ -102,7 +102,8 @@ asmlinkage long sys_setresgid16(old_gid_
return ret;
}

-asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user *egid, old_gid_t __user *sgid)
+
+SYSCALL_DEFINE3(getresgid16, old_gid_t __user *, rgid, old_gid_t __user *, egid, old_gid_t __user *, sgid)
{
int retval;

@@ -113,7 +114,7 @@ asmlinkage long sys_getresgid16(old_gid_
return retval;
}

-asmlinkage long sys_setfsuid16(old_uid_t uid)
+SYSCALL_DEFINE1(setfsuid16, old_uid_t, uid)
{
long ret = sys_setfsuid(low2highuid(uid));
/* avoid REGPARM breakage on x86: */
@@ -121,7 +122,7 @@ asmlinkage long sys_setfsuid16(old_uid_t
return ret;
}

-asmlinkage long sys_setfsgid16(old_gid_t gid)
+SYSCALL_DEFINE1(setfsgid16, old_gid_t, gid)
{
long ret = sys_setfsgid(low2highgid(gid));
/* avoid REGPARM breakage on x86: */

2009-01-15 20:39:04

by Greg KH

[permalink] [raw]
Subject: [patch 60/94] [PATCH 29/44] [CVE-2009-0029] System call wrappers part 19

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 003d7ab479168132a2b2c6700fe682b08f08ab0c upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/read_write.c | 8 ++++----
fs/utimes.c | 5 +++--
kernel/uid16.c | 12 ++++++------
3 files changed, 13 insertions(+), 12 deletions(-)

--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -134,7 +134,7 @@ loff_t vfs_llseek(struct file *file, lof
}
EXPORT_SYMBOL(vfs_llseek);

-asmlinkage long sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
+SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, origin)
{
off_t retval;
struct file * file;
@@ -158,9 +158,9 @@ bad:
}

#ifdef __ARCH_WANT_SYS_LLSEEK
-asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high,
- unsigned long offset_low, loff_t __user * result,
- unsigned int origin)
+SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
+ unsigned long, offset_low, loff_t __user *, result,
+ unsigned int, origin)
{
int retval;
struct file * file;
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -24,7 +24,7 @@
* must be owner or have write permission.
* Else, update from *times, must be owner or super user.
*/
-asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
+SYSCALL_DEFINE2(utime, char __user *, filename, struct utimbuf __user *, times)
{
struct timespec tv[2];

@@ -214,7 +214,8 @@ asmlinkage long sys_futimesat(int dfd, c
return do_utimes(dfd, filename, utimes ? tstimes : NULL, 0);
}

-asmlinkage long sys_utimes(char __user *filename, struct timeval __user *utimes)
+SYSCALL_DEFINE2(utimes, char __user *, filename,
+ struct timeval __user *, utimes)
{
return sys_futimesat(AT_FDCWD, filename, utimes);
}
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -160,7 +160,7 @@ static int groups16_from_user(struct gro
return 0;
}

-asmlinkage long sys_getgroups16(int gidsetsize, old_gid_t __user *grouplist)
+SYSCALL_DEFINE2(getgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
{
int i = 0;

@@ -184,7 +184,7 @@ out:
return i;
}

-asmlinkage long sys_setgroups16(int gidsetsize, old_gid_t __user *grouplist)
+SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
{
struct group_info *group_info;
int retval;
@@ -209,22 +209,22 @@ asmlinkage long sys_setgroups16(int gids
return retval;
}

-asmlinkage long sys_getuid16(void)
+SYSCALL_DEFINE0(getuid16)
{
return high2lowuid(current->uid);
}

-asmlinkage long sys_geteuid16(void)
+SYSCALL_DEFINE0(geteuid16)
{
return high2lowuid(current->euid);
}

-asmlinkage long sys_getgid16(void)
+SYSCALL_DEFINE0(getgid16)
{
return high2lowgid(current->gid);
}

-asmlinkage long sys_getegid16(void)
+SYSCALL_DEFINE0(getegid16)
{
return high2lowgid(current->egid);
}

2009-01-15 20:39:42

by Greg KH

[permalink] [raw]
Subject: [patch 61/94] [PATCH 30/44] [CVE-2009-0029] System call wrappers part 20

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 3cdad42884bbd95d5aa01297e8236ea1bad70053 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/dcache.c | 2 +-
fs/namei.c | 4 ++--
fs/open.c | 4 ++--
fs/quota.c | 3 ++-
fs/read_write.c | 13 +++++++------
5 files changed, 14 insertions(+), 12 deletions(-)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2095,7 +2095,7 @@ Elong:
* return NULL;
* }
*/
-asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
+SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
{
int error;
struct path pwd, root;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2080,7 +2080,7 @@ out_err:
return error;
}

-asmlinkage long sys_mkdir(const char __user *pathname, int mode)
+SYSCALL_DEFINE2(mkdir, const char __user *, pathname, int, mode)
{
return sys_mkdirat(AT_FDCWD, pathname, mode);
}
@@ -2190,7 +2190,7 @@ exit1:
return error;
}

-asmlinkage long sys_rmdir(const char __user *pathname)
+SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
{
return do_rmdir(AT_FDCWD, pathname);
}
--- a/fs/open.c
+++ b/fs/open.c
@@ -527,7 +527,7 @@ SYSCALL_DEFINE2(access, const char __use
return sys_faccessat(AT_FDCWD, filename, mode);
}

-asmlinkage long sys_chdir(const char __user * filename)
+SYSCALL_DEFINE1(chdir, const char __user *, filename)
{
struct path path;
int error;
@@ -548,7 +548,7 @@ out:
return error;
}

-asmlinkage long sys_fchdir(unsigned int fd)
+SYSCALL_DEFINE1(fchdir, unsigned int, fd)
{
struct file *file;
struct inode *inode;
--- a/fs/quota.c
+++ b/fs/quota.c
@@ -368,7 +368,8 @@ static inline struct super_block *quotac
* calls. Maybe we need to add the process quotas etc. in the future,
* but we probably should use rlimits for that.
*/
-asmlinkage long sys_quotactl(unsigned int cmd, const char __user *special, qid_t id, void __user *addr)
+SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
+ qid_t, id, void __user *, addr)
{
uint cmds, type;
struct super_block *sb = NULL;
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -356,7 +356,7 @@ static inline void file_pos_write(struct
file->f_pos = pos;
}

-asmlinkage long sys_read(unsigned int fd, char __user * buf, size_t count)
+SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -373,7 +373,8 @@ asmlinkage long sys_read(unsigned int fd
return ret;
}

-asmlinkage long sys_write(unsigned int fd, const char __user * buf, size_t count)
+SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
+ size_t, count)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -675,8 +676,8 @@ ssize_t vfs_writev(struct file *file, co

EXPORT_SYMBOL(vfs_writev);

-asmlinkage long
-sys_readv(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
+SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
+ unsigned long, vlen)
{
struct file *file;
ssize_t ret = -EBADF;
@@ -696,8 +697,8 @@ sys_readv(unsigned long fd, const struct
return ret;
}

-asmlinkage long
-sys_writev(unsigned long fd, const struct iovec __user *vec, unsigned long vlen)
+SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
+ unsigned long, vlen)
{
struct file *file;
ssize_t ret = -EBADF;

2009-01-15 20:40:18

by Greg KH

[permalink] [raw]
Subject: [patch 62/94] [PATCH 31/44] [CVE-2009-0029] System call wrappers part 21

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 20f37034fb966a1c35894f9fe529fda0b6440101 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/readdir.c | 6 ++++--
net/socket.c | 30 +++++++++++++++---------------
2 files changed, 19 insertions(+), 17 deletions(-)

--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -187,7 +187,8 @@ efault:
return -EFAULT;
}

-asmlinkage long sys_getdents(unsigned int fd, struct linux_dirent __user * dirent, unsigned int count)
+SYSCALL_DEFINE3(getdents, unsigned int, fd,
+ struct linux_dirent __user *, dirent, unsigned int, count)
{
struct file * file;
struct linux_dirent __user * lastdirent;
@@ -268,7 +269,8 @@ efault:
return -EFAULT;
}

-asmlinkage long sys_getdents64(unsigned int fd, struct linux_dirent64 __user * dirent, unsigned int count)
+SYSCALL_DEFINE3(getdents64, unsigned int, fd,
+ struct linux_dirent64 __user *, dirent, unsigned int, count)
{
struct file * file;
struct linux_dirent64 __user * lastdirent;
--- a/net/socket.c
+++ b/net/socket.c
@@ -1364,7 +1364,7 @@ out_fd:
* the protocol layer (having also checked the address is ok).
*/

-asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
+SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
{
struct socket *sock;
struct sockaddr_storage address;
@@ -1426,8 +1426,8 @@ asmlinkage long sys_listen(int fd, int b
* clean when we restucture accept also.
*/

-asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
- int __user *upeer_addrlen, int flags)
+SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+ int __user *, upeer_addrlen, int, flags)
{
struct socket *sock, *newsock;
struct file *newfile;
@@ -1510,8 +1510,8 @@ out_fd:
goto out_put;
}

-asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
- int __user *upeer_addrlen)
+SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
+ int __user *, upeer_addrlen)
{
return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
}
@@ -1528,8 +1528,8 @@ asmlinkage long sys_accept(int fd, struc
* include the -EINPROGRESS status for such sockets.
*/

-asmlinkage long sys_connect(int fd, struct sockaddr __user *uservaddr,
- int addrlen)
+SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+ int, addrlen)
{
struct socket *sock;
struct sockaddr_storage address;
@@ -1560,8 +1560,8 @@ out:
* name to user space.
*/

-asmlinkage long sys_getsockname(int fd, struct sockaddr __user *usockaddr,
- int __user *usockaddr_len)
+SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
+ int __user *, usockaddr_len)
{
struct socket *sock;
struct sockaddr_storage address;
@@ -1591,8 +1591,8 @@ out:
* name to user space.
*/

-asmlinkage long sys_getpeername(int fd, struct sockaddr __user *usockaddr,
- int __user *usockaddr_len)
+SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
+ int __user *, usockaddr_len)
{
struct socket *sock;
struct sockaddr_storage address;
@@ -1733,8 +1733,8 @@ asmlinkage long sys_recv(int fd, void __
* to pass the user mode parameter for the protocols to sort out.
*/

-asmlinkage long sys_setsockopt(int fd, int level, int optname,
- char __user *optval, int optlen)
+SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
+ char __user *, optval, int, optlen)
{
int err, fput_needed;
struct socket *sock;
@@ -1767,8 +1767,8 @@ out_put:
* to pass a user mode parameter for the protocols to sort out.
*/

-asmlinkage long sys_getsockopt(int fd, int level, int optname,
- char __user *optval, int __user *optlen)
+SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
+ char __user *, optval, int __user *, optlen)
{
int err, fput_needed;
struct socket *sock;

2009-01-15 20:40:51

by Greg KH

[permalink] [raw]
Subject: [patch 63/94] [PATCH 32/44] [CVE-2009-0029] System call wrappers part 22

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 3e0fa65f8ba4fd24b3dcfaf14d5b15eaab0fdc61 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/socket.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)

--- a/net/socket.c
+++ b/net/socket.c
@@ -1215,7 +1215,7 @@ int sock_create_kern(int family, int typ
return __sock_create(&init_net, family, type, protocol, res, 1);
}

-asmlinkage long sys_socket(int family, int type, int protocol)
+SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
{
int retval;
struct socket *sock;
@@ -1256,8 +1256,8 @@ out_release:
* Create a pair of connected sockets.
*/

-asmlinkage long sys_socketpair(int family, int type, int protocol,
- int __user *usockvec)
+SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
+ int __user *, usockvec)
{
struct socket *sock1, *sock2;
int fd1, fd2, err;
@@ -1393,7 +1393,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
* ready for listening.
*/

-asmlinkage long sys_listen(int fd, int backlog)
+SYSCALL_DEFINE2(listen, int, fd, int, backlog)
{
struct socket *sock;
int err, fput_needed;
@@ -1623,9 +1623,9 @@ SYSCALL_DEFINE3(getpeername, int, fd, st
* the protocol.
*/

-asmlinkage long sys_sendto(int fd, void __user *buff, size_t len,
- unsigned flags, struct sockaddr __user *addr,
- int addr_len)
+SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
+ unsigned, flags, struct sockaddr __user *, addr,
+ int, addr_len)
{
struct socket *sock;
struct sockaddr_storage address;
@@ -1668,7 +1668,8 @@ out:
* Send a datagram down a socket.
*/

-asmlinkage long sys_send(int fd, void __user *buff, size_t len, unsigned flags)
+SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
+ unsigned, flags)
{
return sys_sendto(fd, buff, len, flags, NULL, 0);
}
@@ -1679,9 +1680,9 @@ asmlinkage long sys_send(int fd, void __
* sender address from kernel to user space.
*/

-asmlinkage long sys_recvfrom(int fd, void __user *ubuf, size_t size,
- unsigned flags, struct sockaddr __user *addr,
- int __user *addr_len)
+SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ unsigned, flags, struct sockaddr __user *, addr,
+ int __user *, addr_len)
{
struct socket *sock;
struct iovec iov;
@@ -1823,7 +1824,7 @@ SYSCALL_DEFINE2(shutdown, int, fd, int,
* BSD sendmsg interface
*/

-asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
{
struct compat_msghdr __user *msg_compat =
(struct compat_msghdr __user *)msg;
@@ -1929,8 +1930,8 @@ out:
* BSD recvmsg interface
*/

-asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg,
- unsigned int flags)
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+ unsigned int, flags)
{
struct compat_msghdr __user *msg_compat =
(struct compat_msghdr __user *)msg;
@@ -2053,7 +2054,7 @@ static const unsigned char nargs[19]={
* it is set by the callees.
*/

-asmlinkage long sys_socketcall(int call, unsigned long __user *args)
+SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
{
unsigned long a[6];
unsigned long a0, a1;

2009-01-15 20:41:23

by Greg KH

[permalink] [raw]
Subject: [patch 64/94] [PATCH 33/44] [CVE-2009-0029] System call wrappers part 23

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 5a8a82b1d306a325d899b67715618413657efda4 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/eventpoll.c | 18 +++++++++---------
fs/select.c | 8 ++++----
kernel/sys.c | 6 +++---
3 files changed, 16 insertions(+), 16 deletions(-)

--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1110,7 +1110,7 @@ retry:
/*
* Open an eventpoll file descriptor.
*/
-asmlinkage long sys_epoll_create1(int flags)
+SYSCALL_DEFINE1(epoll_create1, int, flags)
{
int error, fd = -1;
struct eventpoll *ep;
@@ -1150,7 +1150,7 @@ error_return:
return fd;
}

-asmlinkage long sys_epoll_create(int size)
+SYSCALL_DEFINE1(epoll_create, int, size)
{
if (size < 0)
return -EINVAL;
@@ -1163,8 +1163,8 @@ asmlinkage long sys_epoll_create(int siz
* the eventpoll file that enables the insertion/removal/change of
* file descriptors inside the interest set.
*/
-asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
- struct epoll_event __user *event)
+SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ struct epoll_event __user *, event)
{
int error;
struct file *file, *tfile;
@@ -1261,8 +1261,8 @@ error_return:
* Implement the event wait interface for the eventpoll file. It is the kernel
* part of the user space epoll_wait(2).
*/
-asmlinkage long sys_epoll_wait(int epfd, struct epoll_event __user *events,
- int maxevents, int timeout)
+SYSCALL_DEFINE4(epoll_wait, int, epfd, struct epoll_event __user *, events,
+ int, maxevents, int, timeout)
{
int error;
struct file *file;
@@ -1319,9 +1319,9 @@ error_return:
* Implement the event wait interface for the eventpoll file. It is the kernel
* part of the user space epoll_pwait(2).
*/
-asmlinkage long sys_epoll_pwait(int epfd, struct epoll_event __user *events,
- int maxevents, int timeout, const sigset_t __user *sigmask,
- size_t sigsetsize)
+SYSCALL_DEFINE6(epoll_pwait, int, epfd, struct epoll_event __user *, events,
+ int, maxevents, int, timeout, const sigset_t __user *, sigmask,
+ size_t, sigsetsize)
{
int error;
sigset_t ksigmask, sigsaved;
--- a/fs/select.c
+++ b/fs/select.c
@@ -507,8 +507,8 @@ out_nofds:
return ret;
}

-asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
- fd_set __user *exp, struct timeval __user *tvp)
+SYSCALL_DEFINE5(select, int, n, fd_set __user *, inp, fd_set __user *, outp,
+ fd_set __user *, exp, struct timeval __user *, tvp)
{
struct timespec end_time, *to = NULL;
struct timeval tv;
@@ -806,8 +806,8 @@ static long do_restart_poll(struct resta
return ret;
}

-asmlinkage long sys_poll(struct pollfd __user *ufds, unsigned int nfds,
- long timeout_msecs)
+SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
+ long, timeout_msecs)
{
struct timespec end_time, *to = NULL;
int ret;
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1328,7 +1328,7 @@ asmlinkage long sys_newuname(struct new_
return errno;
}

-asmlinkage long sys_sethostname(char __user *name, int len)
+SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
{
int errno;
char tmp[__NEW_UTS_LEN];
@@ -1352,7 +1352,7 @@ asmlinkage long sys_sethostname(char __u

#ifdef __ARCH_WANT_SYS_GETHOSTNAME

-asmlinkage long sys_gethostname(char __user *name, int len)
+SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
{
int i, errno;
struct new_utsname *u;
@@ -1377,7 +1377,7 @@ asmlinkage long sys_gethostname(char __u
* Only setdomainname; getdomainname can be implemented by calling
* uname()
*/
-asmlinkage long sys_setdomainname(char __user *name, int len)
+SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
{
int errno;
char tmp[__NEW_UTS_LEN];

2009-01-15 20:41:56

by Greg KH

[permalink] [raw]
Subject: [patch 65/94] [PATCH 34/44] [CVE-2009-0029] System call wrappers part 24

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit e48fbb699f82ef1e80bd7126046394d2dc9ca7e6 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
ipc/msg.c | 12 ++++++------
kernel/sys.c | 13 +++++++------
2 files changed, 13 insertions(+), 12 deletions(-)

--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -309,7 +309,7 @@ static inline int msg_security(struct ke
return security_msg_queue_associate(msq, msgflg);
}

-asmlinkage long sys_msgget(key_t key, int msgflg)
+SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
{
struct ipc_namespace *ns;
struct ipc_ops msg_ops;
@@ -466,7 +466,7 @@ out_up:
return err;
}

-asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
+SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
{
struct msg_queue *msq;
int err, version;
@@ -723,8 +723,8 @@ out_free:
return err;
}

-asmlinkage long
-sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
+SYSCALL_DEFINE4(msgsnd, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
+ int, msgflg)
{
long mtype;

@@ -904,8 +904,8 @@ out_unlock:
return msgsz;
}

-asmlinkage long sys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
- long msgtyp, int msgflg)
+SYSCALL_DEFINE5(msgrcv, int, msqid, struct msgbuf __user *, msgp, size_t, msgsz,
+ long, msgtyp, int, msgflg)
{
long err, mtype;

--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1317,7 +1317,7 @@ EXPORT_SYMBOL(in_egroup_p);

DECLARE_RWSEM(uts_sem);

-asmlinkage long sys_newuname(struct new_utsname __user * name)
+SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
{
int errno = 0;

@@ -1400,7 +1400,7 @@ SYSCALL_DEFINE2(setdomainname, char __us
return errno;
}

-asmlinkage long sys_getrlimit(unsigned int resource, struct rlimit __user *rlim)
+SYSCALL_DEFINE2(getrlimit, unsigned int, resource, struct rlimit __user *, rlim)
{
if (resource >= RLIM_NLIMITS)
return -EINVAL;
@@ -1419,7 +1419,8 @@ asmlinkage long sys_getrlimit(unsigned i
* Back compatibility for getrlimit. Needed for some apps.
*/

-asmlinkage long sys_old_getrlimit(unsigned int resource, struct rlimit __user *rlim)
+SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
+ struct rlimit __user *, rlim)
{
struct rlimit x;
if (resource >= RLIM_NLIMITS)
@@ -1437,7 +1438,7 @@ asmlinkage long sys_old_getrlimit(unsign

#endif

-asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
+SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
{
struct rlimit new_rlim, *old_rlim;
int retval;
@@ -1608,7 +1609,7 @@ int getrusage(struct task_struct *p, int
return copy_to_user(ru, &r, sizeof(r)) ? -EFAULT : 0;
}

-asmlinkage long sys_getrusage(int who, struct rusage __user *ru)
+SYSCALL_DEFINE2(getrusage, int, who, struct rusage __user *, ru)
{
if (who != RUSAGE_SELF && who != RUSAGE_CHILDREN &&
who != RUSAGE_THREAD)
@@ -1616,7 +1617,7 @@ asmlinkage long sys_getrusage(int who, s
return getrusage(current, who, ru);
}

-asmlinkage long sys_umask(int mask)
+SYSCALL_DEFINE1(umask, int, mask)
{
mask = xchg(&current->fs->umask, mask & S_IRWXUGO);
return mask;

2009-01-15 20:42:23

by Greg KH

[permalink] [raw]
Subject: [patch 66/94] [PATCH 35/44] [CVE-2009-0029] System call wrappers part 25

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit d5460c9974a321a194aded4a8c4daaac68ea8171 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
ipc/mqueue.c | 6 +++---
ipc/sem.c | 9 +++++----
ipc/shm.c | 8 ++++----
3 files changed, 12 insertions(+), 11 deletions(-)

--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -655,8 +655,8 @@ static int oflag2acc[O_ACCMODE] = { MAY_
return dentry_open(dentry, mqueue_mnt, oflag);
}

-asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
- struct mq_attr __user *u_attr)
+SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
+ struct mq_attr __user *, u_attr)
{
struct dentry *dentry;
struct file *filp;
@@ -723,7 +723,7 @@ out_putname:
return fd;
}

-asmlinkage long sys_mq_unlink(const char __user *u_name)
+SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
{
int err;
char *name;
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -308,7 +308,7 @@ static inline int sem_more_checks(struct
return 0;
}

-asmlinkage long sys_semget(key_t key, int nsems, int semflg)
+SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
{
struct ipc_namespace *ns;
struct ipc_ops sem_ops;
@@ -1055,8 +1055,8 @@ out:
return un;
}

-asmlinkage long sys_semtimedop(int semid, struct sembuf __user *tsops,
- unsigned nsops, const struct timespec __user *timeout)
+SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
+ unsigned, nsops, const struct timespec __user *, timeout)
{
int error = -EINVAL;
struct sem_array *sma;
@@ -1233,7 +1233,8 @@ out_free:
return error;
}

-asmlinkage long sys_semop (int semid, struct sembuf __user *tsops, unsigned nsops)
+SYSCALL_DEFINE3(semop, int, semid, struct sembuf __user *, tsops,
+ unsigned, nsops)
{
return sys_semtimedop(semid, tsops, nsops, NULL);
}
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -440,7 +440,7 @@ static inline int shm_more_checks(struct
return 0;
}

-asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
+SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
{
struct ipc_namespace *ns;
struct ipc_ops shm_ops;
@@ -621,7 +621,7 @@ out_up:
return err;
}

-asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
+SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
{
struct shmid_kernel *shp;
int err, version;
@@ -945,7 +945,7 @@ out_put_dentry:
goto out_nattch;
}

-asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
+SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
{
unsigned long ret;
long err;
@@ -961,7 +961,7 @@ asmlinkage long sys_shmat(int shmid, cha
* detach and kill segment if marked destroyed.
* The work is done in shm_close.
*/
-asmlinkage long sys_shmdt(char __user *shmaddr)
+SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma, *next;

2009-01-15 20:42:47

by Greg KH

[permalink] [raw]
Subject: [patch 67/94] [PATCH 36/44] [CVE-2009-0029] System call wrappers part 26

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit c4ea37c26a691ad0b7e86aa5884aab27830e95c9 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/pci/syscall.c | 12 ++++--------
ipc/mqueue.c | 22 +++++++++++-----------
kernel/sys.c | 4 ++--
mm/swapfile.c | 4 ++--
4 files changed, 19 insertions(+), 23 deletions(-)

--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -14,10 +14,8 @@
#include <asm/uaccess.h>
#include "pci.h"

-asmlinkage long
-sys_pciconfig_read(unsigned long bus, unsigned long dfn,
- unsigned long off, unsigned long len,
- void __user *buf)
+SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ unsigned long, off, unsigned long, len, void __user *, buf)
{
struct pci_dev *dev;
u8 byte;
@@ -86,10 +84,8 @@ error:
return err;
}

-asmlinkage long
-sys_pciconfig_write(unsigned long bus, unsigned long dfn,
- unsigned long off, unsigned long len,
- void __user *buf)
+SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ unsigned long, off, unsigned long, len, void __user *, buf)
{
struct pci_dev *dev;
u8 byte;
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -816,9 +816,9 @@ static inline void pipelined_receive(str
sender->state = STATE_READY;
}

-asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
- size_t msg_len, unsigned int msg_prio,
- const struct timespec __user *u_abs_timeout)
+SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
+ size_t, msg_len, unsigned int, msg_prio,
+ const struct timespec __user *, u_abs_timeout)
{
struct file *filp;
struct inode *inode;
@@ -904,9 +904,9 @@ out:
return ret;
}

-asmlinkage long sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
- size_t msg_len, unsigned int __user *u_msg_prio,
- const struct timespec __user *u_abs_timeout)
+SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
+ size_t, msg_len, unsigned int __user *, u_msg_prio,
+ const struct timespec __user *, u_abs_timeout)
{
long timeout;
ssize_t ret;
@@ -989,8 +989,8 @@ out:
* and he isn't currently owner of notification, will be silently discarded.
* It isn't explicitly defined in the POSIX.
*/
-asmlinkage long sys_mq_notify(mqd_t mqdes,
- const struct sigevent __user *u_notification)
+SYSCALL_DEFINE2(mq_notify, mqd_t, mqdes,
+ const struct sigevent __user *, u_notification)
{
int ret;
struct file *filp;
@@ -1115,9 +1115,9 @@ out:
return ret;
}

-asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
- const struct mq_attr __user *u_mqstat,
- struct mq_attr __user *u_omqstat)
+SYSCALL_DEFINE3(mq_getsetattr, mqd_t, mqdes,
+ const struct mq_attr __user *, u_mqstat,
+ struct mq_attr __user *, u_omqstat)
{
int ret;
struct mq_attr mqstat, omqstat;
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1623,8 +1623,8 @@ SYSCALL_DEFINE1(umask, int, mask)
return mask;
}

-asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
- unsigned long arg4, unsigned long arg5)
+SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+ unsigned long, arg4, unsigned long, arg5)
{
long error = 0;

--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1223,7 +1223,7 @@ int page_queue_congested(struct page *pa
}
#endif

-asmlinkage long sys_swapoff(const char __user * specialfile)
+SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
{
struct swap_info_struct * p = NULL;
unsigned short *swap_map;
@@ -1467,7 +1467,7 @@ __initcall(procswaps_init);
*
* The swapon system call
*/
-asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
+SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
{
struct swap_info_struct * p;
char *name = NULL;

2009-01-15 20:43:29

by Greg KH

[permalink] [raw]
Subject: [patch 68/94] [PATCH 37/44] [CVE-2009-0029] System call wrappers part 27

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 1e7bfb2134dfec37ce04fb3a4ca89299e892d10c upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/exec.c | 2 +-
fs/filesystems.c | 2 +-
fs/nfsctl.c | 4 ++--
kernel/printk.c | 2 +-
kernel/ptrace.c | 2 +-
kernel/sysctl.c | 4 ++--
kernel/timer.c | 2 +-
security/keys/keyctl.c | 18 +++++++++---------
8 files changed, 18 insertions(+), 18 deletions(-)

--- a/fs/exec.c
+++ b/fs/exec.c
@@ -102,7 +102,7 @@ static inline void put_binfmt(struct lin
*
* Also note that we take the address to load from from the file itself.
*/
-asmlinkage long sys_uselib(const char __user * library)
+SYSCALL_DEFINE1(uselib, const char __user *, library)
{
struct file *file;
struct nameidata nd;
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -179,7 +179,7 @@ static int fs_maxindex(void)
/*
* Whee.. Weird sysv syscall.
*/
-asmlinkage long sys_sysfs(int option, unsigned long arg1, unsigned long arg2)
+SYSCALL_DEFINE3(sysfs, int, option, unsigned long, arg1, unsigned long, arg2)
{
int retval = -EINVAL;

--- a/fs/nfsctl.c
+++ b/fs/nfsctl.c
@@ -82,8 +82,8 @@ static struct {
},
};

-long
-asmlinkage sys_nfsservctl(int cmd, struct nfsctl_arg __user *arg, void __user *res)
+SYSCALL_DEFINE3(nfsservctl, int, cmd, struct nfsctl_arg __user *, arg,
+ void __user *, res)
{
struct file *file;
void __user *p = &arg->u;
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -382,7 +382,7 @@ out:
return error;
}

-asmlinkage long sys_syslog(int type, char __user *buf, int len)
+SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
{
return do_syslog(type, buf, len);
}
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -545,7 +545,7 @@ struct task_struct *ptrace_get_task_stru
#define arch_ptrace_attach(child) do { } while (0)
#endif

-asmlinkage long sys_ptrace(long request, long pid, long addr, long data)
+SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
{
struct task_struct *child;
long ret;
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1623,7 +1623,7 @@ int do_sysctl(int __user *name, int nlen
return error;
}

-asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
+SYSCALL_DEFINE1(sysctl, struct __sysctl_args __user *, args)
{
struct __sysctl_args tmp;
int error;
@@ -2924,7 +2924,7 @@ int sysctl_ms_jiffies(struct ctl_table *
#else /* CONFIG_SYSCTL_SYSCALL */


-asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
+SYSCALL_DEFINE1(sysctl, struct __sysctl_args __user *, args)
{
struct __sysctl_args tmp;
int error;
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1415,7 +1415,7 @@ out:
return 0;
}

-asmlinkage long sys_sysinfo(struct sysinfo __user *info)
+SYSCALL_DEFINE1(sysinfo, struct sysinfo __user *, info)
{
struct sysinfo val;

--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -54,11 +54,11 @@ static int key_get_type_from_user(char *
* - returns the new key's serial number
* - implements add_key()
*/
-asmlinkage long sys_add_key(const char __user *_type,
- const char __user *_description,
- const void __user *_payload,
- size_t plen,
- key_serial_t ringid)
+SYSCALL_DEFINE5(add_key, const char __user *, _type,
+ const char __user *, _description,
+ const void __user *, _payload,
+ size_t, plen,
+ key_serial_t, ringid)
{
key_ref_t keyring_ref, key_ref;
char type[32], *description;
@@ -146,10 +146,10 @@ asmlinkage long sys_add_key(const char _
* - if the _callout_info string is empty, it will be rendered as "-"
* - implements request_key()
*/
-asmlinkage long sys_request_key(const char __user *_type,
- const char __user *_description,
- const char __user *_callout_info,
- key_serial_t destringid)
+SYSCALL_DEFINE4(request_key, const char __user *, _type,
+ const char __user *, _description,
+ const char __user *, _callout_info,
+ key_serial_t, destringid)
{
struct key_type *ktype;
struct key *key;

2009-01-15 20:43:59

by Greg KH

[permalink] [raw]
Subject: [patch 69/94] [PATCH 38/44] [CVE-2009-0029] System call wrappers part 28

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/inotify_user.c | 4 ++--
fs/ioprio.c | 5 ++---
mm/mempolicy.c | 24 +++++++++++-------------
mm/migrate.c | 8 ++++----
security/keys/keyctl.c | 4 ++--
5 files changed, 21 insertions(+), 24 deletions(-)

--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -576,7 +576,7 @@ static const struct inotify_operations i
.destroy_watch = free_inotify_user_watch,
};

-asmlinkage long sys_inotify_init1(int flags)
+SYSCALL_DEFINE1(inotify_init1, int, flags)
{
struct inotify_device *dev;
struct inotify_handle *ih;
@@ -655,7 +655,7 @@ out_put_fd:
return ret;
}

-asmlinkage long sys_inotify_init(void)
+SYSCALL_DEFINE0(inotify_init)
{
return sys_inotify_init1(0);
}
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -65,7 +65,7 @@ static int set_task_ioprio(struct task_s
return err;
}

-asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
+SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
{
int class = IOPRIO_PRIO_CLASS(ioprio);
int data = IOPRIO_PRIO_DATA(ioprio);
@@ -181,7 +181,7 @@ int ioprio_best(unsigned short aprio, un
return aprio;
}

-asmlinkage long sys_ioprio_get(int which, int who)
+SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
{
struct task_struct *g, *p;
struct user_struct *user;
@@ -245,4 +245,3 @@ asmlinkage long sys_ioprio_get(int which
read_unlock(&tasklist_lock);
return ret;
}
-
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1068,10 +1068,9 @@ static int copy_nodes_to_user(unsigned l
return copy_to_user(mask, nodes_addr(*nodes), copy) ? -EFAULT : 0;
}

-asmlinkage long sys_mbind(unsigned long start, unsigned long len,
- unsigned long mode,
- unsigned long __user *nmask, unsigned long maxnode,
- unsigned flags)
+SYSCALL_DEFINE6(mbind, unsigned long, start, unsigned long, len,
+ unsigned long, mode, unsigned long __user *, nmask,
+ unsigned long, maxnode, unsigned, flags)
{
nodemask_t nodes;
int err;
@@ -1091,8 +1090,8 @@ asmlinkage long sys_mbind(unsigned long
}

/* Set the process memory policy */
-asmlinkage long sys_set_mempolicy(int mode, unsigned long __user *nmask,
- unsigned long maxnode)
+SYSCALL_DEFINE3(set_mempolicy, int, mode, unsigned long __user *, nmask,
+ unsigned long, maxnode)
{
int err;
nodemask_t nodes;
@@ -1110,9 +1109,9 @@ asmlinkage long sys_set_mempolicy(int mo
return do_set_mempolicy(mode, flags, &nodes);
}

-asmlinkage long sys_migrate_pages(pid_t pid, unsigned long maxnode,
- const unsigned long __user *old_nodes,
- const unsigned long __user *new_nodes)
+SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+ const unsigned long __user *, old_nodes,
+ const unsigned long __user *, new_nodes)
{
struct mm_struct *mm;
struct task_struct *task;
@@ -1180,10 +1179,9 @@ out:


/* Retrieve NUMA policy */
-asmlinkage long sys_get_mempolicy(int __user *policy,
- unsigned long __user *nmask,
- unsigned long maxnode,
- unsigned long addr, unsigned long flags)
+SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
+ unsigned long __user *, nmask, unsigned long, maxnode,
+ unsigned long, addr, unsigned long, flags)
{
int err;
int uninitialized_var(pval);
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1070,10 +1070,10 @@ out:
* Move a list of pages in the address space of the currently executing
* process.
*/
-asmlinkage long sys_move_pages(pid_t pid, unsigned long nr_pages,
- const void __user * __user *pages,
- const int __user *nodes,
- int __user *status, int flags)
+SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+ const void __user * __user *, pages,
+ const int __user *, nodes,
+ int __user *, status, int, flags)
{
struct task_struct *task;
struct mm_struct *mm;
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1152,8 +1152,8 @@ long keyctl_get_security(key_serial_t ke
/*
* the key control system call
*/
-asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
- unsigned long arg4, unsigned long arg5)
+SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
+ unsigned long, arg4, unsigned long, arg5)
{
switch (option) {
case KEYCTL_GET_KEYRING_ID:

2009-01-15 20:44:37

by Greg KH

[permalink] [raw]
Subject: [patch 70/94] [PATCH 39/44] [CVE-2009-0029] System call wrappers part 29

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 2e4d0924eb0c403ce4014fa139d1d61bf2c44fee upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/inotify_user.c | 5 +++--
fs/namei.c | 21 ++++++++++-----------
2 files changed, 13 insertions(+), 13 deletions(-)

--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -660,7 +660,8 @@ SYSCALL_DEFINE0(inotify_init)
return sys_inotify_init1(0);
}

-asmlinkage long sys_inotify_add_watch(int fd, const char __user *pathname, u32 mask)
+SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
+ u32, mask)
{
struct inode *inode;
struct inotify_device *dev;
@@ -704,7 +705,7 @@ fput_and_out:
return ret;
}

-asmlinkage long sys_inotify_rm_watch(int fd, __s32 wd)
+SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd)
{
struct file *filp;
struct inotify_device *dev;
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1969,8 +1969,8 @@ static int may_mknod(mode_t mode)
}
}

-asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
- unsigned dev)
+SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+ unsigned, dev)
{
int error;
char *tmp;
@@ -2047,7 +2047,7 @@ int vfs_mkdir(struct inode *dir, struct
return error;
}

-asmlinkage long sys_mkdirat(int dfd, const char __user *pathname, int mode)
+SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
{
int error = 0;
char * tmp;
@@ -2282,7 +2282,7 @@ slashes:
goto exit2;
}

-asmlinkage long sys_unlinkat(int dfd, const char __user *pathname, int flag)
+SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
{
if ((flag & ~AT_REMOVEDIR) != 0)
return -EINVAL;
@@ -2319,8 +2319,8 @@ int vfs_symlink(struct inode *dir, struc
return error;
}

-asmlinkage long sys_symlinkat(const char __user *oldname,
- int newdfd, const char __user *newname)
+SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+ int, newdfd, const char __user *, newname)
{
int error;
char *from;
@@ -2409,9 +2409,8 @@ int vfs_link(struct dentry *old_dentry,
* with linux 2.0, and to avoid hard-linking to directories
* and other special files. --ADM
*/
-asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
- int newdfd, const char __user *newname,
- int flags)
+SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+ int, newdfd, const char __user *, newname, int, flags)
{
struct dentry *new_dentry;
struct nameidata nd;
@@ -2607,8 +2606,8 @@ int vfs_rename(struct inode *old_dir, st
return error;
}

-asmlinkage long sys_renameat(int olddfd, const char __user *oldname,
- int newdfd, const char __user *newname)
+SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+ int, newdfd, const char __user *, newname)
{
struct dentry *old_dir, *new_dir;
struct dentry *old_dentry, *new_dentry;

2009-01-15 20:45:19

by Greg KH

[permalink] [raw]
Subject: [patch 71/94] [PATCH 40/44] [CVE-2009-0029] System call wrappers part 30

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 6559eed8ca7db0531a207cd80be5e28cd6f213c5 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/open.c | 13 ++++++-------
fs/stat.c | 12 ++++++------
fs/utimes.c | 6 ++++--
kernel/fork.c | 2 +-
4 files changed, 17 insertions(+), 16 deletions(-)

--- a/fs/open.c
+++ b/fs/open.c
@@ -442,7 +442,7 @@ SYSCALL_ALIAS(sys_fallocate, SyS_falloca
* We do this by temporarily clearing all FS-related capabilities and
* switching the fsuid/fsgid around to the real ones.
*/
-asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
+SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
{
struct path path;
struct inode *inode;
@@ -633,8 +633,7 @@ out:
return err;
}

-asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
- mode_t mode)
+SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
{
struct path path;
struct inode *inode;
@@ -712,8 +711,8 @@ out:
return error;
}

-asmlinkage long sys_fchownat(int dfd, const char __user *filename, uid_t user,
- gid_t group, int flag)
+SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
+ gid_t, group, int, flag)
{
struct path path;
int error = -EINVAL;
@@ -1060,8 +1059,8 @@ SYSCALL_DEFINE3(open, const char __user
return ret;
}

-asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
- int mode)
+SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
+ int, mode)
{
long ret;

--- a/fs/stat.c
+++ b/fs/stat.c
@@ -260,8 +260,8 @@ SYSCALL_DEFINE2(newlstat, char __user *,
}

#if !defined(__ARCH_WANT_STAT64) || defined(__ARCH_WANT_SYS_NEWFSTATAT)
-asmlinkage long sys_newfstatat(int dfd, char __user *filename,
- struct stat __user *statbuf, int flag)
+SYSCALL_DEFINE4(newfstatat, int, dfd, char __user *, filename,
+ struct stat __user *, statbuf, int, flag)
{
struct kstat stat;
int error = -EINVAL;
@@ -293,8 +293,8 @@ SYSCALL_DEFINE2(newfstat, unsigned int,
return error;
}

-asmlinkage long sys_readlinkat(int dfd, const char __user *pathname,
- char __user *buf, int bufsiz)
+SYSCALL_DEFINE4(readlinkat, int, dfd, const char __user *, pathname,
+ char __user *, buf, int, bufsiz)
{
struct path path;
int error;
@@ -400,8 +400,8 @@ SYSCALL_DEFINE2(fstat64, unsigned long,
return error;
}

-asmlinkage long sys_fstatat64(int dfd, char __user *filename,
- struct stat64 __user *statbuf, int flag)
+SYSCALL_DEFINE4(fstatat64, int, dfd, char __user *, filename,
+ struct stat64 __user *, statbuf, int, flag)
{
struct kstat stat;
int error = -EINVAL;
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -170,7 +170,8 @@ out:
return error;
}

-asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __user *utimes, int flags)
+SYSCALL_DEFINE4(utimensat, int, dfd, char __user *, filename,
+ struct timespec __user *, utimes, int, flags)
{
struct timespec tstimes[2];

@@ -187,7 +188,8 @@ asmlinkage long sys_utimensat(int dfd, c
return do_utimes(dfd, filename, utimes ? tstimes : NULL, flags);
}

-asmlinkage long sys_futimesat(int dfd, char __user *filename, struct timeval __user *utimes)
+SYSCALL_DEFINE3(futimesat, int, dfd, char __user *, filename,
+ struct timeval __user *, utimes)
{
struct timeval times[2];
struct timespec tstimes[2];
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1589,7 +1589,7 @@ static int unshare_fd(unsigned long unsh
* constructed. Here we are modifying the current, active,
* task_struct.
*/
-asmlinkage long sys_unshare(unsigned long unshare_flags)
+SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
{
int err = 0;
struct fs_struct *fs, *new_fs = NULL;

2009-01-15 20:45:52

by Greg KH

[permalink] [raw]
Subject: [patch 72/94] [PATCH 41/44] [CVE-2009-0029] System call wrappers part 31

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 836f92adf121f806e9beb5b6b88bd5c9c4ea3f24 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/signalfd.c | 8 ++++----
fs/splice.c | 12 ++++++------
fs/timerfd.c | 8 ++++----
kernel/futex.c | 11 +++++------
kernel/sys.c | 4 ++--
5 files changed, 21 insertions(+), 22 deletions(-)

--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -205,8 +205,8 @@ static const struct file_operations sign
.read = signalfd_read,
};

-asmlinkage long sys_signalfd4(int ufd, sigset_t __user *user_mask,
- size_t sizemask, int flags)
+SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask,
+ size_t, sizemask, int, flags)
{
sigset_t sigmask;
struct signalfd_ctx *ctx;
@@ -259,8 +259,8 @@ asmlinkage long sys_signalfd4(int ufd, s
return ufd;
}

-asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask,
- size_t sizemask)
+SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask,
+ size_t, sizemask)
{
return sys_signalfd4(ufd, user_mask, sizemask, 0);
}
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1434,8 +1434,8 @@ static long vmsplice_to_pipe(struct file
* Currently we punt and implement it as a normal copy, see pipe_to_user().
*
*/
-asmlinkage long sys_vmsplice(int fd, const struct iovec __user *iov,
- unsigned long nr_segs, unsigned int flags)
+SYSCALL_DEFINE4(vmsplice, int, fd, const struct iovec __user *, iov,
+ unsigned long, nr_segs, unsigned int, flags)
{
struct file *file;
long error;
@@ -1460,9 +1460,9 @@ asmlinkage long sys_vmsplice(int fd, con
return error;
}

-asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
- int fd_out, loff_t __user *off_out,
- size_t len, unsigned int flags)
+SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in,
+ int, fd_out, loff_t __user *, off_out,
+ size_t, len, unsigned int, flags)
{
long error;
struct file *in, *out;
@@ -1684,7 +1684,7 @@ static long do_tee(struct file *in, stru
return ret;
}

-asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)
+SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags)
{
struct file *in;
int error, fput_in;
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -177,7 +177,7 @@ static struct file *timerfd_fget(int fd)
return file;
}

-asmlinkage long sys_timerfd_create(int clockid, int flags)
+SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
{
int ufd;
struct timerfd_ctx *ctx;
@@ -208,9 +208,9 @@ asmlinkage long sys_timerfd_create(int c
return ufd;
}

-asmlinkage long sys_timerfd_settime(int ufd, int flags,
- const struct itimerspec __user *utmr,
- struct itimerspec __user *otmr)
+SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
+ const struct itimerspec __user *, utmr,
+ struct itimerspec __user *, otmr)
{
struct file *file;
struct timerfd_ctx *ctx;
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1800,9 +1800,8 @@ pi_faulted:
* @head: pointer to the list-head
* @len: length of the list-head, as userspace expects
*/
-asmlinkage long
-sys_set_robust_list(struct robust_list_head __user *head,
- size_t len)
+SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ size_t, len)
{
if (!futex_cmpxchg_enabled)
return -ENOSYS;
@@ -1823,9 +1822,9 @@ sys_set_robust_list(struct robust_list_h
* @head_ptr: pointer to a list-head pointer, the kernel fills it in
* @len_ptr: pointer to a length field, the kernel fills in the header size
*/
-asmlinkage long
-sys_get_robust_list(int pid, struct robust_list_head __user * __user *head_ptr,
- size_t __user *len_ptr)
+SYSCALL_DEFINE3(get_robust_list, int, pid,
+ struct robust_list_head __user * __user *, head_ptr,
+ size_t __user *, len_ptr)
{
struct robust_list_head __user *head;
unsigned long ret;
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1735,8 +1735,8 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
return error;
}

-asmlinkage long sys_getcpu(unsigned __user *cpup, unsigned __user *nodep,
- struct getcpu_cache __user *unused)
+SYSCALL_DEFINE3(getcpu, unsigned __user *, cpup, unsigned __user *, nodep,
+ struct getcpu_cache __user *, unused)
{
int err = 0;
int cpu = raw_smp_processor_id();

2009-01-15 20:46:25

by Greg KH

[permalink] [raw]
Subject: [patch 73/94] [PATCH 42/44] [CVE-2009-0029] System call wrappers part 32

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit d4e82042c4cfa87a7d51710b71f568fe80132551 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/eventfd.c | 5 ++---
fs/pipe.c | 2 +-
fs/readdir.c | 3 ++-
fs/select.c | 11 ++++++-----
fs/timerfd.c | 2 +-
include/linux/syscalls.h | 7 +++++++
kernel/signal.c | 11 +++++------
7 files changed, 24 insertions(+), 17 deletions(-)

--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -198,7 +198,7 @@ struct file *eventfd_fget(int fd)
return file;
}

-asmlinkage long sys_eventfd2(unsigned int count, int flags)
+SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
{
int fd;
struct eventfd_ctx *ctx;
@@ -228,8 +228,7 @@ asmlinkage long sys_eventfd2(unsigned in
return fd;
}

-asmlinkage long sys_eventfd(unsigned int count)
+SYSCALL_DEFINE1(eventfd, unsigned int, count)
{
return sys_eventfd2(count, 0);
}
-
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1048,7 +1048,7 @@ int do_pipe(int *fd)
* sys_pipe() is the normal C calling standard for creating
* a pipe. It's not the way Unix traditionally does this, though.
*/
-asmlinkage long sys_pipe2(int __user *fildes, int flags)
+SYSCALL_DEFINE2(pipe2, int __user *, fildes, int, flags)
{
int fd[2];
int error;
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -102,7 +102,8 @@ efault:
return -EFAULT;
}

-asmlinkage long sys_old_readdir(unsigned int fd, struct old_linux_dirent __user * dirent, unsigned int count)
+SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
+ struct old_linux_dirent __user *, dirent, unsigned int, count)
{
int error;
struct file * file;
--- a/fs/select.c
+++ b/fs/select.c
@@ -586,8 +586,9 @@ static long do_pselect(int n, fd_set __u
* which has a pointer to the sigset_t itself followed by a size_t containing
* the sigset size.
*/
-asmlinkage long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
- fd_set __user *exp, struct timespec __user *tsp, void __user *sig)
+SYSCALL_DEFINE6(pselect6, int, n, fd_set __user *, inp, fd_set __user *, outp,
+ fd_set __user *, exp, struct timespec __user *, tsp,
+ void __user *, sig)
{
size_t sigsetsize = 0;
sigset_t __user *up = NULL;
@@ -841,9 +842,9 @@ SYSCALL_DEFINE3(poll, struct pollfd __us
}

#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
- struct timespec __user *tsp, const sigset_t __user *sigmask,
- size_t sigsetsize)
+SYSCALL_DEFINE5(ppoll, struct pollfd __user *, ufds, unsigned int, nfds,
+ struct timespec __user *, tsp, const sigset_t __user *, sigmask,
+ size_t, sigsetsize)
{
sigset_t ksigmask, sigsaved;
struct timespec ts, end_time, *to = NULL;
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -265,7 +265,7 @@ SYSCALL_DEFINE4(timerfd_settime, int, uf
return 0;
}

-asmlinkage long sys_timerfd_gettime(int ufd, struct itimerspec __user *otmr)
+SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
{
struct file *file;
struct timerfd_ctx *ctx;
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -678,6 +678,13 @@ asmlinkage long sys_eventfd(unsigned int
asmlinkage long sys_eventfd2(unsigned int count, int flags);
asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len);
asmlinkage long sys_old_readdir(unsigned int, struct old_linux_dirent __user *, unsigned int);
+asmlinkage long sys_pselect6(int, fd_set __user *, fd_set __user *,
+ fd_set __user *, struct timespec __user *,
+ void __user *);
+asmlinkage long sys_ppoll(struct pollfd __user *, unsigned int,
+ struct timespec __user *, const sigset_t __user *,
+ size_t);
+asmlinkage long sys_pipe2(int __user *, int);

int kernel_execve(const char *filename, char *const argv[], char *const envp[]);

--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2470,11 +2470,10 @@ out:
#endif /* __ARCH_WANT_SYS_SIGPROCMASK */

#ifdef __ARCH_WANT_SYS_RT_SIGACTION
-asmlinkage long
-sys_rt_sigaction(int sig,
- const struct sigaction __user *act,
- struct sigaction __user *oact,
- size_t sigsetsize)
+SYSCALL_DEFINE4(rt_sigaction, int, sig,
+ const struct sigaction __user *, act,
+ struct sigaction __user *, oact,
+ size_t, sigsetsize)
{
struct k_sigaction new_sa, old_sa;
int ret = -EINVAL;
@@ -2557,7 +2556,7 @@ SYSCALL_DEFINE0(pause)
#endif

#ifdef __ARCH_WANT_SYS_RT_SIGSUSPEND
-asmlinkage long sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize)
+SYSCALL_DEFINE2(rt_sigsuspend, sigset_t __user *, unewset, size_t, sigsetsize)
{
sigset_t newset;

2009-01-15 20:46:53

by Greg KH

[permalink] [raw]
Subject: [patch 74/94] [PATCH 43/44] [CVE-2009-0029] System call wrappers part 33

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 2b66421995d2e93c9d1a0111acf2581f8529c6e5 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/pipe.c | 2 +-
include/linux/syscalls.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)

--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1064,7 +1064,7 @@ SYSCALL_DEFINE2(pipe2, int __user *, fil
return error;
}

-asmlinkage long sys_pipe(int __user *fildes)
+SYSCALL_DEFINE1(pipe, int __user *, fildes)
{
return sys_pipe2(fildes, 0);
}
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -685,6 +685,7 @@ asmlinkage long sys_ppoll(struct pollfd
struct timespec __user *, const sigset_t __user *,
size_t);
asmlinkage long sys_pipe2(int __user *, int);
+asmlinkage long sys_pipe(int __user *);

int kernel_execve(const char *filename, char *const argv[], char *const envp[]);

2009-01-15 20:47:35

by Greg KH

[permalink] [raw]
Subject: [patch 75/94] [PATCH 44/44] [CVE-2009-0029] s390 specific system call wrappers

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Heiko Carstens <[email protected]>

commit 26689452f5ca201add63b1b1ff0dbcf82d6885e7 upstream.

Signed-off-by: Heiko Carstens <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/s390/kernel/compat_wrapper.S | 4 ++--
arch/s390/kernel/entry.h | 15 ++++++++-------
arch/s390/kernel/process.c | 9 +++++----
arch/s390/kernel/signal.c | 19 ++++++++-----------
arch/s390/kernel/sys_s390.c | 35 +++++++++++++++++++++--------------
arch/s390/kernel/syscalls.S | 12 ++++++------
6 files changed, 50 insertions(+), 44 deletions(-)

--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -547,7 +547,7 @@ sys32_setdomainname_wrapper:
.globl sys32_newuname_wrapper
sys32_newuname_wrapper:
llgtr %r2,%r2 # struct new_utsname *
- jg s390x_newuname # branch to system call
+ jg sys_s390_newuname # branch to system call

.globl compat_sys_adjtimex_wrapper
compat_sys_adjtimex_wrapper:
@@ -615,7 +615,7 @@ sys32_sysfs_wrapper:
.globl sys32_personality_wrapper
sys32_personality_wrapper:
llgfr %r2,%r2 # unsigned long
- jg s390x_personality # branch to system call
+ jg sys_s390_personality # branch to system call

.globl sys32_setfsuid16_wrapper
sys32_setfsuid16_wrapper:
--- a/arch/s390/kernel/entry.h
+++ b/arch/s390/kernel/entry.h
@@ -31,21 +31,22 @@ struct old_sigaction;
struct sel_arg_struct;

long sys_mmap2(struct mmap_arg_struct __user *arg);
-long old_mmap(struct mmap_arg_struct __user *arg);
+long sys_s390_old_mmap(struct mmap_arg_struct __user *arg);
long sys_ipc(uint call, int first, unsigned long second,
unsigned long third, void __user *ptr);
-long s390x_newuname(struct new_utsname __user *name);
-long s390x_personality(unsigned long personality);
-long s390_fadvise64(int fd, u32 offset_high, u32 offset_low,
+long sys_s390_newuname(struct new_utsname __user *name);
+long sys_s390_personality(unsigned long personality);
+long sys_s390_fadvise64(int fd, u32 offset_high, u32 offset_low,
size_t len, int advice);
-long s390_fadvise64_64(struct fadvise64_64_args __user *args);
-long s390_fallocate(int fd, int mode, loff_t offset, u32 len_high, u32 len_low);
+long sys_s390_fadvise64_64(struct fadvise64_64_args __user *args);
+long sys_s390_fallocate(int fd, int mode, loff_t offset, u32 len_high,
+ u32 len_low);
long sys_fork(void);
long sys_clone(void);
long sys_vfork(void);
void execve_tail(void);
long sys_execve(void);
-int sys_sigsuspend(int history0, int history1, old_sigset_t mask);
+long sys_sigsuspend(int history0, int history1, old_sigset_t mask);
long sys_sigaction(int sig, const struct old_sigaction __user *act,
struct old_sigaction __user *oact);
long sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss);
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -38,6 +38,7 @@
#include <linux/utsname.h>
#include <linux/tick.h>
#include <linux/elfcore.h>
+#include <linux/syscalls.h>
#include <asm/uaccess.h>
#include <asm/pgtable.h>
#include <asm/system.h>
@@ -260,13 +261,13 @@ int copy_thread(int nr, unsigned long cl
return 0;
}

-asmlinkage long sys_fork(void)
+SYSCALL_DEFINE0(fork)
{
struct pt_regs *regs = task_pt_regs(current);
return do_fork(SIGCHLD, regs->gprs[15], regs, 0, NULL, NULL);
}

-asmlinkage long sys_clone(void)
+SYSCALL_DEFINE0(clone)
{
struct pt_regs *regs = task_pt_regs(current);
unsigned long clone_flags;
@@ -293,7 +294,7 @@ asmlinkage long sys_clone(void)
* do not have enough call-clobbered registers to hold all
* the information you need.
*/
-asmlinkage long sys_vfork(void)
+SYSCALL_DEFINE0(vfork)
{
struct pt_regs *regs = task_pt_regs(current);
return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD,
@@ -313,7 +314,7 @@ asmlinkage void execve_tail(void)
/*
* sys_execve() executes a new program.
*/
-asmlinkage long sys_execve(void)
+SYSCALL_DEFINE0(execve)
{
struct pt_regs *regs = task_pt_regs(current);
char *filename;
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -25,6 +25,7 @@
#include <linux/personality.h>
#include <linux/binfmts.h>
#include <linux/tracehook.h>
+#include <linux/syscalls.h>
#include <asm/ucontext.h>
#include <asm/uaccess.h>
#include <asm/lowcore.h>
@@ -53,8 +54,7 @@ typedef struct
/*
* Atomically swap in the new signal mask, and wait for a signal.
*/
-asmlinkage int
-sys_sigsuspend(int history0, int history1, old_sigset_t mask)
+SYSCALL_DEFINE3(sigsuspend, int, history0, int, history1, old_sigset_t, mask)
{
mask &= _BLOCKABLE;
spin_lock_irq(&current->sighand->siglock);
@@ -70,9 +70,8 @@ sys_sigsuspend(int history0, int history
return -ERESTARTNOHAND;
}

-asmlinkage long
-sys_sigaction(int sig, const struct old_sigaction __user *act,
- struct old_sigaction __user *oact)
+SYSCALL_DEFINE3(sigaction, int, sig, const struct old_sigaction __user *, act,
+ struct old_sigaction __user *, oact)
{
struct k_sigaction new_ka, old_ka;
int ret;
@@ -102,15 +101,13 @@ sys_sigaction(int sig, const struct old_
return ret;
}

-asmlinkage long
-sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss)
+SYSCALL_DEFINE2(sigaltstack, const stack_t __user *, uss,
+ stack_t __user *, uoss)
{
struct pt_regs *regs = task_pt_regs(current);
return do_sigaltstack(uss, uoss, regs->gprs[15]);
}

-
-
/* Returns non-zero on fault. */
static int save_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
{
@@ -164,7 +161,7 @@ static int restore_sigregs(struct pt_reg
return 0;
}

-asmlinkage long sys_sigreturn(void)
+SYSCALL_DEFINE0(sigreturn)
{
struct pt_regs *regs = task_pt_regs(current);
sigframe __user *frame = (sigframe __user *)regs->gprs[15];
@@ -191,7 +188,7 @@ badframe:
return 0;
}

-asmlinkage long sys_rt_sigreturn(void)
+SYSCALL_DEFINE0(rt_sigreturn)
{
struct pt_regs *regs = task_pt_regs(current);
rt_sigframe __user *frame = (rt_sigframe __user *)regs->gprs[15];
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -98,7 +98,7 @@ SYSCALL(sys_uselib,sys_uselib,sys32_usel
SYSCALL(sys_swapon,sys_swapon,sys32_swapon_wrapper)
SYSCALL(sys_reboot,sys_reboot,sys32_reboot_wrapper)
SYSCALL(sys_ni_syscall,sys_ni_syscall,old32_readdir_wrapper) /* old readdir syscall */
-SYSCALL(old_mmap,old_mmap,old32_mmap_wrapper) /* 90 */
+SYSCALL(sys_s390_old_mmap,sys_s390_old_mmap,old32_mmap_wrapper) /* 90 */
SYSCALL(sys_munmap,sys_munmap,sys32_munmap_wrapper)
SYSCALL(sys_truncate,sys_truncate,sys32_truncate_wrapper)
SYSCALL(sys_ftruncate,sys_ftruncate,sys32_ftruncate_wrapper)
@@ -130,7 +130,7 @@ SYSCALL(sys_fsync,sys_fsync,sys32_fsync_
SYSCALL(sys_sigreturn,sys_sigreturn,sys32_sigreturn)
SYSCALL(sys_clone,sys_clone,sys32_clone) /* 120 */
SYSCALL(sys_setdomainname,sys_setdomainname,sys32_setdomainname_wrapper)
-SYSCALL(sys_newuname,s390x_newuname,sys32_newuname_wrapper)
+SYSCALL(sys_newuname,sys_s390_newuname,sys32_newuname_wrapper)
NI_SYSCALL /* modify_ldt for i386 */
SYSCALL(sys_adjtimex,sys_adjtimex,compat_sys_adjtimex_wrapper)
SYSCALL(sys_mprotect,sys_mprotect,sys32_mprotect_wrapper) /* 125 */
@@ -144,7 +144,7 @@ SYSCALL(sys_getpgid,sys_getpgid,sys32_ge
SYSCALL(sys_fchdir,sys_fchdir,sys32_fchdir_wrapper)
SYSCALL(sys_bdflush,sys_bdflush,sys32_bdflush_wrapper)
SYSCALL(sys_sysfs,sys_sysfs,sys32_sysfs_wrapper) /* 135 */
-SYSCALL(sys_personality,s390x_personality,sys32_personality_wrapper)
+SYSCALL(sys_personality,sys_s390_personality,sys32_personality_wrapper)
NI_SYSCALL /* for afs_syscall */
SYSCALL(sys_setfsuid16,sys_ni_syscall,sys32_setfsuid16_wrapper) /* old setfsuid16 syscall */
SYSCALL(sys_setfsgid16,sys_ni_syscall,sys32_setfsgid16_wrapper) /* old setfsgid16 syscall */
@@ -261,7 +261,7 @@ SYSCALL(sys_epoll_create,sys_epoll_creat
SYSCALL(sys_epoll_ctl,sys_epoll_ctl,sys_epoll_ctl_wrapper) /* 250 */
SYSCALL(sys_epoll_wait,sys_epoll_wait,sys_epoll_wait_wrapper)
SYSCALL(sys_set_tid_address,sys_set_tid_address,sys32_set_tid_address_wrapper)
-SYSCALL(s390_fadvise64,sys_fadvise64_64,sys32_fadvise64_wrapper)
+SYSCALL(sys_s390_fadvise64,sys_fadvise64_64,sys32_fadvise64_wrapper)
SYSCALL(sys_timer_create,sys_timer_create,sys32_timer_create_wrapper)
SYSCALL(sys_timer_settime,sys_timer_settime,sys32_timer_settime_wrapper) /* 255 */
SYSCALL(sys_timer_gettime,sys_timer_gettime,sys32_timer_gettime_wrapper)
@@ -272,7 +272,7 @@ SYSCALL(sys_clock_gettime,sys_clock_gett
SYSCALL(sys_clock_getres,sys_clock_getres,sys32_clock_getres_wrapper)
SYSCALL(sys_clock_nanosleep,sys_clock_nanosleep,sys32_clock_nanosleep_wrapper)
NI_SYSCALL /* reserved for vserver */
-SYSCALL(s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper)
+SYSCALL(sys_s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper)
SYSCALL(sys_statfs64,sys_statfs64,compat_sys_statfs64_wrapper)
SYSCALL(sys_fstatfs64,sys_fstatfs64,compat_sys_fstatfs64_wrapper)
SYSCALL(sys_remap_file_pages,sys_remap_file_pages,sys32_remap_file_pages_wrapper)
@@ -322,7 +322,7 @@ NI_SYSCALL /* 310 sys_move_pages *
SYSCALL(sys_getcpu,sys_getcpu,sys_getcpu_wrapper)
SYSCALL(sys_epoll_pwait,sys_epoll_pwait,compat_sys_epoll_pwait_wrapper)
SYSCALL(sys_utimes,sys_utimes,compat_sys_utimes_wrapper)
-SYSCALL(s390_fallocate,sys_fallocate,sys_fallocate_wrapper)
+SYSCALL(sys_s390_fallocate,sys_fallocate,sys_fallocate_wrapper)
SYSCALL(sys_utimensat,sys_utimensat,compat_sys_utimensat_wrapper) /* 315 */
SYSCALL(sys_signalfd,sys_signalfd,compat_sys_signalfd_wrapper)
NI_SYSCALL /* 317 old sys_timer_fd */
--- a/arch/s390/kernel/sys_s390.c
+++ b/arch/s390/kernel/sys_s390.c
@@ -29,6 +29,7 @@
#include <linux/personality.h>
#include <linux/unistd.h>
#include <linux/ipc.h>
+#include <linux/syscalls.h>
#include <asm/uaccess.h>
#include "entry.h"

@@ -74,7 +75,7 @@ struct mmap_arg_struct {
unsigned long offset;
};

-asmlinkage long sys_mmap2(struct mmap_arg_struct __user *arg)
+SYSCALL_DEFINE1(mmap2, struct mmap_arg_struct __user *, arg)
{
struct mmap_arg_struct a;
int error = -EFAULT;
@@ -86,7 +87,7 @@ out:
return error;
}

-asmlinkage long old_mmap(struct mmap_arg_struct __user *arg)
+SYSCALL_DEFINE1(s390_old_mmap, struct mmap_arg_struct __user *, arg)
{
struct mmap_arg_struct a;
long error = -EFAULT;
@@ -127,8 +128,8 @@ asmlinkage long old_select(struct sel_ar
*
* This is really horribly ugly.
*/
-asmlinkage long sys_ipc(uint call, int first, unsigned long second,
- unsigned long third, void __user *ptr)
+SYSCALL_DEFINE5(ipc, uint, call, int, first, unsigned long, second,
+ unsigned long, third, void __user *, ptr)
{
struct ipc_kludge tmp;
int ret;
@@ -194,7 +195,7 @@ asmlinkage long sys_ipc(uint call, int f
}

#ifdef CONFIG_64BIT
-asmlinkage long s390x_newuname(struct new_utsname __user *name)
+SYSCALL_DEFINE1(s390_newuname, struct new_utsname __user *, name)
{
int ret = sys_newuname(name);

@@ -205,7 +206,7 @@ asmlinkage long s390x_newuname(struct ne
return ret;
}

-asmlinkage long s390x_personality(unsigned long personality)
+SYSCALL_DEFINE1(s390_personality, unsigned long, personality)
{
int ret;

@@ -224,15 +225,13 @@ asmlinkage long s390x_personality(unsign
*/
#ifndef CONFIG_64BIT

-asmlinkage long
-s390_fadvise64(int fd, u32 offset_high, u32 offset_low, size_t len, int advice)
+SYSCALL_DEFINE5(s390_fadvise64, int, fd, u32, offset_high, u32, offset_low,
+ size_t, len, int, advice)
{
return sys_fadvise64(fd, (u64) offset_high << 32 | offset_low,
len, advice);
}

-#endif
-
struct fadvise64_64_args {
int fd;
long long offset;
@@ -240,8 +239,7 @@ struct fadvise64_64_args {
int advice;
};

-asmlinkage long
-s390_fadvise64_64(struct fadvise64_64_args __user *args)
+SYSCALL_DEFINE1(s390_fadvise64_64, struct fadvise64_64_args __user *, args)
{
struct fadvise64_64_args a;

@@ -250,7 +248,6 @@ s390_fadvise64_64(struct fadvise64_64_ar
return sys_fadvise64_64(a.fd, a.offset, a.len, a.advice);
}

-#ifndef CONFIG_64BIT
/*
* This is a wrapper to call sys_fallocate(). For 31 bit s390 the last
* 64 bit argument "len" is split into the upper and lower 32 bits. The
@@ -263,9 +260,19 @@ s390_fadvise64_64(struct fadvise64_64_ar
* to
* %r2: fd, %r3: mode, %r4/%r5: offset, 96(%r15)-103(%r15): len
*/
-asmlinkage long s390_fallocate(int fd, int mode, loff_t offset,
+SYSCALL_DEFINE(s390_fallocate)(int fd, int mode, loff_t offset,
u32 len_high, u32 len_low)
{
return sys_fallocate(fd, mode, offset, ((u64)len_high << 32) | len_low);
}
+#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
+asmlinkage long SyS_s390_fallocate(long fd, long mode, loff_t offset,
+ long len_high, long len_low)
+{
+ return SYSC_s390_fallocate((int) fd, (int) mode, offset,
+ (u32) len_high, (u32) len_low);
+}
+SYSCALL_ALIAS(sys_s390_fallocate, SyS_s390_fallocate);
+#endif
+
#endif

2009-01-15 20:48:06

by Greg KH

[permalink] [raw]
Subject: [patch 76/94] x86: fix RIP printout in early_idt_handler

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jiri Slaby <[email protected]>

commit 7aed55d1085f71241284a30af0300feea48c36db upstream.

Impact: fix debug/crash printout

Since errorcode is popped out, RIP is on the top of the stack.
Use real RIP value instead of wrong CS.

Signed-off-by: Jiri Slaby <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/kernel/head_64.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -305,7 +305,7 @@ ENTRY(early_idt_handler)
call dump_stack
#ifdef CONFIG_KALLSYMS
leaq early_idt_ripmsg(%rip),%rdi
- movq 8(%rsp),%rsi # get rip again
+ movq 0(%rsp),%rsi # get rip again
call __print_symbol
#endif
#endif /* EARLY_PRINTK */

2009-01-15 20:48:36

by Greg KH

[permalink] [raw]
Subject: [patch 77/94] Fix timeouts in sys_pselect7

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Bernd Schmidt <[email protected]>

commit 62568510b8e2679cbc331d7de10ea9ba81ae8b3d upstream.

Since we (Analog Devices) updated our Blackfin kernel to 2.6.28, we've
seen occasional 5-second hangs from telnet. telnetd calls select with a
NULL timeout, but with the new kernel, the system call occasionally
returns 0, which causes telnet to call sleep (5). This did not happen
with earlier kernels.

The code in sys_pselect7 looks a bit strange, in particular the variable
"to" is initialized to NULL, then changed if a non-null timeout was
passed in, but not used further. It needs to be passed to
core_sys_select instead of &end_time.

This bug was introduced by 8ff3e8e85fa6c312051134b3953e397feb639f51
("select: switch select() and poll() over to hrtimers").

Signed-off-by: Bernd Schmidt <[email protected]>
Reviewed-by: Ulrich Drepper <[email protected]>
Tested-by: Robin Getz <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/select.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/select.c
+++ b/fs/select.c
@@ -560,7 +560,7 @@ static long do_pselect(int n, fd_set __u
sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
}

- ret = core_sys_select(n, inp, outp, exp, &end_time);
+ ret = core_sys_select(n, inp, outp, exp, to);
ret = poll_select_copy_remaining(&end_time, tsp, 0, ret);

if (ret == -ERESTARTNOHAND) {

2009-01-15 20:49:13

by Greg KH

[permalink] [raw]
Subject: [patch 78/94] USB: another unusual_devs entry for another bad Argosy storage device

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nguyen Anh Quynh <[email protected]>

commit e2673b28911a43257265523e3672861be6e44093 upstream.

I have another Argosy USB storage device, which has the same problem
with the Argosy USB storage device already fixed in 2.6.27.7. But this
device has another product ID (840:84), so this patch adds a new entry
into unusual_devs to fix the mount problem.

I enclose here two patches: one against 2.6.27.8, and another against
the latest linus-git tree.


The information about the Argosy device is like below:

#lsusb -v -d 840:84
Bus 005 Device 005: ID 0840:0084 Argosy Research, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0840 Argosy Research, Inc.
idProduct 0x0084
bcdDevice 0.01
iManufacturer 1 Generic
iProduct 2 USB 2.0 Storage Device
iSerial 3 8400000000002549
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 2mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)

Before the patch, dmesg returns a lot of information like below (my
dmesg is overflown):
....
[ 138.833390] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information
[ 138.877631] sd 7:0:0:0: [sdb] Sense Key : No Sense [current]
[ 138.877643] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information
[ 138.921906] sd 7:0:0:0: [sdb] Sense Key : No Sense [current]
[ 138.921923] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information
....

After the fix, dmesg returns below information:
....
usb 5-1: new high speed USB device using ehci_hcd and address 5
usb 5-1: configuration #1 chosen from 1 choice
scsi7 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 5
usb-storage: waiting for device to settle before scanning
usb-storage: device scan complete
scsi 7:0:0:0: Direct-Access HTS54808 0M9AT00 MG4O PQ: 0 ANSI: 0
sd 7:0:0:0: [sdb] 156301488 512-byte hardware sectors (80026 MB)
sd 7:0:0:0: [sdb] Write Protect is off
sd 7:0:0:0: [sdb] Mode Sense: 03 00 00 00
sd 7:0:0:0: [sdb] Assuming drive cache: write through
sd 7:0:0:0: [sdb] 156301488 512-byte hardware sectors (80026 MB)
sd 7:0:0:0: [sdb] Write Protect is off
sd 7:0:0:0: [sdb] Mode Sense: 03 00 00 00
sd 7:0:0:0: [sdb] Assuming drive cache: write through
sdb: sdb1
sd 7:0:0:0: [sdb] Attached SCSI disk
sd 7:0:0:0: Attached scsi generic sg1 type 0
kjournald starting. Commit interval 5 seconds
EXT3 FS on sdb1, internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.

Cc: Kuniyasu Suzaki <[email protected]>
Signed-off-by: Nguyen Anh Quynh <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1320,6 +1320,13 @@ UNUSUAL_DEV( 0x0840, 0x0082, 0x0001, 0x0
US_SC_DEVICE, US_PR_DEVICE, NULL,
US_FL_FIX_CAPACITY),

+/* Reported and patched by Nguyen Anh Quynh <[email protected]> */
+UNUSUAL_DEV( 0x0840, 0x0084, 0x0001, 0x0001,
+ "Argosy",
+ "Storage",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY),
+
/* Entry and supporting patch by Theodore Kilgore <[email protected]>.
* Flag will support Bulk devices which use a standards-violating 32-byte
* Command Block Wrapper. Here, the "DC2MEGA" cameras (several brands) with

2009-01-15 20:49:50

by Greg KH

[permalink] [raw]
Subject: [patch 79/94] USB: storage: extend unusual range for 067b:3507

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Oliver Neukum <[email protected]>

commit b16363991414a6025beb7269f9c1dd294f9b241f upstream.

This device has been released in a new revision which is still buggy.

Signed-off-by: Oliver Neukum <[email protected]>
Signed-off-by: Phil Dibowitz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1040,7 +1040,7 @@ UNUSUAL_DEV( 0x067b, 0x2507, 0x0100, 0x0
US_FL_FIX_CAPACITY | US_FL_GO_SLOW ),

/* Reported by Alex Butcher <[email protected]> */
-UNUSUAL_DEV( 0x067b, 0x3507, 0x0001, 0x0001,
+UNUSUAL_DEV( 0x067b, 0x3507, 0x0001, 0x0101,
"Prolific Technology Inc.",
"ATAPI-6 Bridge Controller",
US_SC_DEVICE, US_PR_DEVICE, NULL,

2009-01-15 20:50:12

by Greg KH

[permalink] [raw]
Subject: [patch 80/94] USB: storage: recognizing and enabling Nokia 5200 cell phoes

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Paulo Afonso Graner Fessel <[email protected]>

commit b8d23491f127aa0cd1863bd6cb58e771c558b762 upstream.

This patch corrects the issue when one connects a Nokia 5200 cell
phone in data storage mode. If one uses an unpatched unusual_devs.h,
the following messages appear on /var/log/messages:

Dec 12 01:03:24 alberich kernel: usb 4-2: new full speed USB device
using uhci_hcd and address 3
Dec 12 01:03:25 alberich kernel: usb 4-2: configuration #1 chosen from 1 choice
Dec 12 01:03:25 alberich kernel: scsi10 : SCSI emulation for USB Mass
Storage devices
Dec 12 01:03:25 alberich kernel: usb 4-2: New USB device found,
idVendor=0421, idProduct=04bd
Dec 12 01:03:25 alberich kernel: usb 4-2: New USB device strings:
Mfr=1, Product=2, SerialNumber=3
Dec 12 01:03:25 alberich kernel: usb 4-2: Product: Nokia 5200
Dec 12 01:03:25 alberich kernel: usb 4-2: Manufacturer: Nokia
Dec 12 01:03:25 alberich kernel: usb 4-2: SerialNumber: 353930018354523
Dec 12 01:03:25 alberich kernel: usbcore: registered new interface driver ub
Dec 12 01:03:30 alberich kernel: scsi 10:0:0:0: Direct-Access
Nokia Nokia 5200 0000 PQ: 0 AN
SI: 4
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] 3985409 512-byte
hardware sectors (2041 MB)
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Write Protect is off
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Assuming drive
cache: write through
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] 3985409 512-byte
hardware sectors (2041 MB)
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Write Protect is off
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Assuming drive
cache: write through
Dec 12 01:03:30 alberich kernel: sdg: sdg1
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Attached SCSI removable disk
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: Attached scsi generic sg9 type 0
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No
Sense [current]
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Add. Sense: No
additional sense information
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No
Sense [current]
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Add. Sense: No
additional sense information
Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No
Sense [current]

(...)

The MicroSD card in the phone remains inaccessible and finally the
cell phone turns itself off. The patch solves this problem and makes
the cell phone fully accessible:

[root@alberich kernel-linus-2.6.27.5-1mdv]# df -h
Sist. Arq. Tam Usad Disp Uso% Montado em
/dev/sda6 31G 5,2G 26G 17% /
/dev/sda1 92M 27M 61M 31% /boot
/dev/mapper/homevg-homelv 240G 237G 3,5G 99% /home
/dev/sda3 21G 7,9G 13G 40% /mnt/windows
/dev/sdg1 2,0G 287M 1,7G 15% /media/disk <--------

I've found necessary to use the FL_US_CAPACITY_FIX switch, as without
it the cell phone is recognized but it went berserk when performing
low-level functions on it (a fdisk -l /dev/uba for example).

lsusb -v output follows:

Bus 004 Device 004: ID 0421:04bd Nokia Mobile Phones
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0421 Nokia Mobile Phones
idProduct 0x04bd
bcdDevice 6.03
iManufacturer 1 Nokia
iProduct 2 Nokia 5200
iSerial 3 353930018354523
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0001
Self Powered

Signed-off-by: Paulo Afonso Graner Fessel <[email protected]>
Signed-off-by: Phil Dibowitz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -260,6 +260,13 @@ UNUSUAL_DEV( 0x0421, 0x04b9, 0x0500, 0x
US_SC_DEVICE, US_PR_DEVICE, NULL,
US_FL_FIX_CAPACITY ),

+/* Reported by Paulo Fessel <[email protected]> */
+UNUSUAL_DEV( 0x0421, 0x04bd, 0x0000, 0x9999,
+ "Nokia",
+ "5200",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
/* Reported by Richard Nauber <[email protected]> */
UNUSUAL_DEV( 0x0421, 0x04fa, 0x0550, 0x0660,
"Nokia",

2009-01-15 20:50:45

by Greg KH

[permalink] [raw]
Subject: [patch 81/94] HID: fix error condition propagation in hid-sony driver

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jiri Kosina <[email protected]>

commit 4dfdc46468a142216b284eea66040f49df3f7191 upstream.

sony_set_operational() only propagates return value from
usb_control_msg(), which returns negative on error and number
of transferred bytes otherwise.

Reported-by: Marcin Tolysz <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/hid/hid-sony.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -102,7 +102,7 @@ static int sony_probe(struct hid_device
}

ret = sony_set_operational(hdev);
- if (ret)
+ if (ret < 0)
goto err_stop;

return 0;

2009-01-15 20:51:23

by Greg KH

[permalink] [raw]
Subject: [patch 82/94] fix switch_names() breakage in short-to-short case

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Al Viro <[email protected]>

commit dc711ca35f9d95a1eec02118e0c298b5e3068315 upstream.

We want ->name.len to match the resulting name on *both*
source and target

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/dcache.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1620,8 +1620,11 @@ static void switch_names(struct dentry *
*/
memcpy(dentry->d_iname, target->d_name.name,
target->d_name.len + 1);
+ dentry->d_name.len = target->d_name.len;
+ return;
}
}
+ do_switch(dentry->d_name.len, target->d_name.len);
}

/*
@@ -1681,7 +1684,6 @@ already_unhashed:

/* Switch the names.. */
switch_names(dentry, target);
- do_switch(dentry->d_name.len, target->d_name.len);
do_switch(dentry->d_name.hash, target->d_name.hash);

/* ... and switch the parents */
@@ -1791,7 +1793,6 @@ static void __d_materialise_dentry(struc
struct dentry *dparent, *aparent;

switch_names(dentry, anon);
- do_switch(dentry->d_name.len, anon->d_name.len);
do_switch(dentry->d_name.hash, anon->d_name.hash);

dparent = dentry->d_parent;

2009-01-15 20:51:46

by Greg KH

[permalink] [raw]
Subject: [patch 83/94] nfs: remove redundant tests on reading new pages

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Wu Fengguang <[email protected]>

commit 136221fc3219b3805c48db5da065e8e3467175d4 upstream.

aops->readpages() and its NFS helper readpage_async_filler() will only
be called to do readahead I/O for newly allocated pages. So it's not
necessary to test for the always 0 dirty/uptodate page flags.

The removal of nfs_wb_page() call also fixes a readahead bug: the NFS
readahead has been synchronous since 2.6.23, because that call will
clear PG_readahead, which is the reminder for asynchronous readahead.

More background: the PG_readahead page flag is shared with PG_reclaim,
one for read path and the other for write path. clear_page_dirty_for_io()
unconditionally clears PG_readahead to prevent possible readahead residuals,
assuming itself to be always called in the write path. However, NFS is one
and the only exception in that it _always_ calls clear_page_dirty_for_io()
in the read path, i.e. for readpages()/readpage().

Cc: Trond Myklebust <[email protected]>
Signed-off-by: Wu Fengguang <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/nfs/read.c | 6 ------
1 file changed, 6 deletions(-)

--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -533,12 +533,6 @@ readpage_async_filler(void *data, struct
unsigned int len;
int error;

- error = nfs_wb_page(inode, page);
- if (error)
- goto out_unlock;
- if (PageUptodate(page))
- goto out_unlock;
-
len = nfs_page_length(page);
if (len == 0)
return nfs_return_empty_page(page);

2009-01-15 20:52:23

by Greg KH

[permalink] [raw]
Subject: [patch 84/94] eCryptfs: check readlink result was not an error before using it

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Duane Griffin <[email protected]>

commit a17d5232de7b53d34229de79ec22f4bb04adb7e4 upstream.

The result from readlink is being used to index into the link name
buffer without checking whether it is a valid length. If readlink
returns an error this will fault or cause memory corruption.

Cc: Tyler Hicks <[email protected]>
Cc: Dustin Kirkland <[email protected]>
Cc: [email protected]
Signed-off-by: Duane Griffin <[email protected]>
Acked-by: Michael Halcrow <[email protected]>
Acked-by: Tyler Hicks <[email protected]>
Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/ecryptfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct
ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
"dentry->d_name.name = [%s]\n", dentry->d_name.name);
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
- buf[rc] = '\0';
set_fs(old_fs);
if (rc < 0)
goto out_free;
+ else
+ buf[rc] = '\0';
rc = 0;
nd_set_link(nd, buf);
goto out;

2009-01-15 20:52:48

by Greg KH

[permalink] [raw]
Subject: [patch 85/94] [SCSI] mvsas: increase port type detection delay to suit Seagates 10k6 drive ST3450856SS 0003

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Reinhard Nissl <[email protected]>

commit ddccf307a3599e452804e228d8ed30fba578923e upstream.

I increased the delay step by step until loading of mvsas
reliably detected the drive 200 times in sequence. A much better
approach would be to monitor the hardware for some flag which
indicates that port detection has finished, but I do not have any
hardware documentation.

Signed-off-by: Reinhard Nissl <[email protected]>
Cc: Ke Wei <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/scsi/mvsas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/mvsas.c
+++ b/drivers/scsi/mvsas.c
@@ -2959,7 +2959,7 @@ static int __devinit mvs_hw_init(struct

/* enable auto port detection */
mw32(GBL_PORT_TYPE, MODE_AUTO_DET_EN);
- msleep(100);
+ msleep(1100);
/* init and reset phys */
for (i = 0; i < mvi->chip->n_phy; i++) {
u32 lo = be32_to_cpu(*(u32 *)&mvi->sas_addr[4]);

2009-01-15 20:53:23

by Greg KH

[permalink] [raw]
Subject: [patch 86/94] x86: avoid theoretical vmalloc fault loop

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Andi Kleen <[email protected]>

commit f313e12308f7c5ea645f18e759d104d088b18615 upstream.

Ajith Kumar noticed:

I was going through the vmalloc fault handling for x86_64 and am unclear
about the following lines in the vmalloc_fault() function.

pgd = pgd_offset(current->mm ?: &init_mm, address);
pgd_ref = pgd_offset_k(address);

Here the intention is to get the pgd corresponding to the current process
and sync it up with the pgd in init_mm(obtained from pgd_offset_k).
However, for kernel threads current->mm is NULL and hence pgd =
pgd_offset(init_mm, address) = pgd_ref which means the fault handler
returns without setting the pgd entry in the MM structure in the context
of which the kernel thread has faulted. This could lead to never-ending
faults and busy looping of kernel threads like pdflush. So, shouldn't the
pgd = pgd_offset(current->mm ?: &init_mm, address); be pgd =
pgd_offset(current->active_mm ?: &init_mm, address);

We can use active_mm unconditionally because it should be always set.

Signed-off-by: Andi Kleen <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/x86/mm/fault.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -533,7 +533,7 @@ static int vmalloc_fault(unsigned long a
happen within a race in page table update. In the later
case just flush. */

- pgd = pgd_offset(current->mm ?: &init_mm, address);
+ pgd = pgd_offset(current->active_mm, address);
pgd_ref = pgd_offset_k(address);
if (pgd_none(*pgd_ref))
return -1;

2009-01-15 20:53:52

by Greg KH

[permalink] [raw]
Subject: [patch 87/94] ath9k: enable RXing of beacons on STA/IBSS

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit ffb826767bffda61426d964a8fc24a216a14b0bd upstream.

This enables beacons to come through on STA/IBSS.
It should fix sporadic connection issues. Right now
mac80211 expect beacons so give it beacons.

Signed-off-by: Luis R. Rodriguez <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/ath9k/recv.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -627,9 +627,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
rfilt &= ~ATH9K_RX_FILTER_UCAST;
}

- if (((sc->sc_ah->ah_opmode == ATH9K_M_STA) &&
- (sc->rx_filter & FIF_BCN_PRBRESP_PROMISC)) ||
- (sc->sc_ah->ah_opmode == ATH9K_M_IBSS))
+ if (sc->sc_ah->ah_opmode == ATH9K_M_STA ||
+ sc->sc_ah->ah_opmode == ATH9K_M_IBSS)
rfilt |= ATH9K_RX_FILTER_BEACON;

/* If in HOSTAP mode, want to enable reception of PSPOLL frames

2009-01-15 20:54:27

by Greg KH

[permalink] [raw]
Subject: [patch 88/94] mm lockless pagecache barrier fix

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nick Piggin <[email protected]>

commit e8c82c2e23e3527e0c9dc195e432c16784d270fa upstream.

An XFS workload showed up a bug in the lockless pagecache patch. Basically it
would go into an "infinite" loop, although it would sometimes be able to break
out of the loop! The reason is a missing compiler barrier in the "increment
reference count unless it was zero" case of the lockless pagecache protocol in
the gang lookup functions.

This would cause the compiler to use a cached value of struct page pointer to
retry the operation with, rather than reload it. So the page might have been
removed from pagecache and freed (refcount==0) but the lookup would not correctly
notice the page is no longer in pagecache, and keep attempting to increment the
refcount and failing, until the page gets reallocated for something else. This
isn't a data corruption because the condition will be detected if the page has
been reallocated. However it can result in a lockup.

Linus points out that ACCESS_ONCE is also required in that pointer load, even
if it's absence is not causing a bug on our particular build. The most general
way to solve this is just to put an rcu_dereference in radix_tree_deref_slot.

Assembly of find_get_pages,
before:
.L220:
movq (%rbx), %rax #* ivtmp.1162, tmp82
movq (%rax), %rdi #, prephitmp.1149
.L218:
testb $1, %dil #, prephitmp.1149
jne .L217 #,
testq %rdi, %rdi # prephitmp.1149
je .L203 #,
cmpq $-1, %rdi #, prephitmp.1149
je .L217 #,
movl 8(%rdi), %esi # <variable>._count.counter, c
testl %esi, %esi # c
je .L218 #,

after:
.L212:
movq (%rbx), %rax #* ivtmp.1109, tmp81
movq (%rax), %rdi #, ret
testb $1, %dil #, ret
jne .L211 #,
testq %rdi, %rdi # ret
je .L197 #,
cmpq $-1, %rdi #, ret
je .L211 #,
movl 8(%rdi), %esi # <variable>._count.counter, c
testl %esi, %esi # c
je .L212 #,

(notice the obvious infinite loop in the first example, if page->count remains 0)

Signed-off-by: Nick Piggin <[email protected]>
Reviewed-by: Paul E. McKenney <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/linux/radix-tree.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -136,7 +136,7 @@ do { \
*/
static inline void *radix_tree_deref_slot(void **pslot)
{
- void *ret = *pslot;
+ void *ret = rcu_dereference(*pslot);
if (unlikely(radix_tree_is_indirect_ptr(ret)))
ret = RADIX_TREE_RETRY;
return ret;

2009-01-15 20:54:46

by Greg KH

[permalink] [raw]
Subject: [patch 89/94] powerpc: Disable Collaborative Memory Manager for kdump

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Brian King <[email protected]>

commit 2218108e182fd8a6d9106077833ed7ad05fc8e75 upstream.

When running Active Memory Sharing, the Collaborative Memory Manager
(CMM) may mark some pages as "loaned" with the hypervisor.
Periodically, the CMM will query the hypervisor for a loan request,
which is a single signed value. When kexec'ing into a kdump kernel,
the CMM driver in the kdump kernel is not aware of the pages the
previous kernel had marked as "loaned", so the hypervisor and the CMM
driver are out of sync. This results in the CMM driver getting a
negative loan request, which can then get treated as a large unsigned
value and can cause kdump to hang due to the CMM driver inflating too
large. Since there really is no clean way for the CMM driver in the
kdump kernel to clean this up, simply disable CMM in the kdump kernel.
This fixes hangs we were seeing doing kdump with AMS.

Signed-off-by: Brian King <[email protected]>
Signed-off-by: Paul Mackerras <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/powerpc/platforms/pseries/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -54,7 +54,7 @@ config PPC_SMLPAR

config CMM
tristate "Collaborative memory management"
- depends on PPC_SMLPAR
+ depends on PPC_SMLPAR && !CRASH_DUMP
default y
help
Select this option, if you want to enable the kernel interface

2009-01-15 20:55:14

by Greg KH

[permalink] [raw]
Subject: [patch 90/94] [SCSI] ibmvfc: Delay NPIV login retry and add retries

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Brian King <[email protected]>

commit 1c41fa8288277e76785acb50f52bb2f39509f903 upstream.

Adds a delay prior to retrying a failed NPIV login. This fixes
a scenario if the backing fibre channel adapter is getting reset
due to an EEH event, NPIV login will fail. Currently, ibmvfc
retries three times very quickly, resets the CRQ and tries one
more time. If the adapter is getting reset due to EEH, this isn't
enough time. This adds a delay prior to retrying a failed NPIV
login and also increments the number of retries.

Signed-off-by: Brian King <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/scsi/ibmvscsi/ibmvfc.c | 17 ++++++++++++-----
drivers/scsi/ibmvscsi/ibmvfc.h | 4 +++-
2 files changed, 15 insertions(+), 6 deletions(-)

--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -566,7 +566,7 @@ static void ibmvfc_init_host(struct ibmv
struct ibmvfc_target *tgt;

if (vhost->action == IBMVFC_HOST_ACTION_INIT_WAIT) {
- if (++vhost->init_retries > IBMVFC_MAX_INIT_RETRIES) {
+ if (++vhost->init_retries > IBMVFC_MAX_HOST_INIT_RETRIES) {
dev_err(vhost->dev,
"Host initialization retries exceeded. Taking adapter offline\n");
ibmvfc_link_down(vhost, IBMVFC_HOST_OFFLINE);
@@ -847,11 +847,12 @@ static void ibmvfc_reset_host(struct ibm
static void ibmvfc_retry_host_init(struct ibmvfc_host *vhost)
{
if (vhost->action == IBMVFC_HOST_ACTION_INIT_WAIT) {
- if (++vhost->init_retries > IBMVFC_MAX_INIT_RETRIES) {
+ vhost->delay_init = 1;
+ if (++vhost->init_retries > IBMVFC_MAX_HOST_INIT_RETRIES) {
dev_err(vhost->dev,
"Host initialization retries exceeded. Taking adapter offline\n");
ibmvfc_link_down(vhost, IBMVFC_HOST_OFFLINE);
- } else if (vhost->init_retries == IBMVFC_MAX_INIT_RETRIES)
+ } else if (vhost->init_retries == IBMVFC_MAX_HOST_INIT_RETRIES)
__ibmvfc_reset_host(vhost);
else
ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT);
@@ -2669,7 +2670,7 @@ static void ibmvfc_init_tgt(struct ibmvf
static void ibmvfc_retry_tgt_init(struct ibmvfc_target *tgt,
void (*job_step) (struct ibmvfc_target *))
{
- if (++tgt->init_retries > IBMVFC_MAX_INIT_RETRIES) {
+ if (++tgt->init_retries > IBMVFC_MAX_TGT_INIT_RETRIES) {
ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT);
wake_up(&tgt->vhost->work_wait_q);
} else
@@ -3519,7 +3520,13 @@ static void ibmvfc_do_work(struct ibmvfc
break;
case IBMVFC_HOST_ACTION_INIT:
BUG_ON(vhost->state != IBMVFC_INITIALIZING);
- vhost->job_step(vhost);
+ if (vhost->delay_init) {
+ vhost->delay_init = 0;
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ ssleep(5);
+ return;
+ } else
+ vhost->job_step(vhost);
break;
case IBMVFC_HOST_ACTION_QUERY:
list_for_each_entry(tgt, &vhost->targets, queue)
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -43,7 +43,8 @@
#define IBMVFC_MAX_DISC_THREADS 4
#define IBMVFC_TGT_MEMPOOL_SZ 64
#define IBMVFC_MAX_CMDS_PER_LUN 64
-#define IBMVFC_MAX_INIT_RETRIES 3
+#define IBMVFC_MAX_HOST_INIT_RETRIES 6
+#define IBMVFC_MAX_TGT_INIT_RETRIES 3
#define IBMVFC_DEV_LOSS_TMO (5 * 60)
#define IBMVFC_DEFAULT_LOG_LEVEL 2
#define IBMVFC_MAX_CDB_LEN 16
@@ -671,6 +672,7 @@ struct ibmvfc_host {
int discovery_threads;
int client_migrated;
int reinit;
+ int delay_init;
int events_to_log;
#define IBMVFC_AE_LINKUP 0x0001
#define IBMVFC_AE_LINKDOWN 0x0002

2009-01-15 20:55:47

by Greg KH

[permalink] [raw]
Subject: [patch 91/94] [SCSI] ibmvfc: Improve async event handling

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Brian King <[email protected]>

commit d2131b33c7e07c2905ee2f2321cc4dae1928c483 upstream.

While doing various error injection testing, such as cable
pulls and target moves, some issues were observed in handling
these events. This patch improves the way these events are handled
by increasing the delay waiting for the fabric to settle and also
changes the behavior of Link Up to break the CRQ to ensure everything
gets cleaned up properly on the VIOS.

Signed-off-by: Brian King <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/scsi/ibmvscsi/ibmvfc.c | 10 ++++++----
drivers/scsi/ibmvscsi/ibmvfc.h | 2 +-
2 files changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -2090,15 +2090,17 @@ static void ibmvfc_handle_async(struct i
case IBMVFC_AE_LINK_UP:
case IBMVFC_AE_RESUME:
vhost->events_to_log |= IBMVFC_AE_LINKUP;
- ibmvfc_init_host(vhost, 1);
+ vhost->delay_init = 1;
+ __ibmvfc_reset_host(vhost);
break;
case IBMVFC_AE_SCN_FABRIC:
+ case IBMVFC_AE_SCN_DOMAIN:
vhost->events_to_log |= IBMVFC_AE_RSCN;
- ibmvfc_init_host(vhost, 1);
+ vhost->delay_init = 1;
+ __ibmvfc_reset_host(vhost);
break;
case IBMVFC_AE_SCN_NPORT:
case IBMVFC_AE_SCN_GROUP:
- case IBMVFC_AE_SCN_DOMAIN:
vhost->events_to_log |= IBMVFC_AE_RSCN;
case IBMVFC_AE_ELS_LOGO:
case IBMVFC_AE_ELS_PRLO:
@@ -3523,7 +3525,7 @@ static void ibmvfc_do_work(struct ibmvfc
if (vhost->delay_init) {
vhost->delay_init = 0;
spin_unlock_irqrestore(vhost->host->host_lock, flags);
- ssleep(5);
+ ssleep(15);
return;
} else
vhost->job_step(vhost);
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -33,7 +33,7 @@
#define IBMVFC_DRIVER_DATE "(August 14, 2008)"

#define IBMVFC_DEFAULT_TIMEOUT 15
-#define IBMVFC_INIT_TIMEOUT 30
+#define IBMVFC_INIT_TIMEOUT 120
#define IBMVFC_MAX_REQUESTS_DEFAULT 100

#define IBMVFC_DEBUG 0

2009-01-15 20:56:16

by Greg KH

[permalink] [raw]
Subject: [patch 93/94] ath5k: ignore the return value of ath5k_hw_noise_floor_calibration

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Felix Fietkau <[email protected]>

commit 8b0162a3dc5c30e862b7a73da29e32de3170f5e4 upstream.

Noise floor calibration occasionally fails on Atheros hardware.
This is not fatal and can happen if there's simply too much
noise on the air. Ignoring the calibration error is the right
thing to do here, because when the error is ignored, the hardware
will still work, whereas if the error causes the driver to bail out
of a bigger configuration function and does not configure the tx
queues or the IMR (as is the case in reset.c), the hw no longer
works properly until the next reset.

Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Cc: Bob Copeland <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/ath5k/phy.c | 4 +---
drivers/net/wireless/ath5k/reset.c | 4 +---
2 files changed, 2 insertions(+), 6 deletions(-)

--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -2195,9 +2195,7 @@ static int ath5k_hw_rf5110_calibrate(str
return ret;
}

- ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
- if (ret)
- return ret;
+ ath5k_hw_noise_floor_calibration(ah, channel->center_freq);

/*
* Re-enable RX/TX and beacons
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -842,9 +842,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
*
* XXX: Find an interval that's OK for all cards...
*/
- ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
- if (ret)
- return ret;
+ ath5k_hw_noise_floor_calibration(ah, channel->center_freq);

/*
* Reset queues and start beacon timers at the end of the reset routine

2009-01-15 20:56:42

by Greg KH

[permalink] [raw]
Subject: [patch 92/94] getrusage: RUSAGE_THREAD should return ru_utime and ru_stime

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: KOSAKI Motohiro <[email protected]>

commit 8916edef5888c5d8fe283714416a9ca95b4c3431 upstream.

Impact: task stats regression fix

Original getrusage(RUSAGE_THREAD) implementation can return ru_utime and
ru_stime. But commit "f06febc: timers: fix itimer/many thread hang" broke it.

this patch restores it.

Signed-off-by: KOSAKI Motohiro <[email protected]>
Acked-by: Roland McGrath <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
kernel/sys.c | 2 ++
1 file changed, 2 insertions(+)

--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1553,6 +1553,8 @@ static void k_getrusage(struct task_stru
utime = stime = cputime_zero;

if (who == RUSAGE_THREAD) {
+ utime = task_utime(current);
+ stime = task_stime(current);
accumulate_thread_rusage(p, r);
goto out;
}

2009-01-15 20:57:11

by Greg KH

[permalink] [raw]
Subject: [patch 94/94] mm: fix assertion

2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nick Piggin <[email protected]>

commit 18e6959c385f3edf3991fa6662a53dac4eb10d5b upstream.

This assertion is incorrect for lockless pagecache. By definition if we
have an unpinned page that we are trying to take a speculative reference
to, it may become the tail of a compound page at any time (if it is
freed, then reallocated as a compound page).

It was still a valid assertion for the vmscan.c LRU isolation case, but
it doesn't seem incredibly helpful... if somebody wants it, they can
put it back directly where it applies in the vmscan code.

Signed-off-by: Nick Piggin <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/linux/mm.h | 1 -
1 file changed, 1 deletion(-)

--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -253,7 +253,6 @@ static inline int put_page_testzero(stru
*/
static inline int get_page_unless_zero(struct page *page)
{
- VM_BUG_ON(PageTail(page));
return atomic_inc_not_zero(&page->_count);
}

2009-01-15 21:12:12

by Greg KH

[permalink] [raw]
Subject: [patch 95/94] XFS: truncate readdir offsets to signed 32 bit values

2.6.28-stable review patch. If anyone has any objections, please let us know.

---------------------

From: Christoph Hellwig <[email protected]>

commit 15440319767942a363f282d6585303d3d75088ba upstream.

John Stanley reported EOVERFLOW errors in readdir from his self-build
glibc. I traced this down to glibc enabling d_off overflow checks
in one of the about five million different getdents implementations.

In 2.6.28 Dave Woodhouse moved our readdir double buffering required
for NFS4 readdirplus into nfsd and at that point we lost the capping
of the directory offsets to 32 bit signed values. Johns glibc used
getdents64 to even implement readdir for normal 32 bit offset dirents,
and failed with EOVERFLOW only if this happens on the first dirent in
a getdents call. I managed to come up with a testcase that uses
raw getdents and does the EOVERFLOW check manually. We always hit
it with our last entry due to the special end of directory marker.

The patch below is a dumb version of just putting back the masking,
to make sure we have the same behavior as in 2.6.27 and earlier.

I will work on a better and cleaner fix for 2.6.30.

Reported-by: John Stanley <[email protected]>
Tested-by: John Stanley <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
Reviewed-by: Dave Chinner <[email protected]>
Signed-off-by: Lachlan McIlroy <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/xfs/xfs_dir2_block.c | 7 ++++---
fs/xfs/xfs_dir2_leaf.c | 6 +++---
fs/xfs/xfs_dir2_sf.c | 15 ++++++++-------
3 files changed, 15 insertions(+), 13 deletions(-)

--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -517,9 +517,9 @@ xfs_dir2_block_getdents(
/*
* If it didn't fit, set the final offset to here & return.
*/
- if (filldir(dirent, dep->name, dep->namelen, cook,
+ if (filldir(dirent, dep->name, dep->namelen, cook & 0x7fffffff,
ino, DT_UNKNOWN)) {
- *offset = cook;
+ *offset = cook & 0x7fffffff;
xfs_da_brelse(NULL, bp);
return 0;
}
@@ -529,7 +529,8 @@ xfs_dir2_block_getdents(
* Reached the end of the block.
* Set the offset to a non-existent block 1 and return.
*/
- *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0);
+ *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0) &
+ 0x7fffffff;
xfs_da_brelse(NULL, bp);
return 0;
}
--- a/fs/xfs/xfs_dir2_leaf.c
+++ b/fs/xfs/xfs_dir2_leaf.c
@@ -1092,7 +1092,7 @@ xfs_dir2_leaf_getdents(
* Won't fit. Return to caller.
*/
if (filldir(dirent, dep->name, dep->namelen,
- xfs_dir2_byte_to_dataptr(mp, curoff),
+ xfs_dir2_byte_to_dataptr(mp, curoff) & 0x7fffffff,
ino, DT_UNKNOWN))
break;

@@ -1108,9 +1108,9 @@ xfs_dir2_leaf_getdents(
* All done. Set output offset value to current offset.
*/
if (curoff > xfs_dir2_dataptr_to_byte(mp, XFS_DIR2_MAX_DATAPTR))
- *offset = XFS_DIR2_MAX_DATAPTR;
+ *offset = XFS_DIR2_MAX_DATAPTR & 0x7fffffff;
else
- *offset = xfs_dir2_byte_to_dataptr(mp, curoff);
+ *offset = xfs_dir2_byte_to_dataptr(mp, curoff) & 0x7fffffff;
kmem_free(map);
if (bp)
xfs_da_brelse(NULL, bp);
--- a/fs/xfs/xfs_dir2_sf.c
+++ b/fs/xfs/xfs_dir2_sf.c
@@ -752,8 +752,8 @@ xfs_dir2_sf_getdents(
#if XFS_BIG_INUMS
ino += mp->m_inoadd;
#endif
- if (filldir(dirent, ".", 1, dot_offset, ino, DT_DIR)) {
- *offset = dot_offset;
+ if (filldir(dirent, ".", 1, dot_offset & 0x7fffffff, ino, DT_DIR)) {
+ *offset = dot_offset & 0x7fffffff;
return 0;
}
}
@@ -766,8 +766,8 @@ xfs_dir2_sf_getdents(
#if XFS_BIG_INUMS
ino += mp->m_inoadd;
#endif
- if (filldir(dirent, "..", 2, dotdot_offset, ino, DT_DIR)) {
- *offset = dotdot_offset;
+ if (filldir(dirent, "..", 2, dotdot_offset & 0x7fffffff, ino, DT_DIR)) {
+ *offset = dotdot_offset & 0x7fffffff;
return 0;
}
}
@@ -791,14 +791,15 @@ xfs_dir2_sf_getdents(
#endif

if (filldir(dirent, sfep->name, sfep->namelen,
- off, ino, DT_UNKNOWN)) {
- *offset = off;
+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
+ *offset = off & 0x7fffffff;
return 0;
}
sfep = xfs_dir2_sf_nextentry(sfp, sfep);
}

- *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0);
+ *offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk + 1, 0) &
+ 0x7fffffff;
return 0;
}

2009-01-15 21:12:38

by Greg KH

[permalink] [raw]
Subject: Re: [patch 00/94] 2.6.28.1 stable review

On Thu, Jan 15, 2009 at 11:55:20AM -0800, Greg KH wrote:
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.28.1-rc1.gz
> and the diffstat can be found below.

With the addition of the extra xfs patch, a new 2.6.28.1-rc2 patch is
now available at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.28.1-rc2.gz

The changed diffstat is below.

thanks,

greg k-h


Makefile | 2 +-
arch/Kconfig | 3 +
arch/alpha/kernel/entry.S | 8 +-
arch/alpha/kernel/systbls.S | 2 +-
arch/arm/kernel/calls.S | 2 +-
arch/cris/arch-v10/kernel/entry.S | 2 +-
arch/cris/arch-v32/kernel/entry.S | 2 +-
arch/h8300/kernel/syscalls.S | 2 +-
arch/ia64/ia32/ia32_entry.S | 2 +-
arch/ia64/include/asm/unistd.h | 2 +-
arch/ia64/kernel/entry.S | 2 +-
arch/ia64/kernel/sys_ia64.c | 2 +-
arch/m68k/kernel/entry.S | 2 +-
arch/m68knommu/kernel/syscalltable.S | 2 +-
arch/mips/kernel/scall32-o32.S | 2 +-
arch/mn10300/kernel/entry.S | 2 +-
arch/powerpc/Kconfig | 1 +
arch/powerpc/include/asm/systbl.h | 2 +-
arch/powerpc/platforms/pseries/Kconfig | 2 +-
arch/s390/Kconfig | 1 +
arch/s390/kernel/compat_wrapper.S | 4 +-
arch/s390/kernel/entry.h | 16 ++--
arch/s390/kernel/process.c | 9 +-
arch/s390/kernel/signal.c | 19 ++--
arch/s390/kernel/sys_s390.c | 35 ++++---
arch/s390/kernel/syscalls.S | 12 +-
arch/sh/include/asm/syscalls_32.h | 6 +-
arch/sh/kernel/sys_sh32.c | 2 +-
arch/sh/kernel/syscalls_32.S | 4 +-
arch/sh/kernel/syscalls_64.S | 2 +-
arch/sparc/kernel/entry.S | 4 +-
arch/sparc/kernel/systbls.S | 4 +-
arch/sparc64/kernel/syscalls.S | 2 +-
arch/sparc64/kernel/systbls.S | 4 +-
arch/x86/Kconfig | 2 +-
arch/x86/kernel/cpu/addon_cpuid_features.c | 8 ++
arch/x86/kernel/cpu/intel.c | 8 +-
arch/x86/kernel/head64.c | 2 +-
arch/x86/kernel/head_64.S | 2 +-
arch/x86/kernel/syscall_table_32.S | 2 +-
arch/x86/kernel/tlb_uv.c | 9 --
arch/x86/mm/fault.c | 2 +-
drivers/dma/ioat_dma.c | 13 +-
drivers/hid/hid-sony.c | 2 +-
drivers/ide/tx4938ide.c | 4 +-
drivers/ide/tx4939ide.c | 10 ++-
drivers/md/bitmap.c | 8 +-
drivers/md/dm-log.c | 5 +
drivers/md/dm-raid1.c | 6 +-
drivers/net/wireless/ath5k/phy.c | 4 +-
drivers/net/wireless/ath5k/reset.c | 4 +-
drivers/net/wireless/ath9k/recv.c | 5 +-
drivers/net/wireless/iwlwifi/iwl-agn.c | 12 +--
drivers/net/wireless/iwlwifi/iwl-rx.c | 29 +++--
drivers/pci/syscall.c | 12 +--
drivers/scsi/eata.c | 15 ++-
drivers/scsi/ibmvscsi/ibmvfc.c | 25 +++--
drivers/scsi/ibmvscsi/ibmvfc.h | 6 +-
drivers/scsi/mvsas.c | 2 +-
drivers/scsi/pcmcia/aha152x_stub.c | 2 +-
drivers/usb/host/isp1760-if.c | 113 +++++++++++--------
drivers/usb/misc/emi26.c | 2 +-
drivers/usb/storage/unusual_devs.h | 23 ++++-
fs/affs/file.c | 2 +-
fs/afs/write.c | 2 +-
fs/aio.c | 22 ++--
fs/buffer.c | 6 +-
fs/cifs/cifs_dfs_ref.c | 48 ++++++--
fs/cifs/file.c | 2 +-
fs/compat.c | 6 +-
fs/dcache.c | 7 +-
fs/dcookies.c | 10 ++-
fs/ecryptfs/inode.c | 3 +-
fs/ecryptfs/mmap.c | 2 +-
fs/eventfd.c | 5 +-
fs/eventpoll.c | 18 ++--
fs/exec.c | 2 +-
fs/ext3/inode.c | 2 +-
fs/ext3/namei.c | 3 +-
fs/ext4/inode.c | 4 +-
fs/ext4/namei.c | 3 +-
fs/fcntl.c | 11 +-
fs/filesystems.c | 2 +-
fs/fuse/file.c | 4 +-
fs/gfs2/ops_address.c | 2 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/inotify_user.c | 9 +-
fs/ioctl.c | 2 +-
fs/ioprio.c | 5 +-
fs/jffs2/file.c | 2 +-
fs/libfs.c | 2 +-
fs/locks.c | 2 +-
fs/minix/dir.c | 2 +-
fs/namei.c | 48 ++++----
fs/namespace.c | 13 +-
fs/nfs/file.c | 2 +-
fs/nfs/read.c | 6 -
fs/nfsctl.c | 4 +-
fs/open.c | 82 ++++++++------
fs/pipe.c | 4 +-
fs/quota.c | 3 +-
fs/read_write.c | 49 ++++++---
fs/readdir.c | 9 +-
fs/reiserfs/inode.c | 2 +-
fs/select.c | 29 +++---
fs/signalfd.c | 8 +-
fs/smbfs/file.c | 2 +-
fs/splice.c | 12 +-
fs/stat.c | 38 ++++---
fs/super.c | 2 +-
fs/sync.c | 32 ++++-
fs/timerfd.c | 10 +-
fs/ubifs/file.c | 9 +-
fs/utimes.c | 11 +-
fs/xattr.c | 53 ++++-----
fs/xfs/xfs_dir2_block.c | 7 +-
fs/xfs/xfs_dir2_leaf.c | 6 +-
fs/xfs/xfs_dir2_sf.c | 15 ++-
include/linux/compat.h | 13 ++
include/linux/fs.h | 5 +-
include/linux/mm.h | 1 -
include/linux/pagemap.h | 3 +-
include/linux/radix-tree.h | 2 +-
include/linux/syscalls.h | 171 +++++++++++++++++++---------
include/linux/time.h | 1 +
ipc/mqueue.c | 28 +++---
ipc/msg.c | 12 +-
ipc/sem.c | 18 ++-
ipc/shm.c | 8 +-
kernel/acct.c | 2 +-
kernel/capability.c | 4 +-
kernel/cgroup.c | 6 +-
kernel/exec_domain.c | 3 +-
kernel/exit.c | 17 ++--
kernel/fork.c | 4 +-
kernel/futex.c | 17 ++--
kernel/hrtimer.c | 4 +-
kernel/itimer.c | 7 +-
kernel/kexec.c | 5 +-
kernel/module.c | 10 +-
kernel/posix-timers.c | 43 +++----
kernel/printk.c | 7 +-
kernel/ptrace.c | 2 +-
kernel/sched.c | 30 +++---
kernel/sched_clock.c | 5 +-
kernel/signal.c | 59 ++++------
kernel/sys.c | 72 ++++++------
kernel/sys_ni.c | 1 +
kernel/sysctl.c | 4 +-
kernel/time.c | 14 +-
kernel/time/timekeeping.c | 7 +-
kernel/timer.c | 18 ++--
kernel/trace/ring_buffer.c | 19 +++-
kernel/uid16.c | 39 ++++---
mm/fadvise.c | 18 +++-
mm/filemap.c | 22 +++-
mm/fremap.c | 4 +-
mm/madvise.c | 2 +-
mm/mempolicy.c | 24 ++--
mm/migrate.c | 8 +-
mm/mincore.c | 4 +-
mm/mlock.c | 8 +-
mm/mmap.c | 4 +-
mm/mprotect.c | 4 +-
mm/mremap.c | 6 +-
mm/msync.c | 2 +-
mm/nommu.c | 10 +-
mm/swapfile.c | 4 +-
mm/vmalloc.c | 5 +-
net/socket.c | 63 +++++-----
security/device_cgroup.c | 3 +
security/keys/keyctl.c | 22 ++--
sound/pci/hda/patch_analog.c | 5 +-
sound/pci/hda/patch_sigmatel.c | 2 +
sound/usb/caiaq/caiaq-device.h | 1 +
sound/usb/caiaq/caiaq-midi.c | 32 +++---
176 files changed, 1182 insertions(+), 885 deletions(-)

2009-01-15 21:15:38

by Greg KH

[permalink] [raw]
Subject: Re: [patch 00/94] 2.6.28.1 stable review

On Thu, Jan 15, 2009 at 09:59:59PM +0100, Stefan Lippers-Hollmann wrote:
> Hi
>
> On thursday january 15th, 2009 Greg KH wrote:
> > This is the start of the stable review cycle for the 2.6.28.1 release.
> > There are 94 patches in this series, all will be posted as a response to
> > this one. If anyone has any issues with these being applied, please let
> > us know. If anyone is a maintainer of the proper subsystem, and wants
> > to add a Signed-off-by: line to the patch, please respond with it.
>
> Please consider adding the following patch, referring to
> http://bugzilla.kernel.org/show_bug.cgi?id=12301
>
> commit 2caf7fcdb8532045680f06b67b9e63f0c9613aaa
> Author: Alan Stern <[email protected]>
> Date: Wed Dec 31 11:31:33 2008 -0500

<snip>

Alan said he would provide a backported version of this patch for .28
after it went into Linus's tree, as this version will not apply
properly.

Alan, care to come up with something?

thanks,

greg k-h

2009-01-15 21:20:04

by Alan Stern

[permalink] [raw]
Subject: Re: [patch 00/94] 2.6.28.1 stable review

On Thu, 15 Jan 2009, Stefan Lippers-Hollmann wrote:

> Please consider adding the following patch, referring to
> http://bugzilla.kernel.org/show_bug.cgi?id=12301
>
> commit 2caf7fcdb8532045680f06b67b9e63f0c9613aaa
> Author: Alan Stern <[email protected]>
> Date: Wed Dec 31 11:31:33 2008 -0500
>
> USB: re-enable interface after driver unbinds
>
> This patch (as1197) fixes an error introduced recently. Since a
> significant number of devices can't handle Set-Interface requests, we
> no longer call usb_set_interface() when a driver unbinds from an
> interface, provided the interface is already in altsetting 0. However
> the interface still does get disabled, and the call to
> usb_set_interface() was the only thing re-enabling it. Since the
> interface doesn't get re-enabled, further attempts to use it fail.
>
> So the patch adds a call to usb_enable_interface() when a driver
> unbinds and the interface is in altsetting 0. For this to work
> right, the interface's endpoints have to be re-enabled but their
> toggles have to be left alone. Therefore an additional argument is
> added to usb_enable_endpoint() and usb_enable_interface(), a flag
> indicating whether or not the endpoint toggles should be reset.
>
> This is a forward-ported version of a patch which fixes Bugzilla
> #12301.
>
> Signed-off-by: Alan Stern <[email protected]>
> Reported-by: David Roka <[email protected]>
> Reported-by: Erik Ekman <[email protected]>
> Tested-by: Erik Ekman <[email protected]>
> Tested-by: Alon Bar-Lev <[email protected]>
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
>
> This patch seems to fix other USB related issues in 2.6.28 as well, for
> example:
> - random failures to boot from usb-storage (sometimes it works, sometimes
> it's slower to detect the rootfs, sometimes it fails alltogether)
> - problems to detect USB scanners (Epson snapscan (3490), invoking xsane
> the first time fails to detect the scanner, the second time the scanner
> warms up, but fails to get detected by xsane, the third time it finally
> works - sometimes it works directly).
> - issues to connect a ZyDAS zd1211rw based USB wlan stick through wpa2psk
> with wpasupplicant.
>
> Adding this patch (slightly backported to 2.6.28) seems to fix these issues
> reliably. Rediff/ backport below, tested under the circumstances above and
> hopefully correct.

It turns out that this patch isn't sufficient. Additional changes are
needed, as posted here:

http://marc.info/?l=linux-usb&m=123196296431175&w=2

In principle these two patches should be combined into a single one.
Unfortunately the new patch has not yet even been submitted for
mainline, let alone accepted, so it can't go into a stable kernel.

Alan Stern

2009-01-15 21:26:34

by Alan Stern

[permalink] [raw]
Subject: Re: [patch 00/94] 2.6.28.1 stable review

On Thu, 15 Jan 2009, Greg KH wrote:

> On Thu, Jan 15, 2009 at 09:59:59PM +0100, Stefan Lippers-Hollmann wrote:
> > Hi
> >
> > On thursday january 15th, 2009 Greg KH wrote:
> > > This is the start of the stable review cycle for the 2.6.28.1 release.
> > > There are 94 patches in this series, all will be posted as a response to
> > > this one. If anyone has any issues with these being applied, please let
> > > us know. If anyone is a maintainer of the proper subsystem, and wants
> > > to add a Signed-off-by: line to the patch, please respond with it.
> >
> > Please consider adding the following patch, referring to
> > http://bugzilla.kernel.org/show_bug.cgi?id=12301
> >
> > commit 2caf7fcdb8532045680f06b67b9e63f0c9613aaa
> > Author: Alan Stern <[email protected]>
> > Date: Wed Dec 31 11:31:33 2008 -0500
>
> <snip>
>
> Alan said he would provide a backported version of this patch for .28
> after it went into Linus's tree, as this version will not apply
> properly.
>
> Alan, care to come up with something?

Apart from the formatting options used with "diff", my backported
version is identical with the one Stefan posted. However there remains
the question of how to handle the additional changes needed for the
disable_endpoint pathways.

Maybe it would be best to submit this patch for 2.6.28.stable now and
submit the second patch after it gets into the mainline.

Alan Stern

2009-01-15 21:29:18

by Greg KH

[permalink] [raw]
Subject: Re: [patch 00/94] 2.6.28.1 stable review

On Thu, Jan 15, 2009 at 04:19:49PM -0500, Alan Stern wrote:
> On Thu, 15 Jan 2009, Stefan Lippers-Hollmann wrote:
>
> > Please consider adding the following patch, referring to
> > http://bugzilla.kernel.org/show_bug.cgi?id=12301
> >
> > commit 2caf7fcdb8532045680f06b67b9e63f0c9613aaa
> > Author: Alan Stern <[email protected]>
> > Date: Wed Dec 31 11:31:33 2008 -0500
> >
> > USB: re-enable interface after driver unbinds
> >
> > This patch (as1197) fixes an error introduced recently. Since a
> > significant number of devices can't handle Set-Interface requests, we
> > no longer call usb_set_interface() when a driver unbinds from an
> > interface, provided the interface is already in altsetting 0. However
> > the interface still does get disabled, and the call to
> > usb_set_interface() was the only thing re-enabling it. Since the
> > interface doesn't get re-enabled, further attempts to use it fail.
> >
> > So the patch adds a call to usb_enable_interface() when a driver
> > unbinds and the interface is in altsetting 0. For this to work
> > right, the interface's endpoints have to be re-enabled but their
> > toggles have to be left alone. Therefore an additional argument is
> > added to usb_enable_endpoint() and usb_enable_interface(), a flag
> > indicating whether or not the endpoint toggles should be reset.
> >
> > This is a forward-ported version of a patch which fixes Bugzilla
> > #12301.
> >
> > Signed-off-by: Alan Stern <[email protected]>
> > Reported-by: David Roka <[email protected]>
> > Reported-by: Erik Ekman <[email protected]>
> > Tested-by: Erik Ekman <[email protected]>
> > Tested-by: Alon Bar-Lev <[email protected]>
> > Signed-off-by: Greg Kroah-Hartman <[email protected]>
> >
> > This patch seems to fix other USB related issues in 2.6.28 as well, for
> > example:
> > - random failures to boot from usb-storage (sometimes it works, sometimes
> > it's slower to detect the rootfs, sometimes it fails alltogether)
> > - problems to detect USB scanners (Epson snapscan (3490), invoking xsane
> > the first time fails to detect the scanner, the second time the scanner
> > warms up, but fails to get detected by xsane, the third time it finally
> > works - sometimes it works directly).
> > - issues to connect a ZyDAS zd1211rw based USB wlan stick through wpa2psk
> > with wpasupplicant.
> >
> > Adding this patch (slightly backported to 2.6.28) seems to fix these issues
> > reliably. Rediff/ backport below, tested under the circumstances above and
> > hopefully correct.
>
> It turns out that this patch isn't sufficient. Additional changes are
> needed, as posted here:
>
> http://marc.info/?l=linux-usb&m=123196296431175&w=2
>
> In principle these two patches should be combined into a single one.
> Unfortunately the new patch has not yet even been submitted for
> mainline, let alone accepted, so it can't go into a stable kernel.

Ah, ok, sorry about that. I need to flush out a .27-stable update next,
and then I can start to tackle my pending USB queue...

thanks,

greg k-h

2009-01-16 11:00:40

by Pavel Machek

[permalink] [raw]
Subject: Re: [patch 42/94] [PATCH 11/44] [CVE-2009-0029] System call wrappers part 01


> 2.6.28-stable review patch. If anyone has any objections, please let us know.
>
> ------------------
>
> From: Heiko Carstens <[email protected]>
>
> commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream.
>
> Signed-off-by: Heiko Carstens <[email protected]>
> Signed-off-by: Greg Kroah-Hartman <[email protected]>

That does not make review exactly easy. Would it be possible to
inline upstream comment in the commit message?

...upstream commit message is empty :-(.

> -asmlinkage long
> -sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
> +SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
> + struct timespec __user *, rmtp)
> {
> struct timespec tu;
>

Is it strictly neccessary to modify all the syscalls?

Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

2009-01-16 11:25:48

by Heiko Carstens

[permalink] [raw]
Subject: Re: [patch 42/94] [PATCH 11/44] [CVE-2009-0029] System call wrappers part 01

On Fri, Jan 16, 2009 at 12:00:29PM +0100, Pavel Machek wrote:
>
> > 2.6.28-stable review patch. If anyone has any objections, please let us know.
> >
> > ------------------
> >
> > From: Heiko Carstens <[email protected]>
> >
> > commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream.
> >
> > Signed-off-by: Heiko Carstens <[email protected]>
> > Signed-off-by: Greg Kroah-Hartman <[email protected]>
>
> That does not make review exactly easy. Would it be possible to
> inline upstream comment in the commit message?
>
> ...upstream commit message is empty :-(.

Yes, what should it contain anyway?
"This converts the first 10 system calls to the system call wrapper
infrastructure"? IMHO the subject says enough.

> > -asmlinkage long
> > -sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
> > +SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
> > + struct timespec __user *, rmtp)
> > {
> > struct timespec tu;
> >
>
> Is it strictly neccessary to modify all the syscalls?

Not strictly necessary, but much easier to maintain in the long term.
It's simply a just convert 'em all approach and never think again about
this.

Plus the ugliness of the 64 bit parameter special case handling makes it
unlikely that we will ever have again a discussion how a new system call
should pass an loff_t.

2009-01-16 14:41:19

by Pavel Machek

[permalink] [raw]
Subject: Re: [patch 42/94] [PATCH 11/44] [CVE-2009-0029] System call wrappers part 01

On Fri 2009-01-16 12:24:35, Heiko Carstens wrote:
> On Fri, Jan 16, 2009 at 12:00:29PM +0100, Pavel Machek wrote:
> >
> > > 2.6.28-stable review patch. If anyone has any objections, please let us know.
> > >
> > > ------------------
> > >
> > > From: Heiko Carstens <[email protected]>
> > >
> > > commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream.
> > >
> > > Signed-off-by: Heiko Carstens <[email protected]>
> > > Signed-off-by: Greg Kroah-Hartman <[email protected]>
> >
> > That does not make review exactly easy. Would it be possible to
> > inline upstream comment in the commit message?
> >
> > ...upstream commit message is empty :-(.
>
> Yes, what should it contain anyway?
> "This converts the first 10 system calls to the system call wrapper
> infrastructure"? IMHO the subject says enough.

"This converts the first 10 system calls to the system call wrapper
infrastructure. This is neccessary because of <description of security
hole>. It is good idea to convert all syscalls and not only affected
ones for uniformity."

....at the very least.

> > > -asmlinkage long
> > > -sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
> > > +SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
> > > + struct timespec __user *, rmtp)
> > > {
> > > struct timespec tu;
> > >
> >
> > Is it strictly neccessary to modify all the syscalls?
>
> Not strictly necessary, but much easier to maintain in the long term.
> It's simply a just convert 'em all approach and never think again about
> this.

I believe we should go for minimal patch for -stable. This is really
huge.

> Plus the ugliness of the 64 bit parameter special case handling makes it
> unlikely that we will ever have again a discussion how a new system call
> should pass an loff_t.

Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

2009-01-16 15:25:10

by Greg KH

[permalink] [raw]
Subject: Re: [stable] [patch 42/94] [PATCH 11/44] [CVE-2009-0029] System call wrappers part 01

On Fri, Jan 16, 2009 at 03:43:04PM +0100, Pavel Machek wrote:
> On Fri 2009-01-16 12:24:35, Heiko Carstens wrote:
> > On Fri, Jan 16, 2009 at 12:00:29PM +0100, Pavel Machek wrote:
> > >
> > > > 2.6.28-stable review patch. If anyone has any objections, please let us know.
> > > >
> > > > ------------------
> > > >
> > > > From: Heiko Carstens <[email protected]>
> > > >
> > > > commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream.
> > > >
> > > > Signed-off-by: Heiko Carstens <[email protected]>
> > > > Signed-off-by: Greg Kroah-Hartman <[email protected]>
> > >
> > > That does not make review exactly easy. Would it be possible to
> > > inline upstream comment in the commit message?
> > >
> > > ...upstream commit message is empty :-(.
> >
> > Yes, what should it contain anyway?
> > "This converts the first 10 system calls to the system call wrapper
> > infrastructure"? IMHO the subject says enough.
>
> "This converts the first 10 system calls to the system call wrapper
> infrastructure. This is neccessary because of <description of security
> hole>. It is good idea to convert all syscalls and not only affected
> ones for uniformity."
>
> ....at the very least.
>
> > > > -asmlinkage long
> > > > -sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
> > > > +SYSCALL_DEFINE2(nanosleep, struct timespec __user *, rqtp,
> > > > + struct timespec __user *, rmtp)
> > > > {
> > > > struct timespec tu;
> > > >
> > >
> > > Is it strictly neccessary to modify all the syscalls?
> >
> > Not strictly necessary, but much easier to maintain in the long term.
> > It's simply a just convert 'em all approach and never think again about
> > this.
>
> I believe we should go for minimal patch for -stable. This is really
> huge.

Well, it's spread over 44 patches, but the end result is not that much.
And yes, based on the problem, it is required for -stable.

thanks,

greg k-h