This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.
The original patch was by Guillaume Autran, who in turn based it on the
same mechanism implemented in the 'visor' driver. I (Ian Abbott)
re-targeted the patch to the latest sources, fixed a couple of errors,
renamed his new structure members, and updated the implementations of
the 'write_room' and 'chars_in_buffer' methods to take account of the
number of outstanding 'write' bytes. It seems to work fine, though at
low baud rates it is still possible to queue up an amount of data that
takes an age to shift (a job for another day!).
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The anti user-DoS mechanism in the USB serial 'visor' driver can fail in
the following way:
visor_open: priv->outstanding_urbs = 0
visor_write: ++priv->outstanding_urbs
visor_close:
visor_open: priv->outstanding_urbs = 0
visor_write_bulk_callback: --priv->outstanding_urbs
So priv->outstanding_urbs ends up as (unsigned long)(-1). Not good!
I haven't seen this happen with the visor driver as I don't have the
hardware, but I have seen it while testing a patch to implement the same
functionality in the ftdi_sio driver (patch not yet submitted).
The fix is pretty simple: don't reinitialize outstanding_urbs in
visor_open. (Again, I haven't tested the fix in visor, but I have
tested it in ftdi_sio.)
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds the kernel version to the usb-storage Protocol/SubClass
unneeded message in order to help us troubleshoot such problems.
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds a US_FL_MAX_SECTORS_64 and removes the Genesys special-cases
for this that were in scsiglue.c. It also adds the flag to other devices
reported to need it.
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as731) makes a couple of small fixes to the hub_port_resume
routine:
Don't return status >= 0 when an error occurs;
Clear the port-change-suspend status indicator after
resuming a device.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as730) contains an unusual_devs entry for a Samsung MP3
device.
From: Ernis <ernisv@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as725) adds an unusual_devs entry for the Motorola RAZR V3x.
From: Davide Perini <perini.davide@dpsoftware.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
finish_device_resume() in the hub driver isn't careful always to return
a negative code in all the error pathways. It also doesn't return 0 in
all the success pathways. This patch (as724) fixes the behavior.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
My recent patch converting usb-storage to use
usb_reset_composite_device() added a bug, a race between reset and
disconnect. It was necessary to drop the private lock while executing a
reset, and if a disconnect occurs at that time it will cause a crash.
This patch (as722) fixes the problem by explicitly checking for an early
termination after executing each command.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
this adds
better debugging output &
an update of the quirk list
to the acm driver
Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a new driver for the Cypress CY7C63xxx mirco controller series.
It currently supports the pre-programmed CYC63001A-PC by AK Modul-Bus
GmbH. It's based on a kernel 2.4 driver (cyport) by Marcus Maul which I
ported to kernel 2.6 using sysfs. I intend to support more controllers
of this family (and more features) as soon as I get hold of the required
IDs etc. Please see the source code's header for more information.
Signed-off-by: Oliver Bock <o.bock@fh-wolfenbuettel.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usbfs stores the wrong signal number in the siginfo structure used for
notifying user programs about device disconnect. This patch (as726)
fixes it.
From: Zoran Marceta <Zoran.Marceta@micronasnit.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Susteen Datapilot cable
(http://www.susteen.com/productdetail/71/producthl/Notempty) has an
internal pl2303 to communicate with a set of dummy connector-ends that
connect to a variety of cell phones. I've found that it works right out
of the box by simply adding the product/vendor id to the pl2303 driver.
Signed-off-by: Matt Meno <mmeno@idealcorp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds basic Wireless USB 1.0 definitions to usb_ch9.h that
fit into the existing set of declarations. Boils down to two new
recipients for requests (ports and remote pipes), rpipe reset and
abort request codes and wire adapter and remote pipe descriptor
types.
Wire adapters are the USB <-> Wireless USB adaptors; remote pipes
are used by those adapters to pipe the host <-> endpoint traffic.
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes blatant leaks in visor driver and makes it report
mode sensible things in ->write_room (this is only needed if your visor
is a terminal though).
It is made to fit into 80 columns with a temporary variable.
Might even save a few instructions...
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fix addresses two issues:
- Unattached port structures were not freed
- My initial fix for crash when eventd runs a work in a freed port
did not go far enough
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I noticed this while debugging something unrelated on
sparc64.
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Text from the back of the box, for your information/amusement:
USB DATA CABLE
FOR K700 Series
The USB Cable is an ideal link between your mobile phone and PC. Employing
the user-friendiy [sic] USB standard,its capacity for rapid data transfer enables functions
such as synchronization of phone book and calendar,as well as Internet browsing via
a modem-enabled phone.Autual [sic] connection speed is dependent on phone capacity.
MADE IN CHINA
From: Peter Moulder <Peter.Moulder@infotech.monash.edu.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Warning(/var/linsrc/linux-2617-g4//include/linux/usb.h:66): No description found for parameter 'ep_dev'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds OHCI glue bits for the USB host interface in the
Cirrus ep93xx (arm920t) CPU.
Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Acked-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I received an DBAU1200 eval kit from AMD a few days ago and tried to
enable the USB2 port, but the current linux-2.6 GIT did not even
compile with CONFIG_SOC_1200, CONFIG_SOC_AU1X00, CONFIG_USB_EHCI and
CONFIG_USB_OHCI set.
Furthermore, in ehci-hcd.c, platform_driver_register() was called with
an improper argument of type 'struct device_driver *' which of course
ended up in a kernel oops. How could that ever have worked on your
machines?
Anyway, here's a trivial patch that makes the USB subsystem working
on my board for both OHCI and EHCI.
It also removes the /* FIXME use "struct platform_driver" */.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Acked-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Compile fixes for au1200 ohci.
First part looks a bit hackish... but it works for me.
Signed-off-by: Domen Puncer <domen.puncer@ultra.si>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Prior to 2.6.18rc1 you could install with devices on a JMicron chipset
using the "all-generic-ide" option. As of this kernel the AHCI driver
grabs the controller and rams it into AHCI mode losing the PATA ports
and making CD drives and the like vanish. The all-generic-ide option
fails because the AHCI driver grabbed the PCI device and reconfigured
it.
To fix this three things are needed.
#1 We must put the chip into dual function mode
#2 The AHCI driver must grab only function 0 (already in your rc1 tree)
#3 Something must grab the PATA ports
The attached patch is the minimal risk edition of this. It puts the chip
into dual function mode so that AHCI will grab the SATA ports without
losing the PATA ports. To keep the risk as low as possible the third
patch adds the PCI identifiers for the PATA port and the FN check to the
ide-generic driver. There is a more featured jmicron driver on its way
but that adds risk and the ide-generic support is sufficient to install
and run a system.
The actual chip setup done by the quirk is the precise setup recommended
by the vendor.
(The JMB368 appears only in the ide-generic entry as it has no AHCI so
does not need the quirk)
Signed-off-by: Alan Cox <alan@redhat.com>
Acked-by: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
During the recent discussion of taking 'volatile' off of the spinlock, I
noticed that while most arches #define cpu_relax() such that it implies
barrier(), some arches define cpu_relax() to be empty.
This patch changes the definition of cpu_relax() for frv, h8300, m68knommu,
sh, sh64, v850 and xtensa from an empty while(0) to the compiler barrier().
Signed-off-by: Chase Venters <chase.venters@clientec.com>
Acked-by: Arjan van de Ven <arjan@Linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Joseph Fannin reported that hpet_rtc_interrupt() enables hardirqs
in irq context:
[ 25.628000] [<c014af4e>] trace_hardirqs_on+0xce/0x200
[ 25.628000] [<c036cf21>] _spin_unlock_irq+0x31/0x70
[ 25.628000] [<c0296584>] rtc_get_rtc_time+0x44/0x1a0
[ 25.628000] [<c01198bb>] hpet_rtc_interrupt+0x21b/0x280
[ 25.628000] [<c0161141>] handle_IRQ_event+0x31/0x70
[ 25.628000] [<c0162d37>] handle_edge_irq+0xe7/0x210
[ 25.628000] [<c0106192>] do_IRQ+0x92/0x120
[ 25.628000] [<c0104121>] common_interrupt+0x25/0x2c
the call of rtc_get_rtc_time() is highly suspect. At a minimum we
need the patch below to save/restore hardirq state.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Joseph Fannin <jfannin@gmail.com>
Cc: John Stultz <johnstul@us.ibm.com>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
We're supposed to go the next power of two if nfds==nr.
Of `nr', not of `nfsd'.
Spotted by Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
It looks like someone confused kmem_cache_create with a different allocator
and was attempting to give it knowledge of how many cache entries there
were.
With the unfortunate result that each slab entry was big enough to hold
every irq.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Address a potential 'larger than buffer size' memory access by
clear_user(). Without this patch, this call to clear_user() can attempt to
clear too many (tsz) bytes resulting in a wrong (-EFAULT) return code by
read_kcore().
Signed-off-by: Adam B. Jerome <abj@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
sysfs has a different i_mutex lock order behavior for i_mutex than the
other filesystems; sysfs i_mutex is called in many places with subsystem
locks held. At the same time, many of the VFS locking rules do not apply
to sysfs at all (cross directory rename for example). To untangle this
mess (which gives false positives in lockdep), we're giving sysfs inodes
their own class for i_mutex.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
When found, it is obvious. nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.
Found due to OpenVZ resource management (User Beancounters).
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Based on a patch from Ernie Petrides
During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.
The prctl() system call should never allow to set "dumpable" to the
value 2. Especially not for non-privileged users.
This can be split into three cases:
1) running as root -- then core dumps will already be done as root,
and so prctl(PR_SET_DUMPABLE, 2) is not useful
2) running as non-root w/setuid-to-root -- this is the debatable case
3) running as non-root w/setuid-to-non-root -- then you definitely
do NOT want "dumpable" to get set to 2 because you have the
privilege escalation vulnerability
With case #2, the only potential usefulness is for a program that has
designed to run with higher privilege (than the user invoking it) that
wants to be able to create root-owned root-validated core dumps. This
might be useful as a debugging aid, but would only be safe if the program
had done a chdir() to a safe directory.
There is no benefit to a production setuid-to-root utility, because it
shouldn't be dumping core in the first place. If this is true, then the
same debugging aid could also be accomplished with the "suid_dumpable"
sysctl.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
'devices' is not a good name for a global variable.
Thankfully, it can become static.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fixed the missing array terminators in AD1988 codec support code.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix a occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fixed 'section mismatch' errors in ALSA PCI drivers:
- removed invalid __devinitdata from pci id tables
- fix/remove __devinit of functions called in suspend/resume
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Drop the snd_minor structure's name field that was just a helper for
devfs device deregistration.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
The wavefront driver used __init in some places referenced by __devinit
functions.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix the driver string name for Terratec Aureon 7.1 Universe
to fit in 15 letters to avoid the overflow.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:
<-- snip -->
...
LD vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1
<-- snip -->
This patch fixes kernel Bugzilla #6458.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
if one of the first three CS_CHECKS fails, we goto cs_failed:
In this case parse we donr kfree() parse. Since the the last three
CS_CHECKS might also fail, i moved the kfree() below all the CS_CHECKs
and added one in the error path. This fixes coverity bug id #1099
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
