| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
|
|
|
|
The maple mouse driver currently in mainline is broken:
bash-3.1# modprobe maplemouse
[ 56.886378] input: Dreamcast Mouse as /devices/virtual/input/input3
[ 56.918379] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[ 56.930543] pc = c003304e
[ 56.934973] *pde = 00000000
[ 56.944948] Oops: 0000 [#1]
[ 56.947867] Modules linked in: maplemouse(+)
[ 56.952353]
[ 56.953921] Pid : 1157, Comm: \0x09\0x09modprobe
[ 56.958021] CPU : 0 \0x09\0x09Not tainted (2.6.30-rc2-00130-g3e98f9f #1)
[ 56.958052]
[ 56.966567] PC is at dc_mouse_open+0xe/0x40 [maplemouse]
[ 56.972125] PR is at input_open_device+0x8a/0xc0
[ 56.976944] PC : c003304e SP : 8c88bdcc SR : 40008100 TEA : c0033834
[ 56.983854] R0 : 000006c4 R1 : 00000000 R2 : 40008101 R3 : 00000000
[ 56.990744] R4 : 8c8db800 R5 : c0033080 R6 : 00000005 R7 : 00000200
[ 56.997635] R8 : 8c8db800 R9 : 8c8dbe3c R10 : 00000000 R11 : 8c98881c
[ 57.004525] R12 : 8c8dbe64 R13 : 8ca50140 R14 : 8c88bdd4
[ 57.010063] MACH: 00000497 MACL: 00000348 GBR : 29674440 PR : 8c1b4d0a
[ 57.016939]
...
Here is a fix for this, keeping an open and close, so reducing
the load on the system when the mouse is not in use, and also properly
referencing the maple device buffer following the recent update.
Signed-off-by: Adrian McMenamin <adrian@mcmen.demon.co.uk>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
|
|
Fix the problem that cannot work 29-bit mode when use sh7785lcr_defconfig.
Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Paul Mundt <lethal@linux-sh.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: David Howells <dhowells@redhat.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Roman Zippel <zippel@linux-m68k.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Hirokazu Takata <takata@linux-m32r.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: David Howells <dhowells@redhat.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This has the consequence of changing the section name use for head
code from ".text.head" to ".head.text". Since this commit changes all
users in the architecture, this change should be harmless.
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Richard Henderson <rth@twiddle.net>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Cc: Chris Zankel <chris@zankel.net>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
This patch is preparation for replacing all uses of ".head.text" or
".text.head" in the kernel with macros, so that the section name can
later be changed without having to touch a lot of the kernel.
Since some linker scripts do more complex things than referencing
HEAD_TEXT, we add a HEAD_TEXT_SECTION macro that just contains the
actual name.
I've defined HEAD_TEXT_SECTION in a new header,
include/linux/section-names.h, so that this section name only needs to
appear in one place. I anticipate creating similar macro structures
for a number of other section names.
The long-term goal here is to be able to change the kernel's magic
section names to those that are compatible with -ffunction-sections
-fdata-sections. This requires renaming all magic sections with names
of the form ".text.foo".
Signed-off-by: Tim Abbott <tabbott@mit.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Commit c751085943362143f84346d274e0011419c84202 ("PM/Hibernate: Wait for
SCSI devices scan to complete during resume") added a call to
scsi_complete_async_scans() to software_resume(), so that it waited for
the SCSI scanning to complete, but the call was added at a wrong place.
Namely, it should have been added after wait_for_device_probe(), which
is called only if the image partition hasn't been specified yet. Also,
it's reasonable to check if the image partition is present and only wait
for the device probing and SCSI scanning to complete if it is not the
case.
Additionally, since noresume is checked right at the beginning of
software_resume() and the function returns immediately if it's set, it
doesn't make sense to check it once again later.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
RomFS should advance the destination buffer pointer when reading data from a
blockdev source (the data may be split over multiple blocks, each requiring its
own sb_read() call). Without this, all the data is copied to the beginning of
the output buffer.
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Michal Simek <monstr@monstr.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
romfs_lookup() should be using a routine akin to strcmp() on the backing store,
rather than one akin to strncmp(). If it uses the latter, it's liable to match
/bin/shutdown when looking up /bin/sh.
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Michal Simek <monstr@monstr.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Currently, although find_last_bit is EXPORTed, it is statically linked
with the kernel and is referenced only under CONFIG_SMP.
When CONFIG_SMP is undefined and find_last_bit is referenced only by
modules, linking fails with:
ERROR: "find_last_bit" [fs/nfs/nfs.ko] undefined!
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Fred Isaman <iisaman@citi.umich.edu>
Signed-off-by: Benny Halevy <bhalevy@panasas.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Adjust the CacheFiles documentation to use the correct names of the credential
pointers in task_struct.
The documentation was using names from the old versions of the credentials
patches.
Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The virtio-rng drivers checks for spurious callbacks. Since
callbacks can be implemented via shared interrupts (e.g. PCI) this
could lead to guest kernel oopses with lots of virtio devices.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
* 'fixes-for-linus' of git://git.monstr.eu/linux-2.6-microblaze:
microblaze: add parameter to microblaze_read()
microblaze: Use CFLAGS_KERNEL instead of CFLAGS
microblaze: Add STATE_SAVE_ARG_SPACE for noMMU kernel too
microblaze: Do not check use_dcache
microblaze: Do not use PVR configuration for broken MB version
microblaze: Fix USR1/2 pvr printing message
microblaze: iowrite upon timeout
microblaze: Correspond CONFIG...PCMP in Makefile/Kconfig
microblaze: Remove redundant variable
microblaze: Move start_thread to process.c
microblaze: Add missing preadv and pwritev syscalls
microblaze: Add missing declaration for die and _exception func
microblaze: Remove sparse error in traps.c
microblaze: Move task_pt_regs up
microblaze: Rename kernel_mode to pt_mode in pt_regs
microblaze: Remove uncache shadow condition
microblaze: Remove while(1) loop from show_regs function
microblaze: Remove unneded per cpu SYSCALL_SAVE variable
|
|
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: (34 commits)
ACPI, i915: Register ACPI video even when not modesetting
Revert "ACPICA: delete check for AML access to port 0x81-83"
I/O port protection: update for windows compatibility.
sony-laptop: always try to unblock rfkill on load
sony-laptop: fix bogus error message display on resume
ACPI: EC: Fix ACPI EC resume non-query interrupt message
sony-laptop: SNC input event 38 fix
sony-laptop: SNC 127 Initialization Fix
sony-laptop: Duplicate SNC 127 Event Fix
ACPI: prevent processor.max_cstate=0 boot crash
ACPI/hpet: prevent boot hang when hpet=force used on ICH-4M
ACPI: delete obsolete "bus master activity" proc field
ACPI: idle: mark_tsc_unstable() at init-time, not run-time
ACPI: add /sys/firmware/acpi/interrupts/sci_not counter
ACPI video: fix an error when the brightness levels on AC and on Battery are same
acpi-cpufreq: Do not let get_measured perf depend on internal variable
acpi-cpufreq: style-only: add parens to math expression
acpi-cpufreq: Cleanup: Use printk_once
x86, acpi_cpufreq: Fix the NULL pointer dereference in get_measured_perf
thinkpad-acpi: bump up version to 0.23
...
|
|
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68knommu: update the default config for the ColdFire 5407C3 board
m68knommu: update the default config for the ColdFire 5307C3 board
m68knommu: update the default config for the ColdFire 5257EVB board
m68knommu: update the default config for the ColdFire 5249EVB.
m68knommu: add a defconfig for the ColdFire M5272C3 board
m68knommu: update the defconfig for the ColdFire 5208evb board
m68knommu: fix DMA support for ColdFire
m68knommu: remove unused kernel stats offsets
m68knommu: fix missing .data.cacheline_aligned section
m68knommu: Fixed GPIO pin initialization for CONFIG_M5271 FEC.
|
|
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
ext4: Fix potential inode allocation soft lockup in Orlov allocator
ext4: Make the extent validity check more paranoid
jbd: use SWRITE_SYNC_PLUG when writing synchronous revoke records
jbd2: use SWRITE_SYNC_PLUG when writing synchronous revoke records
ext4: really print the find_group_flex fallback warning only once
|
|
* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 5460/1: Orion: reduce namespace pollution
[ARM] 5458/1: pcmcia: pxa2xx-sharpsl: check if we do have Scoop config
[ARM] 5457/1: mach-imx gpio buildfix
[ARM] 5456/1: add sys_preadv and sys_pwritev
[ARM] pxa/pcm990: start external GPIOs immediately after built-in ones
[ARM] pxa/palm27x: General fix for Palm27x aSoC driver
[ARM] pxa/mioa701: use GPIO95 as AC97 reset line
[ARM] pxa: merge AC97 platform data structures
[ARM] pxa/magician: remove un-necessary #include of pxa-regs.h and hardware.h
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: pwc : do not pass stack allocated buffers to USB core.
USB: otg: Fix bug on remove path without transceiver
USB: correct error handling in cdc-wdm
USB: removal of tty->low_latency hack dating back to the old serial code
USB: serial: sierra driver bug fix for composite interface
USB: gadget: omap_udc uses platform_driver_probe()
USB: ci13xxx_udc: fix build error
USB: musb: Prevent multiple includes of musb.h
USB: pass mem_flags to dma_alloc_coherent
USB: g_file_storage: fix use-after-free bug when closing files
USB: ehci-sched.c: EHCI SITD scheduling bugfix
USB: fix mos7840 problem with minor numbers
USB: mos7840: add new device id
USB: musb: fix build when !CONFIG_PM
USB: musb: Remove my email address from few musb related drivers
USB: Gadget: MIPS CI13xxx UDC bugfixes
USB: Unusual Device support for Gold MP3 Player Energy
USB: serial: fix lifetime and locking problems
|
|
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
eCryptfs: Larger buffer for encrypted symlink targets
eCryptfs: Lock lower directory inode mutex during lookup
eCryptfs: Remove ecryptfs_unlink_sigs warnings
eCryptfs: Fix data corruption when using ecryptfs_passthrough
eCryptfs: Print FNEK sig properly in /proc/mounts
eCryptfs: NULL pointer dereference in ecryptfs_send_miscdev()
eCryptfs: Copy lower inode attrs before dentry instantiation
|
|
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
m68k: Update defconfigs for 2.6.30-rc3
m68k,m68knommu: Wire up preadv and pwritev
scsi: a4000 - Correct driver unregistration in case of failure
|
|
* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
[S390] update default configuration.
[S390] omit frame pointers on s390 when possible
[S390] Use tape_generic_offline directly.
[S390] /proc/stat idle field for idle cpus
[S390] appldata: avoid deadlock with appldata_mem
[S390] ipl: fix compile breakage
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
GFS2: Ensure that the inode goal block settings are updated
GFS2: Fix bug in block allocation
bitops: Add __ffs64 bitop
|
|
* 'kvm-updates/2.6.30' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: Unregister cpufreq notifier on unload
KVM: x86: release time_page on vcpu destruction
KVM: Fix overlapping check for memory slots
KVM: MMU: disable global page optimization
KVM: ia64: fix locking order entering guest
KVM: MMU: Fix off-by-one calculating large page count
|
|
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
MAINTAINERS: update IDE entry
palm_bk3710: palm_bk3710_udmatimings[] CodingStyle fixup
palm_bk3710: those registers/bitfields don't exist
mediabay: fix build for CONFIG_BLOCK=n
ide: Stop disks on reboot for laptop which cuts power
ide-cd: fix kernel crash on hppa regression
palm_bk3710: UDMA performance fix
|
|
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: hda - Add quirk for Packard Bell RS65
[ALSA] intel8x0: another attempt to fix ac97_clock measure routine
[ALSA] ac97_codec: increase timeout for analog subsections
ALSA: hda - Add quirks for Realtek codecs
ALSA: hda - Fix alc662_init_verbs
ALSA: keywest: Convert to new-style i2c driver
ALSA: AOA: Convert onyx and tas codecs to new-style i2c drivers
ALSA: Atiixp: Add SSID for mute_led quirk (unknown HP model)
ALSA: us122l: add snd_us122l_free()
ASoC: Fix warning in wm9705
ASoC: OMAP: Update contact addresses
ASoC: pxa-ssp: Don't use SSCR0_SerClkDiv and SSCR0_SCR
ALSA: us122l: Fix signedness in comparisions
|
|
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...
Found by Dan Carpenter using Smatch
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Remove my name and emailaddress from note in the source. Wincor Nixdorf
only has some ITE-chips on their mainboards, other chips are not
available for me for testing.
Signed-off-by: Niels de Vos <niels.devos@wincor-nixdorf.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Wrong types on IRQ handler
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
cfq-iosched: cache prio_tree root in cfqq->p_root
cfq-iosched: fix bug with aliased request and cooperation detection
cfq-iosched: clear ->prio_trees[] on cfqd alloc
block: fix intermittent dm timeout based oops
umem: fix request_queue lock warning
block: simplify I/O stat accounting
pktcdvd.h should include mempool.h
cfq-iosched: use the default seek distance when there aren't enough seek samples
cfq-iosched: make seek_mean converge more quickly
block: make blk_abort_queue() ignore non-request based devices
block: include empty disks in /proc/diskstats
bio: use bio_kmalloc() in copy/map functions
bio: fix bio_kmalloc()
block: fix queue bounce limit setting
block: fix SG_IO vector request data length handling
scatterlist: make sure sg_miter_next() doesn't return 0 sized mappings
|
|
Update the defconfig for the ASB2303 evaluation board.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Slow-work appears to delete its timer as soon as the first user
unregisters, even though other users could be active. At the same time, it
never seems to delete slow_work_oom_timer. Arrange for both to happen in
the shutdown path.
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (94 commits)
netfilter: ctnetlink: fix gcc warning during compilation
net/netrom: Fix socket locking
netlabel: Always remove the correct address selector
ucc_geth.c: Fix upsmr setting in RMII mode
8139too: fix HW initial flow
af_iucv: Fix race when queuing incoming iucv messages
af_iucv: Test additional sk states in iucv_sock_shutdown
af_iucv: Reject incoming msgs if RECV_SHUTDOWN is set
af_iucv: fix oops in iucv_sock_recvmsg() for MSG_PEEK flag
af_iucv: consider state IUCV_CLOSING when closing a socket
iwlwifi: DMA fixes
iwlwifi: add debugging for TX path
mwl8: fix build warning.
mac80211: fix alignment calculation bug
mac80211: do not print WARN if config interface
iwl3945: use cancel_delayed_work_sync to cancel rfkill_poll
iwlwifi: fix EEPROM validation mask to include OTP only devices
atmel: fix netdev ops conversion
pcnet_cs: add cis(firmware) of the Allied Telesis LA-PCM
mlx4_en: Fix cleanup if workqueue create in mlx4_en_add() fails
...
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
sparc: Fix bus type probing for ESP and LE devices.
sparc32: Update defconfig.
sparc64: Update defconfig.
|
|
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
powerpc: Fix modular build of ide-pmac when mediabay is built in
powerpc/pasemi: Fix build error on UP
powerpc: Make macintosh/mediabay driver depend on CONFIG_BLOCK
maintainers: Fix PS3 patterns
powerpc/ps3: Fix CONFIG_PS3_FLASH=n build warning
powerpc/32: Don't clobber personality flags on exec
powerpc: Fix crash on CPU hotplug
powerpc/85xx: Remove defconfigs that mpc85xx_{smp_}defconfig cover
powerpc/85xx: Added SMP defconfig
powerpc/85xx: Enabled a bunch of FSL specific drivers/options
powerpc/85xx: Updated generic mpc85xx_defconfig
powerpc: don't disable SATA interrupts on Freescale MPC8610 HPCD
fsl_rio: Pass the proper device to dma mapping routines
powerpc: Fix of_node_put() exit path in of_irq_map_one()
powerpc/5200: defconfig updates
powerpc/5200: Add FLASH nodes to lite5200 device tree
powerpc/device-tree: Document MTD nodes with multiple "reg" tuples
powerpc/of-device-tree: Factor MTD physmap bindings out of booting-without-of
powerpc/5200: Bring the legacy fsl_spi_platform_data hooks back
|
|
|
|
|
|
|
|
|
|
|
|
write_lock(¤t->fs->lock) guarantees we can't wrongly miss
LSM_UNSAFE_SHARE, this is what we care about. Use rcu_read_lock()
instead of ->siglock to iterate over the sub-threads. We must see
all CLONE_THREAD|CLONE_FS threads which didn't pass exit_fs(), it
takes fs->lock too.
With or without this patch we can miss the freshly cloned thread
and set LSM_UNSAFE_SHARE, we don't care.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@redhat.com>
[ Fixed lock/unlock typo - Hugh ]
Acked-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
If do_execve() fails after check_unsafe_exec(), it clears fs->in_exec
unconditionally. This is wrong if we race with our sub-thread which
also does do_execve:
Two threads T1 and T2 and another process P, all share the same
->fs.
T1 starts do_execve(BAD_FILE). It calls check_unsafe_exec(), since
->fs is shared, we set LSM_UNSAFE but not ->in_exec.
P exits and decrements fs->users.
T2 starts do_execve(), calls check_unsafe_exec(), now ->fs is not
shared, we set fs->in_exec.
T1 continues, open_exec(BAD_FILE) fails, we clear ->in_exec and
return to the user-space.
T1 does clone(CLONE_FS /* without CLONE_THREAD */).
T2 continues without LSM_UNSAFE_SHARE while ->fs is shared with
another process.
Change check_unsafe_exec() to return res = 1 if we set ->in_exec, and change
do_execve() to clear ->in_exec depending on res.
When do_execve() suceeds, it is safe to clear ->in_exec unconditionally.
It can be set only if we don't share ->fs with another process, and since
we already killed all sub-threads either ->in_exec == 0 or we are the
only user of this ->fs.
Also, we do not need fs->lock to clear fs->in_exec.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@redhat.com>
Acked-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
Paul Mundt
Adrian McMenamin
Yoshihiro Shimoda
Tim Abbott
Rafael J. Wysocki
David Howells
Fred Isaman
Marc Dionne
Christian Borntraeger
Linus Torvalds
Alan Cox
Niels de Vos
Jonathan Corbet
Len Brown
Oleg Nesterov