linux-stable.git/arch/arm/kernel, branch linux-2.6.33.y Linux kernel stable tree ARM: 6891/1: prevent heap corruption in OABI semtimedop 2011-05-09T23:04:44+00:00 Dan Rosenberg drosenberg@vsecurity.com 2011-04-29T14:48:07+00:00 41a832836d268172869e1ac965596b472dd13a92 commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream. When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not bound the nsops argument. A sufficiently large value will cause an integer overflow in allocation size, followed by copying too much data into the allocated buffer. Fix this by restricting nsops to SEMOPM. Untested. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.

When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument.  A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer.  Fix this by restricting nsops to SEMOPM.
Untested.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ARM: Ensure predictable endian state on signal handler entry 2011-03-21T19:45:12+00:00 Russell King rmk+kernel@arm.linux.org.uk 2011-02-20T12:22:52+00:00 e10f8b1c1104d1304c16c238235b1bc6e37f563c commit 53399053eb505cf541b2405bd9d9bca5ecfb96fb upstream. Ensure a predictable endian state when entering signal handlers. This avoids programs which use SETEND to momentarily switch their endian state from having their signal handlers entered with an unpredictable endian state. Acked-by: Dave Martin <dave.martin@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 53399053eb505cf541b2405bd9d9bca5ecfb96fb upstream.

Ensure a predictable endian state when entering signal handlers.  This
avoids programs which use SETEND to momentarily switch their endian
state from having their signal handlers entered with an unpredictable
endian state.

Acked-by: Dave Martin <dave.martin@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ARM: 6226/1: fix kprobe bug in ldr instruction emulation 2010-08-02T17:26:41+00:00 Nicolas Pitre nico@fluxnic.net 2010-07-14T04:21:22+00:00 b7806456d7c10c64da49005a911ba0a4998e9d1c commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream. From: Bin Yang <bin.yang@marvell.com> Signed-off-by: Bin Yang <bin.yang@marvell.com> Signed-off-by: Nicolas Pitre <nicolas.pitre@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream.

From: Bin Yang <bin.yang@marvell.com>

Signed-off-by: Bin Yang <bin.yang@marvell.com>
Signed-off-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ARM: 5938/1: ARM: L2: export outer_cache_fns 2010-02-18T16:27:39+00:00 Santosh Shilimkar santosh.shilimkar@ti.com 2010-02-16T06:57:43+00:00 6c09f09d44690d341d970559b64779bef8b9236b The 'outer_cache' variable is needed by the outer_inv_range(), outer_clean_range() and outer_flush_range() functions, which are declared as inline in asm/cacheflush.h. Otherwise drivers built as a loadable module, which access these functions, will have an undefined symbol. Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
The 'outer_cache' variable is needed by the outer_inv_range(),
outer_clean_range() and outer_flush_range() functions, which are
declared as inline in asm/cacheflush.h.  Otherwise drivers built
as a loadable module, which access these functions, will have
an undefined symbol.

Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 5884/1: arm: Fix DCC console for v7 2010-01-19T20:23:16+00:00 Tony Lindgren tony@atomide.com 2010-01-19T15:40:07+00:00 200b7a8dc09504bc0aedac567a307a6e533f39e5 Without this patch arch/arm/compressed/head.S defaults to generic DCC code that does not work for v7. For more information on the v7 DCC, see Cortex-A8 TRM "12.11.1 Debug communications channel". To use it with post 2.6.33-rc1 or later, you need to have: CONFIG_DEBUG_LL=y ONFIG_DEBUG_ICEDCC=y CONFIG_EARLY_PRINTK=y Earlier kernels need commit 93fd03a8c6728b58879f8af20ffd55d9c32a778b backported. Tested on omap3430. Signed-off-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
Without this patch arch/arm/compressed/head.S defaults to generic
DCC code that does not work for v7.

For more information on the v7 DCC, see Cortex-A8 TRM
"12.11.1 Debug communications channel".

To use it with post 2.6.33-rc1 or later, you need to have:

CONFIG_DEBUG_LL=y
ONFIG_DEBUG_ICEDCC=y
CONFIG_EARLY_PRINTK=y

Earlier kernels need commit 93fd03a8c6728b58879f8af20ffd55d9c32a778b
backported.

Tested on omap3430.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 5883/1: Revert "disable NX support for OABI-supporting kernels" 2010-01-18T14:12:11+00:00 Rabin Vincent rabin@rab.in 2010-01-18T14:04:32+00:00 a7b22962776109b5bfe3a3efa4f42622318c547d This reverts commit 14f0aa359365e8a93a77b71e3b840274b9b4dcb1. That commit was needed earlier because system call restarting for OABI (compat) required an executable stack and thus had problems with NX. Since ab72b00734ae4d0b ("ARM: Fix signal restart issues with NX and OABI compat") has reworked the code to not require an executable stack anymore, we can re-enable NX support for kernels with OABI (compat) support. Signed-off-by: Rabin Vincent <rabin@rab.in> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
This reverts commit 14f0aa359365e8a93a77b71e3b840274b9b4dcb1.

That commit was needed earlier because system call restarting for
OABI (compat) required an executable stack and thus had problems
with NX.  Since ab72b00734ae4d0b ("ARM: Fix signal restart issues
with NX and OABI compat") has reworked the code to not require an
executable stack anymore, we can re-enable NX support for kernels
with OABI (compat) support.

Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: Fix wrong dmb 2010-01-12T18:59:16+00:00 Russell King rmk+kernel@arm.linux.org.uk 2010-01-12T18:59:16+00:00 7511bce4069de39ea04b14c1e1d55c249f9ce808 The __kuser_cmpxchg code uses an ARMv6 dmb instruction, rather than one based upon the architecture being built for. Switch to using the macro provided for this purpose, which also eliminates the need for an ifdef. Acked-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
The __kuser_cmpxchg code uses an ARMv6 dmb instruction, rather than
one based upon the architecture being built for.  Switch to using
the macro provided for this purpose, which also eliminates the
need for an ifdef.

Acked-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 5868/1: ARM: fix "BUG: using smp_processor_id() in preemptible code" 2010-01-08T16:14:29+00:00 Rabin Vincent rabin@rab.in 2010-01-08T15:59:34+00:00 22325525d8bb1478daddefec1b762e7882bcd515 Fix the following warning, which appears when the register dump for a faulting process is printed in a kernel with SMP, DEBUG_PREEMPT, and DEBUG_USER (with user_debug=31) enabled: BUG: using smp_processor_id() in preemptible [00000000] code: init/1 caller is __show_regs+0x18/0x234 Backtrace: [<c0159e5c>] (dump_backtrace+0x0/0x114) from [<c01faf30>] (dump_stack+0x18/0x1c) r6:c781a000 r5:c0157544 r4:00000001 r3:00000000 [<c01faf18>] (dump_stack+0x0/0x1c) from [<c01e5230>] (debug_smp_processor_id+0xc4/0xf8) [<c01e516c>] (debug_smp_processor_id+0x0/0xf8) from [<c0157544>] (__show_regs+0x18/0x234) r6:c781bfb0 r5:00000000 r4:c781bfb0 r3:00000000 [<c015752c>] (__show_regs+0x0/0x234) from [<c01577a0>] (show_regs+0x40/0x50) [<c0157760>] (show_regs+0x0/0x50) from [<c015c968>] (__do_user_fault+0x5c/0xa4) r4:c781c000 r3:00000000 [<c015c90c>] (__do_user_fault+0x0/0xa4) from [<c015cbe0>] (do_page_fault+0x1b4/0x1e4) r7:00000000 r6:00010000 r5:c781bfb0 r4:c781c000 [<c015ca2c>] (do_page_fault+0x0/0x1e4) from [<c01554c8>] (do_DataAbort+0x3c/0xa0) [<c015548c>] (do_DataAbort+0x0/0xa0) from [<c01560c4>] (ret_from_exception+0x0/0x10) Signed-off-by: Rabin Vincent <rabin@rab.in> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
Fix the following warning, which appears when the register dump for a
faulting process is printed in a kernel with SMP, DEBUG_PREEMPT, and
DEBUG_USER (with user_debug=31) enabled:

BUG: using smp_processor_id() in preemptible [00000000] code: init/1
caller is __show_regs+0x18/0x234
Backtrace:
[<c0159e5c>] (dump_backtrace+0x0/0x114) from [<c01faf30>] (dump_stack+0x18/0x1c)
 r6:c781a000 r5:c0157544 r4:00000001 r3:00000000
[<c01faf18>] (dump_stack+0x0/0x1c) from [<c01e5230>] (debug_smp_processor_id+0xc4/0xf8)
[<c01e516c>] (debug_smp_processor_id+0x0/0xf8) from [<c0157544>] (__show_regs+0x18/0x234)
 r6:c781bfb0 r5:00000000 r4:c781bfb0 r3:00000000
[<c015752c>] (__show_regs+0x0/0x234) from [<c01577a0>] (show_regs+0x40/0x50)
[<c0157760>] (show_regs+0x0/0x50) from [<c015c968>] (__do_user_fault+0x5c/0xa4)
 r4:c781c000 r3:00000000
[<c015c90c>] (__do_user_fault+0x0/0xa4) from [<c015cbe0>] (do_page_fault+0x1b4/0x1e4)
 r7:00000000 r6:00010000 r5:c781bfb0 r4:c781c000
[<c015ca2c>] (do_page_fault+0x0/0x1e4) from [<c01554c8>] (do_DataAbort+0x3c/0xa0)
[<c015548c>] (do_DataAbort+0x0/0xa0) from [<c01560c4>] (ret_from_exception+0x0/0x10)

Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: dma-isa: request cascade channel after registering it 2009-12-24T18:34:08+00:00 Russell King rmk+kernel@arm.linux.org.uk 2009-12-24T14:45:39+00:00 e8b8f5ef90b934bc9eaef7c8960ecd9dda9f7a62 We can't request the cascade channel before it's been registered, so move it afterwards. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
We can't request the cascade channel before it's been registered, so
move it afterwards.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: Convert VFP/Crunch/XscaleCP thread_release() to exit_thread() 2009-12-18T14:53:41+00:00 Russell King rmk+kernel@arm.linux.org.uk 2009-12-18T14:34:43+00:00 797245f5da543074ee7db0e0516da744c89aa17f This avoids races in the VFP code where the dead thread may have state on another CPU. By moving this code to exit_thread(), we will be running as the thread, and therefore be running on the current CPU. This means that we can ensure that the only local state is accessed in the thread notifiers. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
This avoids races in the VFP code where the dead thread may have
state on another CPU.  By moving this code to exit_thread(), we
will be running as the thread, and therefore be running on the
current CPU.

This means that we can ensure that the only local state is accessed
in the thread notifiers.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>