linux-stable.git/drivers/cdrom, branch linux-2.6.32.y

drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

2014-05-19T05:53:15+00:00

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc->buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret && copy_to_user(arg, cgc->buffer, blocksize))

The cgc->buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Willy Tarreau

cdrom: use copy_to_user() without the underscores

2012-03-04T17:49:22+00:00

commit 822bfa51ce44f2c63c300fdb76dc99c4d5a5ca9f upstream.

"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap
on 32 bit systems.  That would have been ok if we used the same wrapped
value for the copy, but we use a shifted value.  We should just use the
checked version of copy_to_user() because it's not going to make a
difference to the speed.

Signed-off-by: Dan Carpenter 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

block: add and use scsi_blk_cmd_ioctl

2012-01-25T21:53:24+00:00

commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream.

Introduce a wrapper around scsi_cmd_ioctl that takes a block device.

The function will then be enhanced to detect partition block devices
and, in that case, subject the ioctls to whitelisting.

Cc: linux-scsi@vger.kernel.org
Cc: Jens Axboe 
Cc: James Bottomley 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backport to 2.6.32 - adjust context]
Signed-off-by: Ben Hutchings

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24T14:21:04+00:00

It's unused.

It isn't needed -- read or write flag is already passed and sysctl
shouldn't care about the rest.

It _was_ used in two places at arch/frv for some reason.

Signed-off-by: Alexey Dobriyan 
Cc: David Howells 
Cc: "Eric W. Biederman" 
Cc: Al Viro 
Cc: Ralf Baechle 
Cc: Martin Schwidefsky 
Cc: Ingo Molnar 
Cc: "David S. Miller" 
Cc: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

const: make block_device_operations const

2009-09-22T14:17:25+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

block: Use accessor functions for queue limits

2009-05-22T21:22:54+00:00

Convert all external users of queue limits to using wrapper functions
instead of poking the request queue variables directly.

Signed-off-by: Martin K. Petersen 
Signed-off-by: Jens Axboe

block: Do away with the notion of hardsect_size

2009-05-22T21:22:54+00:00

Until now we have had a 1:1 mapping between storage device physical
block size and the logical block sized used when addressing the device.
With SATA 4KB drives coming out that will no longer be the case.  The
sector size will be 4KB but the logical block size will remain
512-bytes.  Hence we need to distinguish between the physical block size
and the logical ditto.

This patch renames hardsect_size to logical_block_size.

Signed-off-by: Martin K. Petersen 
Signed-off-by: Jens Axboe

Merge branch 'master' into for-2.6.31

2009-05-22T18:28:35+00:00

Conflicts:
	drivers/ide/ide-io.c

Signed-off-by: Jens Axboe

cdrom: beyond ARRAY_SIZE of viocd_diskinfo

2009-05-20T06:42:06+00:00

Do not go beyond ARRAY_SIZE of viocd_diskinfo

Signed-off-by: Roel Kluin 
Signed-off-by: Jens Axboe

block: implement and enforce request peek/start/fetch

2009-05-11T07:52:18+00:00

Till now block layer allowed two separate modes of request execution.
A request is always acquired from the request queue via
elv_next_request().  After that, drivers are free to either dequeue it
or process it without dequeueing.  Dequeue allows elv_next_request()
to return the next request so that multiple requests can be in flight.

Executing requests without dequeueing has its merits mostly in
allowing drivers for simpler devices which can't do sg to deal with
segments only without considering request boundary.  However, the
benefit this brings is dubious and declining while the cost of the API
ambiguity is increasing.  Segment based drivers are usually for very
old or limited devices and as converting to dequeueing model isn't
difficult, it doesn't justify the API overhead it puts on block layer
and its more modern users.

Previous patches converted all block low level drivers to dequeueing
model.  This patch completes the API transition by...

* renaming elv_next_request() to blk_peek_request()

* renaming blkdev_dequeue_request() to blk_start_request()

* adding blk_fetch_request() which is combination of peek and start

* disallowing completion of queued (not started) requests

* applying new API to all LLDs

Renamings are for consistency and to break out of tree code so that
it's apparent that out of tree drivers need updating.

[ Impact: block request issue API cleanup, no functional change ]

Signed-off-by: Tejun Heo 
Cc: Rusty Russell 
Cc: James Bottomley 
Cc: Mike Miller 
Cc: unsik Kim 
Cc: Paul Clements 
Cc: Tim Waugh 
Cc: Geert Uytterhoeven 
Cc: David S. Miller 
Cc: Laurent Vivier 
Cc: Jeff Garzik 
Cc: Jeremy Fitzhardinge 
Cc: Grant Likely 
Cc: Adrian McMenamin 
Cc: Stephen Rothwell 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Borislav Petkov 
Cc: Sergei Shtylyov 
Cc: Alex Dubov 
Cc: Pierre Ossman 
Cc: David Woodhouse 
Cc: Markus Lidel 
Cc: Stefan Weinhuber 
Cc: Martin Schwidefsky 
Cc: Pete Zaitcev 
Cc: FUJITA Tomonori 
Signed-off-by: Jens Axboe