linux-stable.git/drivers/staging/android, branch v3.18.22

staging: android: sync: Fix memory corruption in sync_timeline_signal().

2015-05-17T23:11:52+00:00

[ Upstream commit 8e43c9c75faf2902955bd2ecd7a50a8cc41cb00a ]

The android_fence_release() function checks for active sync points
by calling list_empty() on the list head embedded on the sync
point. However, it is only valid to use list_empty() on nodes that
have been initialized with INIT_LIST_HEAD() or list_del_init().

Because the list entry has likely been removed from the active list
by sync_timeline_signal(), there is a good chance that this
WARN_ON_ONCE() will be hit due to dangling pointers pointing at
freed memory (even though the sync drivers did nothing wrong)
and memory corruption will ensue as the list entry is removed for
a second time, corrupting the active list.

This problem can be reproduced quite easily with CONFIG_DEBUG_LIST=y
and fences with more than one sync point.

Signed-off-by: Alistair Strachan 
Cc: Maarten Lankhorst 
Cc: Greg Kroah-Hartman 
Cc: Colin Cross 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: android: logger: Fix log corruption regression

2014-10-28T22:24:30+00:00

Since commit cd678fce4280 ("switch logger to ->write_iter()"), any
attempt to write to the log results in the log data being written over
its own metadata, thus rendering the log unreadable.

The problem was first detected when I ran an Android userspace on the
v3.18-rc1 kernel. However the issue can also be observed with a
non-Android userspace by using echo/cat to write to/from /dev/log_main .

This patch resolves the problem by using a temporary to track the status
of not-yet-committed writes to the log buffer.

Signed-off-by: Daniel Thompson 
Cc: Al Viro 
Signed-off-by: Al Viro

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-10-13T09:28:42+00:00

Pull vfs updates from Al Viro:
 "The big thing in this pile is Eric's unmount-on-rmdir series; we
  finally have everything we need for that.  The final piece of prereqs
  is delayed mntput() - now filesystem shutdown always happens on
  shallow stack.

  Other than that, we have several new primitives for iov_iter (Matt
  Wilcox, culled from his XIP-related series) pushing the conversion to
  ->read_iter()/ ->write_iter() a bit more, a bunch of fs/dcache.c
  cleanups and fixes (including the external name refcounting, which
  gives consistent behaviour of d_move() wrt procfs symlinks for long
  and short names alike) and assorted cleanups and fixes all over the
  place.

  This is just the first pile; there's a lot of stuff from various
  people that ought to go in this window.  Starting with
  unionmount/overlayfs mess...  ;-/"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (60 commits)
  fs/file_table.c: Update alloc_file() comment
  vfs: Deduplicate code shared by xattr system calls operating on paths
  reiserfs: remove pointless forward declaration of struct nameidata
  don't need that forward declaration of struct nameidata in dcache.h anymore
  take dname_external() into fs/dcache.c
  let path_init() failures treated the same way as subsequent link_path_walk()
  fix misuses of f_count() in ppp and netlink
  ncpfs: use list_for_each_entry() for d_subdirs walk
  vfs: move getname() from callers to do_mount()
  gfs2_atomic_open(): skip lookups on hashed dentry
  [infiniband] remove pointless assignments
  gadgetfs: saner API for gadgetfs_create_file()
  f_fs: saner API for ffs_sb_create_file()
  jfs: don't hash direct inode
  [s390] remove pointless assignment of ->f_op in vmlogrdr ->open()
  ecryptfs: ->f_op is never NULL
  android: ->f_op is never NULL
  nouveau: __iomem misannotations
  missing annotation in fs/file.c
  fs: namespace: suppress 'may be used uninitialized' warnings
  ...

android: ->f_op is never NULL

2014-10-09T06:39:12+00:00

Signed-off-by: Al Viro

switch logger to ->write_iter()

2014-10-09T06:39:09+00:00

Signed-off-by: Al Viro

ashmem: use vfs_llseek()

2014-10-09T06:39:04+00:00

Signed-off-by: Al Viro

staging : android : sync : get_unused_fd

2014-09-29T02:03:57+00:00

sync.h recommends to use get_unused_fd which does not set
O_CLOEXEC while the rest of the android tree uses
get_unused_fd_flags and sets O_CLOEXEC.

The patch adjust the comment.

Signed-off-by: Heinrich Schuchardt 
Signed-off-by: Greg Kroah-Hartman

staging: android: sw_sync: checkpatch fixes

2014-09-19T23:35:53+00:00

   - no space after cast
   - allignment should match open parenthesis
   - remove unnecessary new line

Signed-off-by: Purnendu Kapadia 
Signed-off-by: Greg Kroah-Hartman

Merge 3.17-rc5 into staging-next.

2014-09-15T02:33:47+00:00

This fixes a merge conflict in lustre, and we want the other fixes that
went into 3.17-rc5 as well.

Signed-off-by: Greg Kroah-Hartman

android: fix reference leak in sync_fence_create

2014-09-08T20:42:00+00:00

According to the documentation sync_fence_create takes ownership of the point,
not a reference on the point.

This fixes a memory leak introduced in 3.17's android fence rework.

Signed-off-by: Maarten Lankhorst 
Cc: Colin Cross 
Cc: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman