summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-01-09fs/9p: use fscache mutex rather than spinlockSasha Levin3-6/+6
We may sleep inside a the lock, so use a mutex rather than spinlock. Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09proc: add a reschedule point in proc_readfd_common()Eric Dumazet1-0/+1
User can pass an arbitrary large buffer to getdents(). It is typically a 32KB buffer used by libc scandir() implementation. When scanning /proc/{pid}/fd, we can hold cpu way too long, so add a cond_resched() to be kind with other tasks. We've seen latencies of more than 50ms on real workloads. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09logfs: constify logfs_block_ops structuresJulia Lawall3-5/+5
The logfs_block_ops structures are never modified, so declare them as const. Done with the help of Coccinelle. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09fcntl: allow to set O_DIRECT flag on pipeStanislav Kinsburskiy1-1/+2
With packetized mode for pipes, it's not possible to set O_DIRECT on pipe file via sys_fcntl, because of unsupported sanity checks. Ability to set this flag will be used by CRIU to migrate packetized pipes. v2: Fixed typos and mode variable to check. Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGEAbhi Das1-5/+3
During testing, I discovered that __generic_file_splice_read() returns 0 (EOF) when aops->readpage fails with AOP_TRUNCATED_PAGE on the first page of a single/multi-page splice read operation. This EOF return code causes the userspace test to (correctly) report a zero-length read error when it was expecting otherwise. The current strategy of returning a partial non-zero read when ->readpage returns AOP_TRUNCATED_PAGE works only when the failed page is not the first of the lot being processed. This patch attempts to retry lookup and call ->readpage again on pages that had previously failed with AOP_TRUNCATED_PAGE. With this patch, my tests pass and I haven't noticed any unwanted side effects. This version removes the thrice-retry loop and instead indefinitely retries lookups on AOP_TRUNCATED_PAGE errors from ->readpage. This behavior is now similar to do_generic_file_read(). Signed-off-by: Abhi Das <adas@redhat.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Bob Peterson <rpeterso@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09fs: xattr: Use kvfree()Richard Weinberger1-24/+14
... instead of open coding it. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09[s390] page_to_phys() always returns a multiple of PAGE_SIZEAl Viro1-2/+1
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09nbd: use ->compat_ioctl()Al Viro2-11/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09Merge branch 'for-linus' into work.miscAl Viro77-568/+855
2016-01-09compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS)Jann Horn1-62/+68
This replaces all code in fs/compat_ioctl.c that translated ioctl arguments into a in-kernel structure, then performed do_ioctl under set_fs(KERNEL_DS), with code that allocates data on the user stack and can call the VFS ioctl handler under USER_DS. This is done as a hardening measure because the caller does not know what kind of ioctl handler will be invoked, only that no corresponding compat_ioctl handler exists and what the ioctl command number is. The accidental invocation of an unlocked_ioctl handler that unexpectedly calls copy_to_user could be a severe security issue. Signed-off-by: Jann Horn <jann@thejh.net> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09compat_ioctl: don't pass fd around when not neededAl Viro4-55/+61
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-09compat_ioctl: don't look up the fd twiceJann Horn1-54/+68
In code in fs/compat_ioctl.c that translates ioctl arguments into a in-kernel structure, then performs sys_ioctl, possibly under set_fs(KERNEL_DS), this commit changes the sys_ioctl calls to do_ioctl calls. do_ioctl is a new function that does the same thing as sys_ioctl, but doesn't look up the fd again. This change is made to avoid (potential) security issues because of ioctl handlers that accept one of the ioctl commands I2C_FUNCS, VIDEO_GET_EVENT, MTIOCPOS, MTIOCGET, TIOCGSERIAL, TIOCSSERIAL, RTC_IRQP_READ, RTC_EPOCH_READ. This can happen for multiple reasons: - The ioctl command number could be reused. - The ioctl handler might not check the full ioctl command. This is e.g. true for drm_ioctl. - The ioctl handler is very special, e.g. cuse_file_ioctl The real issue is that set_fs(KERNEL_DS) is used here, but that's fixed in a separate commit "compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS)". This change mitigates potential security issues by preventing a race that permits invocation of unlocked_ioctl handlers under KERNEL_DS through compat code even if a corresponding compat_ioctl handler exists. So far, no way has been identified to use this to damage kernel memory without having CAP_SYS_ADMIN in the init ns (with the capability, doing reads/writes at arbitrary kernel addresses should be easy through CUSE's ioctl handler with FUSE_IOCTL_UNRESTRICTED set). [AV: two missed sys_ioctl() taken care of] Signed-off-by: Jann Horn <jann@thejh.net> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06fs: use block_device name vsprintf helperDmitry Monakhov17-90/+49
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06lib/vsprintf: add %*pg format specifierDmitry Monakhov2-0/+35
This allow to directly print block_device name. Currently one should use bdevname() with temporal char buffer. This is very ineffective because bloat stack usage for deep IO call-traces Example: %pg -> sda, sda1 or loop0p1 [AV: fixed a minor braino - position updates should not be dependent upon having reached the of buffer] Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06fs: use gendisk->disk_name where possibleDmitry Monakhov1-9/+3
gendisk with part==0 is obviously gendisk->disk_name. Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06poll: plug an unused argument to do_pollMateusz Guzik1-3/+3
Number of fds is already known based on passed list. No functional changes. Signed-off-by: Mateusz Guzik <mguzik@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06amdkfd: don't open-code memdup_user()Al Viro1-26/+7
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06cdrom: don't open-code memdup_user()Al Viro1-7/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06rsxx: don't open-code memdup_user()Al Viro1-7/+4
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-06mtip32xx: don't open-code memdup_user()Al Viro1-15/+8
[folded a fix by Dan Carpenter] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04[um] mconsole: don't open-code memdup_user_nul()Al Viro1-11/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04[um] hostaudio: don't open-code memdup_user()Al Viro1-7/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04HFS wants 8Kb per-superblock allocation; just use kmalloc()Al Viro1-2/+2
... rather than play with __get_free_pages() (and figuring out the allocation order, etc.) Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04jfs: microoptimize get_zeroed_page / virt_to_pageAl Viro1-5/+4
get_zeroed_page does alloc_page and returns page_address of the result; subsequent virt_to_page will recover the page, but since the caller needs both page and its page_address() anyway, why bother going through that wrapper at all? Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04... and a couple in net/9pAl Viro1-2/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04md: more open-coded offset_in_page()Al Viro2-3/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04dm-bufio: virt_to_phys() doesn't change remainder modulo PAGE_SIZEAl Viro1-1/+1
... so virt_to_phys(p) & (PAGE_SIZE - 1) is a very odd way to spell offset_in_page(p). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04hpfs: missing endianness annotationAl Viro1-1/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04drivers/mtd/maps/pcmciamtd.c: __iomem annotationsAl Viro1-14/+14
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04don't carry MAY_OPEN in op->acc_modeAl Viro3-18/+12
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04saner calling conventions for copy_mount_options()Al Viro3-30/+28
let it just return NULL, pointer to kernel copy or ERR_PTR(). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04fix the leak in integrity_read_file()Al Viro1-5/+6
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04ppc: get rid of the remnants of __get_user64()Al Viro1-15/+0
When __get_user64() had been removed, its helper (__get_user64_nocheck) got missed. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04put the remnants of ..._user_ret() to restAl Viro5-130/+0
they hadn't been used in last 15 years... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04proc_pid_attr_write(): switch to memdup_user()Al Viro1-10/+7
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04kernel/*: switch to memdup_user_nul()Al Viro4-95/+48
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04cciss: switch to memdup_user_nul()Al Viro1-10/+4
all we do to buffer is strncmp()... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04switch wireless debugfs ->write() instances to memdup_user_nul()Al Viro2-174/+89
again, it only parses the contents of the copied buffer, so get_zeroed_page() might as well had been kmalloc(), which makes it open-coded memdup_user_nul() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04selinuxfs: switch to memdup_user_nul()Al Viro1-73/+41
Nothing in there gives a damn about the buffer alignment - it just parses its contents. So the use of get_zeroed_page() doesn't buy us anything - might as well had been kmalloc(), which makes that code equivalent to open-coded memdup_user_nul() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04convert a bunch of open-coded instances of memdup_user_nul()Al Viro12-197/+71
A _lot_ of ->write() instances were open-coding it; some are converted to memdup_user_nul(), a lot more remain... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04Merge branch 'memdup_user_nul' into work.miscAl Viro596-2937/+5015
2016-01-04new helper: memdup_user_nul()Al Viro2-0/+32
Similar to memdup_user(), except that allocated buffer is one byte longer and '\0' is stored after the copied data. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-01-04Linux 4.4-rc8v4.4-rc8Linus Torvalds1-1/+1
2016-01-03Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds1-1/+1
Pull MIPS build fix from Ralf Baechle: "Fix a makefile issue resulting in build breakage with older binutils. This has sat in -next for a few days, testers and buildbot are happy with it, too though if you are going for another -rc that'd certainly help ironing out a few more issues" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: VDSO: Fix build error with binutils 2.24 and earlier
2016-01-03Merge tag 'drm-intel-fixes-2016-01-02' of ↵Linus Torvalds2-5/+9
git://anongit.freedesktop.org/drm-intel Pull i915 drm fixes from Jani Nikula: "Two display fixes still for v4.4. The new year's resolution is to start using signed tags per Linus' request. This one is still unsigned; I want to fix this up in our maintainer scripts instead of doing it one-off" * tag 'drm-intel-fixes-2016-01-02' of git://anongit.freedesktop.org/drm-intel: drm/i915: increase the tries for HDMI hotplug live status checking drm/i915: Unbreak check_digital_port_conflicts()
2016-01-01Merge tag 'pci-v4.4-fixes-3' of ↵Linus Torvalds1-1/+3
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI bugfix from Bjorn Helgaas: "Here's another fix for v4.4. This fixes 32-bit config reads for the HiSilicon driver. Obviously the driver is completely broken without this fix (apparently it actually was tested internally, but got broken somehow in the process of upstreaming it). Summary: HiSilicon host bridge driver Fix 32-bit config reads (Dongdong Liu)" * tag 'pci-v4.4-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: hisi: Fix hisi_pcie_cfg_read() 32-bit reads
2016-01-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparcLinus Torvalds3-18/+25
Pull sparc fixes from David Miller: "Just some missing syscall wire ups" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: Wire up mlock2 system call. sparc: Add all necessary direct socket system calls.
2016-01-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds36-198/+334
Pull networking fixes from David Miller: 1) Prevent XFRM per-cpu counter updates for one namespace from being applied to another namespace. Fix from DanS treetman. 2) Fix RCU de-reference in iwl_mvm_get_key_sta_id(), from Johannes Berg. 3) Remove ethernet header assumption in nft_do_chain_netdev(), from Pablo Neira Ayuso. 4) Fix cpsw PHY ident with multiple slaves and fixed-phy, from Pascal Speck. 5) Fix use after free in sixpack_close and mkiss_close. 6) Fix VXLAN fw assertion on bnx2x, from Yuval Mintz. 7) natsemi doesn't check for DMA mapping errors, from Alexey Khoroshilov. 8) Fix inverted test in ip6addrlbl_get(), from ANdrey Ryabinin. 9) Missing initialization of needed_headroom in geneve tunnel driver, from Paolo Abeni. 10) Fix conntrack template leak in openvswitch, from Joe Stringer. 11) Mission initialization of wq->flags in sock_alloc_inode(), from Nicolai Stange. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (35 commits) sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close net, socket, socket_wq: fix missing initialization of flags drivers: net: cpsw: fix error return code openvswitch: Fix template leak in error cases. sctp: label accepted/peeled off sockets sctp: use GFP_USER for user-controlled kmalloc qlcnic: fix a loop exit condition better net: cdc_ncm: avoid changing RX/TX buffers on MTU changes geneve: initialize needed_headroom ipv6: honor ifindex in case we receive ll addresses in router advertisements addrconf: always initialize sysctl table data ipv6/addrlabel: fix ip6addrlbl_get() switchdev: bridge: Pass ageing time as clock_t instead of jiffies sh_eth: fix 16-bit descriptor field access endianness too veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. net: usb: cdc_ncm: Adding Dell DW5813 LTE AT&T Mobile Broadband Card net: usb: cdc_ncm: Adding Dell DW5812 LTE Verizon Mobile Broadband Card natsemi: add checks for dma mapping errors rhashtable: Kill harmless RCU warning in rhashtable_walk_init openvswitch: correct encoding of set tunnel action attributes ...
2015-12-31sparc: Wire up mlock2 system call.David S. Miller3-4/+5
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-12-31sparc: Add all necessary direct socket system calls.David S. Miller3-18/+24
The GLIBC folks would like to eliminate socketcall support eventually, and this makes sense regardless so wire them all up. Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2024-09-20 01:07:30 +0300