<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux/arch/sparc/kernel, branch v3.12.1</title>
<subtitle>Linux kernel source tree</subtitle>
<id>https://git.amat.us/linux/atom/arch/sparc/kernel?h=v3.12.1</id>
<link rel='self' href='https://git.amat.us/linux/atom/arch/sparc/kernel?h=v3.12.1'/>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/'/>
<updated>2013-10-03T00:02:35Z</updated>
<entry>
<title>sparc: fix MSI build failure on Sparc32</title>
<updated>2013-10-03T00:02:35Z</updated>
<author>
<name>Thomas Petazzoni</name>
<email>thomas.petazzoni@free-electrons.com</email>
</author>
<published>2013-09-11T10:32:05Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=a988fb806d72d4e3a0edbeaece3f2f1172ce44b8'/>
<id>urn:sha1:a988fb806d72d4e3a0edbeaece3f2f1172ce44b8</id>
<content type='text'>
Commit ebd97be635 ('PCI: remove ARCH_SUPPORTS_MSI kconfig option')
removes the ARCH_SUPPORTS_MSI Kconfig option that allowed
architectures to indicate whether they support PCI MSI or not. Now,
PCI MSI support can be compiled in on any architecture thanks to the
use of weak functions thanks to 4287d824f265 ('PCI: use weak functions
for MSI arch-specific functions').

So, architecture specific code is now responsible to ensure that its
PCI MSI code builds in all cases, or be appropriately conditionally
compiled.

On Sparc, the MSI support is only provided for Sparc64, so the
ARCH_SUPPORTS_MSI kconfig option was only selected for SPARC64, and
not for the Sparc architecture as a whole. Therefore, removing
ARCH_SUPPORTS_MSI broke Sparc32 configurations with CONFIG_PCI_MSI=y,
because the Sparc-specific MSI code is not designed to be built on
Sparc32.

To solve this, this commit ensures that the Sparc MSI code is only
built on Sparc64. This is done thanks to a new Kconfig Makefile helper
option SPARC64_PCI_MSI, modeled after the existing SPARC64_PCI. The
SPARC64_PCI_MSI option is an hidden option that is true when both
Sparc64 PCI support is enabled and MSI is enabled. The
arch/sparc/kernel/pci_msi.c file is now only built when
SPARC64_PCI_MSI is true.

Signed-off-by: Thomas Petazzoni &lt;thomas.petazzoni@free-electrons.com&gt;
Reported-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Tested-by: Guenter Roeck &lt;linux@roeck-us.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc: remove deprecated IRQF_DISABLED</title>
<updated>2013-10-03T00:02:35Z</updated>
<author>
<name>Michael Opdenacker</name>
<email>michael.opdenacker@free-electrons.com</email>
</author>
<published>2013-09-07T07:38:09Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=d2f09b1c17158fa870fb4f78babf1b307cd2685b'/>
<id>urn:sha1:d2f09b1c17158fa870fb4f78babf1b307cd2685b</id>
<content type='text'>
This patch proposes to remove the IRQF_DISABLED flag from sparc architecture
code. It's a NOOP since 2.6.35 and it will be removed one day.

Signed-off-by: Michael Opdenacker &lt;michael.opdenacker@free-electrons.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc: fix ldom_reboot buffer overflow harder</title>
<updated>2013-10-03T00:01:56Z</updated>
<author>
<name>Kees Cook</name>
<email>keescook@chromium.org</email>
</author>
<published>2013-10-02T05:13:34Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=20928bd3f08afb036c096d9559d581926b895918'/>
<id>urn:sha1:20928bd3f08afb036c096d9559d581926b895918</id>
<content type='text'>
The length argument to strlcpy was still wrong. It could overflow the end of
full_boot_str by 5 bytes. Instead of strcat and strlcpy, just use snprint.

Reported-by: Brad Spengler &lt;spender@grsecurity.net&gt;
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc64: Fix buggy strlcpy() conversion in ldom_reboot().</title>
<updated>2013-09-27T20:46:04Z</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2013-09-27T20:46:04Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=2bd161a605f1f84a5fc8a4fe8410113a94f79355'/>
<id>urn:sha1:2bd161a605f1f84a5fc8a4fe8410113a94f79355</id>
<content type='text'>
Commit 117a0c5fc9c2d06045bd217385b2b39ea426b5a6 ("sparc: kernel: using
strlcpy() instead of strcpy()") added a bug to ldom_reboot in
arch/sparc/kernel/ds.c

-		strcpy(full_boot_str + strlen("boot "), boot_command);
+				     strlcpy(full_boot_str + strlen("boot "), boot_command,
+				     			     sizeof(full_boot_str + strlen("boot ")));

That last sizeof() expression evaluates to sizeof(size_t) which is
not what was intended.

Also even the corrected:

     sizeof(full_boot_str) + strlen("boot ")

is not right as the destination buffer length is just plain
"sizeof(full_boot_str)" and that's what the final argument
should be.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()</title>
<updated>2013-09-11T22:58:18Z</updated>
<author>
<name>Mathieu Desnoyers</name>
<email>mathieu.desnoyers@efficios.com</email>
</author>
<published>2013-09-11T21:23:18Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=3ddc5b46a8e90f3c9251338b60191d0a804b0d92'/>
<id>urn:sha1:3ddc5b46a8e90f3c9251338b60191d0a804b0d92</id>
<content type='text'>
I found the following pattern that leads in to interesting findings:

  grep -r "ret.*|=.*__put_user" *
  grep -r "ret.*|=.*__get_user" *
  grep -r "ret.*|=.*__copy" *

The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat,
since those appear in compat code, we could probably expect the kernel
addresses not to be reachable in the lower 32-bit range, so I think they
might not be exploitable.

For the "__get_user" cases, I don't think those are exploitable: the worse
that can happen is that the kernel will copy kernel memory into in-kernel
buffers, and will fail immediately afterward.

The alpha csum_partial_copy_from_user() seems to be missing the
access_ok() check entirely.  The fix is inspired from x86.  This could
lead to information leak on alpha.  I also noticed that many architectures
map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I
wonder if the latter is performing the access checks on every
architectures.

Signed-off-by: Mathieu Desnoyers &lt;mathieu.desnoyers@efficios.com&gt;
Cc: Richard Henderson &lt;rth@twiddle.net&gt;
Cc: Ivan Kokshaysky &lt;ink@jurassic.park.msu.ru&gt;
Cc: Matt Turner &lt;mattst88@gmail.com&gt;
Cc: Jens Axboe &lt;axboe@kernel.dk&gt;
Cc: Oleg Nesterov &lt;oleg@redhat.com&gt;
Cc: David Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
</entry>
<entry>
<title>sparc64: Export flush_ptrace_access() (needed by lustre)</title>
<updated>2013-09-05T19:12:51Z</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert@linux-m68k.org</email>
</author>
<published>2013-09-05T09:17:33Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=dc76f9ca71ea597dbb0e9c77d1072ddca651f4f3'/>
<id>urn:sha1:dc76f9ca71ea597dbb0e9c77d1072ddca651f4f3</id>
<content type='text'>
ERROR: "flush_ptrace_access" [drivers/staging/lustre/lustre/libcfs/libcfs.ko]
undefined!

Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc64: Fix off by one in trampoline TLB mapping installation loop.</title>
<updated>2013-08-22T23:38:46Z</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2013-08-22T23:38:46Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=63d499662aeec1864ec36d042aca8184ea6a938e'/>
<id>urn:sha1:63d499662aeec1864ec36d042aca8184ea6a938e</id>
<content type='text'>
Reported-by: Kirill Tkhai &lt;tkhai@yandex.ru&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc64: Fix ITLB handler of null page</title>
<updated>2013-08-03T00:29:06Z</updated>
<author>
<name>Kirill Tkhai</name>
<email>tkhai@yandex.ru</email>
</author>
<published>2013-08-02T15:23:18Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=1c2696cdaad84580545a2e9c0879ff597880b1a9'/>
<id>urn:sha1:1c2696cdaad84580545a2e9c0879ff597880b1a9</id>
<content type='text'>
1)Use kvmap_itlb_longpath instead of kvmap_dtlb_longpath.

2)Handle page #0 only, don't handle page #1: bleu -&gt; blu

 (KERNBASE is 0x400000, so #1 does not exist too. But everything
  is possible in the future. Fix to not to have problems later.)

3)Remove unused kvmap_itlb_nonlinear.

Signed-off-by: Kirill Tkhai &lt;tkhai@yandex.ru&gt;
CC: David Miller &lt;davem@davemloft.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc64: Fix not SRA'ed %o5 in 32-bit traced syscall</title>
<updated>2013-08-01T02:10:04Z</updated>
<author>
<name>Kirill Tkhai</name>
<email>tkhai@yandex.ru</email>
</author>
<published>2013-07-26T13:21:12Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=ab2abda6377723e0d5fbbfe5f5aa16a5523344d1'/>
<id>urn:sha1:ab2abda6377723e0d5fbbfe5f5aa16a5523344d1</id>
<content type='text'>
(From v1 to v2: changed comment)

On the way linux_sparc_syscall32-&gt;linux_syscall_trace32-&gt;goto 2f,
register %o5 doesn't clear its second 32-bit.

Fix that.

Signed-off-by: Kirill Tkhai &lt;tkhai@yandex.ru&gt;
CC: David Miller &lt;davem@davemloft.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
<entry>
<title>sparc64: cleanup: Rename ret_from_syscall to ret_from_fork</title>
<updated>2013-08-01T02:10:04Z</updated>
<author>
<name>Kirill Tkhai</name>
<email>tkhai@yandex.ru</email>
</author>
<published>2013-07-26T12:42:39Z</published>
<link rel='alternate' type='text/html' href='https://git.amat.us/linux/commit/?id=37d6fa34a7f7b16799d0a7c009fcb74fbf090377'/>
<id>urn:sha1:37d6fa34a7f7b16799d0a7c009fcb74fbf090377</id>
<content type='text'>
Rename to make the function name better conform to its goal.

Signed-off-by: Kirill Tkhai &lt;tkhai@yandex.ru&gt;
CC: David Miller &lt;davem@davemloft.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
</entry>
</feed>
