linux/drivers/char, branch v3.10.2

random: fix accounting race condition with lockless irq entropy_count update

2013-05-24T23:22:52Z

Commit 902c098a3663 ("random: use lockless techniques in the interrupt path") turned IRQ path from being spinlock protected into lockless cmpxchg-retry update. That commit removed r->lock serialization between crediting entropy bits from IRQ context and accounting when extracting entropy on userspace read path, but didn't turn the r->entropy_count reads/updates in account() to use cmpxchg as well. It has been observed, that under certain circumstances this leads to read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets corrupted and becomes negative, which in turn results in propagating 0 all the way from account() to the actual read() call. Convert the accounting code to be the proper lockless counterpart of what has been partially done by 902c098a3663. Signed-off-by: Jiri Kosina Cc: Theodore Ts'o Cc: Greg KH Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drivers/char/random.c: fix priming of last_data

2013-05-24T23:22:52Z

Commit ec8f02da9ea5 ("random: prime last_data value per fips requirements") added priming of last_data per fips requirements. Unfortuantely, it did so in a way that can lead to multiple threads all incrementing nbytes, but only one actually doing anything with the extra data, which leads to some fun random corruption and panics. The fix is to simply do everything needed to prime last_data in a single shot, so there's no window for multiple cpus to increment nbytes -- in fact, we won't even increment or decrement nbytes anymore, we'll just extract the needed EXTRACT_SIZE one time per pool and then carry on with the normal routine. All these changes have been tested across multiple hosts and architectures where panics were previously encoutered. The code changes are are strictly limited to areas only touched when when booted in fips mode. This change should also go into 3.8-stable, to make the myriads of fips users on 3.8.x happy. Signed-off-by: Jarod Wilson Tested-by: Jan Stancek Tested-by: Jan Stodola Cc: Herbert Xu Acked-by: Neil Horman Cc: "David S. Miller" Cc: Matt Mackall Cc: "Theodore Ts'o" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Merge tag 'char-misc-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2013-05-23T16:26:32Z

Pull char/misc driver fixes from Greg Kroah-Hartman: "Here are some small char/misc driver fixes for 3.10-rc2. Nothing major here, just a number of fixes for things that people have reported, and a MAINTAINERS update for the recent changes for the hyperv files that went into 3.10-rc1." * tag 'char-misc-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port uio: UIO_DMEM_GENIRQ should depend on HAS_DMA MAINTAINERS: update Hyper-V file list mei: bus: Reset event_cb when disabling a device Drivers: hv: Fix a bug in get_vp_index() mei: fix out of array access to me clients array Char: lp, protect LPGETSTATUS with port_mutex dummy-irq: require the user to specify an IRQ number

ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port

2013-05-21T17:13:23Z

tty_port_init() zeroes out the tty port, which means that we have to set the ops pointer /after/, not before this call. Otherwise, tty_port_open will crash when it tries to deref ops, which is now a NULL pointer. Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman

Merge branch 'devm_no_resource_check' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2013-05-18T17:54:54Z

Pull devm usage cleanup from Wolfram Sang: "Lately, I have been experimenting how to improve the devm interface to make writing device drivers easier and less error prone while also getting rid of its subtle issues. I think it has more potential but still needs work and definately conistency, especiall in its usage. The first thing I come up with is a low hanging fruit regarding devm_ioremap_resouce(). This function already checks if the passed resource is valid and gives an error message if not. So, we can remove similar checks from the drivers and get rid of a bit of code and a number of inconsistent error strings. This series only removes the unneeded check iff devm_ioremap_resource follows platform_get_resource directly. The previous version tried to shuffle code if needed, too, what lead to an embarrasing bug. It turned out to me that shuffling code for all cases found will make the automated script too complex, so I am unsure if an automated cleanup is the proper tool for this case. Removing the easy stuff seems worthwhile to me, though. Despite various architectures and platform dependencies, I managed to compile test 45 out of 57 modified files locally using heuristics and defconfigs." Pulled because: 296 deletions, 0 additions. * 'devm_no_resource_check' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (33 commits) sound/soc/kirkwood: don't check resource with devm_ioremap_resource sound/soc/fsl: don't check resource with devm_ioremap_resource arch/mips/lantiq/xway: don't check resource with devm_ioremap_resource arch/arm/plat-samsung: don't check resource with devm_ioremap_resource arch/arm/mach-tegra: don't check resource with devm_ioremap_resource drivers/watchdog: don't check resource with devm_ioremap_resource drivers/w1/masters: don't check resource with devm_ioremap_resource drivers/video/omap2/dss: don't check resource with devm_ioremap_resource drivers/video/omap2: don't check resource with devm_ioremap_resource drivers/usb/phy: don't check resource with devm_ioremap_resource drivers/usb/host: don't check resource with devm_ioremap_resource drivers/usb/gadget: don't check resource with devm_ioremap_resource drivers/usb/chipidea: don't check resource with devm_ioremap_resource drivers/thermal: don't check resource with devm_ioremap_resource drivers/staging/nvec: don't check resource with devm_ioremap_resource drivers/staging/dwc2: don't check resource with devm_ioremap_resource drivers/spi: don't check resource with devm_ioremap_resource drivers/rtc: don't check resource with devm_ioremap_resource drivers/pwm: don't check resource with devm_ioremap_resource drivers/pinctrl: don't check resource with devm_ioremap_resource ...

Char: lp, protect LPGETSTATUS with port_mutex

2013-05-17T01:08:58Z

The patch fixes a problem in the lp driver that can cause oopses as follows: process A: calls lp_write, which in turn calls parport_ieee1284_write_compat, and that invokes parport_wait_peripheral process B: meanwhile does an ioctl(LPGETSTATUS), which call lp_release_parport when done. This function will set physport->cad = NULL. process A: parport_wait_peripheral tries to dereference physport->cad and dies So, protect that code with the port_mutex in order to protect against simultaneous calls to lp_read/lp_write. Similar protection is probably required for ioctl(LPRESET)... This patch was done by IBM a while back and we (at suse) have that since at least 2004 in our repos. Let's make it upstream. Signed-off-by: okir@suse.de Signed-off-by: Jiri Slaby Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex

2013-05-16T20:49:25Z

When a 32 bit version of ipmitool is used on a 64 bit kernel, the ipmi_devintf code fails to correctly acquire ipmi_mutex. This results in incomplete data being retrieved in some cases, or other possible failures. Add a wrapper around compat_ipmi_ioctl() to take ipmi_mutex to fix this. Signed-off-by: Benjamin LaHaise Signed-off-by: Corey Minyard Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds

ipmi: Improve error messages on failed irq enable

2013-05-16T20:49:25Z

When the interrupt enable message returns an error, the messages are not entirely accurate nor helpful. So improve them. Signed-off-by: Corey Minyard Cc: Andy Lutomirski Signed-off-by: Linus Torvalds

drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow

2013-05-16T20:49:25Z

When calling memcpy, read_data and write_data need additional 2 bytes. write_data: for checking: "if (size > IPMI_MAX_MSG_LENGTH)" for operating: "memcpy(bt->write_data + 3, data + 1, size - 1)" read_data: for checking: "if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH)" for operating: "memcpy(data + 2, bt->read_data + 4, msg_len - 2)" Signed-off-by: Chen Gang Signed-off-by: Corey Minyard Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds

drivers: char: ipmi: Replaced kmalloc and strcpy with kstrdup

2013-05-16T20:49:25Z

Replaced calls to kmalloc followed by strcpy with a sincle call to kstrdup. Patch found using coccinelle. Signed-off-by: Alexandru Gheorghiu Signed-off-by: Corey Minyard Signed-off-by: Linus Torvalds