linux-toradex.git/arch/ia64, branch v2.6.16.33-rc1 Linux kernel for Apalis and Colibri modules ia64/sparc: fix local DoS with corrupted ELFs (CVE-2006-4538) 2006-11-11T00:08:49+00:00 Kirill Korotaev dev@openvz.org 2006-11-11T00:08:49+00:00 05c19c4369b40357c726a224fe51a3f5ff21f9bd This patch prevents cross-region mappings on IA64 and SPARC which could lead to system crash. Adrian Bunk: Adapted to 2.6.16. Signed-Off-By: Kirill Korotaev <dev@openvz.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
This patch prevents cross-region mappings
on IA64 and SPARC which could lead to system crash.

Adrian Bunk:
Adapted to 2.6.16.

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[IA64] correct file descriptor reference counting in perfmon (CVE-2006-3741) 2006-10-17T12:50:56+00:00 Stephane Eranian eranian@hpl.hp.com 2006-10-17T12:50:56+00:00 61dd5c3368db90edf32a5ceb4dde76cc18f34009 Fix a bug in sys_perfmonctl() whereby it was not correctly decrementing the file descriptor reference count. Signed-off-by: Stephane Eranian <eranian@hpl.hp.com> Signed-off-by: Tony Luck <tony.luck@intel.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Fix a bug in sys_perfmonctl() whereby it was not correctly
decrementing the file descriptor reference count.

Signed-off-by: Stephane Eranian <eranian@hpl.hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
ia64 SGI-SN2: fix silent data corruption caused by XPC 2006-09-06T17:25:46+00:00 Dean Nelson dcn@sgi.com 2006-09-06T17:25:46+00:00 c1646ad43e8273c4748ce2d4be2ec71f9329dbbd Jack Steiner identified a problem where XPC can cause a silent data corruption. On module load, the placement may cause the xpc_remote_copy_buffer to span two physical pages. DMA transfers are done to the start virtual address translated to physical. This patch changes the buffer from a statically allocated buffer to a kmalloc'd buffer. Dean Nelson reviewed this before posting. I have tested it in the configuration that was showing the memory corruption and verified it works. I also added a BUG_ON statement to help catch this if a similar situation is encountered. Signed-off-by: Robin Holt <holt@sgi.com> Signed-off-by: Dean Nelson <dcn@sgi.com> Signed-off-by: Jack Steiner <steiner@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Jack Steiner identified a problem where XPC can cause a silent
data corruption.  On module load, the placement may cause the
xpc_remote_copy_buffer to span two physical pages.  DMA transfers are
done to the start virtual address translated to physical.

This patch changes the buffer from a statically allocated buffer to a
kmalloc'd buffer.  Dean Nelson reviewed this before posting.  I have
tested it in the configuration that was showing the memory corruption
and verified it works.  I also added a BUG_ON statement to help catch
this if a similar situation is encountered.

Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Dean Nelson <dcn@sgi.com>
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
memory hotplug: solve config broken: undefined reference to `online_page' 2006-08-08T15:35:33+00:00 Yasunori Goto y-goto@jp.fujitsu.com 2006-08-08T15:35:33+00:00 5443cf44e9f256b5bd85b7ea621ccb179c4217d3 Memory hotplug code of i386 adds memory to only highmem. So, if CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set. Otherwise, it causes compile error. In addition, many architecture can't use memory hotplug feature yet. So, I introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG. Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> 
Memory hotplug code of i386 adds memory to only highmem.  So, if
CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set.
Otherwise, it causes compile error.

In addition, many architecture can't use memory hotplug feature yet.  So, I
introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG.

Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
[IA64] Fix race in the accessed/dirty bit handlers 2006-03-09T00:07:55+00:00 Christoph Lameter clameter@engr.sgi.com 2006-03-08T03:05:32+00:00 d8117ce5a679ff1f48df247da30fb62c16d562c5 A pte may be zapped by the swapper, exiting process, unmapping or page migration while the accessed or dirty bit handers are about to run. In that case the accessed bit or dirty is set on an zeroed pte which leads the VM to conclude that this is a swap pte. This may lead to - Messages from the vm like swap_free: Bad swap file entry 4000000000000000 - Processes being aborted swap_dup: Bad swap file entry 4000000000000000 VM: killing process .... Page migration is particular suitable for the creation of this race since it needs to remove and restore page table entries. The fix here is to check for the present bit and simply not update the pte if the page is not present anymore. If the page is not present then the fault handler should run next which will take care of the problem by bringing the page back and then mark the page dirty or move it onto the active list. Signed-off-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com> 
A pte may be zapped by the swapper, exiting process, unmapping or page
migration while the accessed or dirty bit handers are about to run. In that
case the accessed bit or dirty is set on an zeroed pte which leads the VM to
conclude that this is a swap pte. This may lead to

- Messages from the vm like

swap_free: Bad swap file entry 4000000000000000

- Processes being aborted

swap_dup: Bad swap file entry 4000000000000000
VM: killing process ....

Page migration is particular suitable for the creation of this race since
it needs to remove and restore page table entries.

The fix here is to check for the present bit and simply not update
the pte if the page is not present anymore. If the page is not present
then the fault handler should run next which will take care of the problem
by bringing the page back and then mark the page dirty or move it onto the
active list.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[IA64] mca recovery return value when no bus check 2006-03-07T23:40:06+00:00 Russ Anderson rja@efs.americas.sgi.com 2006-03-03T22:42:26+00:00 e1c48554ae295de984eee83a7798e7fb394a1629 When there is no bus check, the return code should be failure, not success. Signed-off-by: Russ Anderson (rja@sgi.com) Signed-off-by: Tony Luck <tony.luck@intel.com> 
When there is no bus check, the return code should be failure, not success.

Signed-off-by: Russ Anderson (rja@sgi.com)
Signed-off-by: Tony Luck <tony.luck@intel.com>
[IA64] don't report !sn2 or !summit hardware as an error 2006-03-07T23:26:49+00:00 Bjorn Helgaas bjorn.helgaas@hp.com 2006-03-03T22:33:47+00:00 6c5e62159cdef89d8385958c9d8c88efa867110c This stuff is all in the generic ia64 kernel, and the new initcall error reporting complains about them. Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Signed-off-by: Tony Luck <tony.luck@intel.com> 
This stuff is all in the generic ia64 kernel, and the new initcall error
reporting complains about them.

Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[IA64] gensparse_defconfig: turn on PNPACPI 2006-03-07T23:25:29+00:00 Bjorn Helgaas bjorn.helgaas@hp.com 2006-03-02T23:59:50+00:00 57ebc9918f8747c9db7e65659dfd632d4db99e3a Turn on CONFIG_PNPACPI. I recently removed 8250_acpi.c. All devices previously claimed by 8250_acpi.c should now be claimed by 8250_pnp.c. This depends on having CONFIG_PNPACPI so ACPI devices show up as PNP devices. All other ia64 defconfigs either have CONFIG_PNPACPI already, or don't have 8250 support turned on at all. Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Signed-off-by: Tony Luck <tony.luck@intel.com> 
Turn on CONFIG_PNPACPI.  I recently removed 8250_acpi.c.  All devices
previously claimed by 8250_acpi.c should now be claimed by 8250_pnp.c.
This depends on having CONFIG_PNPACPI so ACPI devices show up as PNP
devices.

All other ia64 defconfigs either have CONFIG_PNPACPI already, or
don't have 8250 support turned on at all.

Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[IA64] Increase severity of MCA recovery messages 2006-03-07T23:23:25+00:00 Russ Anderson rja@sgi.com 2006-03-07T23:23:25+00:00 ea0e92a613a1caf85583c83cd131cef7d0f5571d The MCA recovery messages are currently KERN_DEBUG, so they don't show up in /var/log/messages (by default). Increase the severity to KERN_ERR, for the initial message (and also add the physical address to this message). Leave the successful isolation message as KERN_DEBUG, but increase the severity when isolation fails to KERN_CRIT. [Russ' patch made these all KERN_CRIT] Signed-off-by: Russ Anderson (rja@sgi.com) Signed-off-by: Tony Luck <tony.luck@intel.com> 
The MCA recovery messages are currently KERN_DEBUG,
so they don't show up in /var/log/messages (by default).
Increase the severity to KERN_ERR, for the initial
message (and also add the physical address to this
message). Leave the successful isolation message as
KERN_DEBUG, but increase the severity when isolation
fails to KERN_CRIT.

[Russ' patch made these all KERN_CRIT]

Signed-off-by: Russ Anderson (rja@sgi.com)
Signed-off-by: Tony Luck <tony.luck@intel.com>
[IA64] sysctl option to silence unaligned trap warnings 2006-02-28T17:42:23+00:00 Jes Sorensen jes@sgi.com 2006-02-28T17:42:23+00:00 d2b176ed878d4d5fcc0bd35656dfd373f3702af9 Allow sysadmin to disable all warnings about userland apps making unaligned accesses by using: # echo 1 > /proc/sys/kernel/ignore-unaligned-usertrap Rather than having to use prctl on a process by process basis. Default behaivour leaves the warnings enabled. Signed-off-by: Jes Sorensen <jes@sgi.com> Signed-off-by: Tony Luck <tony.luck@intel.com> 
Allow sysadmin to disable all warnings about userland apps
making unaligned accesses by using:
 # echo 1 > /proc/sys/kernel/ignore-unaligned-usertrap
Rather than having to use prctl on a process by process basis.

Default behaivour leaves the warnings enabled.

Signed-off-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>