linux-toradex.git/drivers/char, branch v2.6.33.1

tty: Fix the ldisc hangup race

2010-03-15T16:06:26+00:00

commit 638b9648ab51c9c549ff5735d3de519ef6199df3 upstream.

This was noticed by Matthias Urlichs and he proposed a fix. This patch
does the fixing a different way to avoid introducing several new race
conditions into the code.

The problem case is TTY_DRIVER_RESET_TERMIOS = 0. In that case while we
abort the ldisc change, the hangup processing has not cleaned up and restarted
the ldisc either.

We can't restart the ldisc stuff in the set_ldisc as we don't know what
the hangup did and may touch stuff we shouldn't as we are no longer
supposed to influence the tty at that point in case it has been re-opened
before we get rescheduled.

Instead do it the simple way. Always re-init the ldisc on the hangup, but
use TTY_DRIVER_RESET_TERMIOS to indicate that we should force N_TTY.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2010-02-11T22:01:10+00:00

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86, apic: Don't use logical-flat mode when CPU hotplug may exceed 8 CPUs
  x86-32: Make AT_VECTOR_SIZE_ARCH=2
  x86/agp: Fix amd64-agp module initialization regression
  x86, doc: Fix minor spelling error in arch/x86/mm/gup.c

tpm_infineon: fix suspend/resume handler for pnp_driver

2010-02-11T21:59:42+00:00

When suspending, tpm_infineon calls the generic suspend function of the
TPM framework.  However, the TPM framework does not return and the system
hangs upon suspend.  When sending the necessary command "TPM_SaveState"
directly within the driver, suspending and resuming works fine.

Signed-off-by: Marcel Selhorst 
Cc: OGAWA Hirofumi 
Cc: Debora Velarde 
Cc: Rajiv Andrade 
Cc: 		[2.6.32.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Fix race in tty_fasync() properly

2010-02-07T18:26:01+00:00

This reverts commit 703625118069 ("tty: fix race in tty_fasync") and
commit b04da8bfdfbb ("fnctl: f_modown should call write_lock_irqsave/
restore") that tried to fix up some of the fallout but was incomplete.

It turns out that we really cannot hold 'tty->ctrl_lock' over calling
__f_setown, because not only did that cause problems with interrupt
disables (which the second commit fixed), it also causes a potential
ABBA deadlock due to lock ordering.

Thanks to Tetsuo Handa for following up on the issue, and running
lockdep to show the problem.  It goes roughly like this:

 - f_getown gets filp->f_owner.lock for reading without interrupts
   disabled, so an interrupt that happens while that lock is held can
   cause a lockdep chain from f_owner.lock -> sighand->siglock.

 - at the same time, the tty->ctrl_lock -> f_owner.lock chain that
   commit 703625118069 introduced, together with the pre-existing
   sighand->siglock -> tty->ctrl_lock chain means that we have a lock
   dependency the other way too.

So instead of extending tty->ctrl_lock over the whole __f_setown() call,
we now just take a reference to the 'pid' structure while holding the
lock, and then release it after having done the __f_setown.  That still
guarantees that 'struct pid' won't go away from under us, which is all
we really ever needed.

Reported-and-tested-by: Tetsuo Handa 
Acked-by: Greg Kroah-Hartman 
Acked-by: Américo Wang 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds

x86/agp: Fix amd64-agp module initialization regression

2010-02-04T06:27:26+00:00

This fixes the regression introduced by commit
42590a75019a50012f25a962246498dead428433 ("x86/agp: Fix
agp_amd64_init and agp_amd64_cleanup").

The commit 61684ceaad4f65d1a9832c722f7bd5e7fc714de9 fixed the
above regression but it's not enough. When amd64-agp is built as
a module, AGP isn't initialized, iommu is initialized, all the
aperture is owned by the iommu.

Reported-by: Marin Mitov 
Signed-off-by: FUJITA Tomonori 
Tested-by: Marin Mitov 
LKML-Reference: <20100204090802S.fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Ingo Molnar

devmem: fix kmem write bug on memory holes

2010-02-03T02:11:22+00:00

write_kmem() used to assume vwrite() always return the full buffer length.
However now vwrite() could return 0 to indicate memory hole.  This
creates a bug that "buf" is not advanced accordingly.

Fix it to simply ignore the return value, hence the memory hole.

Signed-off-by: Wu Fengguang 
Cc: Andi Kleen 
Cc: Benjamin Herrenschmidt 
Cc: Christoph Lameter 
Cc: Ingo Molnar 
Cc: Tejun Heo 
Cc: Nick Piggin 
Cc: KAMEZAWA Hiroyuki 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devmem: check vmalloc address on kmem read/write

2010-02-03T02:11:22+00:00

Otherwise vmalloc_to_page() will BUG().

This also makes the kmem read/write implementation aligned with mem(4):
"References to nonexistent locations cause errors to be returned." Here we
return -ENXIO (inspired by Hugh) if no bytes have been transfered to/from
user space, otherwise return partial read/write results.

Signed-off-by: KAMEZAWA Hiroyuki 
Signed-off-by: Wu Fengguang 
Cc: Greg Kroah-Hartman 
Cc: Hugh Dickins 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

2010-02-02T20:48:49+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  random: Remove unused inode variable
  crypto: padlock-sha - Add import/export support
  random: drop weird m_time/a_time manipulation

random: Remove unused inode variable

2010-02-01T19:50:27+00:00

The previous changeset left behind an unused inode variable.
This patch removes it.

Reported-by: Stephen Rothwell 
Signed-off-by: Herbert Xu

random: drop weird m_time/a_time manipulation

2010-02-01T19:50:23+00:00

No other driver does anything remotely like this that I know of except
for the tty drivers, and I can't see any reason for random/urandom to do
it. In fact, it's a (trivial, harmless) timing information leak. And
obviously, it generates power- and flash-cycle wasting I/O, especially
if combined with something like hwrngd. Also, it breaks ubifs's
expectations.

Signed-off-by: Matt Mackall 
Signed-off-by: Herbert Xu