linux-toradex.git/kernel/relay.c, branch v2.6.25-rc2

relay: nopage

2008-02-06T18:41:07+00:00

Convert relay from nopage to fault.
Remove redundant vma range checks.
Switch from OOM to SIGBUS if the resource is not available.

Signed-off-by: Nick Piggin 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vm audit: add VM_DONTEXPAND to mmap for drivers that need it

2008-02-04T15:55:38+00:00

Drivers that register a ->fault handler, but do not range-check the
offset argument, must set VM_DONTEXPAND in the vm_flags in order to
prevent an expanding mremap from overflowing the resource.

I've audited the tree and attempted to fix these problems (usually by
adding VM_DONTEXPAND where it is not obvious).

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds

whitespace fixes: relayfs

2007-10-18T21:37:24+00:00

Signed-off-by: Daniel Walker 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Fix a use after free bug in kernel->userspace relay file support

2007-07-31T22:39:42+00:00

Coverity spotted what looks like a real possible case of using a variable
after it has been freed.  The problem is in
kernel/relay.c::relay_open_buf()

If the code hits "goto free_buf;" it ends up in this code :

  free_buf:
    	relay_destroy_buf(buf);	<--- calls kfree() on 'buf'.
  free_name:
   	kfree(tmpname);
  end:
  	return buf;		<-- use after free of 'buf'.

I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
me).

The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
problem.

The patch also corrects a reference to a documentation file while
I was at it.

Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.

Signed-off-by: Jesper Juhl 
Acked-by: "David J. Wilder" 
Tested-by: "David J. Wilder" 
Signed-off-by: Mathieu Desnoyers 
Cc: Tom Zanussi 
Cc: Karim Yaghmour 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kernel/relay.c: make functions static

2007-07-19T17:04:47+00:00

Signed-off-by: Adrian Bunk 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

relay: fixup kerneldoc comment

2007-07-13T12:14:28+00:00

Change comment from kerneldoc to normal.

Signed-off-by: Tom Zanussi 
Signed-off-by: Jens Axboe

relay: fix bogus cast in subbuf_splice_actor()

2007-07-13T12:14:26+00:00

The current code that sets the read position in subbuf_splice_actor may
give erroneous results if the buffer size isn't a power of 2.  This
patch fixes the problem.

Signed-off-by: Tom Zanussi 
Signed-off-by: Jens Axboe

pipe: change the ->pin() operation to ->confirm()

2007-07-10T06:04:15+00:00

The name 'pin' was badly chosen, it doesn't pin a pipe buffer
in the most commonly used sense in the kernel. So change the
name to 'confirm', after debating this issue with Hugh
Dickins a bit.

A good return from ->confirm() means that the buffer is really
there, and that the contents are good.

Signed-off-by: Jens Axboe

relay: use splice_to_pipe() instead of open-coding the pipe loop

2007-07-10T06:04:15+00:00

It cleans up the relay splice implementation a lot, and gets rid of
a lot of internal pipe knowledge that should not be in there.

Plus fixes for padding and partial first page (and lots more) from
Tom Zanussi.

Signed-off-by: Jens Axboe

splice: divorce the splice structure/function definitions from the pipe header

2007-07-10T06:04:14+00:00

We need to move even more stuff into the header so that folks can use
the splice_to_pipe() implementation instead of open-coding a lot of
pipe knowledge (see relay implementation), so move to our own header
file finally.

Signed-off-by: Jens Axboe