linux-toradex.git/kernel/relay.c, branch v2.6.25.20

relay: fix "full buffer with exactly full last subbuffer" accounting problem

2008-08-20T18:15:23+00:00

commit 32194450330be327f3b25bf6b66298bd122599e9 upstream

In relay's current read implementation, if the buffer is completely full
but hasn't triggered the buffer-full condition (i.e. the last write
didn't cross the subbuffer boundary) and the last subbuffer is exactly
full, the subbuffer accounting code erroneously finds nothing available.
This patch fixes the problem.

Signed-off-by: Tom Zanussi 
Cc: Eduard - Gabriel Munteanu 
Cc: Pekka Enberg 
Cc: Jens Axboe 
Cc: Mathieu Desnoyers 
Cc: Andrea Righi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

relay: set an spd_release() hook for splice

2008-03-26T11:04:09+00:00

relay doesn't reference the pages it adds, however we need a non-NULL
hook or splice_to_pipe() can oops.

Signed-off-by: Jens Axboe

set relay file can not be read by pread(2)

2008-03-26T11:01:28+00:00

I found that relay files can be read by pread(2). I fix it,
for relay files are not capable of seeking.

Signed-off-by: Lai Jiangshan 
Signed-off-by: Jens Axboe

relay: fix subbuf_splice_actor() adding too many pages

2008-03-17T08:04:59+00:00

If subbuf_pages was larger than the max number of pages the pipe
buffer will hold, subbuf_splice_actor() would happily go beyond
the array size.

Signed-off-by: Jens Axboe

relay: nopage

2008-02-06T18:41:07+00:00

Convert relay from nopage to fault.
Remove redundant vma range checks.
Switch from OOM to SIGBUS if the resource is not available.

Signed-off-by: Nick Piggin 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vm audit: add VM_DONTEXPAND to mmap for drivers that need it

2008-02-04T15:55:38+00:00

Drivers that register a ->fault handler, but do not range-check the
offset argument, must set VM_DONTEXPAND in the vm_flags in order to
prevent an expanding mremap from overflowing the resource.

I've audited the tree and attempted to fix these problems (usually by
adding VM_DONTEXPAND where it is not obvious).

Signed-off-by: Nick Piggin 
Signed-off-by: Linus Torvalds

whitespace fixes: relayfs

2007-10-18T21:37:24+00:00

Signed-off-by: Daniel Walker 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Fix a use after free bug in kernel->userspace relay file support

2007-07-31T22:39:42+00:00

Coverity spotted what looks like a real possible case of using a variable
after it has been freed.  The problem is in
kernel/relay.c::relay_open_buf()

If the code hits "goto free_buf;" it ends up in this code :

  free_buf:
    	relay_destroy_buf(buf);	<--- calls kfree() on 'buf'.
  free_name:
   	kfree(tmpname);
  end:
  	return buf;		<-- use after free of 'buf'.

I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
me).

The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
problem.

The patch also corrects a reference to a documentation file while
I was at it.

Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.

Signed-off-by: Jesper Juhl 
Acked-by: "David J. Wilder" 
Tested-by: "David J. Wilder" 
Signed-off-by: Mathieu Desnoyers 
Cc: Tom Zanussi 
Cc: Karim Yaghmour 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kernel/relay.c: make functions static

2007-07-19T17:04:47+00:00

Signed-off-by: Adrian Bunk 
Cc: Tom Zanussi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

relay: fixup kerneldoc comment

2007-07-13T12:14:28+00:00

Change comment from kerneldoc to normal.

Signed-off-by: Tom Zanussi 
Signed-off-by: Jens Axboe