Skip to content
  1. Jan 07, 2012
  3. Jan 05, 2012
    • Neil Horman's avatar
      firmware: Fix an oops on reading fw_priv->fw in sysfs loading file · eea915bb
      Neil Horman authored 
      This oops was reported recently:
firmware_loading_store+0xf9/0x17b
dev_attr_store+0x20/0x22
sysfs_write_file+0x101/0x134
vfs_write+0xac/0xf3
sys_write+0x4a/0x6e
system_call_fastpath+0x16/0x1b

The complete backtrace was unfortunately not captured, but details can be found
here:
https://bugzilla.redhat.com/show_bug.cgi?id=769920



The cause is fairly clear.

Its caused by the fact that firmware_loading_store has a case 0 in its
switch statement that reads and writes the fw_priv->fw poniter without the
protection of the fw_lock mutex.  since there is a window between the time that
_request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
file is unregistered, its possible for a user space application to race in, and
write a zero to the loading file, causing a NULL dereference in
firmware_loading_store.  Fix it by extending the protection of the fw_lock mutex
to cover all of the firware_loading_store function.

Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      eea915bb
    • K. Y. Srinivasan's avatar
      Drivers:hv: Fix a bug in vmbus_driver_unregister() · 8f257a14
      K. Y. Srinivasan authored 
      

The function vmbus_exists() was introduced recently to deal with cases where
the vmbus driver failed to initialize and yet other Hyper-V drivers attempted
to register with the vmbus bus driver. This patch introduced a bug where
vmbus_driver_unregister() would fail to unregister the driver. This patch
fixes the problem.

Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarFuzhou Chen <fuzhouch@microsoft.com>
Cc: Sasha Levin <levinsasha928@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      8f257a14
    • Greg Kroah-Hartman's avatar
      driver core: remove __must_check from device_create_file · b9d4e714
      Greg Kroah-Hartman authored 
      

With the conversion of the sysdev to a real struct device, more drivers
are calling device_create_file, and some of them don't check the return
value, which isn't wise.

But as they happen to be in parts of the kernel where a warning is
considered an error (i.e. powerpc), this breaks the build.  So for now,
remove the marking on the function, which fixes the build problems.

Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      b9d4e714
  5. Jan 04, 2012
  7. Dec 23, 2011
  9. Dec 22, 2011
  11. Dec 16, 2011
  13. Dec 15, 2011
  15. Dec 14, 2011
    • Peter Zijlstra's avatar
      kref: Remove the memory barriers · 3c8ed889
      Peter Zijlstra authored 
      Commit 1b0b3b99

 ("kref: fix CPU ordering with respect to krefs")
wrongly adds memory barriers to kref.

It states:

  some atomic operations are only atomic, not ordered. Thus a CPU is allowed
  to reorder memory references to an object to before the reference is
  obtained. This fixes it.

While true, it fails to show why this is a problem. I say it is not a
problem because if there is a race with kref_put() such that we could
end up referencing a free'd object without this memory barrier, we
would still have that race with the memory barrier.

The kref_put() in question could complete (and free the object) before
the atomic_inc() and we'd still be up shit creek.

The kref_init() case is even worse, if your object is published at this
time you're so wrong the memory barrier won't make a difference what
so ever. If its not published, the act of publishing should include
the needed barriers/locks to make sure all writes prior to the act of
publishing are complete such that others will only observe a complete
object.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      3c8ed889
    • Peter Zijlstra's avatar
      kref: Implement kref_put in terms of kref_sub · 47dbd7d9
      Peter Zijlstra authored 
      

Less lines of code is better.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      47dbd7d9
    • Peter Zijlstra's avatar
      kref: Inline all functions · 4af679cd
      Peter Zijlstra authored 
      

These are tiny functions, there's no point in having them out-of-line.

Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/n/tip-8eccvi2ur2fzgi00xdjlbf5z@git.kernel.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      4af679cd
  17. Dec 13, 2011
  19. Dec 10, 2011