So I spent a while pounding my head against my monitor trying to figure
out the vmsplice() vulnerability - how could a failure to check for
*read* access turn into a root exploit? It turns out that it's a buffer
overflow problem which is made easy by the way get_user_pages() is
coded.

In particular, "len" is a signed int, and it is only checked at the
*end* of a do {} while() loop.  So, if it is passed in as zero, the loop
will execute once and decrement len to -1.  At that point, the loop will
proceed until the next invalid address is found; in the process, it will
likely overflow the pages array passed in to get_user_pages().

I think that, if get_user_pages() has been asked to grab zero pages,
that's what it should do.  Thus this patch; it is, among other things,
enough to block the (already fixed) root exploit and any others which
might be lurking in similar code.  I also think that the number of pages
should be unsigned, but changing the prototype of this function probably
requires some more careful review.
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  mlx4_core: Fix build break (missing include)

Matt is already the maintainer of SLOB which is one of the "SLAB" allocators in
the kernel so add him to MAINTAINERS.
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  sata_mv: platform driver allocs dma without create
  pata_ninja32: setup changes
  pata_legacy: typo fix
  pata_amd: Note in the module description it handles Nvidia
  sata_mv: fix loop with last port
  libata: ignore deverr on SETXFER if mode is configured
  pata_via: fix SATA cable detection on cx700

This avoids warnings with unreferenced variables in the !NUMA case.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit 313abe55 ("mlx4_core: For 64-bit systems, vmap() kernel queue
buffers") caused this to pop up on powerpc allyesconfig, looks like a
missing include file:

    drivers/net/mlx4/alloc.c: In function 'mlx4_buf_alloc':
    drivers/net/mlx4/alloc.c:162: error: implicit declaration of function 'vmap'
    drivers/net/mlx4/alloc.c:162: error: 'VM_MAP' undeclared (first use in this function)
    drivers/net/mlx4/alloc.c:162: error: (Each undeclared identifier is reported only once
    drivers/net/mlx4/alloc.c:162: error: for each function it appears in.)
    drivers/net/mlx4/alloc.c:162: warning: assignment makes pointer from integer without a cast
    drivers/net/mlx4/alloc.c: In function 'mlx4_buf_free':
    drivers/net/mlx4/alloc.c:187: error: implicit declaration of function 'vunmap'
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

When the sata_mv driver is used as a platform driver,
mv_create_dma_pools() is never called so it fails when trying
to alloc in mv_pool_start().
Signed-off-by: Byron Bradley <byron.bbradley@gmail.com>
Acked-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Forcibly set more of the configuration at init time. This seems to fix at
least one problem reported. We don't know what most of these bits do, but
we do know what windows stuffs there.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This has confused a few people so fix it
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

commit f351b2d6
        sata_mv: Support SoC controllers

cause panic:

scsi 4:0:0:0: Direct-Access     ATA      HITACHI HDS7225S V44O PQ: 0 ANSI: 5
sd 4:0:0:0: [sde] 488390625 512-byte hardware sectors (250056 MB)
sd 4:0:0:0: [sde] Write Protect is off
sd 4:0:0:0: [sde] Mode Sense: 00 3a 00 00
sd 4:0:0:0: [sde] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 4:0:0:0: [sde] 488390625 512-byte hardware sectors (250056 MB)
sd 4:0:0:0: [sde] Write Protect is off
sd 4:0:0:0: [sde] Mode Sense: 00 3a 00 00
sd 4:0:0:0: [sde] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
 sde:<1>BUG: unable to handle kernel NULL pointer dereference at 000000000000001a
IP: [<ffffffff806262c7>] mv_interrupt+0x21c/0x4cc
PGD 0
Oops: 0000 [1] SMP
CPU 3
Modules linked in:
Pid: 0, comm: swapper Not tainted 2.6.24-smp-08636-g0afc2edf-dirty #26
RIP: 0010:[<ffffffff806262c7>]  [<ffffffff806262c7>] mv_interrupt+0x21c/0x4cc
RSP: 0000:ffff8102050bbec8  EFLAGS: 00010297
RAX: 0000000000000008 RBX: 0000000000000000 RCX: 0000000000000003
RDX: 0000000000008000 RSI: 0000000000000286 RDI: ffff8102035180e0
RBP: 0000000000000001 R08: 0000000000000003 R09: ffff8102036613e0
R10: 0000000000000002 R11: ffffffff8061474c R12: ffff8102035bf828
R13: 0000000000000008 R14: ffff81020348ece8 R15: ffffc20002cb2000
FS:  0000000000000000(0000) GS:ffff810405025700(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 000000000000001a CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff810405094000, task ffff8102050b28c0)
Stack:  000000010000000c 0002040000220400 0000001100000002 ffff81020348eda8
 0000000000000001 ffff8102035f2cc0 0000000000000000 0000000000000000
 0000000000000018 0000000000000000 0000000000000000 ffffffff80269ee8
Call Trace:
 <IRQ>  [<ffffffff80269ee8>] ? handle_IRQ_event+0x25/0x53
 [<ffffffff8026b393>] ? handle_fasteoi_irq+0x90/0xc8
 [<ffffffff802218e2>] ? do_IRQ+0xf1/0x15f
 [<ffffffff8021df24>] ? default_idle+0x0/0x55
 [<ffffffff8021f361>] ? ret_from_intr+0x0/0xa
 <EOI>  [<ffffffff8023010c>] ? lapic_next_event+0x0/0xa
 [<ffffffff8021df55>] ? default_idle+0x31/0x55
 [<ffffffff8021df50>] ? default_idle+0x2c/0x55
 [<ffffffff8021df24>] ? default_idle+0x0/0x55
 [<ffffffff8021e00b>] ? cpu_idle+0x92/0xb8

Code: 41 14 85 c0 89 44 24 14 0f 84 9d 02 00 00 f7 d0 01 d6 41 89 d5 89 41 14 8b 41 14 89 34 24 e9 7e 02 00 00 49 63 c5 49 8b 5c c6 48 <f6> 43 1a 80 4c 8b a3 20 37 00 00 0f 85 62 02 00 00 31 c9 41 83
RIP  [<ffffffff806262c7>] mv_interrupt+0x21c/0x4cc
 RSP <ffff8102050bbec8>
CR2: 000000000000001a
---[ end trace 2583b5f7a5350584 ]---
Kernel panic - not syncing: Aiee, killing interrupt handler!

last_port already include port0 base.
this patch change use last_port directly, and move pp assignment later.
Signed-off-by: Yinghai Lu <yinghai.lu@sun.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Some controllers (VIA CX700) raise device error on SETXFER even after
mode configuration succeeded.  Update ata_dev_set_mode() such that
device error is ignored if transfer mode is configured correctly.  To
implement this, device is revalidated even after device error on
SETXFER.

This fixes kernel bugzilla bug 8563.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The first port of cx700 is SATA.  Fix cable detection.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

pageattr-test.c contains a noisy debug printk that people reported.
The condition under which it prints (randomly tapping into a mem_map[]
hole and not being able to c_p_a() there) is valid behavior and not
interesting to report.

Remove it.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild:
  kbuild: fix make V=1

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  selinux: support 64-bit capabilities

Without this patch a Opteron test system here oopses at boot with
current git.

Calling to_pci_dev() on a NULL pointer gives a negative value so the
following NULL pointer check never triggers and then an illegal address
is referenced.  Check the unadjusted original device pointer for NULL
instead.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://linux-nfs.org/~bfields/linux:
  SUNPRC: Fix printk format warning
  nfsd: clean up svc_reserve_auth()
  NLM: don't requeue block if it was invalidated while GRANT_MSG was in flight
  NLM: don't reattempt GRANT_MSG when there is already an RPC in flight
  NLM: have server-side RPC clients default to soft RPC tasks
  NLM: set RPC_CLNT_CREATE_NOPING for NLM RPC clients

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: remove stale comment from ide-lib.c
  ide: fix comment in init_irq()
  ide: ide_init_port() bugfix
  ide-disk: fix flush requests (take 2)
  ide: introduce CONFIG_BLK_DEV_IDEDMA_SFF option
  bast-ide: build fix
  ide-tape: remove never executed code
  ide: fix ide/legacy/gayle.c compilation
  ide-cd: replace ntohs with generic byteorder macro be16_to_cpu
  ide: remove stale version number
  pdc202xx_old: always enable burst mode
  palm_bk3710: use struct ide_port_info
  palm_bk3710: port initialization/probing bugfix
  palm_bk3710: fix ide_unregister() usage
  palm_bk3710: ide_register_hw() -> ide_device_add()
  ide: insert BUG_ON() into __ide_set_handler() (take 2)
  cs5520: remove stale comment
  ide: another possible ide panic fix for blk-end-request

When make -s support were added to filechk to
combination created with make V=1 were not
covered.
Fix it by explicitly cover this case too.
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Mike Frysinger <vapier@gentoo.org>

Since we may not have a pci_dev for the device we need to access, we can't
use pci_read_config_word.  But raw_pci_read is an internal implementation
detail; it's better to use the architected pci_bus_read_config_word
interface.  Using PCI_DEVFN instead of a mysterious constant helps
reassure everyone that we really do intend to access device 8.

[ Thanks to Grant Grundler for pointing out to me that this is exactly
  what the write immediately above this is doing -- enabling device 8 to
  respond to config space cycles.
					- Matthew

  Grant also says:

	"Can you also add a comment which points at the Intel
	 documentation?

	 The 'Intel E7320 Memory Controller Hub (MCH) Datasheet' at

	  http://download.intel.com/design/chipsets/datashts/30300702.pdf

	 Page 69 documents register F4h (DEVPRES1).

	 And I just doubled checked that the 0xf4 register value is
	 restored later in the quirk (obvious when you look at the code
	 but not from the patch"

  so here it is.
					 - Linus ]
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Acked-by: Grant Grundler <grundler@parisc-linux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix SELinux to handle 64-bit capabilities correctly, and to catch
future extensions of capabilities beyond 64 bits to ensure that SELinux
is properly updated.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

APUS support is gone...
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

On Sunday 10 February 2008, Atsushi Nemoto wrote:
> On Sun, 06 Jan 2008 18:03:10 +0100, Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> wrote:
> > +	/* reset DMA masks only for SFF-style DMA controllers */
> > +	if ((d->host_flags && IDE_HFLAG_NO_DMA) == 0 && hwif->dma_base == 0)
> > +		hwif->swdma_mask = hwif->mwdma_mask = hwif->ultra_mask = 0;
> 
> It might be too late, but "host_flags && IDE_HFLAGS_NO_DMA" seems
> wrong for me.

Fix regression caused by commmit c413b9b9
("ide: add struct ide_port_info instances to legacy host drivers").
Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 813a0eb2
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Fri Jan 25 22:17:10 2008 +0100

    ide: switch idedisk_prepare_flush() to use REQ_TYPE_ATA_TASKFILE requests

...

broke flush requests.

Allocating IDE command structure on the stack for flush requests is not
a very brilliant idea:

- idedisk_prepare_flush() only prepares the request and it doesn't wait
  for it to be completed

- there are can be multiple flush requests queued in the queue

Fix the problem (per hints from James Bottomley) by:
- dynamically allocating ide_task_t instance using kmalloc(..., GFP_ATOMIC)
- adding new taskfile flag (IDE_TFLAG_DYN)
- calling kfree() in ide_end_drive_command() if IDE_TFLAG_DYN is set
  (while at it rename 'args' to 'task' and fix whitespace damage)

[ This will be fixed properly before 2.6.25 but this bug is rather
  critical and the proper solution requires some more work + testing. ]

Thanks to Sebastian Siewior and Christoph Hellwig for reporting the
problem and testing patches (extra thanks to Sebastian for bisecting
it to the guilty commmit).
Tested-by: Sebastian Siewior <ide-bug@ml.breakpoint.cc>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Tejun Heo <htejun@gmail.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Introduce new option CONFIG_BLK_DEV_IDEDMA_SFF for non-PCI SFF-8038i compatible
bus mastering IDE controllers (which there are a few known), thus fixing a hack
made for Palmchip BK3710 controller...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: Anton Salnikov <asalnikov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

On Saturday 09 February 2008, Adrian Bunk wrote:
> Commit 9e016a71 causes the following 
> compile error:
> 
> <--  snip  -->
> 
> ...
>   CC      drivers/ide/arm/bast-ide.o
> /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ide/arm/bast-ide.c: In function 'bastide_register':
> /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ide/arm/bast-ide.c:31: error: 'hwif' redeclared as different kind of symbol
> /home/bunk/linux/kernel-2.6/git/linux-2.6/drivers/ide/arm/bast-ide.c:29: error: previous definition of 'hwif' was here
> make[4]: *** [drivers/ide/arm/bast-ide.o] Error 1
> 
> <--  snip  -->

Remove 'ide_hwif_t **hwif' argument from bastide_register()
(together with write-only ifs[]).

Cc: Adrian Bunk <bunk@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

rq->cmd[0] is never set to REQ_IDETAPE_READ_BUFFER so remove
REQ_IDETAPE_READ_BUFFER handling from idetape_create_write_cmd()
and the define itself.

Then remove no longer used idetape_create_read_buffer_cmd()
and IDETAPE_RETRIEVE_FAULTY_BLOCK define.

There should be no functional changes caused by this patch.

Cc: Borislav Petkov <petkovbb@gmail.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Signed-off-by: Borislav Petkov <petkovbb@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

On Thursday 03 January 2008, Robert Hancock wrote:

[...]

> How about getting rid of this stupid thing in drivers/ide/ide.c:
> 
> #define       REVISION        "Revision: 7.00alpha2"
> 
> which is used in:
> 
> printk(KERN_INFO "Uniform Multi-Platform E-IDE driver " REVISION "\n");
> 
> It's been 7.00alpha2 for god knows how long, so clearly this version 
> number is not useful..

Cc: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Alan has noticed that distros always enabled burst mode
(+ datasheet confirms that it is the right thing to do).

Thus fix pdc202xx_old host driver to do it unconditionally
and remove no longer needed CONFIG_PDC202XX_BURST option.

Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

* Factor out cable detection to palm_bk3710_cable_detect().

* Add palm_bk3710_init_hwif() (->init_hwif method implementation).

* Remove needless ->quirkproc initialization.

* Add missing ->pio_mask initialization.

* Use ATA_* defines for setting ->{ultra,mwdma}_mask.

* Add 'struct ide_port_info palm_bk3710_port_info' and pass it to
  ide_device_add().  Then remove open-coded 'hwif' initialization.

Cc: Anton Salnikov <asalnikov@ru.mvista.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Probe port _after_ it is fully initialized.

Cc: Anton Salnikov <asalnikov@ru.mvista.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Don't set 'restore' flag for ide_unregister() when initializing new
interface.

[ identical change as done to bast-ide/ide-cs/delkin_cb host drivers
  by commit 909f4369 ]

Cc: Anton Salnikov <asalnikov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

* Convert palm_bk3710 host driver to use ide_device_add() instead of
  ide_register_hw() (while at it drop doing "ide_unregister()" loop which
  tries to unregister _all_ IDE interfaces if useable ide_hwifs[] slot
  cannot be find).

  [ identical change as done to bast-ide/ide-cs/delkin_cb host drivers
    by commit 9e016a71 ]

* Rename 'ide_ctlr_info' to 'hw' and 'index' to 'i' while at it.

Cc: Anton Salnikov <asalnikov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Replace the check for hwgroup->handler and printk(KERN_CRIT, ...) at the start
of __ide_set_handler() with mere BUG_ON() while removing such from the caller,
ide_execute_command(). Fix up the code formatting, while at it...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Remove stale comment from the cs5520 IDE driver.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

I have reviewed all blk-end-request patches again to confirm whether
there are any similar problems with the last week's ide-cd panic:
    http://lkml.org/lkml/2008/1/29/140

And I found a possible similar bug in ide-io change:
ide_end_drive_cmd() could be called for blk_pc_request() which could
have bios.  To complete such requests correctly, we need to pass
the actual size of the request.
Otherwise, __blk_end_request() returns 1 because the request still has
bios, and the system will BUG() unnecessarily.

The following patch fixes the bug and should be applied on top of
Linus' git.
Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: Borislav Petkov <petkovbb@googlemail.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>