1. 20 Mar, 2013 5 commits
  2. 18 Mar, 2013 3 commits
  3. 17 Mar, 2013 1 commit
  4. 15 Mar, 2013 5 commits
  5. 14 Mar, 2013 1 commit
  6. 12 Mar, 2013 3 commits
  7. 11 Mar, 2013 1 commit
    • Takashi Iwai's avatar
      ALSA: seq: Fix missing error handling in snd_seq_timer_open() · 66efdc71
      Takashi Iwai authored
      snd_seq_timer_open() didn't catch the whole error path but let through
      if the timer id is a slave.  This may lead to Oops by accessing the
      uninitialized pointer.
      
       BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae
       IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
       PGD 785cd067 PUD 76964067 PMD 0
       Oops: 0002 [#4] SMP
       CPU 0
       Pid: 4288, comm: trinity-child7 Tainted: G      D W 3.9.0-rc1+ #100 Bochs Bochs
       RIP: 0010:[<ffffffff819b3477>]  [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
       RSP: 0018:ffff88006ece7d38  EFLAGS: 00010246
       RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000
       RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38
       RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe
       R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
       R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007
       FS:  00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0
       DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
       DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
       Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290)
       Stack:
        0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d
        65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000
        ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520
       Call Trace:
        [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
        [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70
        [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120
        [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0
        [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20
        [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570
        [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0
        [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
        [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0
        [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
        [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b
      Reported-and-tested-by: default avatarTommi Rantala <tt.rantala@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      66efdc71
  8. 07 Mar, 2013 10 commits
  9. 06 Mar, 2013 1 commit
  10. 05 Mar, 2013 2 commits
  11. 04 Mar, 2013 1 commit
    • Dan Carpenter's avatar
      ALSA: seq: seq_oss_event: missing range checks · 85c50a58
      Dan Carpenter authored
      The "dev" variable could be out of bounds.  Calling
      snd_seq_oss_synth_is_valid() checks that it is is a valid device
      which has been opened.  We check this inside set_note_event() so
      this function can't succeed without a valid "dev".  But we need to
      do the check earlier to prevent invalid dereferences and memory
      corruption.
      
      One call tree where "dev" could be out of bounds is:
      -> snd_seq_oss_oob_user()
         -> snd_seq_oss_process_event()
            -> extended_event()
               -> note_on_event()
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      85c50a58
  12. 03 Mar, 2013 7 commits
    • Linus Torvalds's avatar
      Linux 3.9-rc1 · 6dbe51c2
      Linus Torvalds authored
      6dbe51c2
    • Linus Torvalds's avatar
      Merge tag 'disintegrate-fbdev-20121220' of git://git.infradead.org/users/dhowells/linux-headers · ea882c2e
      Linus Torvalds authored
      Pull fbdev UAPI disintegration from David Howells:
       "You'll be glad to here that the end is nigh for the UAPI patches.
        Only the fbdev/framebuffer piece remains now that the SCSI stuff has
        gone in.
      
        Here are the UAPI disintegration bits for the fbdev drivers.  It
        appears that Florian hasn't had time to deal with my patch, but back
        in December he did say he didn't mind if I pushed it forward."
      
      Yay.  No more uapi movement.  And hopefully no more big header file
      cleanups coming up either, it just tends to be very painful.
      
      * tag 'disintegrate-fbdev-20121220' of git://git.infradead.org/users/dhowells/linux-headers:
        UAPI: (Scripted) Disintegrate include/video
      ea882c2e
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.9-rc1-tag' of... · 8e8b180a
      Linus Torvalds authored
      Merge tag 'stable/for-linus-3.9-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
      
      Pull Xen bug-fixes from Konrad Rzeszutek Wilk:
       - Update the Xen ACPI memory and CPU hotplug locking mechanism.
       - Fix PAT issues wherein various applications would not start
       - Fix handling of multiple MSI as AHCI now does it.
       - Fix ARM compile failures.
      
      * tag 'stable/for-linus-3.9-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
        xenbus: fix compile failure on ARM with Xen enabled
        xen/pci: We don't do multiple MSI's.
        xen/pat: Disable PAT using pat_enabled value.
        xen/acpi: xen cpu hotplug minor updates
        xen/acpi: xen memory hotplug minor updates
      8e8b180a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 56a79b7b
      Linus Torvalds authored
      Pull  more VFS bits from Al Viro:
       "Unfortunately, it looks like xattr series will have to wait until the
        next cycle ;-/
      
        This pile contains 9p cleanups and fixes (races in v9fs_fid_add()
        etc), fixup for nommu breakage in shmem.c, several cleanups and a bit
        more file_inode() work"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        constify path_get/path_put and fs_struct.c stuff
        fix nommu breakage in shmem.c
        cache the value of file_inode() in struct file
        9p: if v9fs_fid_lookup() gets to asking server, it'd better have hashed dentry
        9p: make sure ->lookup() adds fid to the right dentry
        9p: untangle ->lookup() a bit
        9p: double iput() in ->lookup() if d_materialise_unique() fails
        9p: v9fs_fid_add() can't fail now
        v9fs: get rid of v9fs_dentry
        9p: turn fid->dlist into hlist
        9p: don't bother with private lock in ->d_fsdata; dentry->d_lock will do just fine
        more file_inode() open-coded instances
        selinux: opened file can't have NULL or negative ->f_path.dentry
      
      (In the meantime, the hlist traversal macros have changed, so this
      required a semantic conflict fixup for the newly hlistified fid->dlist)
      56a79b7b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 1c82315a
      Linus Torvalds authored
      Pull btrfs fixup from Chris Mason:
       "Geert and James both sent this one in, sorry guys"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        btrfs/raid56: Add missing #include <linux/vmalloc.h>
      1c82315a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 530ede14
      Linus Torvalds authored
      Pull second set of s390 patches from Martin Schwidefsky:
       "The main part of this merge are Heikos uaccess patches.  Together with
        commit 09884964 ("mm: do not grow the stack vma just because of an
        overrun on preceding vma") the user string access is hopefully fixed
        for good.
      
        In addition some bug fixes and two cleanup patches."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/module: fix compile warning
        qdio: remove unused parameters
        s390/uaccess: fix kernel ds access for page table walk
        s390/uaccess: fix strncpy_from_user string length check
        input: disable i8042 PC Keyboard controller for s390
        s390/dis: Fix invalid array size
        s390/uaccess: remove pointless access_ok() checks
        s390/uaccess: fix strncpy_from_user/strnlen_user zero maxlen case
        s390/uaccess: shorten strncpy_from_user/strnlen_user
        s390/dasd: fix unresponsive device after all channel paths were lost
        s390/mm: ignore change bit for vmemmap
        s390/page table dumper: add support for change-recording override bit
      530ede14
    • Linus Torvalds's avatar
      Merge branch 'fixes-for-3.9-latest' of... · 6977c6fc
      Linus Torvalds authored
      Merge branch 'fixes-for-3.9-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
      
      Pull second round of PARISC updates from Helge Deller:
       "The most important fix in this branch is the switch of io_setup,
        io_getevents and io_submit syscalls to use the available compat
        syscalls when running 32bit userspace on 64bit kernel.  Other than
        that it's mostly removal of compile warnings."
      
      * 'fixes-for-3.9-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix redefinition of SET_PERSONALITY
        parisc: do not install modules when installing kernel
        parisc: fix compile warnings triggered by atomic_sub(sizeof(),v)
        parisc: check return value of down_interruptible() in hp_sdc_rtc.c
        parisc: avoid unitialized variable warning in pa_memcpy()
        parisc: remove unused variable 'compat_val'
        parisc: switch to compat_functions of io_setup, io_getevents and io_submit
        parisc: select ARCH_WANT_FRAME_POINTERS
      6977c6fc