While doing a ktest.pl I used a MIN_CONFIG that had STAGING enabled, and
a randconfig with CONFIG_DEBUG_STRICT_USER_COPY_CHECKS enabled caught
the following bug:
In file included from /home/rostedt/work/autotest/nobackup/linux-test.git/arch/x86/include/asm/uaccess.h:571:0,
from /home/rostedt/work/autotest/nobackup/linux-test.git/include/linux/poll.h:14,
from /home/rostedt/work/autotest/nobackup/linux-test.git/drivers/staging/ft1000/ft1000-usb/ft1000_chdev.c:32:
In function 'copy_from_user',
inlined from 'ft1000_ChIoctl' at /home/rostedt/work/autotest/nobackup/linux-test.git/drivers/staging/ft1000/ft1000-usb/ft1000_chdev.c:702:36:
/home/rostedt/work/autotest/nobackup/linux-test.git/arch/x86/include/asm/uaccess_32.h:212:26: error: call to 'copy_from_user_overflow' declared with attribute error: copy_from_user() buffer size is not provably correct
Looking at the code it was obvious what the problem was. The pointer
dpram_data was being allocated but the address was being written to.
Looking at the comment above the code shows that it use to write into an
element of that pointer where the '&' is appropriate. But now that it
writes to the pointer itself, we need to remove the '&' otherwise we
write over the pointer and not into the data it points to.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
With commit 2dab1ac81b there
was intruduced error which lead to stopping uninitialized
kthread which leads to kernel panics.
This patch fix problems with common entry point in correct
way.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This was necessary in order to resolve some conflicts that happened
between -rc1 and -rc2 with the following files:
drivers/staging/bcm/Bcmchar.c
drivers/staging/intel_sst/intel_sst_app_interface.c
All should be resolved now.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When reg_ft1000_netdev() fails created kthread isn't stopped.
So add return point for stopping thread.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
kthread_run could fail so we will check return value.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Function ft1000_submit_rx_urb() could fail so add checking
for return value.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Handling for pseudo header was done by directly copying
data to tx buffer. This hide a functionality and make
code unreadable.
Use approach where fill pseudo_hdr structure first with data and then copy
to beginning of buffer.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Remove functions which was used nowhere. Also remove dead
variables used by this functions.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Delete successive assignments to the same location. In three of the cases,
the two assignments are identical. In the case of the file
rt2860/common/cmm_aes.c, the assigned variable i is never used, so both
assignments are dropped.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression i;
@@
*i = ...;
i = ...;
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Using pdpram_blk here would cause an oops. We intended to use
&freercvpool.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Tested by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The code here is supposed checking if we exited the loop without hitting
a break. The problem is that in the error handling "i" is out of bounds
and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++.
>From the comments, it looks like someone noticed this corruption and
updated the code, but didn't totally fix the problem. The correct fix
is just to remove nRxMsgMiss++ from the error path.
I believe this bug can be triggered remotely.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
was #ifdef so remove code which was under #else to make
code more readable.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch remove global flag DSP_loading which was checked
only on one place. Instead check return value for dsp_reload() function.
Signed-off-by: Marek Belisko <marek.belisko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
