Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
[S390] cio: allow offline processing for disconnected devices
[S390] cio: handle ssch() return codes correctly.
[S390] cio: Correct cleanup on error.
[S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode
+61
-18
+1
arch/s390/kernel/compat_ptrace.h
+1
arch/s390/kernel/compat_ptrace.h
+28
arch/s390/kernel/ptrace.c
+28
arch/s390/kernel/ptrace.c
···
170
170
*/
171
171
tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
172
172
173
+
} else if (addr < (addr_t) &dummy->regs.fp_regs) {
174
+
/*
175
+
* prevent reads of padding hole between
176
+
* orig_gpr2 and fp_regs on s390.
177
+
*/
178
+
tmp = 0;
179
+
173
180
} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
174
181
/*
175
182
* floating point regs. are stored in the thread structure
···
276
269
* orig_gpr2 is stored on the kernel stack
277
270
*/
278
271
task_pt_regs(child)->orig_gpr2 = data;
272
+
273
+
} else if (addr < (addr_t) &dummy->regs.fp_regs) {
274
+
/*
275
+
* prevent writes of padding hole between
276
+
* orig_gpr2 and fp_regs on s390.
277
+
*/
278
+
return 0;
279
279
280
280
} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
281
281
/*
···
442
428
*/
443
429
tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
444
430
431
+
} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
432
+
/*
433
+
* prevent reads of padding hole between
434
+
* orig_gpr2 and fp_regs on s390.
435
+
*/
436
+
tmp = 0;
437
+
445
438
} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
446
439
/*
447
440
* floating point regs. are stored in the thread structure
···
534
513
* orig_gpr2 is stored on the kernel stack
535
514
*/
536
515
*(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
516
+
517
+
} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
518
+
/*
519
+
* prevent writess of padding hole between
520
+
* orig_gpr2 and fp_regs on s390.
521
+
*/
522
+
return 0;
537
523
538
524
} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
539
525
/*
+4
-3
drivers/s390/cio/chp.c
+4
-3
drivers/s390/cio/chp.c
···
423
423
ret = sysfs_create_group(&chp->dev.kobj, &chp_attr_group);
424
424
if (ret) {
425
425
device_unregister(&chp->dev);
426
-
goto out_free;
426
+
goto out;
427
427
}
428
428
mutex_lock(&channel_subsystems[chpid.cssid]->mutex);
429
429
if (channel_subsystems[chpid.cssid]->cm_enabled) {
···
432
432
sysfs_remove_group(&chp->dev.kobj, &chp_attr_group);
433
433
device_unregister(&chp->dev);
434
434
mutex_unlock(&channel_subsystems[chpid.cssid]->mutex);
435
-
goto out_free;
435
+
goto out;
436
436
}
437
437
}
438
438
channel_subsystems[chpid.cssid]->chps[chpid.id] = chp;
439
439
mutex_unlock(&channel_subsystems[chpid.cssid]->mutex);
440
-
return ret;
440
+
goto out;
441
441
out_free:
442
442
kfree(chp);
443
+
out:
443
444
return ret;
444
445
}
445
446
+3
-1
drivers/s390/cio/cio.c
+3
-1
drivers/s390/cio/cio.c
···
208
208
case 1: /* status pending */
209
209
case 2: /* busy */
210
210
return -EBUSY;
211
-
default: /* device/path not operational */
211
+
case 3: /* device/path not operational */
212
212
return cio_start_handle_notoper(sch, lpm);
213
+
default:
214
+
return ccode;
213
215
}
214
216
}
215
217
+18
-14
drivers/s390/cio/css.c
+18
-14
drivers/s390/cio/css.c
···
633
633
634
634
css = to_css(dev);
635
635
mutex_destroy(&css->mutex);
636
+
if (css->pseudo_subchannel) {
637
+
/* Implies that it has been generated but never registered. */
638
+
css_subchannel_release(&css->pseudo_subchannel->dev);
639
+
css->pseudo_subchannel = NULL;
640
+
}
636
641
kfree(css);
637
642
}
638
643
···
790
785
}
791
786
channel_subsystems[i] = css;
792
787
ret = setup_css(i);
793
-
if (ret)
794
-
goto out_free;
788
+
if (ret) {
789
+
kfree(channel_subsystems[i]);
790
+
goto out_unregister;
791
+
}
795
792
ret = device_register(&css->device);
796
-
if (ret)
797
-
goto out_free_all;
793
+
if (ret) {
794
+
put_device(&css->device);
795
+
goto out_unregister;
796
+
}
798
797
if (css_chsc_characteristics.secm) {
799
798
ret = device_create_file(&css->device,
800
799
&dev_attr_cm_enable);
···
811
802
}
812
803
ret = register_reboot_notifier(&css_reboot_notifier);
813
804
if (ret)
814
-
goto out_pseudo;
805
+
goto out_unregister;
815
806
css_init_done = 1;
816
807
817
808
/* Enable default isc for I/O subchannels. */
···
819
810
820
811
for_each_subchannel(__init_channel_subsystem, NULL);
821
812
return 0;
822
-
out_pseudo:
823
-
device_unregister(&channel_subsystems[i]->pseudo_subchannel->dev);
824
813
out_file:
825
-
device_remove_file(&channel_subsystems[i]->device,
826
-
&dev_attr_cm_enable);
814
+
if (css_chsc_characteristics.secm)
815
+
device_remove_file(&channel_subsystems[i]->device,
816
+
&dev_attr_cm_enable);
827
817
out_device:
828
818
device_unregister(&channel_subsystems[i]->device);
829
-
out_free_all:
830
-
kfree(channel_subsystems[i]->pseudo_subchannel->lock);
831
-
kfree(channel_subsystems[i]->pseudo_subchannel);
832
-
out_free:
833
-
kfree(channel_subsystems[i]);
834
819
out_unregister:
835
820
while (i > 0) {
836
821
struct channel_subsystem *css;
···
832
829
i--;
833
830
css = channel_subsystems[i];
834
831
device_unregister(&css->pseudo_subchannel->dev);
832
+
css->pseudo_subchannel = NULL;
835
833
if (css_chsc_characteristics.secm)
836
834
device_remove_file(&css->device,
837
835
&dev_attr_cm_enable);
+7
drivers/s390/cio/device_fsm.c
+7
drivers/s390/cio/device_fsm.c
···
658
658
{
659
659
struct subchannel *sch;
660
660
661
+
/* Allow ccw_device_offline while disconnected. */
662
+
if (cdev->private->state == DEV_STATE_DISCONNECTED ||
663
+
cdev->private->state == DEV_STATE_NOT_OPER) {
664
+
cdev->private->flags.donotify = 0;
665
+
ccw_device_done(cdev, DEV_STATE_NOT_OPER);
666
+
return 0;
667
+
}
661
668
if (ccw_device_is_orphan(cdev)) {
662
669
ccw_device_done(cdev, DEV_STATE_OFFLINE);
663
670
return 0;