From 0339d3dbbfd51348dda584796e59a740a57a7e32 Mon Sep 17 00:00:00 2001 From: Chris Kelly Date: Wed, 29 Feb 2012 16:39:57 +0000 Subject: staging: ozwpan: Reduced size of oz_evtlist structure. This structure is used in an ioctl definition and was causing the 64-bit PowerPC build to fail. The size of the array in the structure has been reduced to fix this. Signed-off-by: Chris Kelly Reported-by: Stephen Rothwell Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/staging/ozwpan/ozeventdef.h b/drivers/staging/ozwpan/ozeventdef.h index cfe4163..a880288 100644 --- a/drivers/staging/ozwpan/ozeventdef.h +++ b/drivers/staging/ozwpan/ozeventdef.h @@ -37,7 +37,7 @@ struct oz_event { unsigned ctx4; }; -#define OZ_EVT_LIST_SZ 256 +#define OZ_EVT_LIST_SZ 64 struct oz_evtlist { int count; int missed; -- cgit v0.10.2 From 843c666d16e62e4b3889f1491a1d91b87ddc7bd3 Mon Sep 17 00:00:00 2001 From: Seth Jennings Date: Tue, 28 Feb 2012 16:01:37 -0600 Subject: staging: zcache: fix length type mismatch This fixes a type mismatch in the compression code where a size_t pointer was cast to a unsigned int pointer. On little endian archs, there is no issue. However on big endian archs, the value is incorrect, taking the high order bits and truncating the lower order bits. Signed-off-by: Seth Jennings Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c index 238d820..46c7c04 100644 --- a/drivers/staging/zcache/zcache-main.c +++ b/drivers/staging/zcache/zcache-main.c @@ -1170,14 +1170,14 @@ static atomic_t zcache_curr_pers_pampd_count = ATOMIC_INIT(0); static unsigned long zcache_curr_pers_pampd_count_max; /* forward reference */ -static int zcache_compress(struct page *from, void **out_va, size_t *out_len); +static int zcache_compress(struct page *from, void **out_va, unsigned *out_len); static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph, struct tmem_pool *pool, struct tmem_oid *oid, uint32_t index) { void *pampd = NULL, *cdata; - size_t clen; + unsigned clen; int ret; unsigned long count; struct page *page = (struct page *)(data); @@ -1326,7 +1326,7 @@ static struct tmem_pamops zcache_pamops = { static DEFINE_PER_CPU(unsigned char *, zcache_dstmem); #define ZCACHE_DSTMEM_ORDER 1 -static int zcache_compress(struct page *from, void **out_va, size_t *out_len) +static int zcache_compress(struct page *from, void **out_va, unsigned *out_len) { int ret = 0; unsigned char *dmem = __get_cpu_var(zcache_dstmem); @@ -1339,7 +1339,7 @@ static int zcache_compress(struct page *from, void **out_va, size_t *out_len) from_va = kmap_atomic(from, KM_USER0); mb(); ret = zcache_comp_op(ZCACHE_COMPOP_COMPRESS, from_va, PAGE_SIZE, dmem, - (unsigned int *)out_len); + out_len); BUG_ON(ret); *out_va = dmem; kunmap_atomic(from_va, KM_USER0); -- cgit v0.10.2 From 041aba19b916ddfd5254c80ef413ef8a7e76c8ad Mon Sep 17 00:00:00 2001 From: Seth Jennings Date: Tue, 28 Feb 2012 16:02:23 -0600 Subject: staging: zcache: fix memory corruption bug This patch fixes a bug where the zv code writes before the allocated buffer, resulting in system memory corruption. This was introduced during the switch from xvmalloc to zsmalloc. Signed-off-by: Seth Jennings Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c index 46c7c04..7073465 100644 --- a/drivers/staging/zcache/zcache-main.c +++ b/drivers/staging/zcache/zcache-main.c @@ -701,7 +701,6 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id, u32 size = clen + sizeof(struct zv_hdr); int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT; void *handle = NULL; - char *buf; BUG_ON(!irqs_disabled()); BUG_ON(chunks >= NCHUNKS); @@ -710,14 +709,13 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id, goto out; atomic_inc(&zv_curr_dist_counts[chunks]); atomic_inc(&zv_cumul_dist_counts[chunks]); - zv = (struct zv_hdr *)((char *)cdata - sizeof(*zv)); + zv = zs_map_object(pool, handle); zv->index = index; zv->oid = *oid; zv->pool_id = pool_id; zv->size = clen; SET_SENTINEL(zv, ZVH); - buf = zs_map_object(pool, handle); - memcpy(buf, zv, clen + sizeof(*zv)); + memcpy((char *)zv + sizeof(struct zv_hdr), cdata, clen); zs_unmap_object(pool, handle); out: return handle; -- cgit v0.10.2