Merge branch 'akpm' (incoming from Andrew)

Merge second patch-bomb from Andrew Morton:
 - various misc bits
 - the rest of MM
 - add generic fixmap.h, use it
 - backlight updates
 - dynamic_debug updates
 - printk() updates
 - checkpatch updates
 - binfmt_elf
 - ramfs
 - init/
 - autofs4
 - drivers/rtc
 - nilfs
 - hfsplus
 - Documentation/
 - coredump
 - procfs
 - fork
 - exec
 - kexec
 - kdump
 - partitions
 - rapidio
 - rbtree
 - userns
 - memstick
 - w1
 - decompressors

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (197 commits)
  lib/decompress_unlz4.c: always set an error return code on failures
  romfs: fix returm err while getting inode in fill_super
  drivers/w1/masters/w1-gpio.c: add strong pullup emulation
  drivers/memstick/host/rtsx_pci_ms.c: fix ms card data transfer bug
  userns: relax the posix_acl_valid() checks
  arch/sh/kernel/dwarf.c: use rbtree postorder iteration helper instead of solution using repeated rb_erase()
  fs-ext3-use-rbtree-postorder-iteration-helper-instead-of-opencoding-fix
  fs/ext3: use rbtree postorder iteration helper instead of opencoding
  fs/jffs2: use rbtree postorder iteration helper instead of opencoding
  fs/ext4: use rbtree postorder iteration helper instead of opencoding
  fs/ubifs: use rbtree postorder iteration helper instead of opencoding
  net/netfilter/ipset/ip_set_hash_netiface.c: use rbtree postorder iteration instead of opencoding
  rbtree/test: test rbtree_postorder_for_each_entry_safe()
  rbtree/test: move rb_node to the middle of the test struct
  rapidio: add modular rapidio core build into powerpc and mips branches
  partitions/efi: complete documentation of gpt kernel param purpose
  kdump: add /sys/kernel/vmcoreinfo ABI documentation
  kdump: fix exported size of vmcoreinfo note
  kexec: add sysctl to disable kexec_load
  fs/exec.c: call arch_pick_mmap_layout() only once
  ...

11 files changed, 284 insertions, 27 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 900b63c1e899..e0e2eebf7ab3 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1595,6 +1595,33 @@ config DMA_API_DEBUG
 
           If unsure, say N.
 
+config TEST_MODULE
+        tristate "Test module loading with 'hello world' module"
+        default n
+        depends on m
+        help
+          This builds the "test_module" module that emits "Hello, world"
+          on printk when loaded. It is designed to be used for basic
+          evaluation of the module loading subsystem (for example when
+          validating module verification). It lacks any extra dependencies,
+          and will not normally be loaded by the system unless explicitly
+          requested by name.
+
+          If unsure, say N.
+
+config TEST_USER_COPY
+        tristate "Test user/kernel boundary protections"
+        default n
+        depends on m
+        help
+          This builds the "test_user_copy" module that runs sanity checks
+          on the copy_to/from_user infrastructure, making sure basic
+          user/kernel boundary testing is working. If it fails to load,
+          a regression has been detected in the user/kernel memory boundary
+          protections.
+
+          If unsure, say N.
+
 source "samples/Kconfig"
 
 source "lib/Kconfig.kgdb"
diff --git a/lib/Makefile b/lib/Makefile
index a459c31e8c6b..98ec3b861062 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -31,6 +31,8 @@ obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
+obj-$(CONFIG_TEST_MODULE) += test_module.o
+obj-$(CONFIG_TEST_USER_COPY) += test_user_copy.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/cmdline.c b/lib/cmdline.c
index eb6791188cf5..d4932f745e92 100644
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -49,13 +49,13 @@ static int get_range(char **str, int *pint)
  *      3 - hyphen found to denote a range
  */
 
-int get_option (char **str, int *pint)
+int get_option(char **str, int *pint)
 {
         char *cur = *str;
 
         if (!cur || !(*cur))
                 return 0;
-        *pint = simple_strtol (cur, str, 0);
+        *pint = simple_strtol(cur, str, 0);
         if (cur == *str)
                 return 0;
         if (**str == ',') {
@@ -67,6 +67,7 @@ int get_option (char **str, int *pint)
 
         return 1;
 }
+EXPORT_SYMBOL(get_option);
 
 /**
  *      get_options - Parse a string into a list of integers
@@ -84,13 +85,13 @@ int get_option (char **str, int *pint)
  *      the parse to end (typically a null terminator, if @str is
  *      completely parseable).
  */
- 
+
 char *get_options(const char *str, int nints, int *ints)
 {
         int res, i = 1;
 
         while (i < nints) {
-                res = get_option ((char **)&str, ints + i);
+                res = get_option((char **)&str, ints + i);
                 if (res == 0)
                         break;
                 if (res == 3) {
@@ -112,6 +113,7 @@ char *get_options(const char *str, int nints, int *ints)
         ints[0] = i - 1;
         return (char *)str;
 }
+EXPORT_SYMBOL(get_options);
 
 /**
  *      memparse - parse a string with mem suffixes into a number
@@ -152,8 +154,4 @@ unsigned long long memparse(const char *ptr, char **retptr)
 
         return ret;
 }
-
-
 EXPORT_SYMBOL(memparse);
-EXPORT_SYMBOL(get_option);
-EXPORT_SYMBOL(get_options);
diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
index 3e67cfad16ad..7d1e83caf8ad 100644
--- a/lib/decompress_unlz4.c
+++ b/lib/decompress_unlz4.c
@@ -141,6 +141,7 @@ STATIC inline int INIT unlz4(u8 *input, int in_len,
                         goto exit_2;
                 }
 
+                ret = -1;
                 if (flush && flush(outp, dest_len) != dest_len)
                         goto exit_2;
                 if (output)
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index c37aeacd7651..600ac57e2777 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -8,6 +8,7 @@
  * By Greg Banks <gnb@melbourne.sgi.com>
  * Copyright (c) 2008 Silicon Graphics Inc.  All Rights Reserved.
  * Copyright (C) 2011 Bart Van Assche.  All Rights Reserved.
+ * Copyright (C) 2013 Du, Changbin <changbin.du@gmail.com>
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
@@ -24,6 +25,7 @@
 #include <linux/sysctl.h>
 #include <linux/ctype.h>
 #include <linux/string.h>
+#include <linux/parser.h>
 #include <linux/string_helpers.h>
 #include <linux/uaccess.h>
 #include <linux/dynamic_debug.h>
@@ -147,7 +149,8 @@ static int ddebug_change(const struct ddebug_query *query,
         list_for_each_entry(dt, &ddebug_tables, link) {
 
                 /* match against the module name */
-                if (query->module && strcmp(query->module, dt->mod_name))
+                if (query->module &&
+                    !match_wildcard(query->module, dt->mod_name))
                         continue;
 
                 for (i = 0; i < dt->num_ddebugs; i++) {
@@ -155,14 +158,16 @@ static int ddebug_change(const struct ddebug_query *query,
 
                         /* match against the source filename */
                         if (query->filename &&
-                            strcmp(query->filename, dp->filename) &&
-                            strcmp(query->filename, kbasename(dp->filename)) &&
-                            strcmp(query->filename, trim_prefix(dp->filename)))
+                            !match_wildcard(query->filename, dp->filename) &&
+                            !match_wildcard(query->filename,
+                                           kbasename(dp->filename)) &&
+                            !match_wildcard(query->filename,
+                                           trim_prefix(dp->filename)))
                                 continue;
 
                         /* match against the function */
                         if (query->function &&
-                            strcmp(query->function, dp->function))
+                            !match_wildcard(query->function, dp->function))
                                 continue;
 
                         /* match against the format */
diff --git a/lib/kstrtox.c b/lib/kstrtox.c
index f78ae0c0c4e2..ec8da78df9be 100644
--- a/lib/kstrtox.c
+++ b/lib/kstrtox.c
@@ -92,7 +92,6 @@ static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res)
         rv = _parse_integer(s, base, &_res);
         if (rv & KSTRTOX_OVERFLOW)
                 return -ERANGE;
-        rv &= ~KSTRTOX_OVERFLOW;
         if (rv == 0)
                 return -EINVAL;
         s += rv;
diff --git a/lib/parser.c b/lib/parser.c
index 807b2aaa33fa..b6d11631231b 100644
--- a/lib/parser.c
+++ b/lib/parser.c
@@ -113,6 +113,7 @@ int match_token(char *s, const match_table_t table, substring_t args[])
 
         return p->token;
 }
+EXPORT_SYMBOL(match_token);
 
 /**
  * match_number: scan a number in the given base from a substring_t
@@ -163,6 +164,7 @@ int match_int(substring_t *s, int *result)
 {
         return match_number(s, result, 0);
 }
+EXPORT_SYMBOL(match_int);
 
 /**
  * match_octal: - scan an octal representation of an integer from a substring_t
@@ -177,6 +179,7 @@ int match_octal(substring_t *s, int *result)
 {
         return match_number(s, result, 8);
 }
+EXPORT_SYMBOL(match_octal);
 
 /**
  * match_hex: - scan a hex representation of an integer from a substring_t
@@ -191,6 +194,58 @@ int match_hex(substring_t *s, int *result)
 {
         return match_number(s, result, 16);
 }
+EXPORT_SYMBOL(match_hex);
+
+/**
+ * match_wildcard: - parse if a string matches given wildcard pattern
+ * @pattern: wildcard pattern
+ * @str: the string to be parsed
+ *
+ * Description: Parse the string @str to check if matches wildcard
+ * pattern @pattern. The pattern may contain two type wildcardes:
+ *   '*' - matches zero or more characters
+ *   '?' - matches one character
+ * If it's matched, return true, else return false.
+ */
+bool match_wildcard(const char *pattern, const char *str)
+{
+        const char *s = str;
+        const char *p = pattern;
+        bool star = false;
+
+        while (*s) {
+                switch (*p) {
+                case '?':
+                        s++;
+                        p++;
+                        break;
+                case '*':
+                        star = true;
+                        str = s;
+                        if (!*++p)
+                                return true;
+                        pattern = p;
+                        break;
+                default:
+                        if (*s == *p) {
+                                s++;
+                                p++;
+                        } else {
+                                if (!star)
+                                        return false;
+                                str++;
+                                s = str;
+                                p = pattern;
+                        }
+                        break;
+                }
+        }
+
+        if (*p == '*')
+                ++p;
+        return !*p;
+}
+EXPORT_SYMBOL(match_wildcard);
 
 /**
  * match_strlcpy: - Copy the characters from a substring_t to a sized buffer
@@ -213,6 +268,7 @@ size_t match_strlcpy(char *dest, const substring_t *src, size_t size)
         }
         return ret;
 }
+EXPORT_SYMBOL(match_strlcpy);
 
 /**
  * match_strdup: - allocate a new string with the contents of a substring_t
@@ -230,10 +286,4 @@ char *match_strdup(const substring_t *s)
                 match_strlcpy(p, s, sz);
         return p;
 }
-
-EXPORT_SYMBOL(match_token);
-EXPORT_SYMBOL(match_int);
-EXPORT_SYMBOL(match_octal);
-EXPORT_SYMBOL(match_hex);
-EXPORT_SYMBOL(match_strlcpy);
 EXPORT_SYMBOL(match_strdup);
diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
index 31dd4ccd3baa..8b3c9dc88262 100644
--- a/lib/rbtree_test.c
+++ b/lib/rbtree_test.c
@@ -8,8 +8,8 @@
 #define CHECK_LOOPS 100
 
 struct test_node {
-        struct rb_node rb;
         u32 key;
+        struct rb_node rb;
 
         /* following fields used for testing augmented rbtree functionality */
         u32 val;
@@ -114,6 +114,16 @@ static int black_path_count(struct rb_node *rb)
         return count;
 }
 
+static void check_postorder_foreach(int nr_nodes)
+{
+        struct test_node *cur, *n;
+        int count = 0;
+        rbtree_postorder_for_each_entry_safe(cur, n, &root, rb)
+                count++;
+
+        WARN_ON_ONCE(count != nr_nodes);
+}
+
 static void check_postorder(int nr_nodes)
 {
         struct rb_node *rb;
@@ -148,6 +158,7 @@ static void check(int nr_nodes)
         WARN_ON_ONCE(count < (1 << black_path_count(rb_last(&root))) - 1);
 
         check_postorder(nr_nodes);
+        check_postorder_foreach(nr_nodes);
 }
 
 static void check_augmented(int nr_nodes)
diff --git a/lib/test_module.c b/lib/test_module.c
new file mode 100644
index 000000000000..319b66f1ff61
--- /dev/null
+++ b/lib/test_module.c
@@ -0,0 +1,33 @@
+/*
+ * This module emits "Hello, world" on printk when loaded.
+ *
+ * It is designed to be used for basic evaluation of the module loading
+ * subsystem (for example when validating module signing/verification). It
+ * lacks any extra dependencies, and will not normally be loaded by the
+ * system unless explicitly requested by name.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+
+static int __init test_module_init(void)
+{
+        pr_warn("Hello, world\n");
+
+        return 0;
+}
+
+module_init(test_module_init);
+
+static void __exit test_module_exit(void)
+{
+        pr_warn("Goodbye\n");
+}
+
+module_exit(test_module_exit);
+
+MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
+MODULE_LICENSE("GPL");
diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c
new file mode 100644
index 000000000000..0ecef3e4690e
--- /dev/null
+++ b/lib/test_user_copy.c
@@ -0,0 +1,110 @@
+/*
+ * Kernel module for testing copy_to/from_user infrastructure.
+ *
+ * Copyright 2013 Google Inc. All Rights Reserved
+ *
+ * Authors:
+ *      Kees Cook       <keescook@chromium.org>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/mman.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/vmalloc.h>
+
+#define test(condition, msg)            \
+({                                      \
+        int cond = (condition);         \
+        if (cond)                       \
+                pr_warn("%s\n", msg);   \
+        cond;                           \
+})
+
+static int __init test_user_copy_init(void)
+{
+        int ret = 0;
+        char *kmem;
+        char __user *usermem;
+        char *bad_usermem;
+        unsigned long user_addr;
+        unsigned long value = 0x5A;
+
+        kmem = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
+        if (!kmem)
+                return -ENOMEM;
+
+        user_addr = vm_mmap(NULL, 0, PAGE_SIZE * 2,
+                            PROT_READ | PROT_WRITE | PROT_EXEC,
+                            MAP_ANONYMOUS | MAP_PRIVATE, 0);
+        if (user_addr >= (unsigned long)(TASK_SIZE)) {
+                pr_warn("Failed to allocate user memory\n");
+                kfree(kmem);
+                return -ENOMEM;
+        }
+
+        usermem = (char __user *)user_addr;
+        bad_usermem = (char *)user_addr;
+
+        /* Legitimate usage: none of these should fail. */
+        ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE),
+                    "legitimate copy_from_user failed");
+        ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE),
+                    "legitimate copy_to_user failed");
+        ret |= test(get_user(value, (unsigned long __user *)usermem),
+                    "legitimate get_user failed");
+        ret |= test(put_user(value, (unsigned long __user *)usermem),
+                    "legitimate put_user failed");
+
+        /* Invalid usage: none of these should succeed. */
+        ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE),
+                                    PAGE_SIZE),
+                    "illegal all-kernel copy_from_user passed");
+        ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem,
+                                    PAGE_SIZE),
+                    "illegal reversed copy_from_user passed");
+        ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE,
+                                  PAGE_SIZE),
+                    "illegal all-kernel copy_to_user passed");
+        ret |= test(!copy_to_user((char __user *)kmem, bad_usermem,
+                                  PAGE_SIZE),
+                    "illegal reversed copy_to_user passed");
+        ret |= test(!get_user(value, (unsigned long __user *)kmem),
+                    "illegal get_user passed");
+        ret |= test(!put_user(value, (unsigned long __user *)kmem),
+                    "illegal put_user passed");
+
+        vm_munmap(user_addr, PAGE_SIZE * 2);
+        kfree(kmem);
+
+        if (ret == 0) {
+                pr_info("tests passed.\n");
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+module_init(test_user_copy_init);
+
+static void __exit test_user_copy_exit(void)
+{
+        pr_info("unloaded.\n");
+}
+
+module_exit(test_user_copy_exit);
+
+MODULE_AUTHOR("Kees Cook <keescook@chromium.org>");
+MODULE_LICENSE("GPL");
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 10909c571494..185b6d300ebc 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1155,6 +1155,30 @@ char *netdev_feature_string(char *buf, char *end, const u8 *addr,
         return number(buf, end, *(const netdev_features_t *)addr, spec);
 }
 
+static noinline_for_stack
+char *address_val(char *buf, char *end, const void *addr,
+                  struct printf_spec spec, const char *fmt)
+{
+        unsigned long long num;
+
+        spec.flags |= SPECIAL | SMALL | ZEROPAD;
+        spec.base = 16;
+
+        switch (fmt[1]) {
+        case 'd':
+                num = *(const dma_addr_t *)addr;
+                spec.field_width = sizeof(dma_addr_t) * 2 + 2;
+                break;
+        case 'p':
+        default:
+                num = *(const phys_addr_t *)addr;
+                spec.field_width = sizeof(phys_addr_t) * 2 + 2;
+                break;
+        }
+
+        return number(buf, end, num, spec);
+}
+
 int kptr_restrict __read_mostly;
 
 /*
@@ -1218,7 +1242,8 @@ int kptr_restrict __read_mostly;
  *              N no separator
  *            The maximum supported length is 64 bytes of the input. Consider
  *            to use print_hex_dump() for the larger input.
- * - 'a' For a phys_addr_t type and its derivative types (passed by reference)
+ * - 'a[pd]' For address types [p] phys_addr_t, [d] dma_addr_t and derivatives
+ *           (default assumed to be phys_addr_t, passed by reference)
  * - 'd[234]' For a dentry name (optionally 2-4 last components)
  * - 'D[234]' Same as 'd' but for a struct file
  *
@@ -1353,11 +1378,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                 }
                 break;
         case 'a':
-                spec.flags |= SPECIAL | SMALL | ZEROPAD;
-                spec.field_width = sizeof(phys_addr_t) * 2 + 2;
-                spec.base = 16;
-                return number(buf, end,
-                              (unsigned long long) *((phys_addr_t *)ptr), spec);
+                return address_val(buf, end, ptr, spec, fmt);
         case 'd':
                 return dentry_name(buf, end, ptr, spec, fmt);
         case 'D':