6 files changed, 88 insertions, 26 deletions

diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index 04e3958266e0..dc36b222100b 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -46,7 +46,7 @@ extern int file_reader(__u64 offset, char *buf, int len, void *arg);
 extern int read_cow_header(int (*reader)(__u64, char *, int, void *),
                            void *arg, __u32 *version_out,
                            char **backing_file_out, time_t *mtime_out,
-                           __u64 *size_out, int *sectorsize_out,
+                           unsigned long long *size_out, int *sectorsize_out,
                            __u32 *align_out, int *bitmap_offset_out);
 
 extern int write_cow_header(char *cow_file, int fd, char *backing_file,
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index 94de4ead4f7a..7a5b4afde692 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -28,7 +28,7 @@ static inline int cow_seek_file(int fd, __u64 offset)
         return(os_seek_file(fd, offset));
 }
 
-static inline int cow_file_size(char *file, __u64 *size_out)
+static inline int cow_file_size(char *file, unsigned long long *size_out)
 {
         return(os_file_size(file, size_out));
 }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index 61951b721268..6ab852bfcd3a 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -17,30 +17,34 @@
 
 #define PATH_LEN_V1 256
 
+typedef __u32 time32_t;
+
 struct cow_header_v1 {
-        int magic;
-        int version;
+        __s32 magic;
+        __s32 version;
         char backing_file[PATH_LEN_V1];
-        time_t mtime;
+        time32_t mtime;
         __u64 size;
-        int sectorsize;
-};
+        __s32 sectorsize;
+} __attribute__((packed));
 
-#define PATH_LEN_V2 MAXPATHLEN
+/* Define PATH_LEN_V3 as the usual value of MAXPATHLEN, just hard-code it in
+ * case other systems have different values for MAXPATHLEN.
+ *
+ * The same must hold for V2 - we want file format compatibility, not anything
+ * else.
+ */
+#define PATH_LEN_V3 4096
+#define PATH_LEN_V2 PATH_LEN_V3
 
 struct cow_header_v2 {
         __u32 magic;
         __u32 version;
         char backing_file[PATH_LEN_V2];
-        time_t mtime;
+        time32_t mtime;
         __u64 size;
-        int sectorsize;
-};
-
-/* Define PATH_LEN_V3 as the usual value of MAXPATHLEN, just hard-code it in
- * case other systems have different values for MAXPATHLEN
- */
-#define PATH_LEN_V3 4096
+        __s32 sectorsize;
+} __attribute__((packed));
 
 /* Changes from V2 -
  *      PATH_LEN_V3 as described above
@@ -66,6 +70,15 @@ struct cow_header_v2 {
  *      Fixed (finally!) the rounding bug
  */
 
+/* Until Dec2005, __attribute__((packed)) was left out from the below
+ * definition, leading on 64-bit systems to 4 bytes of padding after mtime, to
+ * align size to 8-byte alignment.  This shifted all fields above (no padding
+ * was present on 32-bit, no other padding was added).
+ *
+ * However, this _can be detected_: it means that cow_format (always 0 until
+ * now) is shifted onto the first 4 bytes of backing_file, where it is otherwise
+ * impossible to find 4 zeros. -bb */
+
 struct cow_header_v3 {
         __u32 magic;
         __u32 version;
@@ -75,7 +88,19 @@ struct cow_header_v3 {
         __u32 alignment;
         __u32 cow_format;
         char backing_file[PATH_LEN_V3];
-};
+} __attribute__((packed));
+
+/* This is the broken layout used by some 64-bit binaries. */
+struct cow_header_v3_broken {
+        __u32 magic;
+        __u32 version;
+        __s64 mtime;
+        __u64 size;
+        __u32 sectorsize;
+        __u32 alignment;
+        __u32 cow_format;
+        char backing_file[PATH_LEN_V3];
+} __attribute__((packed));
 
 /* COW format definitions - for now, we have only the usual COW bitmap */
 #define COW_BITMAP 0
@@ -84,6 +109,7 @@ union cow_header {
         struct cow_header_v1 v1;
         struct cow_header_v2 v2;
         struct cow_header_v3 v3;
+        struct cow_header_v3_broken v3_b;
 };
 
 #define COW_MAGIC 0x4f4f4f4d  /* MOOO */
@@ -184,8 +210,9 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
 
         err = -EINVAL;
         if(strlen(backing_file) > sizeof(header->backing_file) - 1){
+                /* Below, %zd is for a size_t value */
                 cow_printf("Backing file name \"%s\" is too long - names are "
-                           "limited to %d characters\n", backing_file,
+                           "limited to %zd characters\n", backing_file,
                            sizeof(header->backing_file) - 1);
                 goto out_free;
         }
@@ -300,7 +327,8 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                 *align_out = *sectorsize_out;
                 file = header->v2.backing_file;
         }
-        else if(version == 3){
+        /* This is very subtle - see above at union cow_header definition */
+        else if(version == 3 && (*((int*)header->v3.backing_file) != 0)){
                 if(n < sizeof(header->v3)){
                         cow_printf("read_cow_header - failed to read V3 "
                                    "header\n");
@@ -310,9 +338,43 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                 *size_out = ntohll(header->v3.size);
                 *sectorsize_out = ntohl(header->v3.sectorsize);
                 *align_out = ntohl(header->v3.alignment);
+                if (*align_out == 0) {
+                        cow_printf("read_cow_header - invalid COW header, "
+                                   "align == 0\n");
+                }
                 *bitmap_offset_out = ROUND_UP(sizeof(header->v3), *align_out);
                 file = header->v3.backing_file;
         }
+        else if(version == 3){
+                cow_printf("read_cow_header - broken V3 file with"
+                           " 64-bit layout - recovering content.\n");
+
+                if(n < sizeof(header->v3_b)){
+                        cow_printf("read_cow_header - failed to read V3 "
+                                   "header\n");
+                        goto out;
+                }
+
+                /* this was used until Dec2005 - 64bits are needed to represent
+                 * 2038+. I.e. we can safely do this truncating cast.
+                 *
+                 * Additionally, we must use ntohl() instead of ntohll(), since
+                 * the program used to use the former (tested - I got mtime
+                 * mismatch "0 vs whatever").
+                 *
+                 * Ever heard about bug-to-bug-compatibility ? ;-) */
+                *mtime_out = (time32_t) ntohl(header->v3_b.mtime);
+
+                *size_out = ntohll(header->v3_b.size);
+                *sectorsize_out = ntohl(header->v3_b.sectorsize);
+                *align_out = ntohl(header->v3_b.alignment);
+                if (*align_out == 0) {
+                        cow_printf("read_cow_header - invalid COW header, "
+                                   "align == 0\n");
+                }
+                *bitmap_offset_out = ROUND_UP(sizeof(header->v3_b), *align_out);
+                file = header->v3_b.backing_file;
+        }
         else {
                 cow_printf("read_cow_header - invalid COW version\n");
                 goto out;
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 28e3760e8b98..6d7173fc55a3 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -62,7 +62,7 @@ static void mc_work_proc(void *unused)
         unsigned long flags;
 
         while(!list_empty(&mc_requests)){
-                local_save_flags(flags);
+                local_irq_save(flags);
                 req = list_entry(mc_requests.next, struct mconsole_entry,
                                  list);
                 list_del(&req->list);
@@ -87,7 +87,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id,
                 if(req.cmd->context == MCONSOLE_INTR)
                         (*req.cmd->handler)(&req);
                 else {
-                        new = kmalloc(sizeof(*new), GFP_ATOMIC);
+                        new = kmalloc(sizeof(*new), GFP_NOWAIT);
                         if(new == NULL)
                                 mconsole_reply(&req, "Out of memory", 1, 0);
                         else {
@@ -415,7 +415,6 @@ static int mem_config(char *str)
 
                         unplugged = page_address(page);
                         if(unplug_index == UNPLUGGED_PER_PAGE){
-                                INIT_LIST_HEAD(&unplugged->list);
                                 list_add(&unplugged->list, &unplugged_pages);
                                 unplug_index = 0;
                         }
@@ -616,7 +615,7 @@ static void console_write(struct console *console, const char *string,
                 return;
 
         while(1){
-                n = min((size_t)len, ARRAY_SIZE(console_buf) - console_index);
+                n = min((size_t) len, ARRAY_SIZE(console_buf) - console_index);
                 strncpy(&console_buf[console_index], string, n);
                 console_index += n;
                 string += n;
@@ -655,7 +654,6 @@ static void with_console(struct mc_request *req, void (*proc)(void *),
         struct mconsole_entry entry;
         unsigned long flags;
 
-        INIT_LIST_HEAD(&entry.list);
         entry.request = *req;
         list_add(&entry.list, &clients);
         spin_lock_irqsave(&console_lock, flags);
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 0e2f06187ea7..0a7786e00cfb 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -182,7 +182,9 @@ static int change_tramp(char **argv, char *output, int output_len)
         pe_data.stdout = fds[1];
         pid = run_helper(change_pre_exec, &pe_data, argv, NULL);
 
-        read_output(fds[0], output, output_len);
+        if (pid > 0)    /* Avoid hang as we won't get data in failure case. */
+                read_output(fds[0], output, output_len);
+
         os_close_file(fds[0]);
         os_close_file(fds[1]);
 
diff --git a/arch/um/drivers/slirp_user.c b/arch/um/drivers/slirp_user.c
index b94c66114bc8..33c5f6e625e8 100644
--- a/arch/um/drivers/slirp_user.c
+++ b/arch/um/drivers/slirp_user.c
@@ -104,7 +104,7 @@ static void slirp_close(int fd, void *data)
         }
 
         if(err == 0) {
-                printk("slirp_close: process %d has not exited\n");
+                printk("slirp_close: process %d has not exited\n", pri->pid);
                 return;
         }