Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1301938 > unrolled thread

[4.2.y-ckt stable] Linux 4.2.8-ckt1 stable review

Back to article view | Back to linux.kernel

Contents

  [4.2.y-ckt stable] Linux 4.2.8-ckt1 stable review Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 185/211] sctp: use the same clock as if sock source timestamps were on Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 067/211] dm: initialize non-blk-mq queue data before queue is used Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 153/211] of/fdt: fix error checking for earlycon address Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 167/211] selftests: kprobe: Choose an always-defined function to probe Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 077/211] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 103/211] scsi_sysfs: Fix queue_ramp_up_period return code Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 114/211] iio:magnetometer:bmc150_magn: sort entry alphabetically Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 093/211] memcg: fix thresholds for 32b architectures. Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 087/211] ALSA: hda - Add Intel Lewisburg device IDs Audio Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 168/211] selftests: Make scripts executable Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 116/211] net-sysfs: get_netdev_queue_index() cleanup Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 209/211] rhashtable: Fix walker list corruption Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 046/211] vTPM: fix memory allocation flag for rtce buffer at kernel boot Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 098/211] printk: prevent userland from spoofing kernel messages Kamal Mostafa <kamal@canonical.com> - 2016-01-05 20:50 +0100
    [PATCH 4.2.y-ckt 207/211] af_unix: Revert 'lock_interruptible' in stream receive code Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 192/211] phy: micrel: Fix finding PHY properties in MAC node. Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 194/211] sh_eth: fix kernel oops in skb_put() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 195/211] net: fix IP early demux races Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 211/211] KVM: x86: Reload pit counters for all channels when restoring state Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 191/211] ipv6: sctp: clone options to avoid use after free Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 201/211] bluetooth: Validate socket address length in sco_sock_bind(). Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 184/211] vxlan: fix incorrect RCO bit in VXLAN header Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 204/211] rhashtable: Enforce minimum size on initial hash table Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 208/211] tcp: restore fastopen with no data in SYN packet Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 181/211] gre6: allow to update all parameters via rtnl Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 199/211] net: check both type and procotol for tcp sockets Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 180/211] pppoe: fix memory corruption in padt work structure Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 190/211] r8152: fix lockup when runtime PM is enabled Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 210/211] KEYS: Fix race between read and revoke Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 189/211] net: qca_spi: fix transmit queue timeout handling Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 178/211] megaraid_sas: Make tape drives visible on PERC5 controllers Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 186/211] sctp: update the netstamp_needed counter when copying sockets Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 187/211] sctp: also copy sk_tsflags when copying the socket Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 183/211] ipv6: keep existing flags when setting IFA_F_OPTIMISTIC Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 196/211] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 202/211] net: fix uninitialized variable issue Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 203/211] ipv6: automatically enable stable privacy mode if stable_secret set Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 200/211] net_sched: make qdisc_tree_decrease_qlen() work for non mq Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 188/211] net: cdc_mbim: add "NDP to end" quirk for Huawei E3372 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 206/211] fou: clean up socket with kfree_rcu Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 182/211] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 193/211] net: add validation for the socket syscall protocol argument Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:00 +0100
    [PATCH 4.2.y-ckt 166/211] vfio/platform: store mapped memory in region, instead of an on-stack copy Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 151/211] DT: mmc: sh_mmcif: fix "compatible" property text Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 169/211] thermal: exynos: Fix first temperature read after registering sensor Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 163/211] tracepoints: Fix documentation of RCU lockdep checks Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 165/211] ipv6: fix tunnel error handling Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 155/211] PCI: Set SR-IOV NumVFs to zero after enumeration Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 152/211] netfilter: nf_nat_redirect: add missing NULL pointer check Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 179/211] ARC: Fix silly typo in MAINTAINERS file Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 159/211] cpufreq: arm_big_little: fix frequency check when bL switcher is active Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 172/211] rtc: ds1307: Fix alarm programming for mcp794xx Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 173/211] NTB: fix 32-bit compiler warning Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 161/211] xprtrdma: Prevent loss of completion signals Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 177/211] TPM: Avoid reference to potentially freed memory Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 156/211] sparc/PCI: Add mem64 resource parsing for root bus Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 176/211] mvneta: add FIXED_PHY dependency Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 157/211] IB/core, cma: Make __attribute_const__ declarations sparse-friendly Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 171/211] perf trace: Fix documentation for -i Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 148/211] perf annotate: Fix 'annotate.use_offset' config variable usage Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 160/211] xprtrdma: Re-arm after missed events Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 158/211] ipv6: no CHECKSUM_PARTIAL on MSG_MORE corked sockets Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 162/211] qmi_wwan: fix entry for HP lt4112 LTE/HSPA+ Gobi 4G Module Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 164/211] net: fix percpu memory leaks Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 174/211] tpm_tis: free irq after probing Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 170/211] ipv4: fix a potential deadlock in mcast getsockopt() path Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 175/211] TPM: revert the list handling logic fixed in 398a1e7 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 149/211] sunrpc: avoid warning in gss_key_timeout Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 150/211] MIPS: atomic: Fix comment describing atomic64_add_unless's return value. Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:10 +0100
    [PATCH 4.2.y-ckt 124/211] netfilter: remove dead code Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 127/211] i2c: img-scb: enable fencing for all versions of the ip Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 128/211] i2c: img-scb: do dummy writes before fifo access Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 147/211] spi: omap2-mcspi: disable other channels CHCONF_FORCE in prepare_message Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 139/211] ALSA: dice: correct variable types for __be32 data Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 130/211] i2c: img-scb: fix LOW and HIGH period values for the SCL clock Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 122/211] [media] vivid: Fix iteration in driver removal path Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 143/211] kconfig: Fix copy&paste error Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 133/211] packet: fix match_fanout_group() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 141/211] ALSA: fireworks: use u32 type for be32_to_cpup() macro Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 146/211] IB/core: avoid 32-bit warning Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 134/211] hsi: fix double kfree Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 145/211] RDMA/cxgb4: re-fix 32-bit build warning Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 137/211] ALSA: fireworks/bebob/oxfw/dice: enable to make as built-in Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 125/211] ipv4: Fix ip_local_out_sk by passing the sk into __ip_local_out_sk Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 123/211] devres: fix a for loop bounds check Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 132/211] i2c: img-scb: verify support for requested bit rate Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 138/211] drm: Fix return value of drm_framebuffer_init() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 100/211] fs, seqfile: always allow oom killer Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 129/211] i2c: img-scb: use DIV_ROUND_UP to round divisor values Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 126/211] ipv4: Fix ip_queue_xmit to pass sk into ip_local_out_sk Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 113/211] dax_io(): don't let non-error value escape via retval instead of EFAULT Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 136/211] regulator: arizona-ldo1: Fix handling of GPIO 0 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 118/211] tools build: Fixup feature detection display function name Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 142/211] ALSA: bebob: use correct type for __be32 data Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 140/211] ALSA: dice: assign converted data to the same type of variable Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 092/211] mm/oom_kill.c: reverse the order of setting TIF_MEMDIE and sending SIGKILL Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 131/211] i2c: img-scb: Clear line and interrupt status before starting a transfer Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 135/211] hsi: omap_ssi_port: Prevent warning if cawake_gpio is not defined. Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 144/211] tcp: apply Kern's check on RTTs used for congestion control Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:20 +0100
    [PATCH 4.2.y-ckt 106/211] drivers: of: of_reserved_mem: fixup the alignment with CMA setup Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 086/211] tracefs: Fix refcount imbalance in start_creating() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 108/211] FS-Cache: Increase reference of parent after registering, netfs success Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 120/211] dmaengine: dw: convert to __ffs() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 119/211] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 097/211] proc: actually make proc_fd_permission() thread-friendly Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 111/211] binfmt_elf: Don't clobber passed executable's file header Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 110/211] FS-Cache: Handle a write to the page immediately beyond the EOF marker Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 109/211] FS-Cache: Don't override netfs's primary_index if registering failed Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 091/211] mm: slab: only move management objects off-slab for sizes larger than KMALLOC_MIN_SIZE Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 105/211] storvsc: Don't set the SRB_FLAGS_QUEUE_ACTION_ENABLE flag Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 095/211] arm64: bpf: fix mod-by-zero case Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 057/211] ACPI: Using correct irq when waiting for events Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 088/211] drm: Use userspace compatible type in fourcc_mod_code macro Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 112/211] fs/pipe.c: return error code rather than 0 in pipe_write() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 101/211] parisc: Fixes and cleanups in kernel uapi header files Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 090/211] toshiba_acpi: Initialize hotkey_event_type variable Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 063/211] drm/amdgpu: add some additional CZ revisions Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 094/211] arm64: bpf: fix div-by-zero case Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 099/211] lib/hexdump.c: truncate output in case of overflow Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 059/211] i2c: at91: manage unexpected RXRDY flag when starting a transfer Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 085/211] ALSA: hda - Apply pin fixup for HP ProBook 6550b Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 121/211] tcp: call sk_mark_napi_id() on the child, not the listener Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 107/211] drm/ast: Initialized data needed to map fbdev memory Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 115/211] ALSA: pcm: remove structure member of 'struct snd_pcm_hwptr_log *' type because this structure had been removed Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 089/211] scsi: restart list search after unlock in scsi_remove_target Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 084/211] timers: Use proper base migration in add_timer_on() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 078/211] xtensa: fix secondary core boot in SMP Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 102/211] perf: Fix inherited events vs. tracepoint filters Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 117/211] crypto: crc32c-pclmul - use .rodata instead of .rotata Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:30 +0100
    [PATCH 4.2.y-ckt 079/211] recordmcount: Fix endianness handling bug for nop_mcount Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 052/211] [media] media: vb2 dma-sg: Fully cache synchronise buffers in prepare and finish Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 073/211] drm/amdgpu: Make amdgpu_mn functions inline Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 027/211] staging/dgnc: fix info leak in ioctl Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 066/211] megaraid_sas: Do not use PAGE_SIZE for max_sectors Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 080/211] recordmcount: arm64: Replace the ignored mcount call into nop Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 064/211] spi/spi-xilinx: Fix race condition on last word read Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 049/211] drm/amdgpu/gfx8: set TC_WB_ACTION_EN in RELEASE_MEM packet Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 081/211] KVM: VMX: fix SMEP and SMAP without EPT Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 013/211] bridge: fix netlink max attr size Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 051/211] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 061/211] ALSA: hda - Disable 64bit address for Creative HDA controllers Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 065/211] megaraid_sas: Expose TAPE drives unconditionally Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 015/211] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 072/211] xtensa: fixes for configs without loop option Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 076/211] PCI: spear: Fix dw_pcie_cfg_read/write() usage Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 021/211] KEYS: Don't permit request_key() to construct a new keyring Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 083/211] thermal: exynos: Fix unbalanced regulator disable on probe failure Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 062/211] MAINTAINERS: Add public mailing list for ARC Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 074/211] ALSA: hda - Fix lost 4k BDL boundary workaround Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 058/211] ACPI / PM: Fix incorrect wakeup IRQ setting during suspend-to-idle Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 012/211] net: bcmgenet: Delay PHY initialization to bcmgenet_open() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 069/211] Revert "dm mpath: fix stalls when handling invalid ioctls" Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 060/211] ALSA: hda/realtek - Dell XPS one ALC3260 speaker no sound after resume back Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 070/211] drm/i915: add quirk to enable backlight on Dell Chromebook 11 (2015) Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 016/211] ebpf: fix fd refcount leaks related to maps in bpf syscall Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 068/211] mtd: blkdevs: fix potential deadlock + lockdep warnings Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 050/211] spi: dw: explicitly free IRQ handler in dw_spi_remove_host() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 071/211] crypto: algif_hash - Only export and import on sockets with data Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 053/211] [media] media/v4l2-ctrls: fix setting autocluster to manual with VIDIOC_S_CTRL Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 054/211] i2c: at91: fix write transfers by clearing pending interrupt first Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 048/211] tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 075/211] tracing: Update instance_rmdir() to use tracefs_remove_recursive Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:40 +0100
    [PATCH 4.2.y-ckt 043/211] iommu/arm-smmu: Fix error checking for ASID and VMID allocation Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 022/211] ARM: OMAP2+: board-generic: Remove stale of_irq macros Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 030/211] HID: core: Avoid uninitialized buffer access Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 039/211] f2fs crypto: allocate buffer for decrypting filename Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 031/211] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 004/211] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 035/211] ubi: fastmap: Implement produce_free_peb() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 005/211] drm/radeon: add quirk for MSI R7 370 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 037/211] drm/i915: Fix userptr deadlock with aliased GTT mmappings Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 047/211] tpm, tpm_crb: fix unaligned read of the command buffer address Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 044/211] jbd2: fix checkpoint list cleanup Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 032/211] mtd: mtdpart: fix add_mtd_partitions error path Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 028/211] ipv6: Fix IPsec pre-encap fragmentation check Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 023/211] vxlan: set needed headroom correctly Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 002/211] drivers: usb :fsl: Implement Workaround for USB Erratum A007792 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 045/211] [PATCH] fix calculation of meta_bg descriptor backups Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 042/211] iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 003/211] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 033/211] [media] v4l2-ctrls: arrays are also considered compound controls Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 034/211] [media] media: v4l2-ctrls: Fix 64bit support in get_ctrl() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 006/211] drm/radeon: add quirk for ASUS R7 370 Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 029/211] KVM: svm: unconditionally intercept #DB Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 038/211] integrity: prevent loading untrusted certificates on the IMA trusted keyring Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 036/211] drm/i915: Only update the current userptr worker Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 041/211] lockd: create NSM handles per net namespace Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 040/211] spi: ti-qspi: Fix data corruption seen on r/w stress test Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 024/211] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 025/211] ppp, slip: Validate VJ compression slot parameters completely Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 026/211] [media] media/vivid-osd: fix info leak in ioctl Kamal Mostafa <kamal@canonical.com> - 2016-01-05 21:50 +0100
    [PATCH 4.2.y-ckt 019/211] KEYS: Fix race between key destruction and finding a keyring by name Kamal Mostafa <kamal@canonical.com> - 2016-01-05 22:00 +0100
    [PATCH 4.2.y-ckt 020/211] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Kamal Mostafa <kamal@canonical.com> - 2016-01-05 22:00 +0100
    [PATCH 4.2.y-ckt 018/211] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2016-01-05 22:00 +0100
    [PATCH 4.2.y-ckt 017/211] netlink, mmap: fix edge-case leakages in nf queue zero-copy Kamal Mostafa <kamal@canonical.com> - 2016-01-05 22:00 +0100

Page 10 of 10 — ← Prev page 1 … 8 9 [10]

#1302140 — [PATCH 4.2.y-ckt 003/211] drivers: usb: fsl: Workaround for USB erratum-A005275

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nikhil Badola <nikhil.badola@freescale.com>

commit f8786a91548df6930643a052e40e5c0b7a8403a5 upstream.

Incoming packets in high speed are randomly corrupted by h/w
resulting in multiple errors. This workaround makes FS as
default mode in all affected socs by disabling HS chirp
signalling.This errata does not affect FS and LS mode.

Forces all HS devices to connect in FS mode for all socs
affected by this erratum:
P3041 and P2041 rev 1.0 and 1.1
P5020 and P5010 rev 1.0 and 2.0
P5040, P1010 and T4240 rev 1.0

Signed-off-by: Ramneek Mehresh <ramneek.mehresh@freescale.com>
Signed-off-by: Nikhil Badola <nikhil.badola@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/host/ehci-fsl.c      |  4 ++++
 drivers/usb/host/ehci-hub.c      |  7 +++++++
 drivers/usb/host/ehci.h          | 12 ++++++++++++
 drivers/usb/host/fsl-mph-dr-of.c |  4 ++++
 include/linux/fsl_devices.h      |  1 +
 5 files changed, 28 insertions(+)

diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 716aa8b..358df00 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -270,6 +270,10 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 		out_be32(non_ehci + FSL_SOC_USB_SNOOP2, 0x80000000 | SNOOP_SIZE_2GB);
 	}
 
+	/* Deal with USB erratum A-005275 */
+	if (pdata->has_fsl_erratum_a005275 == 1)
+		ehci->has_fsl_hs_errata = 1;
+
 	if ((pdata->operating_mode == FSL_USB2_DR_HOST) ||
 			(pdata->operating_mode == FSL_USB2_DR_OTG))
 		if (ehci_fsl_setup_phy(hcd, pdata->phy_mode, 0))
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 22abb68..086a711 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1221,6 +1221,13 @@ int ehci_hub_control(
 				 */
 				ehci->reset_done [wIndex] = jiffies
 						+ msecs_to_jiffies (50);
+
+				/*
+				 * Force full-speed connect for FSL high-speed
+				 * erratum; disable HS Chirp by setting PFSC bit
+				 */
+				if (ehci_has_fsl_hs_errata(ehci))
+					temp |= (1 << PORTSC_FSL_PFSC);
 			}
 			ehci_writel(ehci, temp, status_reg);
 			break;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index f700157..46f62e4 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -215,6 +215,7 @@ struct ehci_hcd {			/* one per controller */
 	/* SILICON QUIRKS */
 	unsigned		no_selective_suspend:1;
 	unsigned		has_fsl_port_bug:1; /* FreeScale */
+	unsigned		has_fsl_hs_errata:1;	/* Freescale HS quirk */
 	unsigned		big_endian_mmio:1;
 	unsigned		big_endian_desc:1;
 	unsigned		big_endian_capbase:1;
@@ -686,6 +687,17 @@ ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)
 #define	ehci_has_fsl_portno_bug(e)		(0)
 #endif
 
+#define PORTSC_FSL_PFSC	24	/* Port Force Full-Speed Connect */
+
+#if defined(CONFIG_PPC_85xx)
+/* Some Freescale processors have an erratum (USB A-005275) in which
+ * incoming packets get corrupted in HS mode
+ */
+#define ehci_has_fsl_hs_errata(e)	((e)->has_fsl_hs_errata)
+#else
+#define ehci_has_fsl_hs_errata(e)	(0)
+#endif
+
 /*
  * While most USB host controllers implement their registers in
  * little-endian format, a minority (celleb companion chip) implement
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 2ade376..56cca8f 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -219,6 +219,10 @@ static int fsl_usb2_mph_dr_of_probe(struct platform_device *ofdev)
 		pdata->has_fsl_erratum_a007792 = 1;
 	else
 		pdata->has_fsl_erratum_a007792 = 0;
+	if (of_get_property(np, "fsl,usb-erratum-a005275", NULL))
+		pdata->has_fsl_erratum_a005275 = 1;
+	else
+		pdata->has_fsl_erratum_a005275 = 0;
 
 	if (pdata->have_sysif_regs) {
 		if (pdata->controller_ver < 0) {
diff --git a/include/linux/fsl_devices.h b/include/linux/fsl_devices.h
index dfcf101397a..1266031 100644
--- a/include/linux/fsl_devices.h
+++ b/include/linux/fsl_devices.h
@@ -94,6 +94,7 @@ struct fsl_usb2_platform_data {
 	unsigned	suspended:1;
 	unsigned	already_suspended:1;
 	unsigned        has_fsl_erratum_a007792:1;
+	unsigned        has_fsl_erratum_a005275:1;
 
 	/* register save area for suspend/resume */
 	u32		pm_command;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302142 — [PATCH 4.2.y-ckt 033/211] [media] v4l2-ctrls: arrays are also considered compound controls

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <hans.verkuil@cisco.com>

commit 35204e2e84f2dae72012f8ca319659c12f428430 upstream.

Array controls weren't skipped when only V4L2_CTRL_FLAG_NEXT_CTRL was
provided (so no V4L2_CTRL_FLAG_NEXT_COMPOUND was set). This is wrong
since arrays are also considered compound controls (i.e. with more than
one value), and applications that do not know about arrays will not
be able to handle such controls.

Fix the test to include arrays.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/media/v4l2-core/v4l2-ctrls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index e3a3468..57864c7 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -2513,7 +2513,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
 			/* We found a control with the given ID, so just get
 			   the next valid one in the list. */
 			list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) {
-				is_compound =
+				is_compound = ref->ctrl->is_array ||
 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
 				if (id < ref->ctrl->id &&
 				    (is_compound & mask) == match)
@@ -2527,7 +2527,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
 			   is one, otherwise the first 'if' above would have
 			   been true. */
 			list_for_each_entry(ref, &hdl->ctrl_refs, node) {
-				is_compound =
+				is_compound = ref->ctrl->is_array ||
 					ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
 				if (id < ref->ctrl->id &&
 				    (is_compound & mask) == match)
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302143 — [PATCH 4.2.y-ckt 034/211] [media] media: v4l2-ctrls: Fix 64bit support in get_ctrl()

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benoit Parrot <bparrot@ti.com>

commit a8077734055f870ba630563868a6349671ca8dfc upstream.

When trying to use v4l2_ctrl_g_ctrl_int64() to retrieve a
V4L2_CTRL_TYPE_INTEGER64 type value the internal helper function
get_ctrl() would prematurely exit because for this control type
the 'is_int' flag is not set. This would result in v4l2_ctrl_g_ctrl_int64
always returning 0.

Also v4l2_ctrl_g_ctrl_int64() is reading and returning the 32bit value
member instead of the 64bit version, so fixing that as well.

This patch extends the condition check to allow the V4L2_CTRL_TYPE_INTEGER64
type to continue processing instead of exiting.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/media/v4l2-core/v4l2-ctrls.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 57864c7..78e7ca7 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -2899,7 +2899,7 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
 	 * cur_to_user() calls below would need to be modified not to access
 	 * userspace memory when called from get_ctrl().
 	 */
-	if (!ctrl->is_int)
+	if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
 		return -EINVAL;
 
 	if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
@@ -2957,9 +2957,9 @@ s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)
 
 	/* It's a driver bug if this happens. */
 	WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64);
-	c.value = 0;
+	c.value64 = 0;
 	get_ctrl(ctrl, &c);
-	return c.value;
+	return c.value64;
 }
 EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302144 — [PATCH 4.2.y-ckt 006/211] drm/radeon: add quirk for ASUS R7 370

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 2b02ec79004388a8c65e227bc289ed891b5ac8c6 upstream.

Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=92260

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/radeon/si_dpm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index e9115d3..e72bf46 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2928,6 +2928,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
+	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
 	{ 0, 0, 0, 0 },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302145 — [PATCH 4.2.y-ckt 029/211] KVM: svm: unconditionally intercept #DB

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <pbonzini@redhat.com>

commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream.

This is needed to avoid the possibility that the guest triggers
an infinite stream of #DB exceptions (CVE-2015-8104).

VMX is not affected: because it does not save DR6 in the VMCS,
it already intercepts #DB unconditionally.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kvm/svm.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 00da6e8..5e203b3 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1107,6 +1107,7 @@ static void init_vmcb(struct vcpu_svm *svm)
 	set_exception_intercept(svm, UD_VECTOR);
 	set_exception_intercept(svm, MC_VECTOR);
 	set_exception_intercept(svm, AC_VECTOR);
+	set_exception_intercept(svm, DB_VECTOR);
 
 	set_intercept(svm, INTERCEPT_INTR);
 	set_intercept(svm, INTERCEPT_NMI);
@@ -1641,20 +1642,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
 	mark_dirty(svm->vmcb, VMCB_SEG);
 }
 
-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 
-	clr_exception_intercept(svm, DB_VECTOR);
 	clr_exception_intercept(svm, BP_VECTOR);
 
-	if (svm->nmi_singlestep)
-		set_exception_intercept(svm, DB_VECTOR);
-
 	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
-		if (vcpu->guest_debug &
-		    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
-			set_exception_intercept(svm, DB_VECTOR);
 		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
 			set_exception_intercept(svm, BP_VECTOR);
 	} else
@@ -1760,7 +1754,6 @@ static int db_interception(struct vcpu_svm *svm)
 		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
 			svm->vmcb->save.rflags &=
 				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
-		update_db_bp_intercept(&svm->vcpu);
 	}
 
 	if (svm->vcpu.guest_debug &
@@ -3759,7 +3752,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
 	 */
 	svm->nmi_singlestep = true;
 	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
-	update_db_bp_intercept(vcpu);
 }
 
 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
@@ -4381,7 +4373,7 @@ static struct kvm_x86_ops svm_x86_ops = {
 	.vcpu_load = svm_vcpu_load,
 	.vcpu_put = svm_vcpu_put,
 
-	.update_db_bp_intercept = update_db_bp_intercept,
+	.update_db_bp_intercept = update_bp_intercept,
 	.get_msr = svm_get_msr,
 	.set_msr = svm_set_msr,
 	.get_segment_base = svm_get_segment_base,
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302147 — [PATCH 4.2.y-ckt 038/211] integrity: prevent loading untrusted certificates on the IMA trusted keyring

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>

commit 72e1eed8abb11c79749266d433c817ce36732893 upstream.

If IMA_LOAD_X509 is enabled, either directly or indirectly via
IMA_APPRAISE_SIGNED_INIT, certificates are loaded onto the IMA
trusted keyring by the kernel via key_create_or_update(). When
the KEY_ALLOC_TRUSTED flag is provided, certificates are loaded
without first verifying the certificate is properly signed by a
trusted key on the system keyring.  This patch removes the
KEY_ALLOC_TRUSTED flag.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 security/integrity/digsig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 36fb6b5..5be9ffb 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -105,7 +105,7 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
 				   rc,
 				   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
 				    KEY_USR_VIEW | KEY_USR_READ),
-				   KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_TRUSTED);
+				   KEY_ALLOC_NOT_IN_QUOTA);
 	if (IS_ERR(key)) {
 		rc = PTR_ERR(key);
 		pr_err("Problem loading X.509 certificate (%d): %s\n",
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302148 — [PATCH 4.2.y-ckt 036/211] drm/i915: Only update the current userptr worker

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 68d6c840595849c0d29f6c52bc75b44ded66b41f upstream.

The userptr worker allows for a slight race condition where upon there
may two or more threads calling get_user_pages for the same object. When
we have the array of pages, then we serialise the update of the object.
However, the worker should only overwrite the obj->userptr.work pointer
if and only if it is the active one. Currently we clear it for a
secondary worker with the effect that we may rarely force a second
lookup.

v2: Rebase and rename a variable to avoid 80cols
v3: Mention v2

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[ kamal: 4.2-stable prereq for
  e4b946b "drm/i915: Fix userptr deadlock with aliased GTT mmappings" ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/i915/i915_gem_userptr.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index a96b900..203a569 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -571,25 +571,25 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
 	struct get_pages_work *work = container_of(_work, typeof(*work), work);
 	struct drm_i915_gem_object *obj = work->obj;
 	struct drm_device *dev = obj->base.dev;
-	const int num_pages = obj->base.size >> PAGE_SHIFT;
+	const int npages = obj->base.size >> PAGE_SHIFT;
 	struct page **pvec;
 	int pinned, ret;
 
 	ret = -ENOMEM;
 	pinned = 0;
 
-	pvec = kmalloc(num_pages*sizeof(struct page *),
+	pvec = kmalloc(npages*sizeof(struct page *),
 		       GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
 	if (pvec == NULL)
-		pvec = drm_malloc_ab(num_pages, sizeof(struct page *));
+		pvec = drm_malloc_ab(npages, sizeof(struct page *));
 	if (pvec != NULL) {
 		struct mm_struct *mm = obj->userptr.mm->mm;
 
 		down_read(&mm->mmap_sem);
-		while (pinned < num_pages) {
+		while (pinned < npages) {
 			ret = get_user_pages(work->task, mm,
 					     obj->userptr.ptr + pinned * PAGE_SIZE,
-					     num_pages - pinned,
+					     npages - pinned,
 					     !obj->userptr.read_only, 0,
 					     pvec + pinned, NULL);
 			if (ret < 0)
@@ -601,20 +601,20 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
 	}
 
 	mutex_lock(&dev->struct_mutex);
-	if (obj->userptr.work != &work->work) {
-		ret = 0;
-	} else if (pinned == num_pages) {
-		ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages);
-		if (ret == 0) {
-			list_add_tail(&obj->global_list, &to_i915(dev)->mm.unbound_list);
-			obj->get_page.sg = obj->pages->sgl;
-			obj->get_page.last = 0;
-
-			pinned = 0;
+	if (obj->userptr.work == &work->work) {
+		if (pinned == npages) {
+			ret = __i915_gem_userptr_set_pages(obj, pvec, npages);
+			if (ret == 0) {
+				list_add_tail(&obj->global_list,
+					      &to_i915(dev)->mm.unbound_list);
+				obj->get_page.sg = obj->pages->sgl;
+				obj->get_page.last = 0;
+				pinned = 0;
+			}
 		}
+		obj->userptr.work = ERR_PTR(ret);
 	}
 
-	obj->userptr.work = ERR_PTR(ret);
 	obj->userptr.workers--;
 	drm_gem_object_unreference(&obj->base);
 	mutex_unlock(&dev->struct_mutex);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302149 — [PATCH 4.2.y-ckt 041/211] lockd: create NSM handles per net namespace

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <aryabinin@virtuozzo.com>

commit 0ad95472bf169a3501991f8f33f5147f792a8116 upstream.

Commit cb7323fffa85 ("lockd: create and use per-net NSM
 RPC clients on MON/UNMON requests") introduced per-net
NSM RPC clients. Unfortunately this doesn't make any sense
without per-net nsm_handle.

E.g. the following scenario could happen
Two hosts (X and Y) in different namespaces (A and B) share
the same nsm struct.

1. nsm_monitor(host_X) called => NSM rpc client created,
	nsm->sm_monitored bit set.
2. nsm_mointor(host-Y) called => nsm->sm_monitored already set,
	we just exit. Thus in namespace B ln->nsm_clnt == NULL.
3. host X destroyed => nsm->sm_count decremented to 1
4. host Y destroyed => nsm_unmonitor() => nsm_mon_unmon() => NULL-ptr
	dereference of *ln->nsm_clnt

So this could be fixed by making per-net nsm_handles list,
instead of global. Thus different net namespaces will not be able
share the same nsm_handle.

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/lockd/host.c             |  7 ++++---
 fs/lockd/mon.c              | 36 ++++++++++++++++++++++--------------
 fs/lockd/netns.h            |  1 +
 fs/lockd/svc.c              |  1 +
 fs/lockd/svc4proc.c         |  2 +-
 fs/lockd/svcproc.c          |  2 +-
 include/linux/lockd/lockd.h |  9 ++++++---
 7 files changed, 36 insertions(+), 22 deletions(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 969d589..b5f3c3a 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -116,7 +116,7 @@ static struct nlm_host *nlm_alloc_host(struct nlm_lookup_host_info *ni,
 		atomic_inc(&nsm->sm_count);
 	else {
 		host = NULL;
-		nsm = nsm_get_handle(ni->sap, ni->salen,
+		nsm = nsm_get_handle(ni->net, ni->sap, ni->salen,
 					ni->hostname, ni->hostname_len);
 		if (unlikely(nsm == NULL)) {
 			dprintk("lockd: %s failed; no nsm handle\n",
@@ -534,17 +534,18 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
 
 /**
  * nlm_host_rebooted - Release all resources held by rebooted host
+ * @net:  network namespace
  * @info: pointer to decoded results of NLM_SM_NOTIFY call
  *
  * We were notified that the specified host has rebooted.  Release
  * all resources held by that peer.
  */
-void nlm_host_rebooted(const struct nlm_reboot *info)
+void nlm_host_rebooted(const struct net *net, const struct nlm_reboot *info)
 {
 	struct nsm_handle *nsm;
 	struct nlm_host	*host;
 
-	nsm = nsm_reboot_lookup(info);
+	nsm = nsm_reboot_lookup(net, info);
 	if (unlikely(nsm == NULL))
 		return;
 
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index 47a32b6..6c05cd1 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -51,7 +51,6 @@ struct nsm_res {
 };
 
 static const struct rpc_program	nsm_program;
-static				LIST_HEAD(nsm_handles);
 static				DEFINE_SPINLOCK(nsm_lock);
 
 /*
@@ -264,33 +263,35 @@ void nsm_unmonitor(const struct nlm_host *host)
 	}
 }
 
-static struct nsm_handle *nsm_lookup_hostname(const char *hostname,
-					      const size_t len)
+static struct nsm_handle *nsm_lookup_hostname(const struct list_head *nsm_handles,
+					const char *hostname, const size_t len)
 {
 	struct nsm_handle *nsm;
 
-	list_for_each_entry(nsm, &nsm_handles, sm_link)
+	list_for_each_entry(nsm, nsm_handles, sm_link)
 		if (strlen(nsm->sm_name) == len &&
 		    memcmp(nsm->sm_name, hostname, len) == 0)
 			return nsm;
 	return NULL;
 }
 
-static struct nsm_handle *nsm_lookup_addr(const struct sockaddr *sap)
+static struct nsm_handle *nsm_lookup_addr(const struct list_head *nsm_handles,
+					const struct sockaddr *sap)
 {
 	struct nsm_handle *nsm;
 
-	list_for_each_entry(nsm, &nsm_handles, sm_link)
+	list_for_each_entry(nsm, nsm_handles, sm_link)
 		if (rpc_cmp_addr(nsm_addr(nsm), sap))
 			return nsm;
 	return NULL;
 }
 
-static struct nsm_handle *nsm_lookup_priv(const struct nsm_private *priv)
+static struct nsm_handle *nsm_lookup_priv(const struct list_head *nsm_handles,
+					const struct nsm_private *priv)
 {
 	struct nsm_handle *nsm;
 
-	list_for_each_entry(nsm, &nsm_handles, sm_link)
+	list_for_each_entry(nsm, nsm_handles, sm_link)
 		if (memcmp(nsm->sm_priv.data, priv->data,
 					sizeof(priv->data)) == 0)
 			return nsm;
@@ -353,6 +354,7 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
 
 /**
  * nsm_get_handle - Find or create a cached nsm_handle
+ * @net: network namespace
  * @sap: pointer to socket address of handle to find
  * @salen: length of socket address
  * @hostname: pointer to C string containing hostname to find
@@ -365,11 +367,13 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
  * @hostname cannot be found in the handle cache.  Returns NULL if
  * an error occurs.
  */
-struct nsm_handle *nsm_get_handle(const struct sockaddr *sap,
+struct nsm_handle *nsm_get_handle(const struct net *net,
+				  const struct sockaddr *sap,
 				  const size_t salen, const char *hostname,
 				  const size_t hostname_len)
 {
 	struct nsm_handle *cached, *new = NULL;
+	struct lockd_net *ln = net_generic(net, lockd_net_id);
 
 	if (hostname && memchr(hostname, '/', hostname_len) != NULL) {
 		if (printk_ratelimit()) {
@@ -384,9 +388,10 @@ retry:
 	spin_lock(&nsm_lock);
 
 	if (nsm_use_hostnames && hostname != NULL)
-		cached = nsm_lookup_hostname(hostname, hostname_len);
+		cached = nsm_lookup_hostname(&ln->nsm_handles,
+					hostname, hostname_len);
 	else
-		cached = nsm_lookup_addr(sap);
+		cached = nsm_lookup_addr(&ln->nsm_handles, sap);
 
 	if (cached != NULL) {
 		atomic_inc(&cached->sm_count);
@@ -400,7 +405,7 @@ retry:
 	}
 
 	if (new != NULL) {
-		list_add(&new->sm_link, &nsm_handles);
+		list_add(&new->sm_link, &ln->nsm_handles);
 		spin_unlock(&nsm_lock);
 		dprintk("lockd: created nsm_handle for %s (%s)\n",
 				new->sm_name, new->sm_addrbuf);
@@ -417,19 +422,22 @@ retry:
 
 /**
  * nsm_reboot_lookup - match NLMPROC_SM_NOTIFY arguments to an nsm_handle
+ * @net:  network namespace
  * @info: pointer to NLMPROC_SM_NOTIFY arguments
  *
  * Returns a matching nsm_handle if found in the nsm cache. The returned
  * nsm_handle's reference count is bumped. Otherwise returns NULL if some
  * error occurred.
  */
-struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info)
+struct nsm_handle *nsm_reboot_lookup(const struct net *net,
+				const struct nlm_reboot *info)
 {
 	struct nsm_handle *cached;
+	struct lockd_net *ln = net_generic(net, lockd_net_id);
 
 	spin_lock(&nsm_lock);
 
-	cached = nsm_lookup_priv(&info->priv);
+	cached = nsm_lookup_priv(&ln->nsm_handles, &info->priv);
 	if (unlikely(cached == NULL)) {
 		spin_unlock(&nsm_lock);
 		dprintk("lockd: never saw rebooted peer '%.*s' before\n",
diff --git a/fs/lockd/netns.h b/fs/lockd/netns.h
index 097bfa3..89fe011 100644
--- a/fs/lockd/netns.h
+++ b/fs/lockd/netns.h
@@ -15,6 +15,7 @@ struct lockd_net {
 	spinlock_t nsm_clnt_lock;
 	unsigned int nsm_users;
 	struct rpc_clnt *nsm_clnt;
+	struct list_head nsm_handles;
 };
 
 extern int lockd_net_id;
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 55505cb..a9d5fb7 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -587,6 +587,7 @@ static int lockd_init_net(struct net *net)
 	INIT_DELAYED_WORK(&ln->grace_period_end, grace_ender);
 	INIT_LIST_HEAD(&ln->lockd_manager.list);
 	spin_lock_init(&ln->nsm_clnt_lock);
+	INIT_LIST_HEAD(&ln->nsm_handles);
 	return 0;
 }
 
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index b147d1a..09c576f 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -421,7 +421,7 @@ nlm4svc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
 		return rpc_system_err;
 	}
 
-	nlm_host_rebooted(argp);
+	nlm_host_rebooted(SVC_NET(rqstp), argp);
 	return rpc_success;
 }
 
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 21171f0..fb26b9f 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -464,7 +464,7 @@ nlmsvc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
 		return rpc_system_err;
 	}
 
-	nlm_host_rebooted(argp);
+	nlm_host_rebooted(SVC_NET(rqstp), argp);
 	return rpc_success;
 }
 
diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
index ff82a32..fd3b65b 100644
--- a/include/linux/lockd/lockd.h
+++ b/include/linux/lockd/lockd.h
@@ -235,7 +235,8 @@ void		  nlm_rebind_host(struct nlm_host *);
 struct nlm_host * nlm_get_host(struct nlm_host *);
 void		  nlm_shutdown_hosts(void);
 void		  nlm_shutdown_hosts_net(struct net *net);
-void		  nlm_host_rebooted(const struct nlm_reboot *);
+void		  nlm_host_rebooted(const struct net *net,
+					const struct nlm_reboot *);
 
 /*
  * Host monitoring
@@ -243,11 +244,13 @@ void		  nlm_host_rebooted(const struct nlm_reboot *);
 int		  nsm_monitor(const struct nlm_host *host);
 void		  nsm_unmonitor(const struct nlm_host *host);
 
-struct nsm_handle *nsm_get_handle(const struct sockaddr *sap,
+struct nsm_handle *nsm_get_handle(const struct net *net,
+					const struct sockaddr *sap,
 					const size_t salen,
 					const char *hostname,
 					const size_t hostname_len);
-struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info);
+struct nsm_handle *nsm_reboot_lookup(const struct net *net,
+					const struct nlm_reboot *info);
 void		  nsm_release(struct nsm_handle *nsm);
 
 /*
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302150 — [PATCH 4.2.y-ckt 040/211] spi: ti-qspi: Fix data corruption seen on r/w stress test

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vignesh R <vigneshr@ti.com>

commit bc27a53928981662079aa243915b443370294a03 upstream.

Writing invalid command to QSPI_SPI_CMD_REG will terminate current
transfer and de-assert the chip select. This has to be done before
calling spi_finalize_current_message(). Because
spi_finalize_current_message() will mark the end of current message
transfer and schedule the next transfer. If the chipselect is not
de-asserted before calling spi_finalize_current_message() then the next
transfer will overlap with the previous transfer leading to data
corruption.
__spi_pump_message() can be called either from kthread worker context or
directly from the calling process's context. It is possible that these
two calls can race against each other. But race is serialized by
checking whether master->cur_msg == NULL (pointer to msg being handled
by transfer_one() at present). The master->cur_msg is set to NULL when
spi_finalize_current_message() is called on that message, which means
calling spi_finalize_current_message() allows __spi_sync() to pump next
message in calling process context.
Now if spi-ti-qspi calls spi_finalize_current_message() before we
terminate transfer at hardware side, if __spi_pump_message() is called
from process context then the successive transactions can overlap.

Fix this by moving writing invalid command to QSPI_SPI_CMD_REG to
before calling spi_finalize_current_message() call.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/spi/spi-ti-qspi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 5c06168..2933626 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -384,11 +384,10 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
 
 	mutex_unlock(&qspi->list_lock);
 
+	ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
 	m->status = status;
 	spi_finalize_current_message(master);
 
-	ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
-
 	return status;
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302151 — [PATCH 4.2.y-ckt 024/211] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 upstream.

Compile-tested only.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index c4198fa..86f9abe 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
 	is->compflags = 0;
 
 	is->reset = isdn_ppp_ccp_reset_alloc(is);
+	if (!is->reset)
+		return -ENOMEM;
 
 	is->lp = NULL;
 	is->mp_seqno = 0;       /* MP sequence number */
@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
 	 * VJ header compression init
 	 */
 	is->slcomp = slhc_init(16, 16);	/* not necessary for 2. link in bundle */
+	if (!is->slcomp) {
+		isdn_ppp_ccp_reset_free(is);
+		return -ENOMEM;
+	}
 #endif
 #ifdef CONFIG_IPPP_FILTER
 	is->pass_filter = NULL;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302152 — [PATCH 4.2.y-ckt 025/211] ppp, slip: Validate VJ compression slot parameters completely

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae upstream.

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 <guoyonggang@360.cn>
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/isdn/i4l/isdn_ppp.c   | 10 ++++------
 drivers/net/ppp/ppp_generic.c |  6 ++----
 drivers/net/slip/slhc.c       | 12 ++++++++----
 drivers/net/slip/slip.c       |  2 +-
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 86f9abe..9c1e8ad 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -322,9 +322,9 @@ isdn_ppp_open(int min, struct file *file)
 	 * VJ header compression init
 	 */
 	is->slcomp = slhc_init(16, 16);	/* not necessary for 2. link in bundle */
-	if (!is->slcomp) {
+	if (IS_ERR(is->slcomp)) {
 		isdn_ppp_ccp_reset_free(is);
-		return -ENOMEM;
+		return PTR_ERR(is->slcomp);
 	}
 #endif
 #ifdef CONFIG_IPPP_FILTER
@@ -573,10 +573,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
 			is->maxcid = val;
 #ifdef CONFIG_ISDN_PPP_VJ
 			sltmp = slhc_init(16, val);
-			if (!sltmp) {
-				printk(KERN_ERR "ippp, can't realloc slhc struct\n");
-				return -ENOMEM;
-			}
+			if (IS_ERR(sltmp))
+				return PTR_ERR(sltmp);
 			if (is->slcomp)
 				slhc_free(is->slcomp);
 			is->slcomp = sltmp;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 487be20..3f3bda8 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -719,10 +719,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			val &= 0xffff;
 		}
 		vj = slhc_init(val2+1, val+1);
-		if (!vj) {
-			netdev_err(ppp->dev,
-				   "PPP: no memory (VJ compressor)\n");
-			err = -ENOMEM;
+		if (IS_ERR(vj)) {
+			err = PTR_ERR(vj);
 			break;
 		}
 		ppp_lock(ppp);
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index 079f7ad..27ed252 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
 static unsigned char * put16(unsigned char *cp, unsigned short x);
 static unsigned short pull16(unsigned char **cpp);
 
-/* Initialize compression data structure
+/* Allocate compression data structure
  *	slots must be in range 0 to 255 (zero meaning no compression)
+ * Returns pointer to structure or ERR_PTR() on error.
  */
 struct slcompress *
 slhc_init(int rslots, int tslots)
@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
 	register struct cstate *ts;
 	struct slcompress *comp;
 
+	if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
+		return ERR_PTR(-EINVAL);
+
 	comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
 	if (! comp)
 		goto out_fail;
 
-	if ( rslots > 0  &&  rslots < 256 ) {
+	if (rslots > 0) {
 		size_t rsize = rslots * sizeof(struct cstate);
 		comp->rstate = kzalloc(rsize, GFP_KERNEL);
 		if (! comp->rstate)
@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
 		comp->rslot_limit = rslots - 1;
 	}
 
-	if ( tslots > 0  &&  tslots < 256 ) {
+	if (tslots > 0) {
 		size_t tsize = tslots * sizeof(struct cstate);
 		comp->tstate = kzalloc(tsize, GFP_KERNEL);
 		if (! comp->tstate)
@@ -141,7 +145,7 @@ out_free2:
 out_free:
 	kfree(comp);
 out_fail:
-	return NULL;
+	return ERR_PTR(-ENOMEM);
 }
 
 
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 05387b1..a17d86a 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
 	if (cbuff == NULL)
 		goto err_exit;
 	slcomp = slhc_init(16, 16);
-	if (slcomp == NULL)
+	if (IS_ERR(slcomp))
 		goto err_exit;
 #endif
 	spin_lock_bh(&sl->lock);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302153 — [PATCH 4.2.y-ckt 026/211] [media] media/vivid-osd: fix info leak in ioctl

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: =?UTF-8?q?Salva=20Peir=C3=B3?= <speirofr@gmail.com>

commit eda98796aff0d9bf41094b06811f5def3b4c333c upstream.

The vivid_fb_ioctl() code fails to initialize the 16 _reserved bytes of
struct fb_vblank after the ->hcount member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Salva Peiró <speirofr@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/media/platform/vivid/vivid-osd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
index 084d346..e15eef6 100644
--- a/drivers/media/platform/vivid/vivid-osd.c
+++ b/drivers/media/platform/vivid/vivid-osd.c
@@ -85,6 +85,7 @@ static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg)
 	case FBIOGET_VBLANK: {
 		struct fb_vblank vblank;
 
+		memset(&vblank, 0, sizeof(vblank));
 		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT |
 			FB_VBLANK_HAVE_VSYNC;
 		vblank.count = 0;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302155 — [PATCH 4.2.y-ckt 019/211] KEYS: Fix race between key destruction and finding a keyring by name

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit 94c4554ba07adbdde396748ee7ae01e86cf2d8d7 upstream.

There appears to be a race between:

 (1) key_gc_unused_keys() which frees key->security and then calls
     keyring_destroy() to unlink the name from the name list

 (2) find_keyring_by_name() which calls key_permission(), thus accessing
     key->security, on a key before checking to see whether the key usage is 0
     (ie. the key is dead and might be cleaned up).

Fix this by calling ->destroy() before cleaning up the core key data -
including key->security.

Reported-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 security/keys/gc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index c795237..39eac1f 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,6 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
+		/* Throw away the key data */
+		if (key->type->destroy)
+			key->type->destroy(key);
+
 		security_key_free(key);
 
 		/* deal with the user's key tracking and quota */
@@ -148,10 +152,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		/* now throw away the key memory */
-		if (key->type->destroy)
-			key->type->destroy(key);
-
 		key_user_put(key->user);
 
 		kfree(key->description);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302156 — [PATCH 4.2.y-ckt 020/211] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.

The following sequence of commands:

    i=`keyctl add user a a @s`
    keyctl request2 keyring foo bar @t
    keyctl unlink $i @s

tries to invoke an upcall to instantiate a keyring if one doesn't already
exist by that name within the user's keyring set.  However, if the upcall
fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
other error code.  When the key is garbage collected, the key destroy
function is called unconditionally and keyring_destroy() uses list_empty()
on keyring->type_data.link - which is in a union with reject_error.
Subsequently, the kernel tries to unlink the keyring from the keyring names
list - which oopses like this:

	BUG: unable to handle kernel paging request at 00000000ffffff8a
	IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	...
	Workqueue: events key_garbage_collector
	...
	RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	RSP: 0018:ffff88003e2f3d30  EFLAGS: 00010203
	RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
	RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
	RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
	R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
	R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
	...
	CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
	...
	Call Trace:
	 [<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
	 [<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
	 [<ffffffff8105ec9b>] process_one_work+0x28e/0x547
	 [<ffffffff8105fd17>] worker_thread+0x26e/0x361
	 [<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
	 [<ffffffff810648ad>] kthread+0xf3/0xfb
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
	 [<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2

Note the value in RAX.  This is a 32-bit representation of -ENOKEY.

The solution is to only call ->destroy() if the key was successfully
instantiated.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 security/keys/gc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 39eac1f..addf060 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,8 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
-		/* Throw away the key data */
-		if (key->type->destroy)
+		/* Throw away the key data if the key is instantiated */
+		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+		    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+		    key->type->destroy)
 			key->type->destroy(key);
 
 		security_key_free(key);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302169 — [PATCH 4.2.y-ckt 018/211] scsi_dh: fix randconfig build error

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@lst.de>

commit 294ab783ad98066b87296db1311c7ba2a60206a5 upstream.

It looks like the Kconfig check that was meant to fix this (commit
fe9233fb6914a0eb20166c967e3020f7f0fba2c9 [SCSI] scsi_dh: fix kconfig related
build errors) was actually reversed, but no-one noticed until the new set of
patches which separated DM and SCSI_DH).

Fixes: fe9233fb6914a0eb20166c967e3020f7f0fba2c9
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/md/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index bfec3bd..19fd680 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -393,7 +393,7 @@ config DM_MULTIPATH
 	# of SCSI_DH if the latter isn't defined but if
 	# it is, DM_MULTIPATH must depend on it.  We get a build
 	# error if SCSI_DH=m and DM_MULTIPATH=y
-	depends on SCSI_DH || !SCSI_DH
+	depends on !SCSI_DH || SCSI
 	---help---
 	  Allow volume managers to support multipath hardware.
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1302175 — [PATCH 4.2.y-ckt 017/211] netlink, mmap: fix edge-case leakages in nf queue zero-copy

4.2.8-ckt1 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

commit 6bb0fef489f667cf701853054f44579754f00a06 upstream.

When netlink mmap on receive side is the consumer of nf queue data,
it can happen that in some edge cases, we write skb shared info into
the user space mmap buffer:

Assume a possible rx ring frame size of only 4096, and the network skb,
which is being zero-copied into the netlink skb, contains page frags
with an overall skb->len larger than the linear part of the netlink
skb.

skb_zerocopy(), which is generic and thus not aware of the fact that
shared info cannot be accessed for such skbs then tries to write and
fill frags, thus leaking kernel data/pointers and in some corner cases
possibly writing out of bounds of the mmap area (when filling the
last slot in the ring buffer this way).

I.e. the ring buffer slot is then of status NL_MMAP_STATUS_VALID, has
an advertised length larger than 4096, where the linear part is visible
at the slot beginning, and the leaked sizeof(struct skb_shared_info)
has been written to the beginning of the next slot (also corrupting
the struct nl_mmap_hdr slot header incl. status etc), since skb->end
points to skb->data + ring->frame_size - NL_MMAP_HDRLEN.

The fix adds and lets __netlink_alloc_skb() take the actual needed
linear room for the network skb + meta data into account. It's completely
irrelevant for non-mmaped netlink sockets, but in case mmap sockets
are used, it can be decided whether the available skb_tailroom() is
really large enough for the buffer, or whether it needs to internally
fallback to a normal alloc_skb().

>From nf queue side, the information whether the destination port is
an mmap RX ring is not really available without extra port-to-socket
lookup, thus it can only be determined in lower layers i.e. when
__netlink_alloc_skb() is called that checks internally for this. I
chose to add the extra ldiff parameter as mmap will then still work:
We have data_len and hlen in nfqnl_build_packet_message(), data_len
is the full length (capped at queue->copy_range) for skb_zerocopy()
and hlen some possible part of data_len that needs to be copied; the
rem_len variable indicates the needed remaining linear mmap space.

The only other workaround in nf queue internally would be after
allocation time by f.e. cap'ing the data_len to the skb_tailroom()
iff we deal with an mmap skb, but that would 1) expose the fact that
we use a mmap skb to upper layers, and 2) trim the skb where we
otherwise could just have moved the full skb into the normal receive
queue.

After the patch, in my test case the ring slot doesn't fit and therefore
shows NL_MMAP_STATUS_COPY, where a full skb carries all the data and
thus needs to be picked up via recv().

Fixes: 3ab1f683bf8b ("nfnetlink: add support for memory mapped netlink")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 include/linux/netlink.h              | 13 +++++++++++--
 net/netfilter/nfnetlink_queue_core.c |  5 +++--
 net/netlink/af_netlink.c             | 18 ++++++++++++------
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 9120edb..639e9b8 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -68,8 +68,17 @@ extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
 extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group);
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
 extern int netlink_has_listeners(struct sock *sk, unsigned int group);
-extern struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
-					 u32 dst_portid, gfp_t gfp_mask);
+
+extern struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+					   unsigned int ldiff, u32 dst_portid,
+					   gfp_t gfp_mask);
+static inline struct sk_buff *
+netlink_alloc_skb(struct sock *ssk, unsigned int size, u32 dst_portid,
+		  gfp_t gfp_mask)
+{
+	return __netlink_alloc_skb(ssk, size, 0, dst_portid, gfp_mask);
+}
+
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
 			     __u32 group, gfp_t allocation);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 685cc6a..a5cd6d9 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -301,7 +301,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 			   __be32 **packet_id_ptr)
 {
 	size_t size;
-	size_t data_len = 0, cap_len = 0;
+	size_t data_len = 0, cap_len = 0, rem_len = 0;
 	unsigned int hlen = 0;
 	struct sk_buff *skb;
 	struct nlattr *nla;
@@ -360,6 +360,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 		hlen = min_t(unsigned int, hlen, data_len);
 		size += sizeof(struct nlattr) + hlen;
 		cap_len = entskb->len;
+		rem_len = data_len - hlen;
 		break;
 	}
 
@@ -377,7 +378,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 			size += nla_total_size(seclen);
 	}
 
-	skb = nfnetlink_alloc_skb(net, size, queue->peer_portid,
+	skb = __netlink_alloc_skb(net->nfnl, size, rem_len, queue->peer_portid,
 				  GFP_ATOMIC);
 	if (!skb) {
 		skb_tx_error(entskb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8b158f7..a7fc3d4 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1864,15 +1864,16 @@ retry:
 }
 EXPORT_SYMBOL(netlink_unicast);
 
-struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
-				  u32 dst_portid, gfp_t gfp_mask)
+struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+				    unsigned int ldiff, u32 dst_portid,
+				    gfp_t gfp_mask)
 {
 #ifdef CONFIG_NETLINK_MMAP
+	unsigned int maxlen, linear_size;
 	struct sock *sk = NULL;
 	struct sk_buff *skb;
 	struct netlink_ring *ring;
 	struct nl_mmap_hdr *hdr;
-	unsigned int maxlen;
 
 	sk = netlink_getsockbyportid(ssk, dst_portid);
 	if (IS_ERR(sk))
@@ -1883,7 +1884,11 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
 	if (ring->pg_vec == NULL)
 		goto out_put;
 
-	if (ring->frame_size - NL_MMAP_HDRLEN < size)
+	/* We need to account the full linear size needed as a ring
+	 * slot cannot have non-linear parts.
+	 */
+	linear_size = size + ldiff;
+	if (ring->frame_size - NL_MMAP_HDRLEN < linear_size)
 		goto out_put;
 
 	skb = alloc_skb_head(gfp_mask);
@@ -1897,13 +1902,14 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
 
 	/* check again under lock */
 	maxlen = ring->frame_size - NL_MMAP_HDRLEN;
-	if (maxlen < size)
+	if (maxlen < linear_size)
 		goto out_free;
 
 	netlink_forward_ring(ring);
 	hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
 	if (hdr == NULL)
 		goto err2;
+
 	netlink_ring_setup_skb(skb, sk, ring, hdr);
 	netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
 	atomic_inc(&ring->pending);
@@ -1929,7 +1935,7 @@ out:
 #endif
 	return alloc_skb(size, gfp_mask);
 }
-EXPORT_SYMBOL_GPL(netlink_alloc_skb);
+EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
 
 int netlink_has_listeners(struct sock *sk, unsigned int group)
 {
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Page 10 of 10 — ← Prev page 1 … 8 9 [10]

Back to top | Article view | linux.kernel

csiph-web