Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1235223 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2015-09-29 17:20 +0200 |
| Last post | 2015-09-30 08:10 +0200 |
| Articles | 20 on this page of 92 — 6 participants |
Back to article view | Back to linux.kernel
[PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:20 +0200
[PATCH 3.14 01/84] blk-mq: fix buffer overflow when reading sysfs file of pending Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:20 +0200
[PATCH 3.14 07/84] arm64: compat: fix vfp save/restore across signal handlers in big-endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 08/84] arm64: head.S: initialise mdcr_el2 in el2_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 81/84] x86/nmi/64: Reorder nested NMI checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 83/84] udf: Check length of extended attributes and allocation descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 72/84] rds: fix an integer overflow test in rds_info_getsockopt() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 63/84] ip6_gre: release cached dst on tunnel removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 60/84] inet: frags: fix defragmented packets IP header for af_packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 80/84] x86/nmi/64: Improve nested NMI comments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 75/84] net: gso: use feature flag argument in all protocol gso handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 03/84] rtlwifi: rtl8192cu: Add new device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 02/84] unshare: Unsharing a thread does not require unsharing a vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 52/84] net: Clone skb before setting peeked flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 69/84] openvswitch: Zero flows on allocation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 82/84] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 67/84] netlink, mmap: transform mmap skb into full skb on taps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 38/84] IB/mlx4: Forbid using sysfs to change RoCE pkeys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 70/84] fib_rules: fix fib rule dumps across multiple skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
Re: [PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Andy Lutomirski <luto@amacapital.net> - 2015-09-29 19:30 +0200
Re: [PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 20:00 +0200
[PATCH 3.14 58/84] bonding: fix destruction of bond with devices different from arphrd_ether Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 47/84] net/tipc: initialize security state for new connection socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 55/84] bridge: mdb: fix double add notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 06/84] arm64: kconfig: Move LIST_POISON to a safe value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 78/84] x86/nmi/64: Remove asm code that saves CR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 62/84] net/mlx4_core: Fix wrong index in propagating port change event to VFs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 14/84] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 84/84] NVMe: Initialize device reference count earlier Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 59/84] bonding: correct the MAC address for "follow" fail_over_mac policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 12/84] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 76/84] Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 29/84] vmscan: fix increasing nr_isolated incurred by putback unevictable pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 13/84] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 27/84] parisc: Use double word condition in 64bit CAS operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 64/84] usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 35/84] IB/qib: Change lkey table allocation to support more MRs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 71/84] packet: missing dev_put() in packet_do_bind() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 61/84] netlink: dont hold mutex in rcu callback when releasing mmapd ring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 57/84] ipv6: lock socket in ip6_datagram_connect() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 37/84] IB/uverbs: Fix race between ib_uverbs_open and remove_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 65/84] ipv6: fix exthdrs offload registration in out_rt path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 53/84] net: Fix skb csum races when peeking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 48/84] bridge: mdb: zero out the local br_ip variable before use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 43/84] ipv6: Make MLD packets to only be processed locally Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 44/84] net: graceful exit from netif_alloc_netdev_queues() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 56/84] isdn/gigaset: reset tty->receive_room when attaching ser_gigaset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 49/84] net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 33/84] xen/gntdev: convert priv->lock to a mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 51/84] net: call rcu_read_lock early in process_backlog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 36/84] IB/uverbs: reject invalid or unknown opcodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 32/84] md/raid10: always set reshape_safe when initializing reshape_position. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 34/84] hfs: fix B-tree corruption after insertion at position 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 50/84] net: do not process device backlog during unregistration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 54/84] net: Fix skb_set_peeked use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 68/84] sctp: fix race on protocol/netns initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 45/84] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 30/84] fs: if a coredump already exists, unlink and recreate with O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 77/84] x86/nmi: Enable nested do_nmi() handling for 64-bit kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 74/84] bna: fix interrupts storm caused by erroneous packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 41/84] stmmac: troubleshoot unexpected bits in des0 & des1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 31/84] mmc: core: fix race condition in mmc_wait_data_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 66/84] net/ipv6: Correct PIM6 mrt_lock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 42/84] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 17/84] CIFS: fix type confusion in copy offload ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 20/84] x86/mm: Initialize pmd_idx in page_table_range_init_count() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 40/84] stmmac: fix check for phydev being open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
Re: [PATCH 3.14 40/84] stmmac: fix check for phydev being open Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2015-09-30 13:30 +0200
Re: [PATCH 3.14 40/84] stmmac: fix check for phydev being open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-01 05:10 +0200
[PATCH 3.14 22/84] [media] v4l: omap3isp: Fix sub-device power management code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 11/84] Input: evdev - do not report errors form flush() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 16/84] powerpc/mm: Recompute hash value after a failed update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 24/84] NFSv4: dont set SETATTR for O_RDONLY|O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 15/84] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 09/84] arm64: errata: add module build workaround for erratum #843419 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 10/84] arm64: KVM: Disable virtual timer even if the guest is not using it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 23/84] Btrfs: check if previous transaction aborted to avoid fs corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 05/84] mac80211: enable assoc check for mesh interfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 28/84] parisc: Filter out spurious interrupts in PA-RISC irq handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 39/84] IB/mlx4: Use correct SL on AH query under RoCE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 19/84] mm: check if section present during memory block registering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 25/84] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 04/84] tg3: Fix temperature reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 18/84] Add radeon suspend/resume quirk for HP Compaq dc5750. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 26/84] NFS: nfs_set_pgio_error sometimes misses errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-09-29 19:00 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 21:50 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-29 23:20 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-30 04:20 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-30 08:00 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-30 08:10 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:20 +0200 |
| Subject | [PATCH 3.14 00/84] 3.14.54-stable review |
| Message-ID | <qe4Rd-1Nk-47@gated-at.bofh.it> |
This is the start of the stable review cycle for the 3.14.54 release.
There are 84 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Oct 1 14:52:55 UTC 2015.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.54-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.14.54-rc1
Keith Busch <keith.busch@intel.com>
NVMe: Initialize device reference count earlier
Jan Kara <jack@suse.cz>
udf: Check length of extended attributes and allocation descriptors
Andy Lutomirski <luto@kernel.org>
x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection
Andy Lutomirski <luto@kernel.org>
x86/nmi/64: Reorder nested NMI checks
Andy Lutomirski <luto@kernel.org>
x86/nmi/64: Improve nested NMI comments
Andy Lutomirski <luto@kernel.org>
x86/nmi/64: Switch stacks on userspace NMI entry
Andy Lutomirski <luto@kernel.org>
x86/nmi/64: Remove asm code that saves CR2
Andy Lutomirski <luto@kernel.org>
x86/nmi: Enable nested do_nmi() handling for 64-bit kernels
Markus Pargmann <mpa@pengutronix.de>
Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required"
Florian Westphal <fw@strlen.de>
net: gso: use feature flag argument in all protocol gso handlers
Ivan Vecera <ivecera@redhat.com>
bna: fix interrupts storm caused by erroneous packets
Eric Dumazet <edumazet@google.com>
udp: fix dst races with multicast early demux
Dan Carpenter <dan.carpenter@oracle.com>
rds: fix an integer overflow test in rds_info_getsockopt()
Lars Westerhoff <lars.westerhoff@newtec.eu>
packet: missing dev_put() in packet_do_bind()
Wilson Kok <wkok@cumulusnetworks.com>
fib_rules: fix fib rule dumps across multiple skbs
Jesse Gross <jesse@nicira.com>
openvswitch: Zero flows on allocation.
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
sctp: fix race on protocol/netns initialization
Daniel Borkmann <daniel@iogearbox.net>
netlink, mmap: transform mmap skb into full skb on taps
Richard Laing <richard.laing@alliedtelesis.co.nz>
net/ipv6: Correct PIM6 mrt_lock handling
Daniel Borkmann <daniel@iogearbox.net>
ipv6: fix exthdrs offload registration in out_rt path
Eugene Shatokhin <eugene.shatokhin@rosalab.ru>
usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared
huaibin Wang <huaibin.wang@6wind.com>
ip6_gre: release cached dst on tunnel removal
Jack Morgenstein <jackm@dev.mellanox.co.il>
net/mlx4_core: Fix wrong index in propagating port change event to VFs
Florian Westphal <fw@strlen.de>
netlink: don't hold mutex in rcu callback when releasing mmapd ring
Edward Hyunkoo Jee <edjee@google.com>
inet: frags: fix defragmented packet's IP header for af_packet
dingtianhong <dingtianhong@huawei.com>
bonding: correct the MAC address for "follow" fail_over_mac policy
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
bonding: fix destruction of bond with devices different from arphrd_ether
Eric Dumazet <edumazet@google.com>
ipv6: lock socket in ip6_datagram_connect()
Tilman Schmidt <tilman@imap.cc>
isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
bridge: mdb: fix double add notification
Herbert Xu <herbert@gondor.apana.org.au>
net: Fix skb_set_peeked use-after-free bug
Herbert Xu <herbert@gondor.apana.org.au>
net: Fix skb csum races when peeking
Herbert Xu <herbert@gondor.apana.org.au>
net: Clone skb before setting peeked flag
Julian Anastasov <ja@ssi.bg>
net: call rcu_read_lock early in process_backlog
Julian Anastasov <ja@ssi.bg>
net: do not process device backlog during unregistration
Oleg Nesterov <oleg@redhat.com>
net: pktgen: fix race between pktgen_thread_worker() and kthread_stop()
Nikolay Aleksandrov <razor@blackwall.org>
bridge: mdb: zero out the local br_ip variable before use
Stephen Smalley <sds@tycho.nsa.gov>
net/tipc: initialize security state for new connection socket
Timo Teräs <timo.teras@iki.fi>
ip_tunnel: fix ipv4 pmtu check to honor inner ip header df
Daniel Borkmann <daniel@iogearbox.net>
rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver
Eric Dumazet <edumazet@google.com>
net: graceful exit from netif_alloc_netdev_queues()
Angga <Hermin.Anggawijaya@alliedtelesis.co.nz>
ipv6: Make MLD packets to only be processed locally
Hin-Tak Leung <htl10@users.sourceforge.net>
hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
Alexey Brodkin <Alexey.Brodkin@synopsys.com>
stmmac: troubleshoot unexpected bits in des0 & des1
Alexey Brodkin <Alexey.Brodkin@synopsys.com>
stmmac: fix check for phydev being open
Noa Osherovich <noaos@mellanox.com>
IB/mlx4: Use correct SL on AH query under RoCE
Jack Morgenstein <jackm@dev.mellanox.co.il>
IB/mlx4: Forbid using sysfs to change RoCE pkeys
Yishai Hadas <yishaih@mellanox.com>
IB/uverbs: Fix race between ib_uverbs_open and remove_one
Christoph Hellwig <hch@lst.de>
IB/uverbs: reject invalid or unknown opcodes
Mike Marciniszyn <mike.marciniszyn@intel.com>
IB/qib: Change lkey table allocation to support more MRs
Hin-Tak Leung <htl10@users.sourceforge.net>
hfs: fix B-tree corruption after insertion at position 0
David Vrabel <david.vrabel@citrix.com>
xen/gntdev: convert priv->lock to a mutex
NeilBrown <neilb@suse.com>
md/raid10: always set reshape_safe when initializing reshape_position.
Jialing Fu <jlfu@marvell.com>
mmc: core: fix race condition in mmc_wait_data_done
Jann Horn <jann@thejh.net>
fs: if a coredump already exists, unlink and recreate with O_EXCL
Jaewon Kim <jaewon31.kim@samsung.com>
vmscan: fix increasing nr_isolated incurred by putback unevictable pages
Helge Deller <deller@gmx.de>
parisc: Filter out spurious interrupts in PA-RISC irq handler
John David Anglin <dave.anglin@bell.net>
parisc: Use double word condition in 64bit CAS operation
Trond Myklebust <trond.myklebust@primarydata.com>
NFS: nfs_set_pgio_error sometimes misses errors
Kinglong Mee <kinglongmee@gmail.com>
NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client
NeilBrown <neilb@suse.com>
NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
Filipe Manana <fdmanana@suse.com>
Btrfs: check if previous transaction aborted to avoid fs corruption
Sakari Ailus <sakari.ailus@iki.fi>
v4l: omap3isp: Fix sub-device power management code
David Härdeman <david@hardeman.nu>
rc-core: fix remove uevent generation
Minfei Huang <mnfhuang@gmail.com>
x86/mm: Initialize pmd_idx in page_table_range_init_count()
Yinghai Lu <yinghai@kernel.org>
mm: check if section present during memory block registering
Jeffery Miller <jmiller@neverware.com>
Add radeon suspend/resume quirk for HP Compaq dc5750.
Jann Horn <jann@thejh.net>
CIFS: fix type confusion in copy offload ioctl
Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
powerpc/mm: Recompute hash value after a failed update
Thomas Huth <thuth@redhat.com>
powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers
Michael Ellerman <mpe@ellerman.id.au>
powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Enable headphone jack detect on old Fujitsu laptops
Takashi Iwai <tiwai@suse.de>
Input: evdev - do not report errors form flush()
Marc Zyngier <marc.zyngier@arm.com>
arm64: KVM: Disable virtual timer even if the guest is not using it
Will Deacon <will.deacon@arm.com>
arm64: errata: add module build workaround for erratum #843419
Will Deacon <will.deacon@arm.com>
arm64: head.S: initialise mdcr_el2 in el2_setup
Will Deacon <will.deacon@arm.com>
arm64: compat: fix vfp save/restore across signal handlers in big-endian
Jeff Vander Stoep <jeffv@google.com>
arm64: kconfig: Move LIST_POISON to a safe value
Bob Copeland <me@bobcopeland.com>
mac80211: enable assoc check for mesh interfaces
Jean Delvare <jdelvare@suse.de>
tg3: Fix temperature reporting
Adrien Schildknecht <adrien+dev@schischi.me>
rtlwifi: rtl8192cu: Add new device ID
Eric W. Biederman <ebiederm@xmission.com>
unshare: Unsharing a thread does not require unsharing a vm
Ming Lei <ming.lei@canonical.com>
blk-mq: fix buffer overflow when reading sysfs file of 'pending'
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/Kconfig | 20 ++
arch/arm64/Makefile | 4 +
arch/arm64/kernel/head.S | 5 +
arch/arm64/kernel/module.c | 2 +
arch/arm64/kernel/signal32.c | 47 +++-
arch/arm64/kvm/hyp.S | 5 +-
arch/parisc/kernel/irq.c | 8 +-
arch/parisc/kernel/syscall.S | 2 +-
arch/powerpc/include/asm/pgtable-ppc64.h | 14 +-
arch/powerpc/include/asm/rtas.h | 1 +
arch/powerpc/kernel/rtas.c | 17 ++
arch/powerpc/mm/hugepage-hash64.c | 3 +-
arch/powerpc/platforms/pseries/ras.c | 3 +-
arch/x86/kernel/entry_64.S | 296 ++++++++++++++--------
arch/x86/kernel/nmi.c | 123 ++++-----
arch/x86/mm/init_32.c | 1 +
block/blk-mq-sysfs.c | 25 +-
drivers/base/node.c | 10 +
drivers/block/nvme-core.c | 2 +-
drivers/gpu/drm/radeon/radeon_combios.c | 8 +
drivers/iio/gyro/Kconfig | 3 +-
drivers/infiniband/core/uverbs.h | 3 +-
drivers/infiniband/core/uverbs_cmd.c | 10 +-
drivers/infiniband/core/uverbs_main.c | 43 +++-
drivers/infiniband/hw/mlx4/ah.c | 6 +-
drivers/infiniband/hw/mlx4/sysfs.c | 5 +-
drivers/infiniband/hw/qib/qib_keys.c | 4 +
drivers/infiniband/hw/qib/qib_verbs.c | 14 +-
drivers/infiniband/hw/qib/qib_verbs.h | 2 +
drivers/input/evdev.c | 13 +-
drivers/isdn/gigaset/ser-gigaset.c | 11 +-
drivers/md/raid10.c | 5 +-
drivers/media/platform/omap3isp/isp.c | 4 +-
drivers/media/rc/rc-main.c | 3 -
drivers/mmc/core/core.c | 6 +-
drivers/net/bonding/bond_main.c | 21 ++
drivers/net/ethernet/broadcom/tg3.c | 2 +-
drivers/net/ethernet/brocade/bna/bnad.c | 2 +-
drivers/net/ethernet/mellanox/mlx4/eq.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/descs.h | 2 +
drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 49 ++--
drivers/net/usb/usbnet.c | 7 +-
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
drivers/xen/gntdev.c | 40 +--
fs/btrfs/transaction.c | 3 +
fs/cifs/ioctl.c | 6 +
fs/coredump.c | 38 ++-
fs/hfs/bnode.c | 9 +-
fs/hfs/brec.c | 20 +-
fs/hfsplus/bnode.c | 3 -
fs/nfs/nfs4proc.c | 3 +-
fs/nfs/pagelist.c | 4 +-
fs/udf/inode.c | 16 ++
include/net/ip.h | 1 +
kernel/fork.c | 28 +-
mm/vmscan.c | 2 +-
net/bridge/br_mdb.c | 3 +-
net/core/datagram.c | 45 +++-
net/core/dev.c | 38 +--
net/core/fib_rules.c | 14 +-
net/core/pktgen.c | 4 +-
net/core/rtnetlink.c | 128 +++++-----
net/ipv4/af_inet.c | 2 +-
net/ipv4/datagram.c | 16 +-
net/ipv4/gre_offload.c | 2 +-
net/ipv4/ip_fragment.c | 7 +-
net/ipv4/ip_tunnel.c | 8 +-
net/ipv4/udp.c | 15 +-
net/ipv6/datagram.c | 20 +-
net/ipv6/exthdrs_offload.c | 2 +-
net/ipv6/ip6_gre.c | 1 +
net/ipv6/ip6_input.c | 6 +-
net/ipv6/ip6_offload.c | 2 +-
net/ipv6/ip6mr.c | 2 +-
net/mac80211/tx.c | 3 -
net/mpls/mpls_gso.c | 2 +-
net/netlink/af_netlink.c | 109 +++++---
net/netlink/af_netlink.h | 9 +
net/openvswitch/datapath.c | 2 +-
net/openvswitch/flow_table.c | 21 +-
net/openvswitch/flow_table.h | 2 +-
net/packet/af_packet.c | 8 +-
net/rds/info.c | 2 +-
net/sctp/protocol.c | 64 +++--
net/tipc/socket.c | 1 +
sound/pci/hda/patch_realtek.c | 6 +-
89 files changed, 1010 insertions(+), 533 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:20 +0200 |
| Subject | [PATCH 3.14 01/84] blk-mq: fix buffer overflow when reading sysfs file of pending |
| Message-ID | <qe4Rd-1Nk-45@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <ming.lei@canonical.com>
commit 596f5aad2a704b72934e5abec1b1b4114c16f45b upstream.
There may be lots of pending requests so that the buffer of PAGE_SIZE
can't hold them at all.
One typical example is scsi-mq, the queue depth(.can_queue) of
scsi_host and blk-mq is quite big but scsi_device's queue_depth
is a bit small(.cmd_per_lun), then it is quite easy to have lots
of pending requests in hw queue.
This patch fixes the following warning and the related memory
destruction.
[ 359.025101] fill_read_buffer: blk_mq_hw_sysfs_show+0x0/0x7d returned bad count^M
[ 359.055595] irq event stamp: 15537^M
[ 359.055606] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC ^M
[ 359.055614] Dumping ftrace buffer:^M
[ 359.055660] (ftrace buffer empty)^M
[ 359.055672] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M
[ 359.055678] CPU: 4 PID: 21631 Comm: stress-ng-sysfs Not tainted 4.2.0-rc5-next-20150805 #434^M
[ 359.055679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011^M
[ 359.055682] task: ffff8802161cc000 ti: ffff88021b4a8000 task.ti: ffff88021b4a8000^M
[ 359.055693] RIP: 0010:[<ffffffff811541c5>] [<ffffffff811541c5>] __kmalloc+0xe8/0x152^M
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-mq-sysfs.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_sh
static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
{
- char *start_page = page;
struct request *rq;
+ int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);
- page += sprintf(page, "%s:\n", msg);
+ list_for_each_entry(rq, list, queuelist) {
+ const int rq_len = 2 * sizeof(rq) + 2;
- list_for_each_entry(rq, list, queuelist)
- page += sprintf(page, "\t%p\n", rq);
+ /* if the output will be truncated */
+ if (PAGE_SIZE - 1 < len + rq_len) {
+ /* backspacing if it can't hold '\t...\n' */
+ if (PAGE_SIZE - 1 < len + 5)
+ len -= rq_len;
+ len += snprintf(page + len, PAGE_SIZE - 1 - len,
+ "\t...\n");
+ break;
+ }
+ len += snprintf(page + len, PAGE_SIZE - 1 - len,
+ "\t%p\n", rq);
+ }
- return page - start_page;
+ return len;
}
static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 07/84] arm64: compat: fix vfp save/restore across signal handlers in big-endian |
| Message-ID | <qe50S-1Za-3@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit bdec97a855ef1e239f130f7a11584721c9a1bf04 upstream.
When saving/restoring the VFP registers from a compat (AArch32)
signal frame, we rely on the compat registers forming a prefix of the
native register file and therefore make use of copy_{to,from}_user to
transfer between the native fpsimd_state and the compat_vfp_sigframe.
Unfortunately, this doesn't work so well in a big-endian environment.
Our fpsimd save/restore code operates directly on 128-bit quantities
(Q registers) whereas the compat_vfp_sigframe represents the registers
as an array of 64-bit (D) registers. The architecture packs the compat D
registers into the Q registers, with the least significant bytes holding
the lower register. Consequently, we need to swap the 64-bit halves when
converting between these two representations on a big-endian machine.
This patch replaces the __copy_{to,from}_user invocations in our
compat VFP signal handling code with explicit __put_user loops that
operate on 64-bit values and swap them accordingly.
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/signal32.c | 47 ++++++++++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 11 deletions(-)
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -203,14 +203,32 @@ int copy_siginfo_from_user32(siginfo_t *
/*
* VFP save/restore code.
+ *
+ * We have to be careful with endianness, since the fpsimd context-switch
+ * code operates on 128-bit (Q) register values whereas the compat ABI
+ * uses an array of 64-bit (D) registers. Consequently, we need to swap
+ * the two halves of each Q register when running on a big-endian CPU.
*/
+union __fpsimd_vreg {
+ __uint128_t raw;
+ struct {
+#ifdef __AARCH64EB__
+ u64 hi;
+ u64 lo;
+#else
+ u64 lo;
+ u64 hi;
+#endif
+ };
+};
+
static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame)
{
struct fpsimd_state *fpsimd = ¤t->thread.fpsimd_state;
compat_ulong_t magic = VFP_MAGIC;
compat_ulong_t size = VFP_STORAGE_SIZE;
compat_ulong_t fpscr, fpexc;
- int err = 0;
+ int i, err = 0;
/*
* Save the hardware registers to the fpsimd_state structure.
@@ -226,10 +244,15 @@ static int compat_preserve_vfp_context(s
/*
* Now copy the FP registers. Since the registers are packed,
* we can copy the prefix we want (V0-V15) as it is.
- * FIXME: Won't work if big endian.
*/
- err |= __copy_to_user(&frame->ufp.fpregs, fpsimd->vregs,
- sizeof(frame->ufp.fpregs));
+ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+ union __fpsimd_vreg vreg = {
+ .raw = fpsimd->vregs[i >> 1],
+ };
+
+ __put_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
+ __put_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
+ }
/* Create an AArch32 fpscr from the fpsr and the fpcr. */
fpscr = (fpsimd->fpsr & VFP_FPSCR_STAT_MASK) |
@@ -254,7 +277,7 @@ static int compat_restore_vfp_context(st
compat_ulong_t magic = VFP_MAGIC;
compat_ulong_t size = VFP_STORAGE_SIZE;
compat_ulong_t fpscr;
- int err = 0;
+ int i, err = 0;
__get_user_error(magic, &frame->magic, err);
__get_user_error(size, &frame->size, err);
@@ -264,12 +287,14 @@ static int compat_restore_vfp_context(st
if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
return -EINVAL;
- /*
- * Copy the FP registers into the start of the fpsimd_state.
- * FIXME: Won't work if big endian.
- */
- err |= __copy_from_user(fpsimd.vregs, frame->ufp.fpregs,
- sizeof(frame->ufp.fpregs));
+ /* Copy the FP registers into the start of the fpsimd_state. */
+ for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+ union __fpsimd_vreg vreg;
+
+ __get_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
+ __get_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
+ fpsimd.vregs[i >> 1] = vreg.raw;
+ }
/* Extract the fpsr and the fpcr from the fpscr */
__get_user_error(fpscr, &frame->ufp.fpscr, err);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 08/84] arm64: head.S: initialise mdcr_el2 in el2_setup |
| Message-ID | <qe50S-1Za-5@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Will Deacon <will.deacon@arm.com> commit d10bcd473301888f957ec4b6b12aa3621be78d59 upstream. When entering the kernel at EL2, we fail to initialise the MDCR_EL2 register which controls debug access and PMU capabilities at EL1. This patch ensures that the register is initialised so that all traps are disabled and all the PMU counters are available to the host. When a guest is scheduled, KVM takes care to configure trapping appropriately. Acked-by: Marc Zyngier <marc.zyngier@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/arm64/kernel/head.S | 5 +++++ 1 file changed, 5 insertions(+) --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -203,6 +203,11 @@ CPU_LE( movk x0, #0x30d0, lsl #16 ) // C msr hstr_el2, xzr // Disable CP15 traps to EL2 #endif + /* EL2 debug */ + mrs x0, pmcr_el0 // Disable debug access traps + ubfx x0, x0, #11, #5 // to EL2 and allow access to + msr mdcr_el2, x0 // all PMU counters from EL1 + /* Stage-2 translation */ msr vttbr_el2, xzr -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 81/84] x86/nmi/64: Reorder nested NMI checks |
| Message-ID | <qe50S-1Za-7@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit a27507ca2d796cfa8d907de31ad730359c8a6d06 upstream. Check the repeat_nmi .. end_repeat_nmi special case first. The next patch will rework the RSP check and, as a side effect, the RSP check will no longer detect repeat_nmi .. end_repeat_nmi, so we'll need this ordering of the checks. Note: this is more subtle than it appears. The check for repeat_nmi .. end_repeat_nmi jumps straight out of the NMI code instead of adjusting the "iret" frame to force a repeat. This is necessary, because the code between repeat_nmi and end_repeat_nmi sets "NMI executing" and then writes to the "iret" frame itself. If a nested NMI comes in and modifies the "iret" frame while repeat_nmi is also modifying it, we'll end up with garbage. The old code got this right, as does the new code, but the new code is a bit more explicit. If we were to move the check right after the "NMI executing" check, then we'd get it wrong and have random crashes. ( Because the "NMI executing" check would jump to the code that would modify the "iret" frame without checking if the interrupted NMI was currently modifying it. ) Signed-off-by: Andy Lutomirski <luto@kernel.org> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Cc: Borislav Petkov <bp@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/x86/kernel/entry_64.S | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1842,7 +1842,23 @@ ENTRY(nmi) /* * Determine whether we're a nested NMI. * - * First check "NMI executing". If it's set, then we're nested. + * If we interrupted kernel code between repeat_nmi and + * end_repeat_nmi, then we are a nested NMI. We must not + * modify the "iret" frame because it's being written by + * the outer NMI. That's okay; the outer NMI handler is + * about to about to call do_nmi anyway, so we can just + * resume the outer NMI. + */ + movq $repeat_nmi, %rdx + cmpq 8(%rsp), %rdx + ja 1f + movq $end_repeat_nmi, %rdx + cmpq 8(%rsp), %rdx + ja nested_nmi_out +1: + + /* + * Now check "NMI executing". If it's set, then we're nested. * This will not detect if we interrupted an outer NMI just * before IRET. */ @@ -1860,21 +1876,6 @@ ENTRY(nmi) nested_nmi: /* - * If we interrupted an NMI that is between repeat_nmi and - * end_repeat_nmi, then we must not modify the "iret" frame - * because it's being written by the outer NMI. That's okay; - * the outer NMI handler is about to call do_nmi anyway, - * so we can just resume the outer NMI. - */ - movq $repeat_nmi, %rdx - cmpq 8(%rsp), %rdx - ja 1f - movq $end_repeat_nmi, %rdx - cmpq 8(%rsp), %rdx - ja nested_nmi_out - -1: - /* * Modify the "iret" frame to point to repeat_nmi, forcing another * iteration of NMI handling. */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 83/84] udf: Check length of extended attributes and allocation descriptors |
| Message-ID | <qe50S-1Za-9@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.
Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.
This fixes CVE-2015-4167.
Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Signed-off-by: Jan Kara <jack@suse.cz>
[Use make_bad_inode() instead of branching due to older implementation.]
Signed-off-by: Chas Williams <3chas3@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1496,6 +1496,22 @@ static void udf_fill_inode(struct inode
iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
}
+ /*
+ * Sanity check length of allocation descriptors and extended attrs to
+ * avoid integer overflows
+ */
+ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize
+ || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
+ make_bad_inode(inode);
+ return;
+ }
+ /* Now do exact checks */
+ if (udf_file_entry_alloc_offset(inode)
+ + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
+ make_bad_inode(inode);
+ return;
+ }
+
switch (fe->icbTag.fileType) {
case ICBTAG_FILE_TYPE_DIRECTORY:
inode->i_op = &udf_dir_inode_operations;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 72/84] rds: fix an integer overflow test in rds_info_getsockopt() |
| Message-ID | <qe50S-1Za-11@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 468b732b6f76b138c0926eadf38ac88467dcd271 ]
"len" is a signed integer. We check that len is not negative, so it
goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison
is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than
INT_MAX so the condition can never be true.
I don't know if this is harmful but it seems safe to limit "len" to
INT_MAX - 4095.
Fixes: a8c879a7ee98 ('RDS: Info and stats')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/info.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *s
/* check for all kinds of wrapping and the like */
start = (unsigned long)optval;
- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
+ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
ret = -EINVAL;
goto out;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 63/84] ip6_gre: release cached dst on tunnel removal |
| Message-ID | <qe50S-1Za-1@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: huaibin Wang <huaibin.wang@6wind.com>
[ Upstream commit d4257295ba1b389c693b79de857a96e4b7cd8ac0 ]
When a tunnel is deleted, the cached dst entry should be released.
This problem may prevent the removal of a netns (seen with a x-netns IPv6
gre tunnel):
unregister_netdevice: waiting for lo to become free. Usage count = 3
CC: Dmitry Kozlov <xeb@mail.ru>
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: huaibin Wang <huaibin.wang@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_gre.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -357,6 +357,7 @@ static void ip6gre_tunnel_uninit(struct
struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
ip6gre_tunnel_unlink(ign, netdev_priv(dev));
+ ip6_tnl_dst_reset(netdev_priv(dev));
dev_put(dev);
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 60/84] inet: frags: fix defragmented packets IP header for af_packet |
| Message-ID | <qe50S-1Za-15@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Hyunkoo Jee <edjee@google.com>
[ Upstream commit 0848f6428ba3a2e42db124d41ac6f548655735bf ]
When ip_frag_queue() computes positions, it assumes that the passed
sk_buff does not contain L2 headers.
However, when PACKET_FANOUT_FLAG_DEFRAG is used, IP reassembly
functions can be called on outgoing packets that contain L2 headers.
Also, IPv4 checksum is not corrected after reassembly.
Fixes: 7736d33f4262 ("packet: Add pre-defragmentation support for ipv4 fanouts.")
Signed-off-by: Edward Hyunkoo Jee <edjee@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Jerry Chu <hkchu@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_fragment.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -357,7 +357,7 @@ static int ip_frag_queue(struct ipq *qp,
ihl = ip_hdrlen(skb);
/* Determine the position of this fragment. */
- end = offset + skb->len - ihl;
+ end = offset + skb->len - skb_network_offset(skb) - ihl;
err = -EINVAL;
/* Is this the final fragment? */
@@ -387,7 +387,7 @@ static int ip_frag_queue(struct ipq *qp,
goto err;
err = -ENOMEM;
- if (pskb_pull(skb, ihl) == NULL)
+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
goto err;
err = pskb_trim_rcsum(skb, end - offset);
@@ -628,6 +628,9 @@ static int ip_frag_reasm(struct ipq *qp,
iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0;
iph->tot_len = htons(len);
iph->tos |= ecn;
+
+ ip_send_check(iph);
+
IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
qp->q.fragments = NULL;
qp->q.fragments_tail = NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 80/84] x86/nmi/64: Improve nested NMI comments |
| Message-ID | <qe50S-1Za-19@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 0b22930ebad563ae97ff3f8d7b9f12060b4c6e6b upstream. I found the nested NMI documentation to be difficult to follow. Improve the comments. Signed-off-by: Andy Lutomirski <luto@kernel.org> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Cc: Borislav Petkov <bp@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/x86/kernel/entry_64.S | 159 +++++++++++++++++++++++++-------------------- arch/x86/kernel/nmi.c | 4 - 2 files changed, 93 insertions(+), 70 deletions(-) --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1702,11 +1702,12 @@ ENTRY(nmi) * If the variable is not set and the stack is not the NMI * stack then: * o Set the special variable on the stack - * o Copy the interrupt frame into a "saved" location on the stack - * o Copy the interrupt frame into a "copy" location on the stack + * o Copy the interrupt frame into an "outermost" location on the + * stack + * o Copy the interrupt frame into an "iret" location on the stack * o Continue processing the NMI * If the variable is set or the previous stack is the NMI stack: - * o Modify the "copy" location to jump to the repeate_nmi + * o Modify the "iret" location to jump to the repeat_nmi * o return back to the first NMI * * Now on exit of the first NMI, we first clear the stack variable @@ -1798,18 +1799,60 @@ ENTRY(nmi) .Lnmi_from_kernel: /* - * Check the special variable on the stack to see if NMIs are - * executing. + * Here's what our stack frame will look like: + * +---------------------------------------------------------+ + * | original SS | + * | original Return RSP | + * | original RFLAGS | + * | original CS | + * | original RIP | + * +---------------------------------------------------------+ + * | temp storage for rdx | + * +---------------------------------------------------------+ + * | "NMI executing" variable | + * +---------------------------------------------------------+ + * | iret SS } Copied from "outermost" frame | + * | iret Return RSP } on each loop iteration; overwritten | + * | iret RFLAGS } by a nested NMI to force another | + * | iret CS } iteration if needed. | + * | iret RIP } | + * +---------------------------------------------------------+ + * | outermost SS } initialized in first_nmi; | + * | outermost Return RSP } will not be changed before | + * | outermost RFLAGS } NMI processing is done. | + * | outermost CS } Copied to "iret" frame on each | + * | outermost RIP } iteration. | + * +---------------------------------------------------------+ + * | pt_regs | + * +---------------------------------------------------------+ + * + * The "original" frame is used by hardware. Before re-enabling + * NMIs, we need to be done with it, and we need to leave enough + * space for the asm code here. + * + * We return by executing IRET while RSP points to the "iret" frame. + * That will either return for real or it will loop back into NMI + * processing. + * + * The "outermost" frame is copied to the "iret" frame on each + * iteration of the loop, so each iteration starts with the "iret" + * frame pointing to the final return target. + */ + + /* + * Determine whether we're a nested NMI. + * + * First check "NMI executing". If it's set, then we're nested. + * This will not detect if we interrupted an outer NMI just + * before IRET. */ cmpl $1, -8(%rsp) je nested_nmi /* - * Now test if the previous stack was an NMI stack. - * We need the double check. We check the NMI stack to satisfy the - * race when the first NMI clears the variable before returning. - * We check the variable because the first NMI could be in a - * breakpoint routine using a breakpoint stack. + * Now test if the previous stack was an NMI stack. This covers + * the case where we interrupt an outer NMI after it clears + * "NMI executing" but before IRET. */ lea 6*8(%rsp), %rdx test_in_nmi rdx, 4*8(%rsp), nested_nmi, first_nmi @@ -1817,9 +1860,11 @@ ENTRY(nmi) nested_nmi: /* - * Do nothing if we interrupted the fixup in repeat_nmi. - * It's about to repeat the NMI handler, so we are fine - * with ignoring this one. + * If we interrupted an NMI that is between repeat_nmi and + * end_repeat_nmi, then we must not modify the "iret" frame + * because it's being written by the outer NMI. That's okay; + * the outer NMI handler is about to call do_nmi anyway, + * so we can just resume the outer NMI. */ movq $repeat_nmi, %rdx cmpq 8(%rsp), %rdx @@ -1829,7 +1874,10 @@ nested_nmi: ja nested_nmi_out 1: - /* Set up the interrupted NMIs stack to jump to repeat_nmi */ + /* + * Modify the "iret" frame to point to repeat_nmi, forcing another + * iteration of NMI handling. + */ leaq -1*8(%rsp), %rdx movq %rdx, %rsp CFI_ADJUST_CFA_OFFSET 1*8 @@ -1848,60 +1896,23 @@ nested_nmi_out: popq_cfi %rdx CFI_RESTORE rdx - /* No need to check faults here */ + /* We are returning to kernel mode, so this cannot result in a fault. */ INTERRUPT_RETURN CFI_RESTORE_STATE first_nmi: - /* - * Because nested NMIs will use the pushed location that we - * stored in rdx, we must keep that space available. - * Here's what our stack frame will look like: - * +-------------------------+ - * | original SS | - * | original Return RSP | - * | original RFLAGS | - * | original CS | - * | original RIP | - * +-------------------------+ - * | temp storage for rdx | - * +-------------------------+ - * | NMI executing variable | - * +-------------------------+ - * | copied SS | - * | copied Return RSP | - * | copied RFLAGS | - * | copied CS | - * | copied RIP | - * +-------------------------+ - * | Saved SS | - * | Saved Return RSP | - * | Saved RFLAGS | - * | Saved CS | - * | Saved RIP | - * +-------------------------+ - * | pt_regs | - * +-------------------------+ - * - * The saved stack frame is used to fix up the copied stack frame - * that a nested NMI may change to make the interrupted NMI iret jump - * to the repeat_nmi. The original stack frame and the temp storage - * is also used by nested NMIs and can not be trusted on exit. - */ - /* Do not pop rdx, nested NMIs will corrupt that part of the stack */ + /* Restore rdx. */ movq (%rsp), %rdx CFI_RESTORE rdx - /* Set the NMI executing variable on the stack. */ + /* Set "NMI executing" on the stack. */ pushq_cfi $1 - /* - * Leave room for the "copied" frame - */ + /* Leave room for the "iret" frame */ subq $(5*8), %rsp CFI_ADJUST_CFA_OFFSET 5*8 - /* Copy the stack frame to the Saved frame */ + /* Copy the "original" frame to the "outermost" frame */ .rept 5 pushq_cfi 11*8(%rsp) .endr @@ -1909,6 +1920,7 @@ first_nmi: /* Everything up to here is safe from nested NMIs */ +repeat_nmi: /* * If there was a nested NMI, the first NMI's iret will return * here. But NMIs are still enabled and we can take another @@ -1917,16 +1929,21 @@ first_nmi: * it will just return, as we are about to repeat an NMI anyway. * This makes it safe to copy to the stack frame that a nested * NMI will update. - */ -repeat_nmi: - /* - * Update the stack variable to say we are still in NMI (the update - * is benign for the non-repeat case, where 1 was pushed just above - * to this very stack slot). + * + * RSP is pointing to "outermost RIP". gsbase is unknown, but, if + * we're repeating an NMI, gsbase has the same value that it had on + * the first iteration. paranoid_entry will load the kernel + * gsbase if needed before we call do_nmi. + * + * Set "NMI executing" in case we came back here via IRET. */ movq $1, 10*8(%rsp) - /* Make another copy, this one may be modified by nested NMIs */ + /* + * Copy the "outermost" frame to the "iret" frame. NMIs that nest + * here must not modify the "iret" frame while we're writing to + * it or it will end up containing garbage. + */ addq $(10*8), %rsp CFI_ADJUST_CFA_OFFSET -10*8 .rept 5 @@ -1937,9 +1954,9 @@ repeat_nmi: end_repeat_nmi: /* - * Everything below this point can be preempted by a nested - * NMI if the first NMI took an exception and reset our iret stack - * so that we repeat another NMI. + * Everything below this point can be preempted by a nested NMI. + * If this happens, then the inner NMI will change the "iret" + * frame to point back to repeat_nmi. */ pushq_cfi $-1 /* ORIG_RAX: no syscall to restart */ subq $ORIG_RAX-R15, %rsp @@ -1967,9 +1984,15 @@ nmi_restore: /* Pop the extra iret frame at once */ RESTORE_ALL 6*8 - /* Clear the NMI executing stack variable */ + /* Clear "NMI executing". */ movq $0, 5*8(%rsp) - jmp irq_return + + /* + * INTERRUPT_RETURN reads the "iret" frame and exits the NMI + * stack in a single instruction. We are returning to kernel + * mode, so this cannot result in a fault. + */ + INTERRUPT_RETURN CFI_ENDPROC END(nmi) --- a/arch/x86/kernel/nmi.c +++ b/arch/x86/kernel/nmi.c @@ -392,8 +392,8 @@ static __kprobes void default_do_nmi(str } /* - * NMIs can hit breakpoints which will cause it to lose its NMI context - * with the CPU when the breakpoint or page fault does an IRET. + * NMIs can page fault or hit breakpoints which will cause it to lose + * its NMI context with the CPU when the breakpoint or page fault does an IRET. * * As a result, NMIs can nest if NMIs get unmasked due an IRET during * NMI processing. On x86_64, the asm glue protects us from nested NMIs -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 75/84] net: gso: use feature flag argument in all protocol gso handlers |
| Message-ID | <qe50S-1Za-21@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 1e16aa3ddf863c6b9f37eddf52503230a62dedb3 ]
skb_gso_segment() has a 'features' argument representing offload features
available to the output path.
A few handlers, e.g. GRE, instead re-fetch the features of skb->dev and use
those instead of the provided ones when handing encapsulation/tunnels.
Depending on dev->hw_enc_features of the output device skb_gso_segment() can
then return NULL even when the caller has disabled all GSO feature bits,
as segmentation of inner header thinks device will take care of segmentation.
This e.g. affects the tbf scheduler, which will silently drop GRE-encap GSO skbs
that did not fit the remaining token quota as the segmentation does not work
when device supports corresponding hw offload capabilities.
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
[jay.vosburgh: backported to 3.14. ]
Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/af_inet.c | 2 +-
net/ipv4/gre_offload.c | 2 +-
net/ipv4/udp.c | 2 +-
net/ipv6/ip6_offload.c | 2 +-
net/mpls/mpls_gso.c | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1291,7 +1291,7 @@ static struct sk_buff *inet_gso_segment(
encap = SKB_GSO_CB(skb)->encap_level > 0;
if (encap)
- features = skb->dev->hw_enc_features & netif_skb_features(skb);
+ features &= skb->dev->hw_enc_features;
SKB_GSO_CB(skb)->encap_level += ihl;
skb_reset_transport_header(skb);
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -69,7 +69,7 @@ static struct sk_buff *gre_gso_segment(s
skb->mac_len = skb_inner_network_offset(skb);
/* segment inner packet. */
- enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+ enc_features = skb->dev->hw_enc_features & features;
segs = skb_mac_gso_segment(skb, enc_features);
if (!segs || IS_ERR(segs)) {
skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len);
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2517,7 +2517,7 @@ struct sk_buff *skb_udp_tunnel_segment(s
skb->protocol = htons(ETH_P_TEB);
/* segment inner packet. */
- enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+ enc_features = skb->dev->hw_enc_features & features;
segs = skb_mac_gso_segment(skb, enc_features);
if (!segs || IS_ERR(segs)) {
skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -112,7 +112,7 @@ static struct sk_buff *ipv6_gso_segment(
encap = SKB_GSO_CB(skb)->encap_level > 0;
if (encap)
- features = skb->dev->hw_enc_features & netif_skb_features(skb);
+ features &= skb->dev->hw_enc_features;
SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h);
ipv6h = ipv6_hdr(skb);
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -47,7 +47,7 @@ static struct sk_buff *mpls_gso_segment(
__skb_push(skb, skb->mac_len);
/* Segment inner packet. */
- mpls_features = skb->dev->mpls_features & netif_skb_features(skb);
+ mpls_features = skb->dev->mpls_features & features;
segs = skb_mac_gso_segment(skb, mpls_features);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 03/84] rtlwifi: rtl8192cu: Add new device ID |
| Message-ID | <qe50T-1Za-23@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrien Schildknecht <adrien+dev@schischi.me>
commit 1642d09fb9b128e8e538b2a4179962a34f38dff9 upstream.
The v2 of NetGear WNA1000M uses a different idProduct: USB ID 0846:9043
Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -314,6 +314,7 @@ static struct usb_device_id rtl8192c_usb
{RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
{RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
{RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+ {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
{RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 02/84] unshare: Unsharing a thread does not require unsharing a vm |
| Message-ID | <qe50T-1Za-25@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 12c641ab8270f787dfcce08b5f20ce8b65008096 upstream.
In the logic in the initial commit of unshare made creating a new
thread group for a process, contingent upon creating a new memory
address space for that process. That is wrong. Two separate
processes in different thread groups can share a memory address space
and clone allows creation of such proceses.
This is significant because it was observed that mm_users > 1 does not
mean that a process is multi-threaded, as reading /proc/PID/maps
temporarily increments mm_users, which allows other processes to
(accidentally) interfere with unshare() calls.
Correct the check in check_unshare_flags() to test for
!thread_group_empty() for CLONE_THREAD, CLONE_SIGHAND, and CLONE_VM.
For sighand->count > 1 for CLONE_SIGHAND and CLONE_VM.
For !current_is_single_threaded instead of mm_users > 1 for CLONE_VM.
By using the correct checks in unshare this removes the possibility of
an accidental denial of service attack.
Additionally using the correct checks in unshare ensures that only an
explicit unshare(CLONE_VM) can possibly trigger the slow path of
current_is_single_threaded(). As an explict unshare(CLONE_VM) is
pointless it is not expected there are many applications that make
that call.
Fixes: b2e0d98705e60e45bbb3c0032c48824ad7ae0704 userns: Implement unshare of the user namespace
Reported-by: Ricky Zhou <rickyz@chromium.org>
Reported-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/fork.c | 28 ++++++++++++++++++----------
1 file changed, 18 insertions(+), 10 deletions(-)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1756,13 +1756,21 @@ static int check_unshare_flags(unsigned
CLONE_NEWUSER|CLONE_NEWPID))
return -EINVAL;
/*
- * Not implemented, but pretend it works if there is nothing to
- * unshare. Note that unsharing CLONE_THREAD or CLONE_SIGHAND
- * needs to unshare vm.
+ * Not implemented, but pretend it works if there is nothing
+ * to unshare. Note that unsharing the address space or the
+ * signal handlers also need to unshare the signal queues (aka
+ * CLONE_THREAD).
*/
if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
- /* FIXME: get_task_mm() increments ->mm_users */
- if (atomic_read(¤t->mm->mm_users) > 1)
+ if (!thread_group_empty(current))
+ return -EINVAL;
+ }
+ if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
+ if (atomic_read(¤t->sighand->count) > 1)
+ return -EINVAL;
+ }
+ if (unshare_flags & CLONE_VM) {
+ if (!current_is_single_threaded())
return -EINVAL;
}
@@ -1831,16 +1839,16 @@ SYSCALL_DEFINE1(unshare, unsigned long,
if (unshare_flags & CLONE_NEWUSER)
unshare_flags |= CLONE_THREAD | CLONE_FS;
/*
- * If unsharing a thread from a thread group, must also unshare vm.
- */
- if (unshare_flags & CLONE_THREAD)
- unshare_flags |= CLONE_VM;
- /*
* If unsharing vm, must also unshare signal handlers.
*/
if (unshare_flags & CLONE_VM)
unshare_flags |= CLONE_SIGHAND;
/*
+ * If unsharing a signal handlers, must also unshare the signal queues.
+ */
+ if (unshare_flags & CLONE_SIGHAND)
+ unshare_flags |= CLONE_THREAD;
+ /*
* If unsharing namespace, must also unshare filesystem information.
*/
if (unshare_flags & CLONE_NEWNS)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 52/84] net: Clone skb before setting peeked flag |
| Message-ID | <qe50T-1Za-27@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ]
Shared skbs must not be modified and this is crucial for broadcast
and/or multicast paths where we use it as an optimisation to avoid
unnecessary cloning.
The function skb_recv_datagram breaks this rule by setting peeked
without cloning the skb first. This causes funky races which leads
to double-free.
This patch fixes this by cloning the skb and replacing the skb
in the list when setting skb->peeked.
Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv")
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 38 insertions(+), 3 deletions(-)
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -130,6 +130,35 @@ out_noerr:
goto out;
}
+static int skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
+ return 0;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
+ goto done;
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
+ return -ENOMEM;
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
+ nskb->prev = skb->prev;
+ nskb->next = skb->next;
+
+ consume_skb(skb);
+ skb = nskb;
+
+done:
+ skb->peeked = 1;
+
+ return 0;
+}
+
/**
* __skb_recv_datagram - Receive a datagram skbuff
* @sk: socket
@@ -164,7 +193,9 @@ out_noerr:
struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
int *peeked, int *off, int *err)
{
+ struct sk_buff_head *queue = &sk->sk_receive_queue;
struct sk_buff *skb, *last;
+ unsigned long cpu_flags;
long timeo;
/*
* Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -183,8 +214,6 @@ struct sk_buff *__skb_recv_datagram(stru
* Look at current nfs client by the way...
* However, this function was correct in any case. 8)
*/
- unsigned long cpu_flags;
- struct sk_buff_head *queue = &sk->sk_receive_queue;
int _off = *off;
last = (struct sk_buff *)queue;
@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(stru
_off -= skb->len;
continue;
}
- skb->peeked = 1;
+
+ error = skb_set_peeked(skb);
+ if (error)
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(stru
return NULL;
+unlock_err:
+ spin_unlock_irqrestore(&queue->lock, cpu_flags);
no_packet:
*err = error;
return NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 69/84] openvswitch: Zero flows on allocation. |
| Message-ID | <qe50T-1Za-29@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Gross <jesse@nicira.com>
[ Upstream commit ae5f2fb1d51fa128a460bcfbe3c56d7ab8bf6a43 ]
When support for megaflows was introduced, OVS needed to start
installing flows with a mask applied to them. Since masking is an
expensive operation, OVS also had an optimization that would only
take the parts of the flow keys that were covered by a non-zero
mask. The values stored in the remaining pieces should not matter
because they are masked out.
While this works fine for the purposes of matching (which must always
look at the mask), serialization to netlink can be problematic. Since
the flow and the mask are serialized separately, the uninitialized
portions of the flow can be encoded with whatever values happen to be
present.
In terms of functionality, this has little effect since these fields
will be masked out by definition. However, it leaks kernel memory to
userspace, which is a potential security vulnerability. It is also
possible that other code paths could look at the masked key and get
uninitialized data, although this does not currently appear to be an
issue in practice.
This removes the mask optimization for flows that are being installed.
This was always intended to be the case as the mask optimizations were
really targetting per-packet flow operations.
Fixes: 03f0d916 ("openvswitch: Mega flow implementation")
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/openvswitch/datapath.c | 2 +-
net/openvswitch/flow_table.c | 21 ++++++++++++---------
net/openvswitch/flow_table.h | 2 +-
3 files changed, 14 insertions(+), 11 deletions(-)
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -803,7 +803,7 @@ static int ovs_flow_cmd_new_or_set(struc
if (IS_ERR(acts))
goto error;
- ovs_flow_mask_key(&masked_key, &key, &mask);
+ ovs_flow_mask_key(&masked_key, &key, true, &mask);
error = ovs_nla_copy_actions(a[OVS_FLOW_ATTR_ACTIONS],
&masked_key, 0, &acts);
if (error) {
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -55,18 +55,21 @@ static u16 range_n_bytes(const struct sw
}
void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
- const struct sw_flow_mask *mask)
+ bool full, const struct sw_flow_mask *mask)
{
- const long *m = (long *)((u8 *)&mask->key + mask->range.start);
- const long *s = (long *)((u8 *)src + mask->range.start);
- long *d = (long *)((u8 *)dst + mask->range.start);
+ int start = full ? 0 : mask->range.start;
+ int len = full ? sizeof *dst : range_n_bytes(&mask->range);
+ const long *m = (const long *)((const u8 *)&mask->key + start);
+ const long *s = (const long *)((const u8 *)src + start);
+ long *d = (long *)((u8 *)dst + start);
int i;
- /* The memory outside of the 'mask->range' are not set since
- * further operations on 'dst' only uses contents within
- * 'mask->range'.
+ /* If 'full' is true then all of 'dst' is fully initialized. Otherwise,
+ * if 'full' is false the memory outside of the 'mask->range' is left
+ * uninitialized. This can be used as an optimization when further
+ * operations on 'dst' only use contents within 'mask->range'.
*/
- for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long))
+ for (i = 0; i < len; i += sizeof(long))
*d++ = *s++ & *m++;
}
@@ -436,7 +439,7 @@ static struct sw_flow *masked_flow_looku
u32 hash;
struct sw_flow_key masked_key;
- ovs_flow_mask_key(&masked_key, unmasked, mask);
+ ovs_flow_mask_key(&masked_key, unmasked, false, mask);
hash = flow_hash(&masked_key, key_start, key_end);
head = find_bucket(ti, hash);
hlist_for_each_entry_rcu(flow, head, hash_node[ti->node_ver]) {
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -79,5 +79,5 @@ bool ovs_flow_cmp_unmasked_key(const str
struct sw_flow_match *match);
void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
- const struct sw_flow_mask *mask);
+ bool full, const struct sw_flow_mask *mask);
#endif /* flow_table.h */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 82/84] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection |
| Message-ID | <qe50T-1Za-33@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 810bc075f78ff2c221536eb3008eac6a492dba2d upstream. We have a tricky bug in the nested NMI code: if we see RSP pointing to the NMI stack on NMI entry from kernel mode, we assume that we are executing a nested NMI. This isn't quite true. A malicious userspace program can point RSP at the NMI stack, issue SYSCALL, and arrange for an NMI to happen while RSP is still pointing at the NMI stack. Fix it with a sneaky trick. Set DF in the region of code that the RSP check is intended to detect. IRET will clear DF atomically. ( Note: other than paravirt, there's little need for all this complexity. We could check RIP instead of RSP. ) Signed-off-by: Andy Lutomirski <luto@kernel.org> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Cc: Borislav Petkov <bp@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/x86/kernel/entry_64.S | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1868,10 +1868,25 @@ ENTRY(nmi) /* * Now test if the previous stack was an NMI stack. This covers * the case where we interrupt an outer NMI after it clears - * "NMI executing" but before IRET. + * "NMI executing" but before IRET. We need to be careful, though: + * there is one case in which RSP could point to the NMI stack + * despite there being no NMI active: naughty userspace controls + * RSP at the very beginning of the SYSCALL targets. We can + * pull a fast one on naughty userspace, though: we program + * SYSCALL to mask DF, so userspace cannot cause DF to be set + * if it controls the kernel's RSP. We set DF before we clear + * "NMI executing". */ lea 6*8(%rsp), %rdx test_in_nmi rdx, 4*8(%rsp), nested_nmi, first_nmi + + /* Ah, it is within the NMI stack. */ + + testb $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp) + jz first_nmi /* RSP was user controlled. */ + + /* This is a nested NMI. */ + CFI_REMEMBER_STATE nested_nmi: @@ -1985,8 +2000,16 @@ nmi_restore: /* Pop the extra iret frame at once */ RESTORE_ALL 6*8 - /* Clear "NMI executing". */ - movq $0, 5*8(%rsp) + /* + * Clear "NMI executing". Set DF first so that we can easily + * distinguish the remaining code between here and IRET from + * the SYSCALL entry and exit paths. On a native kernel, we + * could just inspect RIP, but, on paravirt kernels, + * INTERRUPT_RETURN can translate into a jump into a + * hypercall page. + */ + std + movq $0, 5*8(%rsp) /* clear "NMI executing" */ /* * INTERRUPT_RETURN reads the "iret" frame and exits the NMI -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 67/84] netlink, mmap: transform mmap skb into full skb on taps |
| Message-ID | <qe50T-1Za-35@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 1853c949646005b5959c483becde86608f548f24 ]
Ken-ichirou reported that running netlink in mmap mode for receive in
combination with nlmon will throw a NULL pointer dereference in
__kfree_skb() on nlmon_xmit(), in my case I can also trigger an "unable
to handle kernel paging request". The problem is the skb_clone() in
__netlink_deliver_tap_skb() for skbs that are mmaped.
I.e. the cloned skb doesn't have a destructor, whereas the mmap netlink
skb has it pointed to netlink_skb_destructor(), set in the handler
netlink_ring_setup_skb(). There, skb->head is being set to NULL, so
that in such cases, __kfree_skb() doesn't perform a skb_release_data()
via skb_release_all(), where skb->head is possibly being freed through
kfree(head) into slab allocator, although netlink mmap skb->head points
to the mmap buffer. Similarly, the same has to be done also for large
netlink skbs where the data area is vmalloced. Therefore, as discussed,
make a copy for these rather rare cases for now. This fixes the issue
on my and Ken-ichirou's test-cases.
Reference: http://thread.gmane.org/gmane.linux.network/371129
Fixes: bcbde0d449ed ("net: netlink: virtual tap device management")
Reported-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlink/af_netlink.c | 30 +++++++++++++++++++++++-------
net/netlink/af_netlink.h | 9 +++++++++
2 files changed, 32 insertions(+), 7 deletions(-)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -115,6 +115,24 @@ static inline struct hlist_head *nl_port
return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask];
}
+static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
+ gfp_t gfp_mask)
+{
+ unsigned int len = skb_end_offset(skb);
+ struct sk_buff *new;
+
+ new = alloc_skb(len, gfp_mask);
+ if (new == NULL)
+ return NULL;
+
+ NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
+ NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
+ NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
+
+ memcpy(skb_put(new, len), skb->data, len);
+ return new;
+}
+
int netlink_add_tap(struct netlink_tap *nt)
{
if (unlikely(nt->dev->type != ARPHRD_NETLINK))
@@ -199,7 +217,11 @@ static int __netlink_deliver_tap_skb(str
int ret = -ENOMEM;
dev_hold(dev);
- nskb = skb_clone(skb, GFP_ATOMIC);
+
+ if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
+ nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
+ else
+ nskb = skb_clone(skb, GFP_ATOMIC);
if (nskb) {
nskb->dev = dev;
nskb->protocol = htons((u16) sk->sk_protocol);
@@ -271,11 +293,6 @@ static void netlink_rcv_wake(struct sock
}
#ifdef CONFIG_NETLINK_MMAP
-static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
-{
- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
-}
-
static bool netlink_rx_is_mmaped(struct sock *sk)
{
return nlk_sk(sk)->rx_ring.pg_vec != NULL;
@@ -827,7 +844,6 @@ static void netlink_ring_set_copied(stru
}
#else /* CONFIG_NETLINK_MMAP */
-#define netlink_skb_is_mmaped(skb) false
#define netlink_rx_is_mmaped(sk) false
#define netlink_tx_is_mmaped(sk) false
#define netlink_mmap sock_no_mmap
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -65,6 +65,15 @@ struct nl_portid_hash {
u32 rnd;
};
+static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NETLINK_MMAP
+ return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
+#else
+ return false;
+#endif /* CONFIG_NETLINK_MMAP */
+}
+
struct netlink_table {
struct nl_portid_hash hash;
struct hlist_head mc_list;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 38/84] IB/mlx4: Forbid using sysfs to change RoCE pkeys |
| Message-ID | <qe50T-1Za-39@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
commit 2b135db3e81301d0452e6aa107349abe67b097d6 upstream.
The pkey mapping for RoCE must remain the default mapping:
VFs:
virtual index 0 = mapped to real index 0 (0xFFFF)
All others indices: mapped to a real pkey index containing an
invalid pkey.
PF:
virtual index i = real index i.
Don't allow users to change these mappings using files found in
sysfs.
Fixes: c1e7e466120b ('IB/mlx4: Add iov directory in sysfs under the ib device')
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/sysfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -563,6 +563,8 @@ static int add_port(struct mlx4_ib_dev *
struct mlx4_port *p;
int i;
int ret;
+ int is_eth = rdma_port_get_link_layer(&dev->ib_dev, port_num) ==
+ IB_LINK_LAYER_ETHERNET;
p = kzalloc(sizeof *p, GFP_KERNEL);
if (!p)
@@ -580,7 +582,8 @@ static int add_port(struct mlx4_ib_dev *
p->pkey_group.name = "pkey_idx";
p->pkey_group.attrs =
- alloc_group_attrs(show_port_pkey, store_port_pkey,
+ alloc_group_attrs(show_port_pkey,
+ is_eth ? NULL : store_port_pkey,
dev->dev->caps.pkey_table_len[port_num]);
if (!p->pkey_group.attrs) {
ret = -ENOMEM;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 70/84] fib_rules: fix fib rule dumps across multiple skbs |
| Message-ID | <qe50T-1Za-37@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wilson Kok <wkok@cumulusnetworks.com>
[ Upstream commit 41fc014332d91ee90c32840bf161f9685b7fbf2b ]
dump_rules returns skb length and not error.
But when family == AF_UNSPEC, the caller of dump_rules
assumes that it returns an error. Hence, when family == AF_UNSPEC,
we continue trying to dump on -EMSGSIZE errors resulting in
incorrect dump idx carried between skbs belonging to the same dump.
This results in fib rule dump always only dumping rules that fit
into the first skb.
This patch fixes dump_rules to return error so that we exit correctly
and idx is correctly maintained between skbs that are part of the
same dump.
Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com>
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/fib_rules.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -621,15 +621,17 @@ static int dump_rules(struct sk_buff *sk
{
int idx = 0;
struct fib_rule *rule;
+ int err = 0;
rcu_read_lock();
list_for_each_entry_rcu(rule, &ops->rules_list, list) {
if (idx < cb->args[1])
goto skip;
- if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq, RTM_NEWRULE,
- NLM_F_MULTI, ops) < 0)
+ err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, RTM_NEWRULE,
+ NLM_F_MULTI, ops);
+ if (err)
break;
skip:
idx++;
@@ -638,7 +640,7 @@ skip:
cb->args[1] = idx;
rules_ops_put(ops);
- return skb->len;
+ return err;
}
static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
@@ -654,7 +656,9 @@ static int fib_nl_dumprule(struct sk_buf
if (ops == NULL)
return -EAFNOSUPPORT;
- return dump_rules(skb, cb, ops);
+ dump_rules(skb, cb, ops);
+
+ return skb->len;
}
rcu_read_lock();
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-09-29 17:30 +0200 |
| Subject | [PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry |
| Message-ID | <qe50T-1Za-43@gated-at.bofh.it> |
| In reply to | #1235223 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Lutomirski <luto@kernel.org> commit 9b6e6a8334d56354853f9c255d1395c2ba570e0a upstream. Returning to userspace is tricky: IRET can fail, and ESPFIX can rearrange the stack prior to IRET. The NMI nesting fixup relies on a precise stack layout and atomic IRET. Rather than trying to teach the NMI nesting fixup to handle ESPFIX and failed IRET, punt: run NMIs that came from user mode on the normal kernel stack. This will make some nested NMIs visible to C code, but the C code is okay with that. As a side effect, this should speed up perf: it eliminates an RDMSR when NMIs come from user mode. Signed-off-by: Andy Lutomirski <luto@kernel.org> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Reviewed-by: Borislav Petkov <bp@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/x86/kernel/entry_64.S | 77 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 73 insertions(+), 4 deletions(-) --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1715,19 +1715,88 @@ ENTRY(nmi) * a nested NMI that updated the copy interrupt stack frame, a * jump will be made to the repeat_nmi code that will handle the second * NMI. + * + * However, espfix prevents us from directly returning to userspace + * with a single IRET instruction. Similarly, IRET to user mode + * can fault. We therefore handle NMIs from user space like + * other IST entries. */ /* Use %rdx as out temp variable throughout */ pushq_cfi %rdx CFI_REL_OFFSET rdx, 0 + testb $3, CS-RIP+8(%rsp) + jz .Lnmi_from_kernel + + /* + * NMI from user mode. We need to run on the thread stack, but we + * can't go through the normal entry paths: NMIs are masked, and + * we don't want to enable interrupts, because then we'll end + * up in an awkward situation in which IRQs are on but NMIs + * are off. + */ + SWAPGS + cld + movq %rsp, %rdx + movq PER_CPU_VAR(kernel_stack), %rsp + addq $KERNEL_STACK_OFFSET, %rsp + pushq 5*8(%rdx) /* pt_regs->ss */ + pushq 4*8(%rdx) /* pt_regs->rsp */ + pushq 3*8(%rdx) /* pt_regs->flags */ + pushq 2*8(%rdx) /* pt_regs->cs */ + pushq 1*8(%rdx) /* pt_regs->rip */ + pushq $-1 /* pt_regs->orig_ax */ + pushq %rdi /* pt_regs->di */ + pushq %rsi /* pt_regs->si */ + pushq (%rdx) /* pt_regs->dx */ + pushq %rcx /* pt_regs->cx */ + pushq %rax /* pt_regs->ax */ + pushq %r8 /* pt_regs->r8 */ + pushq %r9 /* pt_regs->r9 */ + pushq %r10 /* pt_regs->r10 */ + pushq %r11 /* pt_regs->r11 */ + pushq %rbx /* pt_regs->rbx */ + pushq %rbp /* pt_regs->rbp */ + pushq %r12 /* pt_regs->r12 */ + pushq %r13 /* pt_regs->r13 */ + pushq %r14 /* pt_regs->r14 */ + pushq %r15 /* pt_regs->r15 */ + + /* + * At this point we no longer need to worry about stack damage + * due to nesting -- we're on the normal thread stack and we're + * done with the NMI stack. + */ + movq %rsp, %rdi + movq $-1, %rsi + call do_nmi + + /* + * Return back to user mode. We must *not* do the normal exit + * work, because we don't want to enable interrupts. Fortunately, + * do_nmi doesn't modify pt_regs. + */ + SWAPGS + /* - * If %cs was not the kernel segment, then the NMI triggered in user - * space, which means it is definitely not nested. + * Open-code the entire return process for compatibility with varying + * register layouts across different kernel versions. */ - cmpl $__KERNEL_CS, 16(%rsp) - jne first_nmi + addq $6*8, %rsp /* skip bx, bp, and r12-r15 */ + popq %r11 /* pt_regs->r11 */ + popq %r10 /* pt_regs->r10 */ + popq %r9 /* pt_regs->r9 */ + popq %r8 /* pt_regs->r8 */ + popq %rax /* pt_regs->ax */ + popq %rcx /* pt_regs->cx */ + popq %rdx /* pt_regs->dx */ + popq %rsi /* pt_regs->si */ + popq %rdi /* pt_regs->di */ + addq $8, %rsp /* skip orig_ax */ + INTERRUPT_RETURN +.Lnmi_from_kernel: /* * Check the special variable on the stack to see if NMIs are * executing. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.kernel
csiph-web