Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1264433 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2015-11-06 21:30 +0100 |
| Last post | 2015-11-07 04:00 +0100 |
| Articles | 19 — 5 participants |
Back to article view | Back to linux.kernel
[PATCH 4.1 00/86] 4.1.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 13/86] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 24/86] x86/setup: Extend low identity map to cover whole kernel range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 28/86] drm/radeon/dpm: dont add pwm attributes if DPM is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 14/86] drm: fix mutex leak in drm_dp_get_mst_branch_device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 02/86] iwlwifi: dvm: fix D3 firmware PN programming Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 18/86] KVM: arm: use GIC support unconditionally Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 21/86] ASoC: Add info callback for SX_TLV controls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 12/86] iommu/amd: Dont clear DTE flags when modifying it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 03/86] iwlwifi: fix firmware filename for 3160 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 17/86] [media] rtl28xxu: fix control message flaws Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 16/86] [media] si2168: Bounds check firmware Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 19/86] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
[PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-11-06 21:30 +0100
Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-06 21:50 +0100
Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Linus Torvalds <torvalds@linux-foundation.org> - 2015-11-06 22:00 +0100
Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Joerg Roedel <jroedel@suse.de> - 2015-11-08 12:50 +0100
Re: [PATCH 4.1 00/86] 4.1.13-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-07 02:50 +0100
Re: [PATCH 4.1 00/86] 4.1.13-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-11-07 04:00 +0100
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 00/86] 4.1.13-stable review |
| Message-ID | <qrV1D-gl-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.1.13 release.
There are 86 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Nov 8 19:21:32 UTC 2015.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.13-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.1.13-rc1
Dong Aisheng <aisheng.dong@freescale.com>
dts: imx6: fix sd card gpio polarity specified in device tree
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xen: fix backport of previous kexec patch
Soeren Grunewald <soeren.grunewald@desy.de>
serial: 8250_pci: Add support for 12 port Exar boards
Mika Westerberg <mika.westerberg@linux.intel.com>
pinctrl: baytrail: Use raw_spinlock for locking
Mika Westerberg <mika.westerberg@linux.intel.com>
pinctrl: baytrail: Serialize all register access
Minchan Kim <minchan@kernel.org>
thp: use is_zero_pfn() only after pte_present() check
Thomas Hellstrom <thellstrom@vmware.com>
drm/vmwgfx: Fix up user_dmabuf refcounting
Keith Busch <keith.busch@intel.com>
NVMe: Fix memory leak on retried commands
Will Deacon <will.deacon@arm.com>
arm64: compat: fix stxr failure case in SWP emulation
Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
arm64: kernel: fix tcr_el1.t0sz restore on systems with extended idmap
Sudeep Holla <sudeep.holla@arm.com>
arm64: kernel: rename __cpu_suspend to keep it aligned with arm
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL)
Doron Tsur <doront@mellanox.com>
IB/cm: Fix rb-tree duplicate free and use-after-free
Christian Engelmayer <cengelma@gmx.at>
btrfs: fix possible leak in btrfs_ioctl_balance()
Linus Walleij <linus.walleij@linaro.org>
MFD/OF: document MFD devices and handle simple-mfd
Dāvis Mosāns <davispuh@gmail.com>
mvsas: Fix NULL pointer dereference in mvs_slot_task_free
Lucas Stach <dev@lynxeye.de>
irqchip/tegra: Propagate IRQ type setting to parent
Seth Jennings <sjenning@redhat.com>
EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs()
NeilBrown <neilb@suse.com>
Revert "md: allow a partially recovered device to be hot-added to an array."
Roman Gushchin <klamm@yandex-team.ru>
md/raid5: fix locking in handle_stripe_clean_event()
Jes Sorensen <Jes.Sorensen@redhat.com>
md/raid10: submit_bio_wait() returns 0 on success
Jes Sorensen <Jes.Sorensen@redhat.com>
md/raid1: submit_bio_wait() returns 0 on success
Herbert Xu <herbert@gondor.apana.org.au>
crypto: api - Only abort operations on fatal signal
Hans de Goede <hdegoede@redhat.com>
Input: alps - only the Dell Latitude D420/430/620/630 have separate stick button bits
David Howells <dhowells@redhat.com>
ovl: fix dentry reference leak
David Howells <dhowells@redhat.com>
ovl: use O_LARGEFILE in ovl_copy_up()
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
ovl: free lower_mnt array in ovl_put_super
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
ovl: free stack of paths in ovl_fill_super
Sasha Levin <sasha.levin@oracle.com>
PCI: Prevent out of bounds access in numa_node override
Peter Zijlstra <peterz@infradead.org>
module: Fix locking in symbol_put_addr()
Cathy Avery <cathy.avery@oracle.com>
xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
Laura Abbott <labbott@fedoraproject.org>
xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: handle no ping response error properly
Hezi Shahmoon <hezi@marvell.com>
i2c: mv64xxx: really allow I2C offloading
Bjørn Mork <bjorn@mork.no>
USB: qcserial: add Sierra Wireless MC74xx/EM74xx
Frederic Danis <frederic.danis@linux.intel.com>
Revert "serial: 8250_dma: don't bother DMA with small transfers"
Mike Snitzer <snitzer@redhat.com>
dm btree: fix leak of bufio-backed block in btree_split_beneath error path
Joe Thornber <ejt@redhat.com>
dm btree remove: fix a bug when rebalancing nodes after removal
Will Deacon <will.deacon@arm.com>
Revert "ARM64: unwind: Fix PC calculation"
H. Nikolaus Schaller <hns@goldelico.com>
ARM: 8449/1: fix bug in vdsomunge swab32 macro
H. Nikolaus Schaller <hns@goldelico.com>
ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h
Timo Sigurdsson <public_timo.s@silentcreek.de>
ARM: dts: sunxi: Raise minimum CPU voltage for sun7i-a20 to meet SoC specifications
Tomi Valkeinen <tomi.valkeinen@ti.com>
ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on
Alim Akhtar <alim.akhtar@samsung.com>
ARM: dts: Fix audio card detection on Peach boards
Marcin Wojtas <mw@semihalf.com>
ARM: mvebu: correct a385-db-ap compatible string
Florian Fainelli <f.fainelli@gmail.com>
ARM: orion: Fix DSA platform device after mvmdio conversion
Ilya Dryomov <idryomov@gmail.com>
rbd: prevent kernel stack blow up on rbd map
Ilya Dryomov <idryomov@gmail.com>
rbd: don't leak parent_spec in rbd_dev_probe_parent()
Ronny Hegewald <ronny.hegewald@online.de>
rbd: require stable pages if message data CRCs are enabled
Dan Carpenter <dan.carpenter@oracle.com>
iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
Linus Walleij <linus.walleij@linaro.org>
iio: st_accel: fix interrupt handling on LIS3LV02
Alexandre Belloni <alexandre.belloni@free-electrons.com>
iio: mxs-lradc: Fix temperature offset
Alex Deucher <alexander.deucher@amd.com>
drm/radeon: move bl encoder assignment into bl init
Alex Deucher <alexander.deucher@amd.com>
drm/radeon: fix dpms when driver backlight control is disabled
Alex Deucher <alexander.deucher@amd.com>
drm/radeon: don't try to recreate sysfs entries on resume
Chris Wilson <chris@chris-wilson.co.uk>
drm/i915: Deny wrapping an userptr into a framebuffer
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Restore lost DPLL register write on gen2-4
Chris Wilson <chris@chris-wilson.co.uk>
drm/i915: Flush pipecontrol post-sync writes
Alex Deucher <alexander.deucher@amd.com>
drm/radeon/dpm: don't add pwm attributes if DPM is disabled
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/gem: return only valid domain when there's only one
Florian Westphal <fw@strlen.de>
fault-inject: fix inverted interval/probability values in printk
Jan Kara <jack@suse.com>
mm: make sendfile(2) killable
Paolo Bonzini <pbonzini@redhat.com>
x86/setup: Extend low identity map to cover whole kernel range
Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
x86/efi: Fix multiple GOP device support
Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
ASoC: wm8904: Correct number of EQ registers
Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
ASoC: Add info callback for SX_TLV controls
Takashi Iwai <tiwai@suse.de>
ALSA: hda - Fix deadlock at error in building PCM
David Henningsson <david.henningsson@canonical.com>
ALSA: hda - Fix inverted internal mic on Lenovo G50-80
Arnd Bergmann <arnd@arndb.de>
KVM: arm: use GIC support unconditionally
Antti Palosaari <crope@iki.fi>
rtl28xxu: fix control message flaws
Laura Abbott <labbott@fedoraproject.org>
si2168: Bounds check firmware
Laura Abbott <labbott@fedoraproject.org>
si2157: Bounds check firmware
Adam Richter <adamrichter4@gmail.com>
drm: fix mutex leak in drm_dp_get_mst_branch_device
Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
powerpc/rtas: Validate rtas.entry before calling enter_rtas()
Joerg Roedel <jroedel@suse.de>
iommu/amd: Don't clear DTE flags when modifying it
Jay Cornwall <jay@jcornwall.me>
iommu/amd: Fix BUG when faulting a PROT_NONE VMA
Christian Zander <christian@nervanasys.com>
iommu/vt-d: fix range computation when making room for large pages
Luca Coelho <luciano.coelho@intel.com>
iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series
Andrei Otcheretianski <andrei.otcheretianski@intel.com>
iwlwifi: mvm: flush fw_dump_wk when mvm fails to start
Arik Nemtsov <arik@wizery.com>
iwlwifi: mvm: init card correctly on ctkill exit check
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: fix D3 firmware PN programming
Avraham Stern <avraham.stern@intel.com>
iwlwifi: mvm: clear csa countdown when AP is stopped
Larry Finger <Larry.Finger@lwfinger.net>
rtlwifi: rtl8821ae: Fix system lockups on boot
Johannes Berg <johannes.berg@intel.com>
iwlwifi: fix firmware filename for 3160
Johannes Berg <johannes.berg@intel.com>
iwlwifi: dvm: fix D3 firmware PN programming
Felix Fietkau <nbd@openwrt.org>
ath9k: declare required extra tx headroom
-------------
Diffstat:
Documentation/devicetree/bindings/mfd/mfd.txt | 41 ++++++++++++++
Makefile | 4 +-
arch/arm/boot/dts/am57xx-beagle-x15.dts | 3 +-
arch/arm/boot/dts/armada-385-db-ap.dts | 2 +-
arch/arm/boot/dts/exynos5420-peach-pit.dts | 5 ++
arch/arm/boot/dts/exynos5800-peach-pi.dts | 5 ++
arch/arm/boot/dts/imx6dl-riotboard.dts | 8 +--
arch/arm/boot/dts/imx6q-arm2.dts | 5 +-
arch/arm/boot/dts/imx6q-gk802.dts | 3 +-
arch/arm/boot/dts/imx6q-tbs2910.dts | 4 +-
arch/arm/boot/dts/imx6qdl-aristainetos.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-cubox-i.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-hummingboard.dtsi | 3 +-
arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 8 +--
arch/arm/boot/dts/imx6qdl-rex.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-sabrelite.dtsi | 6 +--
arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 8 +--
arch/arm/boot/dts/imx6qdl-tx6.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 6 ++-
arch/arm/boot/dts/imx6sl-evk.dts | 10 ++--
arch/arm/boot/dts/imx6sx-sabreauto.dts | 4 +-
arch/arm/boot/dts/imx6sx-sdb.dtsi | 4 +-
arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
arch/arm/kvm/Kconfig | 1 +
arch/arm/plat-orion/common.c | 2 +-
arch/arm/vdso/vdsomunge.c | 17 ++++--
arch/arm64/include/asm/cpuidle.h | 8 +--
arch/arm64/include/asm/suspend.h | 2 +-
arch/arm64/kernel/armv8_deprecated.c | 18 ++++---
arch/arm64/kernel/cpuidle.c | 4 +-
arch/arm64/kernel/psci.c | 2 +-
arch/arm64/kernel/stacktrace.c | 6 +--
arch/arm64/kernel/suspend.c | 26 +++++----
arch/powerpc/kernel/rtas.c | 3 ++
arch/x86/boot/compressed/eboot.c | 8 ++-
arch/x86/kernel/setup.c | 8 +++
arch/x86/xen/enlighten.c | 6 +--
crypto/ablkcipher.c | 2 +-
crypto/algapi.c | 2 +-
crypto/api.c | 6 +--
crypto/crypto_user.c | 2 +-
drivers/block/nvme-core.c | 9 ++--
drivers/block/rbd.c | 71 ++++++++++++++-----------
drivers/block/xen-blkfront.c | 3 +-
drivers/cpufreq/intel_pstate.c | 5 ++
drivers/edac/sb_edac.c | 8 +--
drivers/gpu/drm/drm_dp_mst_topology.c | 7 +--
drivers/gpu/drm/i915/i915_gem_userptr.c | 5 +-
drivers/gpu/drm/i915/intel_display.c | 7 +++
drivers/gpu/drm/i915/intel_lrc.c | 1 +
drivers/gpu/drm/i915/intel_ringbuffer.c | 2 +
drivers/gpu/drm/nouveau/nouveau_gem.c | 5 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 19 +++++--
drivers/gpu/drm/radeon/radeon.h | 1 +
drivers/gpu/drm/radeon/radeon_encoders.c | 1 -
drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 +
drivers/gpu/drm/radeon/radeon_pm.c | 43 +++++++++------
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 3 ++
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 29 +++++++---
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 12 +++--
drivers/i2c/busses/i2c-mv64xxx.c | 2 -
drivers/iio/accel/st_accel_core.c | 6 ---
drivers/infiniband/core/cm.c | 10 +++-
drivers/input/mouse/alps.c | 48 ++++++++++++++---
drivers/iommu/amd_iommu.c | 4 +-
drivers/iommu/amd_iommu_types.h | 1 +
drivers/iommu/amd_iommu_v2.c | 7 +++
drivers/iommu/intel-iommu.c | 12 +++--
drivers/irqchip/irq-tegra.c | 1 +
drivers/md/md.c | 3 +-
drivers/md/persistent-data/dm-btree-remove.c | 17 +++---
drivers/md/persistent-data/dm-btree.c | 2 +-
drivers/md/raid1.c | 2 +-
drivers/md/raid10.c | 2 +-
drivers/md/raid5.c | 6 ++-
drivers/media/dvb-frontends/si2168.c | 4 ++
drivers/media/tuners/si2157.c | 4 ++
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++-
drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
drivers/net/wireless/ath/ath9k/init.c | 1 +
drivers/net/wireless/iwlwifi/dvm/lib.c | 2 +-
drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +-
drivers/net/wireless/iwlwifi/mvm/d3.c | 12 ++---
drivers/net/wireless/iwlwifi/mvm/fw.c | 4 +-
drivers/net/wireless/iwlwifi/mvm/mac80211.c | 1 +
drivers/net/wireless/iwlwifi/mvm/mvm.h | 5 ++
drivers/net/wireless/iwlwifi/mvm/ops.c | 1 +
drivers/net/wireless/iwlwifi/pcie/drv.c | 5 ++
drivers/net/wireless/rtlwifi/pci.h | 2 +
drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 ++++++
drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 ++
drivers/net/wireless/rtlwifi/wifi.h | 3 ++
drivers/of/platform.c | 1 +
drivers/pci/pci-sysfs.c | 2 +-
drivers/pinctrl/intel/pinctrl-baytrail.c | 59 +++++++++++---------
drivers/scsi/mvsas/mv_sas.c | 2 +
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
drivers/staging/iio/adc/mxs-lradc.c | 9 ++--
drivers/tty/serial/8250/8250_dma.c | 4 --
drivers/tty/serial/8250/8250_pci.c | 21 ++++++++
drivers/usb/host/xhci-pci.c | 1 +
drivers/usb/host/xhci-ring.c | 20 +++++--
drivers/usb/serial/qcserial.c | 2 +
fs/btrfs/ioctl.c | 5 +-
fs/overlayfs/copy_up.c | 6 +--
fs/overlayfs/super.c | 2 +
include/sound/soc.h | 6 ++-
include/sound/wm8904.h | 2 +-
kernel/module.c | 8 ++-
lib/fault-inject.c | 2 +-
mm/filemap.c | 9 ++--
mm/huge_memory.c | 3 +-
sound/pci/hda/hda_codec.c | 4 +-
sound/pci/hda/patch_conexant.c | 1 +
sound/soc/soc-ops.c | 28 ++++++++++
125 files changed, 653 insertions(+), 288 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 13/86] powerpc/rtas: Validate rtas.entry before calling enter_rtas() |
| Message-ID | <qrVO3-Q7-21@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
commit 8832317f662c06f5c06e638f57bfe89a71c9b266 upstream.
Currently we do not validate rtas.entry before calling enter_rtas(). This
leads to a kernel oops when user space calls rtas system call on a powernv
platform (see below). This patch adds code to validate rtas.entry before
making enter_rtas() call.
Oops: Exception in kernel mode, sig: 4 [#1]
SMP NR_CPUS=1024 NUMA PowerNV
task: c000000004294b80 ti: c0000007e1a78000 task.ti: c0000007e1a78000
NIP: 0000000000000000 LR: 0000000000009c14 CTR: c000000000423140
REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
MSR: 1000000000081000 <HV,ME> CR: 00000000 XER: 00000000
CFAR: c000000000009c0c SOFTE: 0
NIP [0000000000000000] (null)
LR [0000000000009c14] 0x9c14
Call Trace:
[c0000007e1a7bba0] [c00000000041a7f4] avc_has_perm_noaudit+0x54/0x110 (unreliable)
[c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
[c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98
Fixes: 55190f88789a ("powerpc: Add skeleton PowerNV platform")
Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Reword change log, trim oops, and add stable + fixes]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/rtas.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1041,6 +1041,9 @@ asmlinkage int ppc_rtas(struct rtas_args
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (!rtas.entry)
+ return -EINVAL;
+
if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
return -EFAULT;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 24/86] x86/setup: Extend low identity map to cover whole kernel range |
| Message-ID | <qrVO3-Q7-23@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit f5f3497cad8c8416a74b9aaceb127908755d020a upstream.
On 32-bit systems, the initial_page_table is reused by
efi_call_phys_prolog as an identity map to call
SetVirtualAddressMap. efi_call_phys_prolog takes care of
converting the current CPU's GDT to a physical address too.
For PAE kernels the identity mapping is achieved by aliasing the
first PDPE for the kernel memory mapping into the first PDPE
of initial_page_table. This makes the EFI stub's trick "just work".
However, for non-PAE kernels there is no guarantee that the identity
mapping in the initial_page_table extends as far as the GDT; in this
case, accesses to the GDT will cause a page fault (which quickly becomes
a triple fault). Fix this by copying the kernel mappings from
swapper_pg_dir to initial_page_table twice, both at PAGE_OFFSET and at
identity mapping.
For some reason, this is only reproducible with QEMU's dynamic translation
mode, and not for example with KVM. However, even under KVM one can clearly
see that the page table is bogus:
$ qemu-system-i386 -pflash OVMF.fd -M q35 vmlinuz0 -s -S -daemonize
$ gdb
(gdb) target remote localhost:1234
(gdb) hb *0x02858f6f
Hardware assisted breakpoint 1 at 0x2858f6f
(gdb) c
Continuing.
Breakpoint 1, 0x02858f6f in ?? ()
(gdb) monitor info registers
...
GDT= 0724e000 000000ff
IDT= fffbb000 000007ff
CR0=0005003b CR2=ff896000 CR3=032b7000 CR4=00000690
...
The page directory is sane:
(gdb) x/4wx 0x32b7000
0x32b7000: 0x03398063 0x03399063 0x0339a063 0x0339b063
(gdb) x/4wx 0x3398000
0x3398000: 0x00000163 0x00001163 0x00002163 0x00003163
(gdb) x/4wx 0x3399000
0x3399000: 0x00400003 0x00401003 0x00402003 0x00403003
but our particular page directory entry is empty:
(gdb) x/1wx 0x32b7000 + (0x724e000 >> 22) * 4
0x32b7070: 0x00000000
[ It appears that you can skate past this issue if you don't receive
any interrupts while the bogus GDT pointer is loaded, or if you avoid
reloading the segment registers in general.
Andy Lutomirski provides some additional insight:
"AFAICT it's entirely permissible for the GDTR and/or LDT
descriptor to point to unmapped memory. Any attempt to use them
(segment loads, interrupts, IRET, etc) will try to access that memory
as if the access came from CPL 0 and, if the access fails, will
generate a valid page fault with CR2 pointing into the GDT or
LDT."
Up until commit 23a0d4e8fa6d ("efi: Disable interrupts around EFI
calls, not in the epilog/prolog calls") interrupts were disabled
around the prolog and epilog calls, and the functional GDT was
re-installed before interrupts were re-enabled.
Which explains why no one has hit this issue until now. ]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Laszlo Ersek <lersek@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[ Updated changelog. ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/setup.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1194,6 +1194,14 @@ void __init setup_arch(char **cmdline_p)
clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
swapper_pg_dir + KERNEL_PGD_BOUNDARY,
KERNEL_PGD_PTRS);
+
+ /*
+ * sync back low identity map too. It is used for example
+ * in the 32-bit EFI stub.
+ */
+ clone_pgd_range(initial_page_table,
+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+ KERNEL_PGD_PTRS);
#endif
tboot_probe();
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 28/86] drm/radeon/dpm: dont add pwm attributes if DPM is disabled |
| Message-ID | <qrVO3-Q7-25@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexander.deucher@amd.com> commit 2a7d44f47f53fa1be677f44c73d78b1bcf9c05d9 upstream. PWM fan control is only available with DPM. If DPM disabled, don't expose the PWM fan controls to avoid a crash. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92524 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_pm.c +++ b/drivers/gpu/drm/radeon/radeon_pm.c @@ -720,10 +720,14 @@ static umode_t hwmon_attributes_visible( struct radeon_device *rdev = dev_get_drvdata(dev); umode_t effective_mode = attr->mode; - /* Skip limit attributes if DPM is not enabled */ + /* Skip attributes if DPM is not enabled */ if (rdev->pm.pm_method != PM_METHOD_DPM && (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr || - attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr)) + attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr || + attr == &sensor_dev_attr_pwm1.dev_attr.attr || + attr == &sensor_dev_attr_pwm1_enable.dev_attr.attr || + attr == &sensor_dev_attr_pwm1_max.dev_attr.attr || + attr == &sensor_dev_attr_pwm1_min.dev_attr.attr)) return 0; /* Skip fan attributes if fan is not present */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 14/86] drm: fix mutex leak in drm_dp_get_mst_branch_device |
| Message-ID | <qrVO3-Q7-27@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Richter <adamrichter4@gmail.com>
commit 30730c7f5943b3beace1e29f7f1476e05de3da14 upstream.
In Linux 4.3-rc5, there is an error case in drm_dp_get_branch_device
that returns without releasing mgr->lock, resulting a spew of kernel
messages about a kernel work function possibly having leaked a mutex
and presumably more serious adverse consequences later. This patch
changes the error to "goto out" to unlock the mutex before returning.
[airlied: grabbed from drm-next as it fixes something we've seen]
Signed-off-by: Adam J. Richter <adam_richter2004@yahoo.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1179,17 +1179,18 @@ static struct drm_dp_mst_branch *drm_dp_
list_for_each_entry(port, &mstb->ports, next) {
if (port->port_num == port_num) {
- if (!port->mstb) {
+ mstb = port->mstb;
+ if (!mstb) {
DRM_ERROR("failed to lookup MSTB with lct %d, rad %02x\n", lct, rad[0]);
- return NULL;
+ goto out;
}
- mstb = port->mstb;
break;
}
}
}
kref_get(&mstb->kref);
+out:
mutex_unlock(&mgr->lock);
return mstb;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 02/86] iwlwifi: dvm: fix D3 firmware PN programming |
| Message-ID | <qrVO3-Q7-31@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg <johannes.berg@intel.com> commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream. The code to send the RX PN data (for each TID) to the firmware has a devastating bug: it overwrites the data for TID 0 with all the TID data, leaving the remaining TIDs zeroed. This will allow replays to actually be accepted by the firmware, which could allow waking up the system. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/wireless/iwlwifi/dvm/lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/iwlwifi/dvm/lib.c +++ b/drivers/net/wireless/iwlwifi/dvm/lib.c @@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(s u8 *pn = seq.ccmp.pn; ieee80211_get_key_rx_seq(key, i, &seq); - aes_sc->pn = cpu_to_le64( + aes_sc[i].pn = cpu_to_le64( (u64)pn[5] | ((u64)pn[4] << 8) | ((u64)pn[3] << 16) | -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 18/86] KVM: arm: use GIC support unconditionally |
| Message-ID | <qrVO3-Q7-37@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 4a5d69b73948d0e03cd38d77dc11edb2e707165f upstream.
The vgic code on ARM is built for all configurations that enable KVM,
but the parent_data field that it references is only present when
CONFIG_IRQ_DOMAIN_HIERARCHY is set:
virt/kvm/arm/vgic.c: In function 'kvm_vgic_map_phys_irq':
virt/kvm/arm/vgic.c:1781:13: error: 'struct irq_data' has no member named 'parent_data'
This flag is implied by the GIC driver, and indeed the VGIC code only
makes sense if a GIC is present. This changes the CONFIG_KVM symbol
to always select GIC, which avoids the issue.
Fixes: 662d9715840 ("arm/arm64: KVM: Kill CONFIG_KVM_ARM_{VGIC,TIMER}")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kvm/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
depends on MMU && OF
select PREEMPT_NOTIFIERS
select ANON_INODES
+ select ARM_GIC
select HAVE_KVM_CPU_RELAX_INTERCEPT
select HAVE_KVM_ARCH_TLB_FLUSH_ALL
select KVM_MMIO
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 21/86] ASoC: Add info callback for SX_TLV controls |
| Message-ID | <qrVO3-Q7-39@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit 34198710f55b5f359f43e67d9a08fe5aadfbca1b upstream.
SX_TLV controls are intended for situations where the register behind
the control has some non-zero value indicating the minimum gain
and then gains increasing from there and eventually overflowing through
zero.
Currently every CODEC implementing these controls specifies the minimum
as the non-zero value for the minimum and the maximum as the number of
gain settings available.
This means when the info callback subtracts the minimum value from the
maximum value to calculate the number of gain levels available it is
actually under reporting the available levels. This patch fixes this
issue by adding a new snd_soc_info_volsw_sx callback that does not
subtract the minimum value.
Fixes: 1d99f2436d0d ("ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV")
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Acked-by: Brian Austin <brian.austin@cirrus.com>
Tested-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/soc.h | 6 ++++--
sound/soc/soc-ops.c | 28 ++++++++++++++++++++++++++++
2 files changed, 32 insertions(+), 2 deletions(-)
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -85,7 +85,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array),\
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx,\
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -155,7 +155,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array), \
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx, \
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -563,6 +563,8 @@ int snd_soc_put_enum_double(struct snd_k
struct snd_ctl_elem_value *ucontrol);
int snd_soc_info_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo);
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo);
#define snd_soc_info_bool_ext snd_ctl_boolean_mono_info
int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol);
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -207,6 +207,34 @@ int snd_soc_info_volsw(struct snd_kcontr
EXPORT_SYMBOL_GPL(snd_soc_info_volsw);
/**
+ * snd_soc_info_volsw_sx - Mixer info callback for SX TLV controls
+ * @kcontrol: mixer control
+ * @uinfo: control element information
+ *
+ * Callback to provide information about a single mixer control, or a double
+ * mixer control that spans 2 registers of the SX TLV type. SX TLV controls
+ * have a range that represents both positive and negative values either side
+ * of zero but without a sign bit.
+ *
+ * Returns 0 for success.
+ */
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo)
+{
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+
+ snd_soc_info_volsw(kcontrol, uinfo);
+ /* Max represents the number of levels in an SX control not the
+ * maximum value, so add the minimum value back on
+ */
+ uinfo->value.integer.max += mc->min;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(snd_soc_info_volsw_sx);
+
+/**
* snd_soc_get_volsw - single mixer get callback
* @kcontrol: mixer control
* @ucontrol: control element information
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 12/86] iommu/amd: Dont clear DTE flags when modifying it |
| Message-ID | <qrVO3-Q7-45@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit cbf3ccd09d683abf1cacd36e3640872ee912d99b upstream.
During device assignment/deassignment the flags in the DTE
get lost, which might cause spurious faults, for example
when the device tries to access the system management range.
Fix this by not clearing the flags with the rest of the DTE.
Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Tested-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu.c | 4 ++--
drivers/iommu/amd_iommu_types.h | 1 +
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2099,8 +2099,8 @@ static void set_dte_entry(u16 devid, str
static void clear_dte_entry(u16 devid)
{
/* remove entry from the device table seen by the hardware */
- amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
- amd_iommu_dev_table[devid].data[1] = 0;
+ amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
+ amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK;
amd_iommu_apply_erratum_63(devid);
}
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -295,6 +295,7 @@
#define IOMMU_PTE_IR (1ULL << 61)
#define IOMMU_PTE_IW (1ULL << 62)
+#define DTE_FLAG_MASK (0x3ffULL << 32)
#define DTE_FLAG_IOTLB (0x01UL << 32)
#define DTE_FLAG_GV (0x01ULL << 55)
#define DTE_GLX_SHIFT (56)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 03/86] iwlwifi: fix firmware filename for 3160 |
| Message-ID | <qrVO4-Q7-51@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit b5a48134f8af08f5243328f8a0b05fc5ae7cf343 upstream.
The MODULE_FIRMWARE() for 3160 should be using the 7260 version as
it's done in the device configuration struct instead of referencing
IWL3160_UCODE_API_OK which doesn't even exist.
Reported-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -325,6 +325,6 @@ const struct iwl_cfg iwl7265d_n_cfg = {
};
MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 17/86] [media] rtl28xxu: fix control message flaws |
| Message-ID | <qrVO4-Q7-57@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.
Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++++++++++--
drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
2 files changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_
unsigned int pipe;
u8 requesttype;
+ mutex_lock(&d->usb_mutex);
+
+ if (req->size > sizeof(dev->buf)) {
+ dev_err(&d->intf->dev, "too large message %u\n", req->size);
+ ret = -EINVAL;
+ goto err_mutex_unlock;
+ }
+
if (req->index & CMD_WR_FLAG) {
/* write */
memcpy(dev->buf, req->data, req->size);
@@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
req->index, dev->buf, req->size);
if (ret < 0)
- goto err;
+ goto err_mutex_unlock;
/* read request, copy returned data to return buf */
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
memcpy(req->data, dev->buf, req->size);
+ mutex_unlock(&d->usb_mutex);
+
return 0;
-err:
+err_mutex_unlock:
+ mutex_unlock(&d->usb_mutex);
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
return ret;
}
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
@@ -69,7 +69,7 @@
struct rtl28xxu_dev {
- u8 buf[28];
+ u8 buf[128];
u8 chip_id;
u8 tuner;
char *tuner_name;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 16/86] [media] si2168: Bounds check firmware |
| Message-ID | <qrVO4-Q7-65@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@fedoraproject.org>
commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream.
When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:
si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f
Add the proper check.
Reported-by: Stuart Auchterlonie <sauchter@redhat.com>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/si2168.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -457,6 +457,10 @@ static int si2168_init(struct dvb_fronte
/* firmware is in the new format */
for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining];
+ if (len > SI2168_ARGLEN) {
+ ret = -EINVAL;
+ break;
+ }
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len;
cmd.rlen = 1;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 19/86] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 |
| Message-ID | <qrVO4-Q7-71@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: David Henningsson <david.henningsson@canonical.com> commit e8d65a8d985271a102f07c7456da5b86c19ffe16 upstream. Add the appropriate quirk to indicate the Lenovo G50-80 has a stereo mic input where one channel has reverse polarity. Alsa-info available at: https://launchpadlibrarian.net/220846272/AlsaInfo.txt BugLink: https://bugs.launchpad.net/bugs/1504778 Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_conexant.c +++ b/sound/pci/hda/patch_conexant.c @@ -819,6 +819,7 @@ static const struct snd_pci_quirk cxt506 SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410), SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410), SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2015-11-06 21:30 +0100 |
| Subject | [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA |
| Message-ID | <qrVO4-Q7-61@gated-at.bofh.it> |
| In reply to | #1264433 |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Cornwall <jay@jcornwall.me>
commit d14f6fced5f9360edca5a1325ddb7077aab1203b upstream.
handle_mm_fault indirectly triggers a BUG in do_numa_page
when given a VMA without read/write/execute access. Check
this condition in do_fault.
do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page
mm/memory.c
3147 static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
....
3159 /* A PROT_NONE fault should not end up here */
3160 BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
Signed-off-by: Jay Cornwall <jay@jcornwall.me>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_v2.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -508,6 +508,13 @@ static void do_fault(struct work_struct
goto out;
}
+ if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
+ /* handle_mm_fault would BUG_ON() */
+ up_read(&mm->mmap_sem);
+ handle_fault_error(fault);
+ goto out;
+ }
+
ret = handle_mm_fault(mm, vma, address, write);
if (ret & VM_FAULT_ERROR) {
/* failed to service fault */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Date | 2015-11-06 21:50 +0100 |
| Subject | Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA |
| Message-ID | <qrW7p-YG-25@gated-at.bofh.it> |
| In reply to | #1264455 |
On Fri, Nov 6, 2015 at 11:22 AM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Jay Cornwall <jay@jcornwall.me>
>
> commit d14f6fced5f9360edca5a1325ddb7077aab1203b upstream.
>
> handle_mm_fault indirectly triggers a BUG in do_numa_page
> when given a VMA without read/write/execute access. Check
> this condition in do_fault.
This reminds me.
I think the code is still wrong.
The thing is, the VM assumes that the caller has already checked
permissions. An dby "checked permissions", I mean actually checking
permissions. The AMD iommu driver doesn't do that, it does something
completely different, namely "check it's not PROT_NONE".
So I think the code should instead do something like
if ((write && !(vma->vm_flags & VM_WRITE)) || !(vma->vm_flags & VM_READ)) {
up_read(&mm->mmap_sem);
handle_fault_error(fault);
goto out;
}
because it is *not* valid to call "handle_mm_fault()" with a write
fault unless you have write permissions (or with a read fault unless
you have read permissions).
And some "handle_mm_fault would BUG_ON()" comment is just bogus. It's
not handle_mm_fault()'s case that you called it without checking
proper permissions.
I'm not arguing against the stable backport, because that is fine. But
I think this should be fixed further.
Joerg?
Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Date | 2015-11-06 22:00 +0100 |
| Subject | Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA |
| Message-ID | <qrWh6-13l-61@gated-at.bofh.it> |
| In reply to | #1264506 |
On Fri, Nov 6, 2015 at 12:49 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> And some "handle_mm_fault would BUG_ON()" comment is just bogus. It's
> not handle_mm_fault()'s case that you called it without checking
> proper permissions.
Side note: as to why handle_mm_fault() doesn't just do things itself,
there's a historical situation where we used to let people do things
in ptrace() that they couldn't do directly, and punch through
protections (and turn shared read-only pages into a dirty private
page).
So the permissions checking was up to the caller, because some callers
could do things that other callers could not.
I *think* we have gotten rid of all those cases, and I guess we could
consider just making handle_mm_fault() itself stricter. But that's the
historical background on why callers need to check this.
Adding linux-mm to the cc, to see if anybody there has some comments
wrt just moving all the EFAULT handling into handle_mm_fault() and
relaxing the caller requirements.
Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Joerg Roedel <jroedel@suse.de> |
|---|---|
| Date | 2015-11-08 12:50 +0100 |
| Subject | Re: [PATCH 4.1 11/86] iommu/amd: Fix BUG when faulting a PROT_NONE VMA |
| Message-ID | <qswDT-830-5@gated-at.bofh.it> |
| In reply to | #1264506 |
On Fri, Nov 06, 2015 at 12:49:20PM -0800, Linus Torvalds wrote: > I'm not arguing against the stable backport, because that is fine. But > I think this should be fixed further. > > Joerg? Huh, you are right, I completly missed that. Basically the code needs to do a lot of checks that the cpu page-fault handlers also do, including the access-checks. Other checks are probably necessary too, I'll have look at this. Thanks for pointing it out. Joerg -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2015-11-07 02:50 +0100 |
| Message-ID | <qs0NI-41w-7@gated-at.bofh.it> |
| In reply to | #1264433 |
On 11/06/2015 11:21 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.1.13 release. > There are 86 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Sun Nov 8 19:21:32 UTC 2015. > Anything received after that time might be too late. > Build results: total: 137 pass: 137 fail: 0 Qemu test results: total: 94 pass: 94 fail: 0 Details are available at http://server.roeck-us.net:8010/builders. Guenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuahkh@osg.samsung.com> |
|---|---|
| Date | 2015-11-07 04:00 +0100 |
| Message-ID | <qs1Ts-4Dm-13@gated-at.bofh.it> |
| In reply to | #1264433 |
On 11/06/2015 12:21 PM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.1.13 release. > There are 86 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Sun Nov 8 19:21:32 UTC 2015. > Anything received after that time might be too late. > > The whole patch series can be found in one patch at: > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.13-rc1.gz > and the diffstat can be found below. > > thanks, > > greg k-h > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah -- Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America (Silicon Valley) shuahkh@osg.samsung.com | (970) 217-8978 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web