Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1341722 > unrolled thread

[PATCH 3.12 001/142] dcache: use IS_ROOT to decide where dentry is hashed

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 3.12 001/142] dcache: use IS_ROOT to decide where dentry is hashed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 140/142] module: wrapper for symbol name. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 103/142] SCSI: Add Marvell Console to VPD blacklist Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 141/142] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 130/142] xhci: Fix list corruption in urb dequeue at host removal Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 137/142] dump_stack: avoid potential deadlocks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 133/142] scripts/bloat-o-meter: fix python3 syntax error Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 106/142] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 138/142] intel_scu_ipcutil: underflow in scu_reg_access() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 125/142] Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 135/142] radix-tree: fix race in gang lookup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 129/142] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 127/142] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 126/142] Input: elantech - mark protocols v2 and v3 as semi-mt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 120/142] ARM: 8519/1: ICST: try other dividends than 1 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 132/142] dma-debug: switch check from _text to _stext Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 128/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 134/142] memcg: only free spare array when readers are done Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 119/142] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 105/142] iio:ad7793: Fix ad7785 product ID Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 131/142] m32r: fix m32104ut_defconfig build fail Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 136/142] radix-tree: fix oops after radix_tree_iter_retry Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 117/142] udf: Check output buffer length when converting name to CS0 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 116/142] udf: Prevent buffer overrun with multi-byte characters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 121/142] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 124/142] mm: fix mlock accouting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 122/142] fuse: break infinite loop in fuse_fill_write_pages() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 108/142] iio: ad5064: Fix ad5629/ad5669 shift Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 114/142] nfs: Fix race in __update_open_stateid() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 112/142] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 109/142] iio: fix some warning messages Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 102/142] scsi_dh_rdac: always retry MODE SELECT on command lock violation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 118/142] ARM: dts: Kirkwood: Fix QNAP TS219 power-off Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 099/142] iscsi-target: Fix potential dead-lock during node acl delete Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 101/142] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 123/142] mm: soft-offline: check return value in second __get_any_page() call Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 113/142] cifs: fix erroneous return value Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 111/142] iio: dac: mcp4725: set iio name property in sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 110/142] iio: adis_buffer: Fix out-of-bounds memory access Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 115/142] udf: limit the maximum number of indirect extents in a row Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 068/142] ahci: Intel DNV device IDs SATA Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 090/142] ptrace: use fsuid, fsgid, effective creds for fs access checks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 088/142] perf: Fix inherited events vs. tracepoint filters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 094/142] scsi: restart list search after unlock in scsi_remove_target Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 089/142] perf trace: Fix documentation for -i Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 085/142] ext4: fix potential integer overflow Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 065/142] crypto: algif_hash - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 083/142] serial: 8250_pci: Correct uartclk for xr17v35x expansion chips Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 093/142] klist: fix starting point removed bug in klist iterators Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 095/142] scsi_sysfs: Fix queue_ramp_up_period return code Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 086/142] btrfs: properly set the termination value of ctx->pos in readdir Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 091/142] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 087/142] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 098/142] SCSI: Fix NULL pointer dereference in runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 096/142] iscsi-target: Fix rx_login_comp hang after login failure Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 082/142] pty: make sure super_block is still valid in final /dev/tty close Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 100/142] SCSI: fix crashes in sd and sr runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 092/142] tracing: Fix freak link error caused by branch tracer Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 066/142] AHCI: Fix softreset failed issue of Port Multiplier Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 097/142] Fix a memory leak in scsi_host_dev_release() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 074/142] tty: remove platform_sysrq_reset_seq Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 077/142] ALSA: seq: Fix double port list deletion Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 062/142] crypto: af_alg - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 081/142] pty: fix possible use after free of tty->driver_data Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 073/142] binfmt_elf: Don't clobber passed executable's file header Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 060/142] crypto: af_alg - Disallow bind/setkey/... after accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 002/142] pipe: Fix buffer offset after partially failed read Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 064/142] crypto: hash - Add crypto_ahash_has_setkey Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 063/142] crypto: algif_skcipher - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 072/142] FS-Cache: Don't override netfs's primary_index if registering failed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 078/142] phy: twl4030-usb: Relase usb phy on unload Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 070/142] crypto: user - lock crypto_alg_list on alg dump Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 080/142] staging/speakup: Use tty_ldisc_ref() for paste kworker Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 061/142] crypto: af_alg - Fix socket double-free when accept fails Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 071/142] FS-Cache: Increase reference of parent after registering, netfs success Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 079/142] wan/x25: Fix use-after-free in x25_asy_open_tty() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 059/142] crypto: algif_skcipher - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 075/142] s390: fix normalization bug in exception table sorting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 084/142] AIO: properly check iovec sizes Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 054/142] USB: option: fix Cinterion AHxx enumeration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 058/142] ext4: Fix handling of extended tv_sec Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 057/142] xhci: fix usb2 resume timing and races. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 003/142] Revert "ocfs2: fix umask ignored issue" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 052/142] USB: cp210x: add ID for IAI USB to RS485 adaptor Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 051/142] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 055/142] tty: Fix GPF in flush_to_ldisc() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 056/142] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 039/142] ALSA: seq: Fix lockdep warnings due to double mutex locks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 053/142] USB: serial: option: Adding support for Telit LE922 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 042/142] ALSA: timer: Fix link corruption due to double start or stop Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 010/142] sh64: fix __NR_fgetxattr Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 050/142] USB: serial: visor: fix crash on detecting device without write_urbs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 004/142] proc: actually make proc_fd_permission() thread-friendly Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 047/142] ALSA: hda - Fix speaker output from VAIO AiO machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 040/142] ALSA: timer: Code cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 045/142] ALSA: hda - Add fixup for Mac Mini 7,1 model Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 048/142] ALSA: dummy: Implement timer backend switching more safely Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 044/142] ALSA: timer: Fix race between stop and interrupt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 043/142] ALSA: timer: Fix wrong instance passed to slave callbacks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 046/142] ALSA: hda - Fix static checker warning in patch_hdmi.c Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 041/142] ALSA: timer: Fix leftover link at closing Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 038/142] ALSA: seq: Fix race at closing in virmidi driver Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 049/142] saa7134-alsa: Only frees registered sound cards Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 032/142] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 031/142] ALSA: dummy: Disable switching timer backend via sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 022/142] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 024/142] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 029/142] ALSA: usb-audio: avoid freeing umidi object twice Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 019/142] tracing: Fix setting of start_index in find_next() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 025/142] v4l2-compat-ioctl32: fix alignment for ARM64 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 030/142] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 005/142] remoteproc: avoid stack overflow in debugfs file Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 028/142] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 026/142] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 021/142] fix calculation of meta_bg descriptor backups Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 007/142] kernel/signal.c: unexport sigsuspend() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 035/142] ALSA: pcm: Fix potential deadlock in OSS emulation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 034/142] ALSA: rawmidi: Fix race at copying & updating the position Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 037/142] ALSA: seq: Fix yet another races among ALSA timer accesses Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 023/142] parisc: Fix syscall restarts Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 027/142] fix sysvfs symlinks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 020/142] jbd2: Fix unreclaimed pages after truncate in data=journal mode Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 009/142] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 006/142] fat: fix fake_offset handling on error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 033/142] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 036/142] ASoC: dpcm: fix the BE state on hw_free Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 017/142] vTPM: fix memory allocation flag for rtce buffer at kernel boot Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 014/142] spi: fix parent-device reference leak Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 011/142] Revert "dm mpath: fix stalls when handling invalid ioctls" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 018/142] mtd: mtdpart: fix add_mtd_partitions error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 016/142] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 012/142] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 013/142] spi: ti-qspi: Fix data corruption seen on r/w stress test Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 008/142] ocfs2/dlm: ignore cleaning the migration mle that is inuse Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 015/142] wlcore/wl12xx: spi: fix oops on firmware load Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7  Next page →

#1341803 — [PATCH 3.12 074/142] tty: remove platform_sysrq_reset_seq

From: Arnd Bergmann <arnd@arndb.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit ffb6e0c9a0572f8e5f8e9337a1b40ac2ec1493a1 upstream.

The platform_sysrq_reset_seq code was intended as a way for an embedded
platform to provide its own sysrq sequence at compile time. After over two
years, nobody has started using it in an upstream kernel, and the platforms
that were interested in it have moved on to devicetree, which can be used
to configure the sequence without requiring kernel changes. The method is
also incompatible with the way that most architectures build support for
multiple platforms into a single kernel.

Now the code is producing warnings when built with gcc-5.1:

drivers/tty/sysrq.c: In function 'sysrq_init':
drivers/tty/sysrq.c:959:33: warning: array subscript is above array bounds [-Warray-bounds]
   key = platform_sysrq_reset_seq[i];

We could fix this, but it seems unlikely that it will ever be used, so
let's just remove the code instead. We still have the option to pass the
sequence either in DT, using the kernel command line, or using the
/sys/module/sysrq/parameters/reset_seq file.

Fixes: 154b7a489a ("Input: sysrq - allow specifying alternate reset sequence")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/tty/sysrq.c | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 40a9fe9d3b10..3b9b80856c1b 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -54,9 +54,6 @@
 static int __read_mostly sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 static bool __read_mostly sysrq_always_enabled;
 
-unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
-int sysrq_reset_downtime_ms __weak;
-
 static bool sysrq_on(void)
 {
 	return sysrq_enabled || sysrq_always_enabled;
@@ -565,6 +562,7 @@ void handle_sysrq(int key)
 EXPORT_SYMBOL(handle_sysrq);
 
 #ifdef CONFIG_INPUT
+static int sysrq_reset_downtime_ms;
 
 /* Simple translation table for the SysRq keys */
 static const unsigned char sysrq_xlate[KEY_CNT] =
@@ -945,23 +943,8 @@ static bool sysrq_handler_registered;
 
 static inline void sysrq_register_handler(void)
 {
-	unsigned short key;
 	int error;
-	int i;
-
-	/* First check if a __weak interface was instantiated. */
-	for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) {
-		key = platform_sysrq_reset_seq[i];
-		if (key == KEY_RESERVED || key > KEY_MAX)
-			break;
-
-		sysrq_reset_seq[sysrq_reset_seq_len++] = key;
-	}
 
-	/*
-	 * DT configuration takes precedence over anything that would
-	 * have been defined via the __weak interface.
-	 */
 	sysrq_of_get_keyreset_config();
 
 	error = input_register_handler(&sysrq_handler);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341804 — [PATCH 3.12 077/142] ALSA: seq: Fix double port list deletion

From: Takashi Iwai <tiwai@suse.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 13d5e5d4725c64ec06040d636832e78453f477b7 upstream.

The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to
double mutex locks] split the management of two linked lists (source
and destination) into two individual calls for avoiding the AB/BA
deadlock.  However, this may leave the possible double deletion of one
of two lists when the counterpart is being deleted concurrently.
It ends up with a list corruption, as revealed by syzkaller fuzzer.

This patch fixes it by checking the list emptiness and skipping the
deletion and the following process.

BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com
Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks)
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/core/seq/seq_ports.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 67c91d226552..ee0522a8f730 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -540,19 +540,22 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
 					bool is_src, bool ack)
 {
 	struct snd_seq_port_subs_info *grp;
+	struct list_head *list;
+	bool empty;
 
 	grp = is_src ? &port->c_src : &port->c_dest;
+	list = is_src ? &subs->src_list : &subs->dest_list;
 	down_write(&grp->list_mutex);
 	write_lock_irq(&grp->list_lock);
-	if (is_src)
-		list_del(&subs->src_list);
-	else
-		list_del(&subs->dest_list);
+	empty = list_empty(list);
+	if (!empty)
+		list_del_init(list);
 	grp->exclusive = 0;
 	write_unlock_irq(&grp->list_lock);
 	up_write(&grp->list_mutex);
 
-	unsubscribe_port(client, port, grp, &subs->info, ack);
+	if (!empty)
+		unsubscribe_port(client, port, grp, &subs->info, ack);
 }
 
 /* connect two ports */
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341805 — [PATCH 3.12 062/142] crypto: af_alg - Add nokey compatibility path

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 37766586c965d63758ad542325a96d5384f4a8c9 upstream.

This patch adds a compatibility path to support old applications
that do acept(2) before setkey.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/af_alg.c         | 13 ++++++++++++-
 include/crypto/if_alg.h |  2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 0ca108f3c840..de130c24a64b 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af_alg_type *type)
 		goto unlock;
 
 	type->ops->owner = THIS_MODULE;
+	if (type->ops_nokey)
+		type->ops_nokey->owner = THIS_MODULE;
 	node->type = type;
 	list_add(&node->list, &alg_types);
 	err = 0;
@@ -257,6 +259,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 	const struct af_alg_type *type;
 	struct sock *sk2;
 	int err;
+	bool nokey;
 
 	lock_sock(sk);
 	type = ask->type;
@@ -275,12 +278,17 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 	security_sk_clone(sk, sk2);
 
 	err = type->accept(ask->private, sk2);
+
+	nokey = err == -ENOKEY;
+	if (nokey && type->accept_nokey)
+		err = type->accept_nokey(ask->private, sk2);
+
 	if (err)
 		goto unlock;
 
 	sk2->sk_family = PF_ALG;
 
-	if (!ask->refcnt++)
+	if (nokey || !ask->refcnt++)
 		sock_hold(sk);
 	alg_sk(sk2)->parent = sk;
 	alg_sk(sk2)->type = type;
@@ -288,6 +296,9 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 	newsock->ops = type->ops;
 	newsock->state = SS_CONNECTED;
 
+	if (nokey)
+		newsock->ops = type->ops_nokey;
+
 	err = 0;
 
 unlock:
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index 2f38daaab3d7..9e6a2f38c52f 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -51,8 +51,10 @@ struct af_alg_type {
 	void (*release)(void *private);
 	int (*setkey)(void *private, const u8 *key, unsigned int keylen);
 	int (*accept)(void *private, struct sock *sk);
+	int (*accept_nokey)(void *private, struct sock *sk);
 
 	struct proto_ops *ops;
+	struct proto_ops *ops_nokey;
 	struct module *owner;
 	char name[14];
 };
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341806 — [PATCH 3.12 081/142] pty: fix possible use after free of tty->driver_data

From: "Herton R. Krzesinski" <herton@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 2831c89f42dcde440cfdccb9fee9f42d54bbc1ef upstream.

This change fixes a bug for a corner case where we have the the last
release from a pty master/slave coming from a previously opened /dev/tty
file. When this happens, the tty->driver_data can be stale, due to all
ptmx or pts/N files having already been closed before (and thus the inode
related to these files, which tty->driver_data points to, being already
freed/destroyed).

The fix here is to keep a reference on the opened master ptmx inode.
We maintain the inode referenced until the final pty_unix98_shutdown,
and only pass this inode to devpts_kill_index.

Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/tty/pty.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index e49616eeb1cc..5f37f0ddf7b9 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -617,7 +617,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 /* this is called once with whichever end is closed last */
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
-	devpts_kill_index(tty->driver_data, tty->index);
+	struct inode *ptmx_inode;
+
+	if (tty->driver->subtype == PTY_TYPE_MASTER)
+		ptmx_inode = tty->driver_data;
+	else
+		ptmx_inode = tty->link->driver_data;
+	devpts_kill_index(ptmx_inode, tty->index);
+	iput(ptmx_inode); /* drop reference we acquired at ptmx_open */
 }
 
 static const struct tty_operations ptm_unix98_ops = {
@@ -708,6 +715,15 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 	set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
 	tty->driver_data = inode;
 
+	/*
+	 * In the case where all references to ptmx inode are dropped and we
+	 * still have /dev/tty opened pointing to the master/slave pair (ptmx
+	 * is closed/released before /dev/tty), we must make sure that the inode
+	 * is still valid when we call the final pty_unix98_shutdown, thus we
+	 * hold an additional reference to the ptmx inode
+	 */
+	ihold(inode);
+
 	tty_add_file(tty, filp);
 
 	slave_inode = devpts_pty_new(inode,
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341807 — [PATCH 3.12 073/142] binfmt_elf: Don't clobber passed executable's file header

From: "Maciej W. Rozycki" <macro@imgtec.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream.

Do not clobber the buffer space passed from `search_binary_handler' and
originally preloaded by `prepare_binprm' with the executable's file
header by overwriting it with its interpreter's file header.  Instead
keep the buffer space intact and directly use the data structure locally
allocated for the interpreter's file header, fixing a bug introduced in
2.1.14 with loadable module support (linux-mips.org commit beb11695
[Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).
Adjust the amount of data read from the interpreter's file accordingly.

This was not an issue before loadable module support, because back then
`load_elf_binary' was executed only once for a given ELF executable,
whether the function succeeded or failed.

With loadable module support supported and enabled, upon a failure of
`load_elf_binary' -- which may for example be caused by architecture
code rejecting an executable due to a missing hardware feature requested
in the file header -- a module load is attempted and then the function
reexecuted by `search_binary_handler'.  With the executable's file
header replaced with its interpreter's file header the executable can
then be erroneously accepted in this subsequent attempt.

Signed-off-by: Maciej W. Rozycki <macro@imgtec.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/binfmt_elf.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index d872fda15539..00fb056a6714 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -682,16 +682,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
 			 */
 			would_dump(bprm, interpreter);
 
-			retval = kernel_read(interpreter, 0, bprm->buf,
-					     BINPRM_BUF_SIZE);
-			if (retval != BINPRM_BUF_SIZE) {
+			/* Get the exec headers */
+			retval = kernel_read(interpreter, 0,
+					     (void *)&loc->interp_elf_ex,
+					     sizeof(loc->interp_elf_ex));
+			if (retval != sizeof(loc->interp_elf_ex)) {
 				if (retval >= 0)
 					retval = -EIO;
 				goto out_free_dentry;
 			}
 
-			/* Get the exec headers */
-			loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 			break;
 		}
 		elf_ppnt++;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341808 — [PATCH 3.12 060/142] crypto: af_alg - Disallow bind/setkey/... after accept(2)

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.

Each af_alg parent socket obtained by socket(2) corresponds to a
tfm object once bind(2) has succeeded.  An accept(2) call on that
parent socket creates a context which then uses the tfm object.

Therefore as long as any child sockets created by accept(2) exist
the parent socket must not be modified or freed.

This patch guarantees this by using locks and a reference count
on the parent socket.  Any attempt to modify the parent socket will
fail with EBUSY.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/af_alg.c         | 35 ++++++++++++++++++++++++++++++++---
 include/crypto/if_alg.h |  8 +++-----
 2 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 6ef6e2ad344e..d7fefeb3d1a7 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -125,6 +125,23 @@ int af_alg_release(struct socket *sock)
 }
 EXPORT_SYMBOL_GPL(af_alg_release);
 
+void af_alg_release_parent(struct sock *sk)
+{
+	struct alg_sock *ask = alg_sk(sk);
+	bool last;
+
+	sk = ask->parent;
+	ask = alg_sk(sk);
+
+	lock_sock(sk);
+	last = !--ask->refcnt;
+	release_sock(sk);
+
+	if (last)
+		sock_put(sk);
+}
+EXPORT_SYMBOL_GPL(af_alg_release_parent);
+
 static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
@@ -132,6 +149,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 	struct sockaddr_alg *sa = (void *)uaddr;
 	const struct af_alg_type *type;
 	void *private;
+	int err;
 
 	if (sock->state == SS_CONNECTED)
 		return -EINVAL;
@@ -157,16 +175,22 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 		return PTR_ERR(private);
 	}
 
+	err = -EBUSY;
 	lock_sock(sk);
+	if (ask->refcnt)
+		goto unlock;
 
 	swap(ask->type, type);
 	swap(ask->private, private);
 
+	err = 0;
+
+unlock:
 	release_sock(sk);
 
 	alg_do_release(type, private);
 
-	return 0;
+	return err;
 }
 
 static int alg_setkey(struct sock *sk, char __user *ukey,
@@ -199,11 +223,15 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
 	const struct af_alg_type *type;
-	int err = -ENOPROTOOPT;
+	int err = -EBUSY;
 
 	lock_sock(sk);
+	if (ask->refcnt)
+		goto unlock;
+
 	type = ask->type;
 
+	err = -ENOPROTOOPT;
 	if (level != SOL_ALG || !type)
 		goto unlock;
 
@@ -254,7 +282,8 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 
 	sk2->sk_family = PF_ALG;
 
-	sock_hold(sk);
+	if (!ask->refcnt++)
+		sock_hold(sk);
 	alg_sk(sk2)->parent = sk;
 	alg_sk(sk2)->type = type;
 
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index d61c11170213..2f38daaab3d7 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -30,6 +30,8 @@ struct alg_sock {
 
 	struct sock *parent;
 
+	unsigned int refcnt;
+
 	const struct af_alg_type *type;
 	void *private;
 };
@@ -64,6 +66,7 @@ int af_alg_register_type(const struct af_alg_type *type);
 int af_alg_unregister_type(const struct af_alg_type *type);
 
 int af_alg_release(struct socket *sock);
+void af_alg_release_parent(struct sock *sk);
 int af_alg_accept(struct sock *sk, struct socket *newsock);
 
 int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
@@ -80,11 +83,6 @@ static inline struct alg_sock *alg_sk(struct sock *sk)
 	return (struct alg_sock *)sk;
 }
 
-static inline void af_alg_release_parent(struct sock *sk)
-{
-	sock_put(alg_sk(sk)->parent);
-}
-
 static inline void af_alg_init_completion(struct af_alg_completion *completion)
 {
 	init_completion(&completion->completion);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341809 — [PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address

From: Matt Fleming <matt@codeblueprint.co.uk>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 742563777e8da62197d6cb4b99f4027f59454735 upstream.

There are a couple of nasty truncation bugs lurking in the pageattr
code that can be triggered when mapping EFI regions, e.g. when we pass
a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting
left by PAGE_SHIFT will truncate the resultant address to 32-bits.

Viorel-Cătălin managed to trigger this bug on his Dell machine that
provides a ~5GB EFI region which requires 1236992 pages to be mapped.
When calling populate_pud() the end of the region gets calculated
incorrectly in the following buggy expression,

  end = start + (cpa->numpages << PAGE_SHIFT);

And only 188416 pages are mapped. Next, populate_pud() gets invoked
for a second time because of the loop in __change_page_attr_set_clr(),
only this time no pages get mapped because shifting the remaining
number of pages (1048576) by PAGE_SHIFT is zero. At which point the
loop in __change_page_attr_set_clr() spins forever because we fail to
map progress.

Hitting this bug depends very much on the virtual address we pick to
map the large region at and how many pages we map on the initial run
through the loop. This explains why this issue was only recently hit
with the introduction of commit

  a5caa209ba9c ("x86/efi: Fix boot crash by mapping EFI memmap
   entries bottom-up at runtime, instead of top-down")

It's interesting to note that safe uses of cpa->numpages do exist in
the pageattr code. If instead of shifting ->numpages we multiply by
PAGE_SIZE, no truncation occurs because PAGE_SIZE is a UL value, and
so the result is unsigned long.

To avoid surprises when users try to convert very large cpa->numpages
values to addresses, change the data type from 'int' to 'unsigned
long', thereby making it suitable for shifting by PAGE_SHIFT without
any type casting.

The alternative would be to make liberal use of casting, but that is
far more likely to cause problems in the future when someone adds more
code and fails to cast properly; this bug was difficult enough to
track down in the first place.

Reported-and-tested-by: Viorel-Cătălin Răpițeanu <rapiteanu.catalin@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=110131
Link: http://lkml.kernel.org/r/1454067370-10374-1-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/mm/pageattr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index aabdf762f592..0fcd960b382a 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -32,7 +32,7 @@ struct cpa_data {
 	unsigned long	*vaddr;
 	pgprot_t	mask_set;
 	pgprot_t	mask_clr;
-	int		numpages;
+	unsigned long	numpages;
 	int		flags;
 	unsigned long	pfn;
 	unsigned	force_split : 1;
@@ -884,7 +884,7 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
 		 * CPA operation. Either a large page has been
 		 * preserved or a single page update happened.
 		 */
-		BUG_ON(cpa->numpages > numpages);
+		BUG_ON(cpa->numpages > numpages || !cpa->numpages);
 		numpages -= cpa->numpages;
 		if (cpa->flags & (CPA_PAGES_ARRAY | CPA_ARRAY))
 			cpa->curpage++;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341810 — [PATCH 3.12 002/142] pipe: Fix buffer offset after partially failed read

From: Ben Hutchings <ben@decadent.org.uk>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

Quoting the RHEL advisory:

> It was found that the fix for CVE-2015-1805 incorrectly kept buffer
> offset and buffer length in sync on a failed atomic read, potentially
> resulting in a pipe buffer state corruption. A local, unprivileged user
> could use this flaw to crash the system or leak kernel memory to user
> space. (CVE-2016-0774, Moderate)

The same flawed fix was applied to stable branches from 2.6.32.y to
3.14.y inclusive, and I was able to reproduce the issue on 3.2.y.
We need to give pipe_iov_copy_to_user() a separate offset variable
and only update the buffer offset if it succeeds.

References: https://rhn.redhat.com/errata/RHSA-2016-0103.html
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/pipe.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 3e7ab278bb0c..50267e6ba688 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -401,6 +401,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 			void *addr;
 			size_t chars = buf->len, remaining;
 			int error, atomic;
+			int offset;
 
 			if (chars > total_len)
 				chars = total_len;
@@ -414,9 +415,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 
 			atomic = !iov_fault_in_pages_write(iov, chars);
 			remaining = chars;
+			offset = buf->offset;
 redo:
 			addr = ops->map(pipe, buf, atomic);
-			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
+			error = pipe_iov_copy_to_user(iov, addr, &offset,
 						      &remaining, atomic);
 			ops->unmap(pipe, buf, addr);
 			if (unlikely(error)) {
@@ -432,6 +434,7 @@ redo:
 				break;
 			}
 			ret += chars;
+			buf->offset += chars;
 			buf->len -= chars;
 
 			/* Was it a packet buffer? Clean up and exit */
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341813 — [PATCH 3.12 064/142] crypto: hash - Add crypto_ahash_has_setkey

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit a5596d6332787fd383b3b5427b41f94254430827 upstream.

This patch adds a way for ahash users to determine whether a key
is required by a crypto_ahash transform.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/ahash.c        | 5 ++++-
 crypto/shash.c        | 4 +++-
 include/crypto/hash.h | 7 +++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/crypto/ahash.c b/crypto/ahash.c
index 857ae2b2a2a2..b246858ca032 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -369,6 +369,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
 	struct ahash_alg *alg = crypto_ahash_alg(hash);
 
 	hash->setkey = ahash_nosetkey;
+	hash->has_setkey = false;
 	hash->export = ahash_no_export;
 	hash->import = ahash_no_import;
 
@@ -381,8 +382,10 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
 	hash->finup = alg->finup ?: ahash_def_finup;
 	hash->digest = alg->digest;
 
-	if (alg->setkey)
+	if (alg->setkey) {
 		hash->setkey = alg->setkey;
+		hash->has_setkey = true;
+	}
 	if (alg->export)
 		hash->export = alg->export;
 	if (alg->import)
diff --git a/crypto/shash.c b/crypto/shash.c
index 929058a68561..8e4256aae963 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -354,8 +354,10 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
 	crt->finup = shash_async_finup;
 	crt->digest = shash_async_digest;
 
-	if (alg->setkey)
+	if (alg->setkey) {
 		crt->setkey = shash_async_setkey;
+		crt->has_setkey = true;
+	}
 	if (alg->export)
 		crt->export = shash_async_export;
 	if (alg->import)
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index 26cb1eb16f4c..4bdd795dfaf9 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -94,6 +94,7 @@ struct crypto_ahash {
 		      unsigned int keylen);
 
 	unsigned int reqsize;
+	bool has_setkey;
 	struct crypto_tfm base;
 };
 
@@ -181,6 +182,12 @@ static inline void *ahash_request_ctx(struct ahash_request *req)
 
 int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
 			unsigned int keylen);
+
+static inline bool crypto_ahash_has_setkey(struct crypto_ahash *tfm)
+{
+	return tfm->has_setkey;
+}
+
 int crypto_ahash_finup(struct ahash_request *req);
 int crypto_ahash_final(struct ahash_request *req);
 int crypto_ahash_digest(struct ahash_request *req);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341814 — [PATCH 3.12 063/142] crypto: algif_skcipher - Add nokey compatibility path

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit a0fa2d037129a9849918a92d91b79ed6c7bd2818 upstream.

This patch adds a compatibility path to support old applications
that do acept(2) before setkey.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/algif_skcipher.c | 149 ++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 144 insertions(+), 5 deletions(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 377010cee09b..4456ec8c94a1 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -549,6 +549,99 @@ static struct proto_ops algif_skcipher_ops = {
 	.poll		=	skcipher_poll,
 };
 
+static int skcipher_check_key(struct socket *sock)
+{
+	int err;
+	struct sock *psk;
+	struct alg_sock *pask;
+	struct skcipher_tfm *tfm;
+	struct sock *sk = sock->sk;
+	struct alg_sock *ask = alg_sk(sk);
+
+	if (ask->refcnt)
+		return 0;
+
+	psk = ask->parent;
+	pask = alg_sk(ask->parent);
+	tfm = pask->private;
+
+	err = -ENOKEY;
+	lock_sock(psk);
+	if (!tfm->has_key)
+		goto unlock;
+
+	if (!pask->refcnt++)
+		sock_hold(psk);
+
+	ask->refcnt = 1;
+	sock_put(psk);
+
+	err = 0;
+
+unlock:
+	release_sock(psk);
+
+	return err;
+}
+
+static int skcipher_sendmsg_nokey(struct kiocb *unused, struct socket *sock,
+				  struct msghdr *msg, size_t size)
+{
+	int err;
+
+	err = skcipher_check_key(sock);
+	if (err)
+		return err;
+
+	return skcipher_sendmsg(NULL, sock, msg, size);
+}
+
+static ssize_t skcipher_sendpage_nokey(struct socket *sock, struct page *page,
+				       int offset, size_t size, int flags)
+{
+	int err;
+
+	err = skcipher_check_key(sock);
+	if (err)
+		return err;
+
+	return skcipher_sendpage(sock, page, offset, size, flags);
+}
+
+static int skcipher_recvmsg_nokey(struct kiocb *unused, struct socket *sock,
+				  struct msghdr *msg, size_t ignored, int flags)
+{
+	int err;
+
+	err = skcipher_check_key(sock);
+	if (err)
+		return err;
+
+	return skcipher_recvmsg(NULL, sock, msg, ignored, flags);
+}
+
+static struct proto_ops algif_skcipher_ops_nokey = {
+	.family		=	PF_ALG,
+
+	.connect	=	sock_no_connect,
+	.socketpair	=	sock_no_socketpair,
+	.getname	=	sock_no_getname,
+	.ioctl		=	sock_no_ioctl,
+	.listen		=	sock_no_listen,
+	.shutdown	=	sock_no_shutdown,
+	.getsockopt	=	sock_no_getsockopt,
+	.mmap		=	sock_no_mmap,
+	.bind		=	sock_no_bind,
+	.accept		=	sock_no_accept,
+	.setsockopt	=	sock_no_setsockopt,
+
+	.release	=	af_alg_release,
+	.sendmsg	=	skcipher_sendmsg_nokey,
+	.sendpage	=	skcipher_sendpage_nokey,
+	.recvmsg	=	skcipher_recvmsg_nokey,
+	.poll		=	skcipher_poll,
+};
+
 static void *skcipher_bind(const char *name, u32 type, u32 mask)
 {
 	struct skcipher_tfm *tfm;
@@ -588,7 +681,7 @@ static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
 	return err;
 }
 
-static void skcipher_sock_destruct(struct sock *sk)
+static void skcipher_sock_destruct_common(struct sock *sk)
 {
 	struct alg_sock *ask = alg_sk(sk);
 	struct skcipher_ctx *ctx = ask->private;
@@ -597,10 +690,33 @@ static void skcipher_sock_destruct(struct sock *sk)
 	skcipher_free_sgl(sk);
 	sock_kfree_s(sk, ctx->iv, crypto_ablkcipher_ivsize(tfm));
 	sock_kfree_s(sk, ctx, ctx->len);
+}
+
+static void skcipher_sock_destruct(struct sock *sk)
+{
+	skcipher_sock_destruct_common(sk);
 	af_alg_release_parent(sk);
 }
 
-static int skcipher_accept_parent(void *private, struct sock *sk)
+static void skcipher_release_parent_nokey(struct sock *sk)
+{
+	struct alg_sock *ask = alg_sk(sk);
+
+	if (!ask->refcnt) {
+		sock_put(ask->parent);
+		return;
+	}
+
+	af_alg_release_parent(sk);
+}
+
+static void skcipher_sock_destruct_nokey(struct sock *sk)
+{
+	skcipher_sock_destruct_common(sk);
+	skcipher_release_parent_nokey(sk);
+}
+
+static int skcipher_accept_parent_common(void *private, struct sock *sk)
 {
 	struct skcipher_ctx *ctx;
 	struct alg_sock *ask = alg_sk(sk);
@@ -608,9 +724,6 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 	struct crypto_ablkcipher *skcipher = tfm->skcipher;
 	unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(skcipher);
 
-	if (!tfm->has_key)
-		return -ENOKEY;
-
 	ctx = sock_kmalloc(sk, len, GFP_KERNEL);
 	if (!ctx)
 		return -ENOMEM;
@@ -643,12 +756,38 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 	return 0;
 }
 
+static int skcipher_accept_parent(void *private, struct sock *sk)
+{
+	struct skcipher_tfm *tfm = private;
+
+	if (!tfm->has_key)
+		return -ENOKEY;
+
+	return skcipher_accept_parent_common(private, sk);
+}
+
+static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+{
+	int err;
+
+	err = skcipher_accept_parent_common(private, sk);
+	if (err)
+		goto out;
+
+	sk->sk_destruct = skcipher_sock_destruct_nokey;
+
+out:
+	return err;
+}
+
 static const struct af_alg_type algif_type_skcipher = {
 	.bind		=	skcipher_bind,
 	.release	=	skcipher_release,
 	.setkey		=	skcipher_setkey,
 	.accept		=	skcipher_accept_parent,
+	.accept_nokey	=	skcipher_accept_parent_nokey,
 	.ops		=	&algif_skcipher_ops,
+	.ops_nokey	=	&algif_skcipher_ops_nokey,
 	.name		=	"skcipher",
 	.owner		=	THIS_MODULE
 };
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341815 — [PATCH 3.12 072/142] FS-Cache: Don't override netfs's primary_index if registering failed

From: Kinglong Mee <kinglongmee@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b130ed5998e62879a66bad08931a2b5e832da95c upstream.

Only override netfs->primary_index when registering success.

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/fscache/netfs.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index 04e18d28013b..1cc98088001f 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list);
 int __fscache_register_netfs(struct fscache_netfs *netfs)
 {
 	struct fscache_netfs *ptr;
+	struct fscache_cookie *cookie;
 	int ret;
 
 	_enter("{%s}", netfs->name);
@@ -29,25 +30,24 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 	INIT_LIST_HEAD(&netfs->link);
 
 	/* allocate a cookie for the primary index */
-	netfs->primary_index =
-		kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
+	cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
 
-	if (!netfs->primary_index) {
+	if (!cookie) {
 		_leave(" = -ENOMEM");
 		return -ENOMEM;
 	}
 
 	/* initialise the primary index cookie */
-	atomic_set(&netfs->primary_index->usage, 1);
-	atomic_set(&netfs->primary_index->n_children, 0);
-	atomic_set(&netfs->primary_index->n_active, 1);
+	atomic_set(&cookie->usage, 1);
+	atomic_set(&cookie->n_children, 0);
+	atomic_set(&cookie->n_active, 1);
 
-	netfs->primary_index->def		= &fscache_fsdef_netfs_def;
-	netfs->primary_index->parent		= &fscache_fsdef_index;
-	netfs->primary_index->netfs_data	= netfs;
+	cookie->def		= &fscache_fsdef_netfs_def;
+	cookie->parent		= &fscache_fsdef_index;
+	cookie->netfs_data	= netfs;
 
-	spin_lock_init(&netfs->primary_index->lock);
-	INIT_HLIST_HEAD(&netfs->primary_index->backing_objects);
+	spin_lock_init(&cookie->lock);
+	INIT_HLIST_HEAD(&cookie->backing_objects);
 
 	/* check the netfs type is not already present */
 	down_write(&fscache_addremove_sem);
@@ -58,9 +58,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 			goto already_registered;
 	}
 
-	atomic_inc(&netfs->primary_index->parent->usage);
-	atomic_inc(&netfs->primary_index->parent->n_children);
+	atomic_inc(&cookie->parent->usage);
+	atomic_inc(&cookie->parent->n_children);
 
+	netfs->primary_index = cookie;
 	list_add(&netfs->link, &fscache_netfs_list);
 	ret = 0;
 
@@ -70,10 +71,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 already_registered:
 	up_write(&fscache_addremove_sem);
 
-	if (ret < 0) {
-		kmem_cache_free(fscache_cookie_jar, netfs->primary_index);
-		netfs->primary_index = NULL;
-	}
+	if (ret < 0)
+		kmem_cache_free(fscache_cookie_jar, cookie);
 
 	_leave(" = %d", ret);
 	return ret;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341816 — [PATCH 3.12 078/142] phy: twl4030-usb: Relase usb phy on unload

From: Tony Lindgren <tony@atomide.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b241d31ef2f6a289d33dcaa004714b26e06f476f upstream.

Otherwise rmmod omap2430; rmmod phy-twl4030-usb; modprobe omap2430
will try to use a non-existing phy and oops:

Unable to handle kernel paging request at virtual address b6f7c1f0
...
[<c048a284>] (devm_usb_get_phy_by_node) from [<bf0758ac>]
(omap2430_musb_init+0x44/0x2b4 [omap2430])
[<bf0758ac>] (omap2430_musb_init [omap2430]) from [<bf055ec0>]
(musb_init_controller+0x194/0x878 [musb_hdrc])

Cc: Bin Liu <b-liu@ti.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Cc: NeilBrown <neil@brown.name>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/usb/phy/phy-twl4030-usb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/phy/phy-twl4030-usb.c b/drivers/usb/phy/phy-twl4030-usb.c
index 90730c8762b8..cb91d05fd177 100644
--- a/drivers/usb/phy/phy-twl4030-usb.c
+++ b/drivers/usb/phy/phy-twl4030-usb.c
@@ -732,6 +732,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
 	struct twl4030_usb *twl = platform_get_drvdata(pdev);
 	int val;
 
+	usb_remove_phy(&twl->phy);
 	cancel_delayed_work(&twl->id_workaround_work);
 	device_remove_file(twl->dev, &dev_attr_vbus);
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341817 — [PATCH 3.12 070/142] crypto: user - lock crypto_alg_list on alg dump

From: Mathias Krause <minipli@googlemail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.

We miss to take the crypto_alg_sem semaphore when traversing the
crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with
crypto_unregister_alg() removing algorithms from the list while we're
still traversing it, thereby leading to a use-after-free as show below:

[ 3482.071639] general protection fault: 0000 [#1] SMP
[ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel]
[ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126
[ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8
[ 3482.075639] RIP: 0010:[<ffffffff93722bd3>]  [<ffffffff93722bd3>] strncpy+0x13/0x30
[ 3482.075639] RSP: 0018:ffff88001f713b60  EFLAGS: 00010202
[ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430
[ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430
[ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480
[ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28
[ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20
[ 3482.075639] FS:  0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000
[ 3482.075639] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0
[ 3482.075639] Stack:
[ 3482.075639]  ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700
[ 3482.075639]  ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20
[ 3482.075639]  ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20
[ 3482.075639] Call Trace:
[ 3482.075639]  [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0
[ 3482.075639]  [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300
[ 3482.075639]  [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90
[ 3482.075639]  [<ffffffff93935707>] netlink_dump+0x147/0x2e0
[ 3482.075639]  [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190
[ 3482.075639]  [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130
[ 3482.075639]  [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0
[ 3482.075639]  [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120
[ 3482.075639]  [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120
[ 3482.075639]  [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0
[ 3482.075639]  [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130
[ 3482.075639]  [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40
[ 3482.075639]  [<ffffffff939375a8>] netlink_unicast+0x108/0x180
[ 3482.075639]  [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770
[ 3482.075639]  [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40
[ 3482.075639]  [<ffffffff938e4763>] SyS_sendto+0xf3/0x130
[ 3482.075639]  [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20
[ 3482.075639]  [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0
[ 3482.075639]  [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e
[ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb
[ 3482.075639] RIP  [<ffffffff93722bd3>] strncpy+0x13/0x30

To trigger the race run the following loops simultaneously for a while:
  $ while : ; do modprobe aesni-intel; rmmod aesni-intel; done
  $ while : ; do crconf show all > /dev/null; done

Fix the race by taking the crypto_alg_sem read lock, thereby preventing
crypto_unregister_alg() from modifying the algorithm list during the
dump.

This bug has been detected by the PaX memory sanitize feature.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: PaX Team <pageexec@freemail.hu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/crypto_user.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index c7666f401381..a3dfc0d83107 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -477,6 +477,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 		if (link->dump == NULL)
 			return -EINVAL;
 
+		down_read(&crypto_alg_sem);
 		list_for_each_entry(alg, &crypto_alg_list, cra_list)
 			dump_alloc += CRYPTO_REPORT_MAXSIZE;
 
@@ -486,8 +487,11 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 				.done = link->done,
 				.min_dump_alloc = dump_alloc,
 			};
-			return netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+			err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
 		}
+		up_read(&crypto_alg_sem);
+
+		return err;
 	}
 
 	err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341819 — [PATCH 3.12 080/142] staging/speakup: Use tty_ldisc_ref() for paste kworker

From: Peter Hurley <peter@hurleysoftware.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit f4f9edcf9b5289ed96113e79fa65a7bf27ecb096 upstream.

As the function documentation for tty_ldisc_ref_wait() notes, it is
only callable from a tty file_operations routine; otherwise there
is no guarantee the ref won't be NULL.

The key difference with the VT's paste_selection() is that is an ioctl,
where __speakup_paste_selection() is completely async kworker, kicked
off from interrupt context.

Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
       tty (ab)usage to match vt")
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/staging/speakup/selection.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
index ca04d3669acc..34a6deef1d6c 100644
--- a/drivers/staging/speakup/selection.c
+++ b/drivers/staging/speakup/selection.c
@@ -140,7 +140,9 @@ static void __speakup_paste_selection(struct work_struct *work)
 	struct tty_ldisc *ld;
 	DECLARE_WAITQUEUE(wait, current);
 
-	ld = tty_ldisc_ref_wait(tty);
+	ld = tty_ldisc_ref(tty);
+	if (!ld)
+		goto tty_unref;
 	tty_buffer_lock_exclusive(&vc->port);
 
 	add_wait_queue(&vc->paste_wait, &wait);
@@ -160,6 +162,7 @@ static void __speakup_paste_selection(struct work_struct *work)
 
 	tty_buffer_unlock_exclusive(&vc->port);
 	tty_ldisc_deref(ld);
+tty_unref:
 	tty_kref_put(tty);
 }
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341821 — [PATCH 3.12 061/142] crypto: af_alg - Fix socket double-free when accept fails

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.

When we fail an accept(2) call we will end up freeing the socket
twice, once due to the direct sk_free call and once again through
newsock.

This patch fixes this by removing the sk_free call.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/af_alg.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index d7fefeb3d1a7..0ca108f3c840 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -275,10 +275,8 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 	security_sk_clone(sk, sk2);
 
 	err = type->accept(ask->private, sk2);
-	if (err) {
-		sk_free(sk2);
+	if (err)
 		goto unlock;
-	}
 
 	sk2->sk_family = PF_ALG;
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341822 — [PATCH 3.12 071/142] FS-Cache: Increase reference of parent after registering, netfs success

From: Kinglong Mee <kinglongmee@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 86108c2e34a26e4bec3c6ddb23390bf8cedcf391 upstream.

If netfs exist, fscache should not increase the reference of parent's
usage and n_children, otherwise, never be decreased.

v2: thanks David's suggest,
 move increasing reference of parent if success
 use kmem_cache_free() freeing primary_index directly

v3: don't move "netfs->primary_index->parent = &fscache_fsdef_index;"

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/fscache/netfs.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index b1bb6117473a..04e18d28013b 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -46,9 +46,6 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 	netfs->primary_index->parent		= &fscache_fsdef_index;
 	netfs->primary_index->netfs_data	= netfs;
 
-	atomic_inc(&netfs->primary_index->parent->usage);
-	atomic_inc(&netfs->primary_index->parent->n_children);
-
 	spin_lock_init(&netfs->primary_index->lock);
 	INIT_HLIST_HEAD(&netfs->primary_index->backing_objects);
 
@@ -61,6 +58,9 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
 			goto already_registered;
 	}
 
+	atomic_inc(&netfs->primary_index->parent->usage);
+	atomic_inc(&netfs->primary_index->parent->n_children);
+
 	list_add(&netfs->link, &fscache_netfs_list);
 	ret = 0;
 
@@ -71,8 +71,7 @@ already_registered:
 	up_write(&fscache_addremove_sem);
 
 	if (ret < 0) {
-		netfs->primary_index->parent = NULL;
-		__fscache_cookie_put(netfs->primary_index);
+		kmem_cache_free(fscache_cookie_jar, netfs->primary_index);
 		netfs->primary_index = NULL;
 	}
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341823 — [PATCH 3.12 079/142] wan/x25: Fix use-after-free in x25_asy_open_tty()

From: Peter Hurley <peter@hurleysoftware.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit ee9159ddce14bc1dec9435ae4e3bd3153e783706 upstream.

The N_X25 line discipline may access the previous line discipline's closed
and already-freed private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/wan/x25_asy.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 5895f1978691..e98de425f8e0 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -545,16 +545,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty,
 
 static int x25_asy_open_tty(struct tty_struct *tty)
 {
-	struct x25_asy *sl = tty->disc_data;
+	struct x25_asy *sl;
 	int err;
 
 	if (tty->ops->write == NULL)
 		return -EOPNOTSUPP;
 
-	/* First make sure we're not already connected. */
-	if (sl && sl->magic == X25_ASY_MAGIC)
-		return -EEXIST;
-
 	/* OK.  Find a free X.25 channel to use. */
 	sl = x25_asy_alloc();
 	if (sl == NULL)
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341824 — [PATCH 3.12 059/142] crypto: algif_skcipher - Require setkey before accept(2)

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit dd504589577d8e8e70f51f997ad487a4cb6c026f upstream.

Some cipher implementations will crash if you try to use them
without calling setkey first.  This patch adds a check so that
the accept(2) call will fail with -ENOKEY if setkey hasn't been
done on the socket yet.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/algif_skcipher.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 83187f497c7c..377010cee09b 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -31,6 +31,11 @@ struct skcipher_sg_list {
 	struct scatterlist sg[0];
 };
 
+struct skcipher_tfm {
+	struct crypto_ablkcipher *skcipher;
+	bool has_key;
+};
+
 struct skcipher_ctx {
 	struct list_head tsgl;
 	struct af_alg_sgl rsgl;
@@ -546,17 +551,41 @@ static struct proto_ops algif_skcipher_ops = {
 
 static void *skcipher_bind(const char *name, u32 type, u32 mask)
 {
-	return crypto_alloc_ablkcipher(name, type, mask);
+	struct skcipher_tfm *tfm;
+	struct crypto_ablkcipher *skcipher;
+
+	tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
+	if (!tfm)
+		return ERR_PTR(-ENOMEM);
+
+	skcipher = crypto_alloc_ablkcipher(name, type, mask);
+	if (IS_ERR(skcipher)) {
+		kfree(tfm);
+		return ERR_CAST(skcipher);
+	}
+
+	tfm->skcipher = skcipher;
+
+	return tfm;
 }
 
 static void skcipher_release(void *private)
 {
-	crypto_free_ablkcipher(private);
+	struct skcipher_tfm *tfm = private;
+
+	crypto_free_ablkcipher(tfm->skcipher);
+	kfree(tfm);
 }
 
 static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
 {
-	return crypto_ablkcipher_setkey(private, key, keylen);
+	struct skcipher_tfm *tfm = private;
+	int err;
+
+	err = crypto_ablkcipher_setkey(tfm->skcipher, key, keylen);
+	tfm->has_key = !err;
+
+	return err;
 }
 
 static void skcipher_sock_destruct(struct sock *sk)
@@ -575,20 +604,25 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 {
 	struct skcipher_ctx *ctx;
 	struct alg_sock *ask = alg_sk(sk);
-	unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(private);
+	struct skcipher_tfm *tfm = private;
+	struct crypto_ablkcipher *skcipher = tfm->skcipher;
+	unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(skcipher);
+
+	if (!tfm->has_key)
+		return -ENOKEY;
 
 	ctx = sock_kmalloc(sk, len, GFP_KERNEL);
 	if (!ctx)
 		return -ENOMEM;
 
-	ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(private),
+	ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(skcipher),
 			       GFP_KERNEL);
 	if (!ctx->iv) {
 		sock_kfree_s(sk, ctx, len);
 		return -ENOMEM;
 	}
 
-	memset(ctx->iv, 0, crypto_ablkcipher_ivsize(private));
+	memset(ctx->iv, 0, crypto_ablkcipher_ivsize(skcipher));
 
 	INIT_LIST_HEAD(&ctx->tsgl);
 	ctx->len = len;
@@ -600,7 +634,7 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 
 	ask->private = ctx;
 
-	ablkcipher_request_set_tfm(&ctx->req, private);
+	ablkcipher_request_set_tfm(&ctx->req, skcipher);
 	ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
 					af_alg_complete, &ctx->completion);
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341825 — [PATCH 3.12 075/142] s390: fix normalization bug in exception table sorting

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit bcb7825a77f41c7dd91da6f7ac10b928156a322e upstream.

The normalization pass in the sorting routine of the relative exception
table serves two purposes:
- it ensures that the address fields of the exception table entries are
  fully ordered, so that no ambiguities arise between entries with
  identical instruction offsets (i.e., when two instructions that are
  exactly 8 bytes apart each have an exception table entry associated with
  them)
- it ensures that the offsets of both the instruction and the fixup fields
  of each entry are relative to their final location after sorting.

Commit eb608fb366de ("s390/exceptions: switch to relative exception table
entries") ported the relative exception table format from x86, but modified
the sorting routine to only normalize the instruction offset field and not
the fixup offset field. The result is that the fixup offset of each entry
will be relative to the original location of the entry before sorting,
likely leading to crashes when those entries are dereferenced.

Fixes: eb608fb366de ("s390/exceptions: switch to relative exception table entries")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/s390/mm/extable.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
index 4d1ee88864e8..18c8b819b0aa 100644
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start,
 	int i;
 
 	/* Normalize entries to being relative to the start of the section */
-	for (p = start, i = 0; p < finish; p++, i += 8)
+	for (p = start, i = 0; p < finish; p++, i += 8) {
 		p->insn += i;
+		p->fixup += i + 4;
+	}
 	sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
 	/* Denormalize all entries */
-	for (p = start, i = 0; p < finish; p++, i += 8)
+	for (p = start, i = 0; p < finish; p++, i += 8) {
 		p->insn -= i;
+		p->fixup -= i + 4;
+	}
 }
 
 #ifdef CONFIG_MODULES
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341826 — [PATCH 3.12 084/142] AIO: properly check iovec sizes

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

In Linus's tree, the iovec code has been reworked massively, but in
older kernels the AIO layer should be checking this before passing the
request on to other layers.

Many thanks to Ben Hawkes of Google Project Zero for pointing out the
issue.

Reported-by: Ben Hawkes <hawkes@google.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/aio.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 31a5cb74ae1f..b37e86c54a36 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1380,11 +1380,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
 				       unsigned long *nr_segs,
 				       struct iovec *iovec)
 {
-	if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes)))
+	size_t len = kiocb->ki_nbytes;
+
+	if (len > MAX_RW_COUNT)
+		len = MAX_RW_COUNT;
+
+	if (unlikely(!access_ok(!rw, buf, len)))
 		return -EFAULT;
 
 	iovec->iov_base = buf;
-	iovec->iov_len = kiocb->ki_nbytes;
+	iovec->iov_len = len;
 	*nr_segs = 1;
 	return 0;
 }
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web