Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1493275 > unrolled thread
| Started by | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| First post | 2016-09-29 12:30 +0200 |
| Last post | 2016-09-30 08:50 +0200 |
| Articles | 20 on this page of 111 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 001/119] MIPS: KVM: Check for pfn noslot case Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 057/119] drm: Reject page_flip for !DRIVER_MODESET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 013/119] usb: xhci: Fix panic if disconnect Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 010/119] usb: dwc3: gadget: increment request->actual once Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 055/119] ipv6: release dst in ping_v6_sendmsg Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 014/119] USB: serial: fix memleak in driver-registration error path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 015/119] USB: serial: option: add D-Link DWM-156/A3 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:30 +0200
[PATCH 3.12 111/119] metag: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 114/119] mn10300: copy_from_user() should zero on access_ok() failure... Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 089/119] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 098/119] score: fix __get_user/get_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 110/119] alpha: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 101/119] asm-generic: make get_user() clear the destination on errors Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 112/119] parisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 102/119] frv: fix clear_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 096/119] m32r: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 105/119] score: fix copy_from_user() and friends Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 106/119] sh: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 109/119] asm-generic: make copy_from_user() zero the destination properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 100/119] ARC: uaccess: get_user to zero out dest in cause of fault Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 093/119] microblaze: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 088/119] ARM: OMAP3: hwmod data: Add sysc information for DSI Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 091/119] microblaze: fix __get_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 062/119] x86/apic: Do not init irq remapping if ioapic is disabled Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 113/119] openrisc: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 115/119] sparc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 095/119] mn10300: failing __get_user() and get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 097/119] sh64: failing __get_user() should zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 118/119] avr32: fix 'undefined reference to `___copy_from_user' Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 090/119] crypto: cryptd - initialize child shash_desc on import Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 085/119] USB: serial: simple: add support for another Infineon flashloader Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 099/119] s390: get_user() should zero on failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 117/119] ia64: copy_from_user() should zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 084/119] iio: accel: kxsd9: Fix scaling bug Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 083/119] iio: accel: kxsd9: Fix raw read return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 116/119] ppc32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 103/119] cris: buggered copy_from_user/copy_to_user/clear_user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 092/119] avr32: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 104/119] blackfin: fix copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 108/119] mips: copy_from_user() must zero the destination on access_ok() failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 087/119] USB: change bInterval default to 10 ms Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 107/119] hexagon: fix strncpy_from_user() error return Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 094/119] fix minor infoleak in get_user_ex() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 119/119] openrisc: fix the fix of copy_from_user() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 086/119] usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:40 +0200
[PATCH 3.12 033/119] USB: serial: mos7840: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 075/119] ipvs: count pre-established TCP states as active Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 043/119] fix d_walk()/non-delayed __d_free() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 044/119] ext4: avoid modifying checksum fields directly during checksum verification Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 079/119] NFSv4.x: Fix a refcount leak in nfs_callback_up_net Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 048/119] net/irda: handle iriap_register_lsap() allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 082/119] kvm-arm: Unmap shadow pagetables properly Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 051/119] tcp: properly scale window in tcp_v[46]_reqsk_send_ack() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 039/119] ALSA: oxygen: Fix logical-not-parentheses warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 045/119] timers: Use proper base migration in add_timer_on() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 073/119] mISDN: Fixing missing validation in base_sock_bind() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 069/119] hwrng: exynos - Disable runtime PM on probe failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 071/119] HID: add usb device id for Apple Magic Keyboard Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 040/119] stb6100: fix buffer length check in stb6100_write_reg_range() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 074/119] net: disable fragment reassembly if high_thresh is set to zero Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 067/119] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 050/119] net/mlx5: Added missing check of msg length in verifying its signature Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 080/119] dm flakey: fix reads to be issued if drop_writes configured Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 070/119] Input: ili210x - fix permissions on "calibrate" attribute Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 063/119] ALSA: rawmidi: Fix possible deadlock with virmidi registration Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 072/119] mISDN: Support DR6 indication in mISDNipac driver Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 037/119] be2iscsi: Fix bogus WARN_ON length check Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 077/119] clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 038/119] HID: hid-input: Add parentheses to quell gcc warning Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 042/119] s390/sclp_ctl: fix potential information leak with /dev/sclp Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 064/119] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 035/119] ACPI / sysfs: fix error code in get_status() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 041/119] ext4: validate that metadata blocks do not overlap superblock Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 046/119] ext4: use __GFP_NOFAIL in ext4_free_blocks() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 078/119] powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 047/119] Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 065/119] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 081/119] x86/paravirt: Do not trace _paravirt_ident_*() functions Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 076/119] x86/mm/pat, /dev/mem: Remove superfluous error message Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 068/119] cpufreq: Fix GOV_LIMITS handling for the userspace governor Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 066/119] ALSA: timer: fix NULL pointer dereference on memory allocation failure Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 049/119] tcp: fix use after free in tcp_xmit_retransmit_queue() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 12:50 +0200
[PATCH 3.12 026/119] gpio: Fix OF build problem on UM Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 027/119] fs/seq_file: fix out-of-bounds read Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 024/119] cdc-acm: fix wrong pipe type on rx interrupt xfers Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 036/119] Revert "can: fix handling of unmodifiable configuration options fix" Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 021/119] s390/dasd: fix hanging device after clear subchannel Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 028/119] Input: i8042 - break load dependency between atkbd/psmouse and i8042 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 029/119] Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 031/119] USB: fix typo in wMaxPacketSize validation Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 019/119] xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices. Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 020/119] EDAC: Increment correct counter in edac_inc_ue_error() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 023/119] aacraid: Check size values after double-fetch from user Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 034/119] staging: comedi: daqboard2000: bug fix board type matching code Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 002/119] x86/mm: Disable preemption during CR3 read+write Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 022/119] mac80211: fix purging multicast PS buffer queue Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 005/119] PCI: Support PCIe devices with short cfg_size Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 016/119] USB: serial: option: add support for Telit LE920A4 Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 004/119] parisc: Fix order of EREFUSED define in errno.h Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 018/119] USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 030/119] crypto: nx - off by one bug in nx_of_update_msc() Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 025/119] megaraid_sas: Fix probing cards without io port Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 006/119] PCI: Add Netronome vendor and device IDs Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
[PATCH 3.12 032/119] USB: serial: mos7720: fix non-atomic allocation in write path Jiri Slaby <jslaby@suse.cz> - 2016-09-29 13:00 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-29 16:30 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-10-03 13:00 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-09-29 19:20 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Mike Galbraith <umgwanakikbuti@gmail.com> - 2016-09-30 07:30 +0200
Re: [PATCH 3.12 000/119] 3.12.64-stable review Jiri Slaby <jslaby@suse.cz> - 2016-09-30 08:50 +0200
Page 1 of 6 [1] 2 3 4 5 6 Next page →
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 000/119] 3.12.64-stable review |
| Message-ID | <smGLg-2Ok-35@gated-at.bofh.it> |
This is the start of the stable review cycle for the 3.12.64 release.
There are 119 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon Oct 3 12:25:22 CEST 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.64-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Al Viro (26):
microblaze: fix __get_user()
avr32: fix copy_from_user()
microblaze: fix copy_from_user()
fix minor infoleak in get_user_ex()
mn10300: failing __get_user() and get_user() should zero
m32r: fix __get_user()
sh64: failing __get_user() should zero
score: fix __get_user/get_user
s390: get_user() should zero on failure
asm-generic: make get_user() clear the destination on errors
frv: fix clear_user()
cris: buggered copy_from_user/copy_to_user/clear_user
blackfin: fix copy_from_user()
score: fix copy_from_user() and friends
sh: fix copy_from_user()
hexagon: fix strncpy_from_user() error return
mips: copy_from_user() must zero the destination on access_ok()
failure
asm-generic: make copy_from_user() zero the destination properly
alpha: fix copy_from_user()
metag: copy_from_user() should zero the destination on access_ok()
failure
parisc: fix copy_from_user()
openrisc: fix copy_from_user()
mn10300: copy_from_user() should zero on access_ok() failure...
sparc32: fix copy_from_user()
ppc32: fix copy_from_user()
ia64: copy_from_user() should zero the destination on access_ok()
failure
Alan Stern (3):
USB: validate wMaxPacketValue entries in endpoint descriptors
USB: fix typo in wMaxPacketSize validation
USB: change bInterval default to 10 ms
Alexander Shiyan (1):
stb6100: fix buffer length check in stb6100_write_reg_range()
Alexey Khoroshilov (2):
USB: serial: mos7720: fix non-atomic allocation in write path
USB: serial: mos7840: fix non-atomic allocation in write path
Alexey Klimov (1):
USB: serial: fix memleak in driver-registration error path
Ard Biesheuvel (1):
crypto: cryptd - initialize child shash_desc on import
Chen-Yu Tsai (1):
clocksource/drivers/sun4i: Clear interrupts after stopping timer in
probe function
Christian König (1):
drm/radeon: fix radeon_move_blit on 32bit systems
Daeho Jeong (1):
ext4: avoid modifying checksum fields directly during checksum
verification
Dan Carpenter (2):
crypto: nx - off by one bug in nx_of_update_msc()
ACPI / sysfs: fix error code in get_status()
Daniel Vetter (1):
drm: Reject page_flip for !DRIVER_MODESET
Daniele Palmas (2):
USB: serial: option: add support for Telit LE920A4
USB: serial: simple: add support for another Infineon flashloader
Dave Carroll (1):
aacraid: Check size values after double-fetch from user
Dave Chinner (1):
xfs: fix superblock inprogress check
Dave Jones (1):
ipv6: release dst in ping_v6_sendmsg
Dmitry Torokhov (3):
Input: i8042 - break load dependency between atkbd/psmouse and i8042
Input: i8042 - set up shared ps2_cmd_mutex for AUX ports
Input: ili210x - fix permissions on "calibrate" attribute
Emmanouil Maroudas (1):
EDAC: Increment correct counter in edac_inc_ue_error()
Emrah Demir (1):
mISDN: Fixing missing validation in base_sock_bind()
Eric Dumazet (2):
tcp: fix use after free in tcp_xmit_retransmit_queue()
tcp: properly scale window in tcp_v[46]_reqsk_send_ack()
Felipe Balbi (1):
usb: dwc3: gadget: increment request->actual once
Felix Fietkau (1):
mac80211: fix purging multicast PS buffer queue
Gavin Li (1):
cdc-acm: fix wrong pipe type on rx interrupt xfers
Greg Kroah-Hartman (1):
Revert "can: fix handling of unmodifiable configuration options fix"
Guenter Roeck (2):
avr32: fix 'undefined reference to `___copy_from_user'
openrisc: fix the fix of copy_from_user()
Helge Deller (1):
parisc: Fix order of EREFUSED define in errno.h
Ian Abbott (1):
staging: comedi: daqboard2000: bug fix board type matching code
James C Boyd (1):
HID: hid-input: Add parentheses to quell gcc warning
James Hogan (2):
MIPS: KVM: Check for pfn noslot case
arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
Jason S. McMullan (3):
PCI: Support PCIe devices with short cfg_size
PCI: Add Netronome vendor and device IDs
PCI: Limit config space size for Netronome NFP6000 family
Jean-Gabriel Gill-Couture (1):
HID: add usb device id for Apple Magic Keyboard
Jim Lin (1):
usb: xhci: Fix panic if disconnect
Jiri Kosina (1):
x86/mm/pat, /dev/mem: Remove superfluous error message
Johannes Berg (1):
Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit
Kernel"
John Stultz (1):
timekeeping: Cap array access in timekeeping_debug
Konstantin Khlebnikov (2):
ext4: use __GFP_NOFAIL in ext4_free_blocks()
net: ratelimit warnings about dst entry refcount underflow or overflow
Krzysztof Kozlowski (1):
hwrng: exynos - Disable runtime PM on probe failure
Linus Walleij (3):
gpio: Fix OF build problem on UM
iio: accel: kxsd9: Fix raw read return
iio: accel: kxsd9: Fix scaling bug
Lubomir Rintel (1):
USB: serial: option: add D-Link DWM-156/A3
Maciej S. Szmigiero (1):
mISDN: Support DR6 indication in mISDNipac driver
Mahesh Bandewar (1):
bonding: Fix bonding crash
Martin Schwidefsky (1):
s390/sclp_ctl: fix potential information leak with /dev/sclp
Mathias Nyman (2):
usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1
devices
xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices.
Michal Kubecek (2):
net: disable fragment reassembly if high_thresh is set to zero
ipvs: count pre-established TCP states as active
Mike Snitzer (1):
dm flakey: fix reads to be issued if drop_writes configured
Paul Blakey (1):
net/mlx5: Added missing check of msg length in verifying its signature
Paul Mackerras (1):
powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET
Rob Clark (1):
drm/msm: fix use of copy_from_user() while holding spinlock
Robert Deliën (1):
USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices
Sai Gurrappadi (1):
cpufreq: Fix GOV_LIMITS handling for the userspace governor
Sebastian Andrzej Siewior (1):
x86/mm: Disable preemption during CR3 read+write
Sebastian Reichel (1):
ARM: OMAP3: hwmod data: Add sysc information for DSI
Sheng-Hui J. Chu (1):
USB: serial: ftdi_sio: add device ID for WICED USB UART dev board
Simon Horman (2):
PCI: Add Netronome NFP4000 PF device ID
PCI: Limit config space size for Netronome NFP4000
Soheil Hassas Yeganeh (1):
tun: fix transmit timestamp support
Stefan Haberland (1):
s390/dasd: fix hanging device after clear subchannel
Steven Rostedt (1):
x86/paravirt: Do not trace _paravirt_ident_*() functions
Suzuki K Poulose (1):
kvm-arm: Unmap shadow pagetables properly
Takashi Iwai (1):
ALSA: rawmidi: Fix possible deadlock with virmidi registration
Tejun Heo (1):
timers: Use proper base migration in add_timer_on()
Theodore Ts'o (1):
ext4: validate that metadata blocks do not overlap superblock
Tim Gardner (1):
be2iscsi: Fix bogus WARN_ON length check
Tomer Barletz (1):
ALSA: oxygen: Fix logical-not-parentheses warning
Trond Myklebust (1):
NFSv4.x: Fix a refcount leak in nfs_callback_up_net
Tyrel Datwyler (1):
scsi: fix upper bounds check of sense key in scsi_sense_key_string()
Vegard Nossum (5):
fs/seq_file: fix out-of-bounds read
net/irda: handle iriap_register_lsap() allocation failure
ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
ALSA: timer: fix NULL pointer dereference on memory allocation failure
Vincent Stehlé (1):
ubifs: Fix assertion in layout_in_gaps()
Vineet Gupta (1):
ARC: uaccess: get_user to zero out dest in cause of fault
Wanpeng Li (1):
x86/apic: Do not init irq remapping if ioapic is disabled
Will Deacon (1):
arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb()
Willy Tarreau (1):
fix d_walk()/non-delayed __d_free() race
Yinghai Lu (1):
megaraid_sas: Fix probing cards without io port
Yoshihiro Shimoda (1):
usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition
arch/alpha/include/asm/uaccess.h | 19 +++---
arch/arc/include/asm/uaccess.h | 11 ++-
arch/arm/kvm/arm.c | 2 -
arch/arm/kvm/mmu.c | 1 +
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 12 ++++
arch/arm64/include/asm/elf.h | 1 +
arch/arm64/include/asm/spinlock.h | 10 +++
arch/arm64/include/uapi/asm/auxvec.h | 2 +
arch/avr32/include/asm/uaccess.h | 11 ++-
arch/avr32/kernel/avr32_ksyms.c | 2 +-
arch/avr32/lib/copy_user.S | 8 +--
arch/blackfin/include/asm/uaccess.h | 9 +--
arch/cris/include/asm/uaccess.h | 71 +++++++++-----------
arch/frv/include/asm/uaccess.h | 12 +++-
arch/hexagon/include/asm/uaccess.h | 3 +-
arch/ia64/include/asm/uaccess.h | 20 +++---
arch/m32r/include/asm/uaccess.h | 2 +-
arch/metag/include/asm/uaccess.h | 3 +-
arch/microblaze/include/asm/uaccess.h | 11 +--
arch/mips/include/asm/uaccess.h | 3 +
arch/mips/kvm/kvm_tlb.c | 2 +-
arch/mn10300/include/asm/uaccess.h | 1 +
arch/mn10300/lib/usercopy.c | 4 +-
arch/openrisc/include/asm/uaccess.h | 35 +++-------
arch/parisc/include/asm/uaccess.h | 7 +-
arch/parisc/include/uapi/asm/errno.h | 4 +-
arch/powerpc/include/asm/uaccess.h | 21 +-----
arch/powerpc/mm/slb_low.S | 7 +-
arch/s390/include/asm/uaccess.h | 8 +--
arch/score/include/asm/uaccess.h | 46 +++++++------
arch/sh/include/asm/uaccess.h | 5 +-
arch/sh/include/asm/uaccess_64.h | 1 +
arch/sparc/include/asm/uaccess_32.h | 4 +-
arch/x86/include/asm/tlbflush.h | 7 ++
arch/x86/include/asm/uaccess.h | 6 +-
arch/x86/kernel/apic/apic.c | 3 +
arch/x86/kernel/paravirt.c | 4 +-
arch/x86/mm/pat.c | 5 +-
crypto/cryptd.c | 9 ++-
drivers/acpi/sysfs.c | 7 +-
drivers/char/hw_random/exynos-rng.c | 9 ++-
drivers/char/mem.c | 6 +-
drivers/clocksource/sun4i_timer.c | 9 ++-
drivers/cpufreq/cpufreq_userspace.c | 43 ++++++++++--
drivers/crypto/nx/nx.c | 2 +-
drivers/edac/edac_mc.c | 2 +-
drivers/gpio/Kconfig | 1 +
drivers/gpu/drm/drm_crtc.c | 3 +
drivers/gpu/drm/msm/msm_gem_submit.c | 27 ++++++--
drivers/gpu/drm/radeon/radeon_ttm.c | 4 +-
drivers/hid/hid-apple.c | 2 +
drivers/hid/hid-core.c | 1 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-input.c | 2 +-
drivers/iio/accel/kxsd9.c | 2 +
drivers/input/serio/i8042.c | 17 +----
drivers/input/serio/libps2.c | 10 ++-
drivers/input/touchscreen/ili210x.c | 2 +-
drivers/isdn/hardware/mISDN/ipac.h | 1 +
drivers/isdn/hardware/mISDN/mISDNipac.c | 2 +
drivers/isdn/mISDN/socket.c | 3 +
drivers/md/dm-flakey.c | 27 +++++---
drivers/media/dvb-frontends/stb6100.c | 2 +-
drivers/net/bonding/bond_main.c | 7 +-
drivers/net/can/dev.c | 3 -
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 86 +++++++++++++++---------
drivers/net/tun.c | 5 +-
drivers/pci/pci-sysfs.c | 18 ++---
drivers/pci/quirks.c | 12 ++++
drivers/s390/block/dasd.c | 10 ++-
drivers/s390/char/sclp_ctl.c | 12 ++--
drivers/scsi/aacraid/commctrl.c | 13 +++-
drivers/scsi/be2iscsi/be_main.c | 2 +-
drivers/scsi/constants.c | 5 +-
drivers/scsi/megaraid/megaraid_sas_base.c | 6 +-
drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +-
drivers/staging/comedi/drivers/daqboard2000.c | 2 +-
drivers/usb/class/cdc-acm.c | 5 +-
drivers/usb/class/cdc-acm.h | 1 -
drivers/usb/core/config.c | 97 ++++++++++++++++++++++-----
drivers/usb/core/devices.c | 10 +--
drivers/usb/core/hcd-pci.c | 2 +-
drivers/usb/core/hcd.c | 6 +-
drivers/usb/core/hub.c | 24 ++++---
drivers/usb/core/urb.c | 3 +-
drivers/usb/core/usb.h | 2 +-
drivers/usb/dwc3/gadget.c | 19 +++---
drivers/usb/host/xhci-hub.c | 3 +
drivers/usb/host/xhci-mem.c | 9 ++-
drivers/usb/host/xhci-ring.c | 3 +-
drivers/usb/host/xhci.c | 7 +-
drivers/usb/renesas_usbhs/mod.c | 11 ++-
drivers/usb/serial/ftdi_sio.c | 3 +
drivers/usb/serial/ftdi_sio_ids.h | 12 ++++
drivers/usb/serial/mos7720.c | 2 +-
drivers/usb/serial/mos7840.c | 4 +-
drivers/usb/serial/option.c | 22 ++++++
drivers/usb/serial/usb-serial-simple.c | 3 +-
drivers/usb/serial/usb-serial.c | 4 +-
fs/dcache.c | 1 +
fs/ext4/inode.c | 38 ++++++-----
fs/ext4/mballoc.c | 47 +++++++------
fs/ext4/namei.c | 9 ++-
fs/ext4/super.c | 36 +++++++---
fs/ext4/xattr.c | 13 ++--
fs/nfs/callback.c | 1 +
fs/seq_file.c | 4 +-
fs/ubifs/tnc_commit.c | 2 +-
fs/xfs/xfs_sb.c | 3 +-
include/asm-generic/uaccess.h | 20 ++++--
include/linux/i8042.h | 6 --
include/linux/netdevice.h | 1 +
include/linux/pci_ids.h | 7 ++
include/linux/serio.h | 24 +++++--
include/net/tcp.h | 2 +
include/uapi/linux/usb/ch9.h | 1 +
kernel/time/timekeeping_debug.c | 9 ++-
kernel/timer.c | 19 +++++-
net/core/dev.c | 16 +++++
net/core/dst.c | 4 +-
net/ipv4/ip_fragment.c | 4 ++
net/ipv4/tcp_ipv4.c | 8 ++-
net/ipv6/netfilter/nf_conntrack_reasm.c | 3 +
net/ipv6/ping.c | 9 ++-
net/ipv6/reassembly.c | 4 ++
net/ipv6/tcp_ipv6.c | 8 ++-
net/irda/iriap.c | 8 ++-
net/mac80211/cfg.c | 2 +-
net/mac80211/tx.c | 6 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 25 ++++++-
net/wireless/wext-core.c | 25 +------
sound/core/rawmidi.c | 4 +-
sound/core/timer.c | 20 +++++-
sound/pci/oxygen/oxygen_mixer.c | 2 +-
134 files changed, 923 insertions(+), 480 deletions(-)
--
2.10.0
[toc] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 001/119] MIPS: KVM: Check for pfn noslot case |
| Message-ID | <smGLf-2Ok-5@gated-at.bofh.it> |
| In reply to | #1493275 |
From: James Hogan <james.hogan@imgtec.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ba913e4f72fc9cfd03dad968dfb110eb49211d80 upstream.
When mapping a page into the guest we error check using is_error_pfn(),
however this doesn't detect a value of KVM_PFN_NOSLOT, indicating an
error HVA for the page. This can only happen on MIPS right now due to
unusual memslot management (e.g. being moved / removed / resized), or
with an Enhanced Virtual Memory (EVA) configuration where the default
KVM_HVA_ERR_* and kvm_is_error_hva() definitions are unsuitable (fixed
in a later patch). This case will be treated as a pfn of zero, mapping
the first page of physical memory into the guest.
It would appear the MIPS KVM port wasn't updated prior to being merged
(in v3.10) to take commit 81c52c56e2b4 ("KVM: do not treat noslot pfn as
a error pfn") into account (merged v3.8), which converted a bunch of
is_error_pfn() calls to is_error_noslot_pfn(). Switch to using
is_error_noslot_pfn() instead to catch this case properly.
Fixes: 858dd5d45733 ("KVM/MIPS32: MMU/TLB operations for the Guest.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[james.hogan@imgtec.com: Backport to v3.16.y]
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mips/kvm/kvm_tlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/kvm/kvm_tlb.c b/arch/mips/kvm/kvm_tlb.c
index 4bee4397dca8..8a47bd96cee3 100644
--- a/arch/mips/kvm/kvm_tlb.c
+++ b/arch/mips/kvm/kvm_tlb.c
@@ -182,7 +182,7 @@ static int kvm_mips_map_page(struct kvm *kvm, gfn_t gfn)
srcu_idx = srcu_read_lock(&kvm->srcu);
pfn = kvm_mips_gfn_to_pfn(kvm, gfn);
- if (kvm_mips_is_error_pfn(pfn)) {
+ if (is_error_noslot_pfn(pfn)) {
kvm_err("Couldn't get pfn for gfn %#" PRIx64 "!\n", gfn);
err = -EFAULT;
goto out;
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 057/119] drm: Reject page_flip for !DRIVER_MODESET |
| Message-ID | <smGLh-2Ok-45@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Daniel Vetter <daniel.vetter@ffwll.ch> 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 6f00975c619064a18c23fd3aced325ae165a73b9 upstream. Somehow this one slipped through, which means drivers without modeset support can be oopsed (since those also don't call drm_mode_config_init, which means the crtc lookup will chase an uninitalized idr). Reported-by: Alexander Potapenko <glider@google.com> Cc: Alexander Potapenko <glider@google.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> --- drivers/gpu/drm/drm_crtc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index b382df64c4f2..00244210658a 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -3562,6 +3562,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, int hdisplay, vdisplay; int ret = -EINVAL; + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || page_flip->reserved != 0) return -EINVAL; -- 2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 012/119] USB: validate wMaxPacketValue entries in endpoint descriptors |
| Message-ID | <smGLh-2Ok-55@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Alan Stern <stern@rowland.harvard.edu>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream.
Erroneous or malicious endpoint descriptors may have non-zero bits in
reserved positions, or out-of-bounds values. This patch helps prevent
these from causing problems by bounds-checking the wMaxPacketValue
entries in endpoint descriptors and capping the values at the maximum
allowed.
This issue was first discovered and tests were conducted by Jake Lamberson
<jake.lamberson1@gmail.com>, an intern working for Rosie Hall.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: roswest <roswest@cisco.com>
Tested-by: roswest <roswest@cisco.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/core/config.c | 66 ++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 63 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index ab6a23227cd6..c7e10f5b1143 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -144,6 +144,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
}
}
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_CONTROL] = 8,
+ [USB_ENDPOINT_XFER_ISOC] = 0,
+ [USB_ENDPOINT_XFER_BULK] = 0,
+ [USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_CONTROL] = 64,
+ [USB_ENDPOINT_XFER_ISOC] = 1023,
+ [USB_ENDPOINT_XFER_BULK] = 64,
+ [USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_CONTROL] = 64,
+ [USB_ENDPOINT_XFER_ISOC] = 1024,
+ [USB_ENDPOINT_XFER_BULK] = 512,
+ [USB_ENDPOINT_XFER_INT] = 1023,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_CONTROL] = 512,
+ [USB_ENDPOINT_XFER_ISOC] = 1024,
+ [USB_ENDPOINT_XFER_BULK] = 1024,
+ [USB_ENDPOINT_XFER_INT] = 1024,
+};
+
static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
int asnum, struct usb_host_interface *ifp, int num_ep,
unsigned char *buffer, int size)
@@ -152,6 +177,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
struct usb_endpoint_descriptor *d;
struct usb_host_endpoint *endpoint;
int n, i, j, retval;
+ unsigned int maxp;
+ const unsigned short *maxpacket_maxes;
d = (struct usb_endpoint_descriptor *) buffer;
buffer += d->bLength;
@@ -259,6 +286,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
}
+ /* Validate the wMaxPacketSize field */
+ maxp = usb_endpoint_maxp(&endpoint->desc);
+
+ /* Find the highest legal maxpacket size for this endpoint */
+ i = 0; /* additional transactions per microframe */
+ switch (to_usb_device(ddev)->speed) {
+ case USB_SPEED_LOW:
+ maxpacket_maxes = low_speed_maxpacket_maxes;
+ break;
+ case USB_SPEED_FULL:
+ maxpacket_maxes = full_speed_maxpacket_maxes;
+ break;
+ case USB_SPEED_HIGH:
+ /* Bits 12..11 are allowed only for HS periodic endpoints */
+ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+ i = maxp & (BIT(12) | BIT(11));
+ maxp &= ~i;
+ }
+ /* fallthrough */
+ default:
+ maxpacket_maxes = high_speed_maxpacket_maxes;
+ break;
+ case USB_SPEED_SUPER:
+ case USB_SPEED_SUPER_PLUS:
+ maxpacket_maxes = super_speed_maxpacket_maxes;
+ break;
+ }
+ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+ if (maxp > j) {
+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+ cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+ maxp = j;
+ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+ }
+
/*
* Some buggy high speed devices have bulk endpoints using
* maxpacket sizes other than 512. High speed HCDs may not
@@ -266,9 +329,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
*/
if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
&& usb_endpoint_xfer_bulk(d)) {
- unsigned maxp;
-
- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
if (maxp != 512)
dev_warn(ddev, "config %d interface %d altsetting %d "
"bulk endpoint 0x%X has invalid maxpacket %d\n",
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 013/119] usb: xhci: Fix panic if disconnect |
| Message-ID | <smGLh-2Ok-39@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Jim Lin <jilin@nvidia.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 88716a93766b8f095cdef37a8e8f2c93aa233b21 upstream.
After a device is disconnected, xhci_stop_device() will be invoked
in xhci_bus_suspend().
Also the "disconnect" IRQ will have ISR to invoke
xhci_free_virt_device() in this sequence.
xhci_irq -> xhci_handle_event -> handle_cmd_completion ->
xhci_handle_cmd_disable_slot -> xhci_free_virt_device
If xhci->devs[slot_id] has been assigned to NULL in
xhci_free_virt_device(), then virt_dev->eps[i].ring in
xhci_stop_device() may point to an invlid address to cause kernel
panic.
virt_dev = xhci->devs[slot_id];
:
if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
[] Unable to handle kernel paging request at virtual address 00001a68
[] pgd=ffffffc001430000
[] [00001a68] *pgd=000000013c807003, *pud=000000013c807003,
*pmd=000000013c808003, *pte=0000000000000000
[] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[] CPU: 0 PID: 39 Comm: kworker/0:1 Tainted: G U
[] Workqueue: pm pm_runtime_work
[] task: ffffffc0bc0e0bc0 ti: ffffffc0bc0ec000 task.ti:
ffffffc0bc0ec000
[] PC is at xhci_stop_device.constprop.11+0xb4/0x1a4
This issue is found when running with realtek ethernet device
(0bda:8153).
Signed-off-by: Jim Lin <jilin@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/host/xhci-hub.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 66a7641dfff1..8a79270ca44d 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -276,6 +276,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
ret = 0;
virt_dev = xhci->devs[slot_id];
+ if (!virt_dev)
+ return -ENODEV;
+
cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
if (!cmd) {
xhci_dbg(xhci, "Couldn't allocate command structure.\n");
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 010/119] usb: dwc3: gadget: increment request->actual once |
| Message-ID | <smGLh-2Ok-57@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Felipe Balbi <felipe.balbi@linux.intel.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c7de573471832dff7d31f0c13b0f143d6f017799 upstream.
When using SG lists, we would end up setting
request->actual to:
num_mapped_sgs * (request->length - count)
Let's fix that up by incrementing request->actual
only once.
Reported-by: Brian E Rogers <brian.e.rogers@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/dwc3/gadget.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 346140c55430..af03ea2c9c78 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1799,14 +1799,6 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
s_pkt = 1;
}
- /*
- * We assume here we will always receive the entire data block
- * which we should receive. Meaning, if we program RX to
- * receive 4K but we receive only 2K, we assume that's all we
- * should receive and we simply bounce the request back to the
- * gadget driver for further processing.
- */
- req->request.actual += req->request.length - count;
if (s_pkt)
return 1;
if ((event->status & DEPEVT_STATUS_LST) &&
@@ -1826,6 +1818,7 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
struct dwc3_trb *trb;
unsigned int slot;
unsigned int i;
+ int count = 0;
int ret;
do {
@@ -1842,6 +1835,8 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
slot++;
slot %= DWC3_TRB_NUM;
trb = &dep->trb_pool[slot];
+ count += trb->size & DWC3_TRB_SIZE_MASK;
+
ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
event, status);
@@ -1849,6 +1844,14 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
break;
}while (++i < req->request.num_mapped_sgs);
+ /*
+ * We assume here we will always receive the entire data block
+ * which we should receive. Meaning, if we program RX to
+ * receive 4K but we receive only 2K, we assume that's all we
+ * should receive and we simply bounce the request back to the
+ * gadget driver for further processing.
+ */
+ req->request.actual += req->request.length - count;
dwc3_gadget_giveback(dep, req, status);
if (ret)
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 055/119] ipv6: release dst in ping_v6_sendmsg |
| Message-ID | <smGLh-2Ok-49@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Dave Jones <davej@codemonkey.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 03c2778a938aaba0893f6d6cdc29511d91a79848 ]
Neither the failure or success paths of ping_v6_sendmsg release
the dst it acquires. This leads to a flood of warnings from
"net/core/dst.c:288 dst_release" on older kernels that
don't have 8bf4ada2e21378816b28205427ee6b0e1ca4c5f1 backported.
That patch optimistically hoped this had been fixed post 3.10, but
it seems at least one case wasn't, where I've seen this triggered
a lot from machines doing unprivileged icmp sockets.
Cc: Martin Lau <kafai@fb.com>
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/ipv6/ping.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index f414af6cda43..1896e104116c 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -152,8 +152,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
rt = (struct rt6_info *) dst;
np = inet6_sk(sk);
- if (!np)
- return -EBADF;
+ if (!np) {
+ err = -EBADF;
+ goto dst_err_out;
+ }
if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
fl6.flowi6_oif = np->mcast_oif;
@@ -193,6 +195,9 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
}
release_sock(sk);
+dst_err_out:
+ dst_release(dst);
+
if (err)
return err;
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 014/119] USB: serial: fix memleak in driver-registration error path |
| Message-ID | <smGLh-2Ok-51@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Alexey Klimov <klimov.linux@gmail.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 647024a7df36014bbc4479d92d88e6b77c0afcf6 upstream.
udriver struct allocated by kzalloc() will not be freed
if usb_register() and next calls fail. This patch fixes this
by adding one more step with kfree(udriver) in error path.
Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/usb-serial.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index c56752273bf5..137908af7c4c 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1426,7 +1426,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
rc = usb_register(udriver);
if (rc)
- return rc;
+ goto failed_usb_register;
for (sd = serial_drivers; *sd; ++sd) {
(*sd)->usb_driver = udriver;
@@ -1444,6 +1444,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
while (sd-- > serial_drivers)
usb_serial_deregister(*sd);
usb_deregister(udriver);
+failed_usb_register:
+ kfree(udriver);
return rc;
}
EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:30 +0200 |
| Subject | [PATCH 3.12 015/119] USB: serial: option: add D-Link DWM-156/A3 |
| Message-ID | <smGLh-2Ok-61@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Lubomir Rintel <lkundrak@v3.sk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cf1b18030de29e4e5b0a57695ae5db4a89da0ff7 upstream.
The device has four interfaces; the three serial ports ought to be
handled by this driver:
00 Diagnostic interface serial port
01 NMEA device serial port
02 Mass storage (sd card)
03 Modem serial port
The other product ids listed in the Windows driver are present already.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 006a2a721edf..2950844b518a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1839,6 +1839,7 @@ static const struct usb_device_id option_ids[] = {
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 111/119] metag: copy_from_user() should zero the destination on access_ok() failure |
| Message-ID | <smGUV-2TV-1@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8ae95ed4ae5fc7c3391ed668b2014c9e2079533b upstream.
Acked-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/metag/include/asm/uaccess.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 0748b0a97986..7841f2290385 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -199,8 +199,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
static inline unsigned long
copy_from_user(void *to, const void __user *from, unsigned long n)
{
- if (access_ok(VERIFY_READ, from, n))
+ if (likely(access_ok(VERIFY_READ, from, n)))
return __copy_user_zeroing(to, from, n);
+ memset(to, 0, n);
return n;
}
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 114/119] mn10300: copy_from_user() should zero on access_ok() failure... |
| Message-ID | <smGUV-2TV-13@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ae7cc577ec2a4a6151c9e928fd1f595d953ecef1 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/mn10300/lib/usercopy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
index 7826e6c364e7..ce8899e5e171 100644
--- a/arch/mn10300/lib/usercopy.c
+++ b/arch/mn10300/lib/usercopy.c
@@ -9,7 +9,7 @@
* as published by the Free Software Foundation; either version
* 2 of the Licence, or (at your option) any later version.
*/
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
unsigned long
__generic_copy_to_user(void *to, const void *from, unsigned long n)
@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
{
if (access_ok(VERIFY_READ, from, n))
__copy_user_zeroing(to, from, n);
+ else
+ memset(to, 0, n);
return n;
}
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 089/119] arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() |
| Message-ID | <smGUV-2TV-17@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Will Deacon <will.deacon@arm.com> 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 872c63fbf9e153146b07f0cece4da0d70b283eeb upstream. smp_mb__before_spinlock() is intended to upgrade a spin_lock() operation to a full barrier, such that prior stores are ordered with respect to loads and stores occuring inside the critical section. Unfortunately, the core code defines the barrier as smp_wmb(), which is insufficient to provide the required ordering guarantees when used in conjunction with our load-acquire-based spinlock implementation. This patch overrides the arm64 definition of smp_mb__before_spinlock() to map to a full smp_mb(). Cc: Peter Zijlstra <peterz@infradead.org> Reported-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> --- arch/arm64/include/asm/spinlock.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h index 0defa0728a9b..c3cab6f87de4 100644 --- a/arch/arm64/include/asm/spinlock.h +++ b/arch/arm64/include/asm/spinlock.h @@ -200,4 +200,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw) #define arch_read_relax(lock) cpu_relax() #define arch_write_relax(lock) cpu_relax() +/* + * Accesses appearing in program order before a spin_lock() operation + * can be reordered with accesses inside the critical section, by virtue + * of arch_spin_lock being constructed using acquire semantics. + * + * In cases where this is problematic (e.g. try_to_wake_up), an + * smp_mb__before_spinlock() can restore the required ordering. + */ +#define smp_mb__before_spinlock() smp_mb() + #endif /* __ASM_SPINLOCK_H */ -- 2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 098/119] score: fix __get_user/get_user |
| Message-ID | <smGUV-2TV-19@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c2f18fa4cbb3ad92e033a24efa27583978ce9600 upstream.
* should zero on any failure
* __get_user() should use __copy_from_user(), not copy_from_user()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/score/include/asm/uaccess.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
index ab66ddde777b..c882d961e5b8 100644
--- a/arch/score/include/asm/uaccess.h
+++ b/arch/score/include/asm/uaccess.h
@@ -158,7 +158,7 @@ do { \
__get_user_asm(val, "lw", ptr); \
break; \
case 8: \
- if ((copy_from_user((void *)&val, ptr, 8)) == 0) \
+ if (__copy_from_user((void *)&val, ptr, 8) == 0) \
__gu_err = 0; \
else \
__gu_err = -EFAULT; \
@@ -183,6 +183,8 @@ do { \
\
if (likely(access_ok(VERIFY_READ, __gu_ptr, size))) \
__get_user_common((x), size, __gu_ptr); \
+ else \
+ (x) = 0; \
\
__gu_err; \
})
@@ -196,6 +198,7 @@ do { \
"2:\n" \
".section .fixup,\"ax\"\n" \
"3:li %0, %4\n" \
+ "li %1, 0\n" \
"j 2b\n" \
".previous\n" \
".section __ex_table,\"a\"\n" \
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 110/119] alpha: fix copy_from_user() |
| Message-ID | <smGUV-2TV-7@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2561d309dfd1555e781484af757ed0115035ddb3 upstream.
it should clear the destination even when access_ok() fails.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/alpha/include/asm/uaccess.h | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index 766fdfde2b7a..6e9d27ad5103 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -371,14 +371,6 @@ __copy_tofrom_user_nocheck(void *to, const void *from, long len)
return __cu_len;
}
-extern inline long
-__copy_tofrom_user(void *to, const void *from, long len, const void __user *validate)
-{
- if (__access_ok((unsigned long)validate, len, get_fs()))
- len = __copy_tofrom_user_nocheck(to, from, len);
- return len;
-}
-
#define __copy_to_user(to,from,n) \
({ \
__chk_user_ptr(to); \
@@ -393,17 +385,22 @@ __copy_tofrom_user(void *to, const void *from, long len, const void __user *vali
#define __copy_to_user_inatomic __copy_to_user
#define __copy_from_user_inatomic __copy_from_user
-
extern inline long
copy_to_user(void __user *to, const void *from, long n)
{
- return __copy_tofrom_user((__force void *)to, from, n, to);
+ if (likely(__access_ok((unsigned long)to, n, get_fs())))
+ n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+ return n;
}
extern inline long
copy_from_user(void *to, const void __user *from, long n)
{
- return __copy_tofrom_user(to, (__force void *)from, n, from);
+ if (likely(__access_ok((unsigned long)from, n, get_fs())))
+ n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
+ else
+ memset(to, 0, n);
+ return n;
}
extern void __do_clear_user(void);
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 101/119] asm-generic: make get_user() clear the destination on errors |
| Message-ID | <smGUW-2TV-27@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9ad18b75c2f6e4a78ce204e79f37781f8815c0fa upstream.
both for access_ok() failures and for faults halfway through
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
include/asm-generic/uaccess.h | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index dc1269c74a52..a79424155cfe 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -228,14 +228,18 @@ extern int __put_user_bad(void) __attribute__((noreturn));
might_fault(); \
access_ok(VERIFY_READ, ptr, sizeof(*ptr)) ? \
__get_user(x, ptr) : \
- -EFAULT; \
+ ((x) = (__typeof__(*(ptr)))0,-EFAULT); \
})
#ifndef __get_user_fn
static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
{
- size = __copy_from_user(x, ptr, size);
- return size ? -EFAULT : size;
+ size_t n = __copy_from_user(x, ptr, size);
+ if (unlikely(n)) {
+ memset(x + (size - n), 0, n);
+ return -EFAULT;
+ }
+ return 0;
}
#define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k)
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 112/119] parisc: fix copy_from_user() |
| Message-ID | <smGUV-2TV-25@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aace880feea38875fbc919761b77e5732a3659ef upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/parisc/include/asm/uaccess.h | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index e0a82358517e..9bbddafb0da3 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -9,6 +9,8 @@
#include <asm/errno.h>
#include <asm-generic/uaccess-unaligned.h>
+#include <linux/string.h>
+
#define VERIFY_READ 0
#define VERIFY_WRITE 1
@@ -246,13 +248,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
unsigned long n)
{
int sz = __compiletime_object_size(to);
- int ret = -EFAULT;
+ unsigned long ret = n;
if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
ret = __copy_from_user(to, from, n);
else
copy_from_user_overflow();
-
+ if (unlikely(ret))
+ memset(to + (n - ret), 0, ret);
return ret;
}
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 102/119] frv: fix clear_user() |
| Message-ID | <smGUV-2TV-11@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3b8767a8f00cc6538ba6b1cf0f88502e2fd2eb90 upstream.
It should check access_ok(). Otherwise a bunch of places turn into
trivially exploitable rootholes.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/frv/include/asm/uaccess.h | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
index 3ac9a59d65d4..87d9e34c5df8 100644
--- a/arch/frv/include/asm/uaccess.h
+++ b/arch/frv/include/asm/uaccess.h
@@ -263,19 +263,25 @@ do { \
extern long __memset_user(void *dst, unsigned long count);
extern long __memcpy_user(void *dst, const void *src, unsigned long count);
-#define clear_user(dst,count) __memset_user(____force(dst), (count))
+#define __clear_user(dst,count) __memset_user(____force(dst), (count))
#define __copy_from_user_inatomic(to, from, n) __memcpy_user((to), ____force(from), (n))
#define __copy_to_user_inatomic(to, from, n) __memcpy_user(____force(to), (from), (n))
#else
-#define clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
+#define __clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
#define __copy_from_user_inatomic(to, from, n) (memcpy((to), ____force(from), (n)), 0)
#define __copy_to_user_inatomic(to, from, n) (memcpy(____force(to), (from), (n)), 0)
#endif
-#define __clear_user clear_user
+static inline unsigned long __must_check
+clear_user(void __user *to, unsigned long n)
+{
+ if (likely(__access_ok(to, n)))
+ n = __clear_user(to, n);
+ return n;
+}
static inline unsigned long __must_check
__copy_to_user(void __user *to, const void *from, unsigned long n)
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 096/119] m32r: fix __get_user() |
| Message-ID | <smGUW-2TV-31@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c90a3bc5061d57e7931a9b7ad14784e1a0ed497d upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/m32r/include/asm/uaccess.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
index 84fe7ba53035..c393e8f57cf7 100644
--- a/arch/m32r/include/asm/uaccess.h
+++ b/arch/m32r/include/asm/uaccess.h
@@ -215,7 +215,7 @@ extern int fixup_exception(struct pt_regs *regs);
#define __get_user_nocheck(x,ptr,size) \
({ \
long __gu_err = 0; \
- unsigned long __gu_val; \
+ unsigned long __gu_val = 0; \
might_fault(); \
__get_user_size(__gu_val,(ptr),(size),__gu_err); \
(x) = (__typeof__(*(ptr)))__gu_val; \
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 105/119] score: fix copy_from_user() and friends |
| Message-ID | <smGUV-2TV-23@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b615e3c74621e06cd97f86373ca90d43d6d998aa upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
arch/score/include/asm/uaccess.h | 41 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 21 deletions(-)
diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
index c882d961e5b8..69326dfb894d 100644
--- a/arch/score/include/asm/uaccess.h
+++ b/arch/score/include/asm/uaccess.h
@@ -296,35 +296,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
static inline unsigned long
copy_from_user(void *to, const void *from, unsigned long len)
{
- unsigned long over;
+ unsigned long res = len;
- if (access_ok(VERIFY_READ, from, len))
- return __copy_tofrom_user(to, from, len);
+ if (likely(access_ok(VERIFY_READ, from, len)))
+ res = __copy_tofrom_user(to, from, len);
- if ((unsigned long)from < TASK_SIZE) {
- over = (unsigned long)from + len - TASK_SIZE;
- return __copy_tofrom_user(to, from, len - over) + over;
- }
- return len;
+ if (unlikely(res))
+ memset(to + (len - res), 0, res);
+
+ return res;
}
static inline unsigned long
copy_to_user(void *to, const void *from, unsigned long len)
{
- unsigned long over;
-
- if (access_ok(VERIFY_WRITE, to, len))
- return __copy_tofrom_user(to, from, len);
+ if (likely(access_ok(VERIFY_WRITE, to, len)))
+ len = __copy_tofrom_user(to, from, len);
- if ((unsigned long)to < TASK_SIZE) {
- over = (unsigned long)to + len - TASK_SIZE;
- return __copy_tofrom_user(to, from, len - over) + over;
- }
return len;
}
-#define __copy_from_user(to, from, len) \
- __copy_tofrom_user((to), (from), (len))
+static inline unsigned long
+__copy_from_user(void *to, const void *from, unsigned long len)
+{
+ unsigned long left = __copy_tofrom_user(to, from, len);
+ if (unlikely(left))
+ memset(to + (len - left), 0, left);
+ return left;
+}
#define __copy_to_user(to, from, len) \
__copy_tofrom_user((to), (from), (len))
@@ -338,17 +337,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
static inline unsigned long
__copy_from_user_inatomic(void *to, const void *from, unsigned long len)
{
- return __copy_from_user(to, from, len);
+ return __copy_tofrom_user(to, from, len);
}
-#define __copy_in_user(to, from, len) __copy_from_user(to, from, len)
+#define __copy_in_user(to, from, len) __copy_tofrom_user(to, from, len)
static inline unsigned long
copy_in_user(void *to, const void *from, unsigned long len)
{
if (access_ok(VERIFY_READ, from, len) &&
access_ok(VERFITY_WRITE, to, len))
- return copy_from_user(to, from, len);
+ return __copy_tofrom_user(to, from, len);
}
/*
--
2.10.0
[toc] | [prev] | [next] | [standalone]
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Date | 2016-09-29 12:40 +0200 |
| Subject | [PATCH 3.12 106/119] sh: fix copy_from_user() |
| Message-ID | <smGUW-2TV-37@gated-at.bofh.it> |
| In reply to | #1493276 |
From: Al Viro <viro@zeniv.linux.org.uk> 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit 6e050503a150b2126620c1a1e9b3a368fcd51eac upstream. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Jiri Slaby <jslaby@suse.cz> --- arch/sh/include/asm/uaccess.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h index 9486376605f4..c04cc18ae9cd 100644 --- a/arch/sh/include/asm/uaccess.h +++ b/arch/sh/include/asm/uaccess.h @@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n) __kernel_size_t __copy_size = (__kernel_size_t) n; if (__copy_size && __access_ok(__copy_from, __copy_size)) - return __copy_user(to, from, __copy_size); + __copy_size = __copy_user(to, from, __copy_size); + + if (unlikely(__copy_size)) + memset(to + (n - __copy_size), 0, __copy_size); return __copy_size; } -- 2.10.0
[toc] | [prev] | [next] | [standalone]
Page 1 of 6 [1] 2 3 4 5 6 Next page →
Back to top | Article view | linux.kernel
csiph-web