Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1593014 > unrolled thread

[PATCH 3.12 000/113] 3.12.71-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.12 000/113] 3.12.71-stable review Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
    [PATCH 3.12 001/113] x86/Kconfig: Simplify X86_IO_APIC dependencies Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 092/113] ocfs2: do not write error flag to user structure we cannot copy from/to Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 111/113] USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 089/113] af_packet: remove a stray tab in packet_set_ring() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 103/113] ipv6: simplify detection of first operational link-local address on interface Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 102/113] net: 6lowpan: fix lowpan_header_create non-compression memcpy call Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 109/113] net: filter: x86: fix JIT address randomization Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:20 +0100
      [PATCH 3.12 065/113] vfs: fix uninitialized flags in splice_to_pipe() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 077/113] tty: serial: msm: Fix module autoload Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 063/113] l2tp: do not use udp_ioctl() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 068/113] futex: Move futex_init() to core_initcall Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 076/113] net: socket: fix recvmmsg not returning error from sock_error Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 080/113] USB: serial: ftdi_sio: fix modem-status error handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 090/113] ext4: validate s_first_meta_bg at mount time Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 088/113] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 096/113] drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 086/113] x86/platform/goldfish: Prevent unconditional loading Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 074/113] dccp: fix freeing skb too early for IPV6_RECVPKTINFO Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 075/113] irda: Fix lockdep annotations in hashbin_delete(). Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 082/113] USB: serial: ftdi_sio: fix line-status over-reporting Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 059/113] macvtap: read vnet_hdr_size once Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 091/113] ext4: fix fencepost in s_first_meta_bg validation Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 097/113] cpufreq: fix garbage kobjects on errors during suspend/resume Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 099/113] cpufreq: Clean up after a failing light-weight initialization Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 061/113] packet: round up linear to header len Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 081/113] USB: serial: ftdi_sio: fix extreme low-latency setting Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 070/113] rtc: interface: ignore expired timers when enqueuing new timers Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 060/113] sctp: avoid BUG_ON on sctp_wait_for_sndbuf Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 084/113] USB: serial: opticon: fix CTS retrieval at open Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 057/113] tcp: avoid infinite loop in tcp_splice_read() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 071/113] net/llc: avoid BUG_ON() in skb_orphan() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 079/113] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 085/113] USB: serial: ark3116: fix register-accessor error handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 095/113] Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 069/113] printk: use rcuidle console tracepoint Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 062/113] ping: fix a null pointer dereference Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 064/113] scsi: move the nr_phys_segments assert into scsi_init_io Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 072/113] packet: fix races in fanout_add() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 073/113] packet: Do not call fanout_release from atomic contexts Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 058/113] tun: read vnet_hdr_sz once Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 083/113] USB: serial: spcp8x5: fix modem-status handling Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 078/113] USB: serial: mos7840: fix another NULL-deref at open Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 087/113] goldfish: Sanitize the broken interrupt handler Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:30 +0100
      [PATCH 3.12 023/113] USB: serial: option: add WeTelecom 0x6802 and 0x6803 products Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 037/113] USB: serial: option: add device ID for HP lt2523 (Novatel E371) Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 042/113] mac80211: Fix adding of mesh vendor IEs Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 050/113] ipv6: fix ip6_tnl_parse_tlv_enc_lim() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 034/113] USB: serial: qcserial: add Dell DW5570 QDL Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 055/113] netlabel: out of bound access in cipso_v4_validate() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 040/113] ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 036/113] USB: Add quirk for WORLDE easykey.25 MIDI keyboard Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 041/113] target: Fix COMPARE_AND_WRITE ref leak for non GOOD status Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 051/113] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 054/113] ipv4: keep skb->dst around in presence of IP options Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 043/113] scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 067/113] scsi: don't BUG_ON() empty DMA transfers Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 026/113] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 022/113] USB: serial: option: add WeTelecom WM-D200 Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 053/113] net: use a work queue to defer net_disable_timestamp() work Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 029/113] svcrpc: fix oops in absence of krb5 module Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 033/113] can: bcm: fix hrtimer/tasklet termination in bcm op removal Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 066/113] siano: make it work again with CONFIG_VMAP_STACK Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 039/113] selinux: fix off-by-one in setprocattr Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 056/113] ip6_gre: fix ip6gre_err() invalid reads Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 049/113] can: Fix kernel panic at security_sock_rcv_skb Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 044/113] ALSA: seq: Fix race at creating a queue Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 035/113] USB: serial: pl2303: add ATEN device ID Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 032/113] mm, fs: check for fatal signals in do_generic_file_read() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 021/113] qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 031/113] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 025/113] USB: serial: option: add even more ZTE device ids Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 038/113] ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 052/113] tcp: fix 0 divide in __tcp_select_window() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:40 +0100
      [PATCH 3.12 007/113] ISDN: eicon: silence misleading array-bounds warning Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 012/113] nfs: Don't increment lock sequence ID after NFS4ERR_MOVED Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 011/113] parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 018/113] ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 020/113] af_unix: move unix_mknod() out of bindlock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 009/113] can: ti_hecc: add missing prepare and unprepare of the clock Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 016/113] platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 008/113] can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 014/113] drm/i915: Don't leak edid in intel_crt_detect_ddc() Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 019/113] tcp: initialize max window for a new fastopen socket Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 015/113] s5k4ecgx: select CRC32 helper Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 003/113] net: possible use after free in dst_release Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 010/113] ARC: [arcompact] handle unaligned access delay slot corner case Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 013/113] SUNRPC: cleanup ida information when removing sunrpc module Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 017/113] net: fix harmonize_features() vs NETIF_F_HIGHDMA Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
      [PATCH 3.12 002/113] crypto: caam - fix non-hmac hashes Jiri Slaby <jslaby@suse.cz> - 2017-03-06 10:50 +0100
    Re: [PATCH 3.12 000/113] 3.12.71-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-06 15:50 +0100
      Re: [PATCH 3.12 000/113] 3.12.71-stable review Jiri Slaby <jslaby@suse.cz> - 2017-03-09 21:00 +0100
    Re: [PATCH 3.12 000/113] 3.12.71-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-06 20:30 +0100

Page 1 of 5  [1] 2 3 4 5  Next page →

#1593014 — [PATCH 3.12 000/113] 3.12.71-stable review

This is the start of the stable review cycle for the 3.12.71 release.
There are 113 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Mar  8 10:10:31 CET 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.71-rc1.xz
and the diffstat can be found below.

thanks,
js

===============


Aleksander Morgado (1):
  USB: serial: qcserial: add Dell DW5570 QDL

Aleksandr Makarov (2):
  USB: serial: option: add WeTelecom WM-D200
  USB: serial: option: add WeTelecom 0x6802 and 0x6803 products

Alexei Starovoitov (1):
  net: filter: x86: fix JIT address randomization

Alexey Khoroshilov (1):
  USB: cdc-acm: fix double usb_autopm_put_interface() in
    acm_port_activate()

Alexey Kodanev (1):
  tcp: initialize max window for a new fastopen socket

Ander Conselvan de Oliveira (1):
  drm/i915: Don't leak edid in intel_crt_detect_ddc()

Andrey Konovalov (1):
  dccp: fix freeing skb too early for IPV6_RECVPKTINFO

Andrey Ryabinin (1):
  drm/i915: fix use-after-free in page_flip_completed()

Andy Shevchenko (1):
  platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT

Anoob Soman (1):
  packet: Do not call fanout_release from atomic contexts

Arnd Bergmann (2):
  ISDN: eicon: silence misleading array-bounds warning
  s5k4ecgx: select CRC32 helper

Arvind Yadav (1):
  ata: sata_mv:- Handle return value of devm_ioremap.

Ben Hutchings (1):
  ocfs2: do not write error flag to user structure we cannot copy
    from/to

Bjørn Mork (3):
  qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN
    card
  USB: serial: option: add device ID for HP lt2523 (Novatel E371)
  cpufreq: fix garbage kobjects on errors during suspend/resume

Christoph Hellwig (1):
  scsi: move the nr_phys_segments assert into scsi_init_io

Chuck Lever (1):
  nfs: Don't increment lock sequence ID after NFS4ERR_MOVED

Claudiu Manoil (1):
  gianfar: Check if phydev present on ethtool -A

Colin Ian King (1):
  rtc: interface: ignore expired timers when enqueuing new timers

Dan Carpenter (6):
  ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
  af_packet: remove a stray tab in packet_set_ring()
  6lowpan: release device on error path
  mfd: pm8921: Potential NULL dereference in pm8921_remove()
  Staging: vt6655-6: potential NULL dereference in
    hostap_disable_hostapd()
  drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set()

Daniel Borkmann (2):
  net: 6lowpan: fix lowpan_header_create non-compression memcpy call
  net: sctp: rework multihoming retransmission path selection to rfc4960

Dave Martin (2):
  tile/ptrace: Preserve previous registers for short regset write
  ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset
    write

David S. Miller (1):
  irda: Fix lockdep annotations in hashbin_delete().

Einar Jón (1):
  can: c_can_pci: fix null-pointer-deref in c_can_start() - set device
    pointer

Eric Dumazet (13):
  sysctl: fix proc_doulongvec_ms_jiffies_minmax()
  net: fix harmonize_features() vs NETIF_F_HIGHDMA
  can: Fix kernel panic at security_sock_rcv_skb
  ipv6: fix ip6_tnl_parse_tlv_enc_lim()
  tcp: fix 0 divide in __tcp_select_window()
  net: use a work queue to defer net_disable_timestamp() work
  ipv4: keep skb->dst around in presence of IP options
  netlabel: out of bound access in cipso_v4_validate()
  ip6_gre: fix ip6gre_err() invalid reads
  tcp: avoid infinite loop in tcp_splice_read()
  l2tp: do not use udp_ioctl()
  net/llc: avoid BUG_ON() in skb_orphan()
  packet: fix races in fanout_add()

Eryu Guan (1):
  ext4: validate s_first_meta_bg at mount time

Francesco Ruggeri (1):
  net: possible use after free in dst_release

Hannes Frederic Sowa (1):
  ipv6: simplify detection of first operational link-local address on
    interface

Heiko Carstens (1):
  net: filter: s390: fix JIT address randomization

Helge Deller (1):
  parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header

Herbert Xu (1):
  tun: Fix TUN_PKT_STRIP setting

Ilia Mirkin (1):
  drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval

J. Bruce Fields (1):
  svcrpc: fix oops in absence of krb5 module

Jan Beulich (1):
  x86/Kconfig: Simplify X86_IO_APIC dependencies

Javier Martinez Canillas (1):
  tty: serial: msm: Fix module autoload

Jingoo Han (1):
  PCI: mvebu: Use max_t() instead of max(resource_size_t,)

Johan Hovold (9):
  USB: serial: mos7840: fix another NULL-deref at open
  USB: serial: ftdi_sio: fix modem-status error handling
  USB: serial: ftdi_sio: fix extreme low-latency setting
  USB: serial: ftdi_sio: fix line-status over-reporting
  USB: serial: spcp8x5: fix modem-status handling
  USB: serial: opticon: fix CTS retrieval at open
  USB: serial: ark3116: fix register-accessor error handling
  USB: cdc-acm: fix open and suspend race
  USB: cdc-acm: fix failed open not being detected

Johannes Thumshirn (1):
  scsi: don't BUG_ON() empty DMA transfers

Kees Cook (1):
  fbdev: color map copying bounds checking

Kefeng Wang (1):
  ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side
    lock

Ken Lin (1):
  USB: serial: cp210x: add new IDs for GE Bx50v3 boards

Kinglong Mee (1):
  SUNRPC: cleanup ida information when removing sunrpc module

Lei Liu (1):
  USB: serial: option: add even more ZTE device ids

Li RongQing (1):
  ipv6: fix the use of pcpu_tstats in ip6_tunnel

Lukáš Lalinský (1):
  USB: Add quirk for WORLDE easykey.25 MIDI keyboard

Marcel J.E. Mol (1):
  USB: serial: pl2303: add ATEN device ID

Marcelo Ricardo Leitner (1):
  sctp: avoid BUG_ON on sctp_wait_for_sndbuf

Mauro Carvalho Chehab (1):
  siano: make it work again with CONFIG_VMAP_STACK

Maxime Jayat (1):
  net: socket: fix recvmmsg not returning error from sock_error

Michael Schenk (1):
  rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down

Michal Hocko (1):
  mm, fs: check for fatal signals in do_generic_file_read()

Miklos Szeredi (1):
  vfs: fix uninitialized flags in splice_to_pipe()

Nicholas Bellinger (1):
  target: Fix COMPARE_AND_WRITE ref leak for non GOOD status

Oliver Hartkopp (1):
  can: bcm: fix hrtimer/tasklet termination in bcm op removal

Rabin Vincent (2):
  cifs: initialize file_info_lock
  sched/debug: Don't dump sched debug info in SysRq-W

Rafael J. Wysocki (1):
  cpufreq: Clean up after a failing light-weight initialization

Russell King (1):
  crypto: caam - fix non-hmac hashes

Salvatore Benedetto (1):
  crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg

Sergey Senozhatsky (1):
  printk: use rcuidle console tracepoint

Steffen Klassert (1):
  vti4: Don't count header length twice.

Steffen Maier (1):
  scsi: zfcp: fix use-after-free by not tracing WKA port open/close on
    failed send

Stephen Smalley (1):
  selinux: fix off-by-one in setprocattr

Takashi Iwai (2):
  ALSA: seq: Fix race at creating a queue
  ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()

Theodore Ts'o (1):
  ext4: fix fencepost in s_first_meta_bg validation

Thomas Gleixner (2):
  x86/platform/goldfish: Prevent unconditional loading
  goldfish: Sanitize the broken interrupt handler

Thomas Petazzoni (1):
  PCI: mvebu: split PCIe BARs into multiple MBus windows when needed

Thorsten Horstmann (1):
  mac80211: Fix adding of mesh vendor IEs

Toshi Kani (1):
  mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone()

Vineet Gupta (2):
  ARC: [arcompact] handle unaligned access delay slot corner case
  ARC: [arcompact] brown paper bag bug in unaligned access delay slot
    fixup

Viresh Kumar (2):
  cpufreq: remove sysfs files for CPUs which failed to come back after
    resume
  cpufreq: preserve user_policy across suspend/resume

WANG Cong (2):
  af_unix: move unix_mknod() out of bindlock
  ping: fix a null pointer dereference

Willem de Bruijn (3):
  tun: read vnet_hdr_sz once
  macvtap: read vnet_hdr_size once
  packet: round up linear to header len

Yang Yang (1):
  futex: Move futex_init() to core_initcall

Yegor Yefremov (1):
  can: ti_hecc: add missing prepare and unprepare of the clock

lei liu (1):
  USB: serial: option: add more ZTE device ids

 Documentation/kernel-parameters.txt              |   4 +
 arch/arc/kernel/unaligned.c                      |   3 +-
 arch/arm/kernel/ptrace.c                         |   2 +-
 arch/parisc/include/asm/bitops.h                 |   8 +-
 arch/parisc/include/uapi/asm/bitsperlong.h       |   2 -
 arch/parisc/include/uapi/asm/swab.h              |   5 +-
 arch/s390/net/bpf_jit_comp.c                     |   2 +-
 arch/tile/kernel/ptrace.c                        |   2 +-
 arch/x86/Kconfig                                 |   2 +-
 arch/x86/net/bpf_jit_comp.c                      |   2 +-
 arch/x86/platform/goldfish/goldfish.c            |  14 ++-
 crypto/algapi.c                                  |   1 +
 drivers/ata/sata_mv.c                            |   3 +
 drivers/cpufreq/cpufreq.c                        | 101 ++++++++--------
 drivers/crypto/caam/caamhash.c                   |   1 +
 drivers/gpu/drm/i915/intel_crt.c                 |   9 +-
 drivers/gpu/drm/i915/intel_display.c             |   4 +-
 drivers/gpu/drm/nouveau/dispnv04/hw.c            |   3 +-
 drivers/gpu/drm/nouveau/nv50_display.c           |   2 +-
 drivers/isdn/hardware/eicon/message.c            |   3 +-
 drivers/media/i2c/Kconfig                        |   1 +
 drivers/media/usb/siano/smsusb.c                 |  18 ++-
 drivers/mfd/pm8921-core.c                        |   9 +-
 drivers/net/can/c_can/c_can_pci.c                |   1 +
 drivers/net/can/ti_hecc.c                        |  16 ++-
 drivers/net/ethernet/freescale/gianfar_ethtool.c |   3 +
 drivers/net/macvtap.c                            |   4 +-
 drivers/net/tun.c                                |  20 ++--
 drivers/net/usb/cdc_ether.c                      |   8 ++
 drivers/net/usb/qmi_wwan.c                       |   7 ++
 drivers/net/wireless/rtlwifi/usb.c               |  18 +++
 drivers/pci/host/pci-mvebu.c                     |  88 +++++++++++---
 drivers/platform/goldfish/pdev_bus.c             |  13 ++-
 drivers/platform/x86/intel_mid_powerbtn.c        |   4 +-
 drivers/rtc/interface.c                          |  16 ++-
 drivers/s390/scsi/zfcp_fsf.c                     |   8 +-
 drivers/scsi/scsi_lib.c                          |  17 +--
 drivers/staging/vt6655/hostap.c                  |   3 +-
 drivers/staging/vt6656/hostap.c                  |   3 +-
 drivers/target/target_core_sbc.c                 |   8 +-
 drivers/tty/serial/msm_serial.c                  |   1 +
 drivers/usb/class/cdc-acm.c                      |  17 +--
 drivers/usb/core/quirks.c                        |   4 +
 drivers/usb/serial/ark3116.c                     |  13 ++-
 drivers/usb/serial/cp210x.c                      |   2 +
 drivers/usb/serial/ftdi_sio.c                    |  31 +++--
 drivers/usb/serial/mos7840.c                     |   4 +-
 drivers/usb/serial/opticon.c                     |   2 +-
 drivers/usb/serial/option.c                      | 140 ++++++++++++++++++++++-
 drivers/usb/serial/pl2303.c                      |   1 +
 drivers/usb/serial/pl2303.h                      |   1 +
 drivers/usb/serial/qcserial.c                    |   1 +
 drivers/usb/serial/spcp8x5.c                     |   8 +-
 drivers/video/fbcmap.c                           |  26 +++--
 fs/cifs/readdir.c                                |   1 +
 fs/ext4/super.c                                  |   9 ++
 fs/ocfs2/ioctl.c                                 | 129 +++++++--------------
 fs/splice.c                                      |   1 +
 include/linux/can/core.h                         |   7 +-
 include/linux/nfs4.h                             |   3 +-
 include/linux/sunrpc/clnt.h                      |   1 +
 include/net/cipso_ipv4.h                         |   4 +
 include/net/if_inet6.h                           |   1 -
 include/net/sock.h                               |   1 +
 kernel/futex.c                                   |   2 +-
 kernel/printk/printk.c                           |   2 +-
 kernel/sched/core.c                              |   3 +-
 kernel/sysctl.c                                  |   1 +
 mm/filemap.c                                     |   5 +
 mm/memory_hotplug.c                              |  12 +-
 net/can/af_can.c                                 |  12 +-
 net/can/af_can.h                                 |   3 +-
 net/can/bcm.c                                    |  27 +++--
 net/can/gw.c                                     |   2 +-
 net/can/raw.c                                    |   4 +-
 net/core/dev.c                                   |  35 +++---
 net/core/dst.c                                   |   3 +-
 net/core/sock.c                                  |   6 +
 net/dccp/input.c                                 |   3 +-
 net/ieee802154/6lowpan.c                         |   6 +-
 net/ipv4/cipso_ipv4.c                            |   4 +
 net/ipv4/ip_sockglue.c                           |   9 +-
 net/ipv4/ip_vti.c                                |   1 -
 net/ipv4/ping.c                                  |   2 +
 net/ipv4/tcp.c                                   |   6 +
 net/ipv4/tcp_ipv4.c                              |   1 +
 net/ipv4/tcp_output.c                            |   6 +-
 net/ipv6/addrconf.c                              |  42 +++----
 net/ipv6/ip6_gre.c                               |  41 ++++---
 net/ipv6/ip6_tunnel.c                            |  55 ++++++---
 net/irda/irqueue.c                               |  34 +++---
 net/l2tp/l2tp_core.h                             |   1 +
 net/l2tp/l2tp_ip.c                               |  27 ++++-
 net/l2tp/l2tp_ip6.c                              |   2 +-
 net/llc/llc_conn.c                               |   3 +
 net/llc/llc_sap.c                                |   3 +
 net/mac80211/mesh.c                              |   2 +-
 net/packet/af_packet.c                           |  55 ++++++---
 net/sctp/associola.c                             | 129 +++++++++++++--------
 net/sctp/socket.c                                |   3 +-
 net/socket.c                                     |   4 +-
 net/sunrpc/auth_gss/gss_rpc_xdr.c                |   2 +-
 net/sunrpc/clnt.c                                |   5 +
 net/sunrpc/sunrpc_syms.c                         |   1 +
 net/unix/af_unix.c                               |  27 +++--
 security/selinux/hooks.c                         |   2 +-
 sound/core/seq/seq_memory.c                      |   9 +-
 sound/core/seq/seq_queue.c                       |  33 +++---
 108 files changed, 982 insertions(+), 499 deletions(-)

-- 
2.12.0

[toc] | [next] | [standalone]

#1593029 — [PATCH 3.12 001/113] x86/Kconfig: Simplify X86_IO_APIC dependencies

From: Jan Beulich <JBeulich@suse.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b1da1e715d4faf01468b7f45f7098922bc85ea8e upstream.

Since dependencies are transitive, we don't really need to
repeat those of X86_UP_IOAPIC.

Furthermore avoid the symbol getting entered into .config when
it is off by having the default simply Y and the dependencies
solely handled via the intended for that purpose "depends on".

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Link: http://lkml.kernel.org/r/54D39BC9020000780005D688@mail.emea.novell.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 0cda30450825..7255e3dee799 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -894,7 +894,7 @@ config X86_LOCAL_APIC
 
 config X86_IO_APIC
 	def_bool y
-	depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI
+	depends on X86_LOCAL_APIC || X86_UP_IOAPIC
 
 config X86_VISWS_APIC
 	def_bool y
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593030 — [PATCH 3.12 092/113] ocfs2: do not write error flag to user structure we cannot copy from/to

From: Ben Hutchings <ben@decadent.org.uk>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 2b462638e41ea62230297c21c4da9955937b7a3c upstream.

If we failed to copy from the structure, writing back the flags leaks 31
bits of kernel memory (the rest of the ir_flags field).

In any case, if we cannot copy from/to the structure, why should we
expect putting just the flags to work?

Also make sure ocfs2_info_handle_freeinode() returns the right error
code if the copy_to_user() fails.

Fixes: ddee5cdb70e6 ('Ocfs2: Add new OCFS2_IOC_INFO ioctl for ocfs2 v8.')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Joel Becker <jlbec@evilplan.org>
Acked-by: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ocfs2/ioctl.c | 129 +++++++++++++++++++------------------------------------
 1 file changed, 43 insertions(+), 86 deletions(-)

diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index fa32ce9b455d..71e249201bcd 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -34,9 +34,8 @@
 		copy_to_user((typeof(a) __user *)b, &(a), sizeof(a))
 
 /*
- * This call is void because we are already reporting an error that may
- * be -EFAULT.  The error will be returned from the ioctl(2) call.  It's
- * just a best-effort to tell userspace that this request caused the error.
+ * This is just a best-effort to tell userspace that this request
+ * caused the error.
  */
 static inline void o2info_set_request_error(struct ocfs2_info_request *kreq,
 					struct ocfs2_info_request __user *req)
@@ -145,136 +144,105 @@ bail:
 int ocfs2_info_handle_blocksize(struct inode *inode,
 				struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_blocksize oib;
 
 	if (o2info_from_user(oib, req))
-		goto bail;
+		return -EFAULT;
 
 	oib.ib_blocksize = inode->i_sb->s_blocksize;
 
 	o2info_set_request_filled(&oib.ib_req);
 
 	if (o2info_to_user(oib, req))
-		goto bail;
-
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oib.ib_req, req);
+		return -EFAULT;
 
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_clustersize(struct inode *inode,
 				  struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_clustersize oic;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oic, req))
-		goto bail;
+		return -EFAULT;
 
 	oic.ic_clustersize = osb->s_clustersize;
 
 	o2info_set_request_filled(&oic.ic_req);
 
 	if (o2info_to_user(oic, req))
-		goto bail;
-
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oic.ic_req, req);
+		return -EFAULT;
 
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_maxslots(struct inode *inode,
 			       struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_maxslots oim;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oim, req))
-		goto bail;
+		return -EFAULT;
 
 	oim.im_max_slots = osb->max_slots;
 
 	o2info_set_request_filled(&oim.im_req);
 
 	if (o2info_to_user(oim, req))
-		goto bail;
+		return -EFAULT;
 
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oim.im_req, req);
-
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_label(struct inode *inode,
 			    struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_label oil;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oil, req))
-		goto bail;
+		return -EFAULT;
 
 	memcpy(oil.il_label, osb->vol_label, OCFS2_MAX_VOL_LABEL_LEN);
 
 	o2info_set_request_filled(&oil.il_req);
 
 	if (o2info_to_user(oil, req))
-		goto bail;
+		return -EFAULT;
 
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oil.il_req, req);
-
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_uuid(struct inode *inode,
 			   struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_uuid oiu;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oiu, req))
-		goto bail;
+		return -EFAULT;
 
 	memcpy(oiu.iu_uuid_str, osb->uuid_str, OCFS2_TEXT_UUID_LEN + 1);
 
 	o2info_set_request_filled(&oiu.iu_req);
 
 	if (o2info_to_user(oiu, req))
-		goto bail;
-
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oiu.iu_req, req);
+		return -EFAULT;
 
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_fs_features(struct inode *inode,
 				  struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_fs_features oif;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oif, req))
-		goto bail;
+		return -EFAULT;
 
 	oif.if_compat_features = osb->s_feature_compat;
 	oif.if_incompat_features = osb->s_feature_incompat;
@@ -283,39 +251,28 @@ int ocfs2_info_handle_fs_features(struct inode *inode,
 	o2info_set_request_filled(&oif.if_req);
 
 	if (o2info_to_user(oif, req))
-		goto bail;
+		return -EFAULT;
 
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oif.if_req, req);
-
-	return status;
+	return 0;
 }
 
 int ocfs2_info_handle_journal_size(struct inode *inode,
 				   struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_journal_size oij;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
 	if (o2info_from_user(oij, req))
-		goto bail;
+		return -EFAULT;
 
 	oij.ij_journal_size = i_size_read(osb->journal->j_inode);
 
 	o2info_set_request_filled(&oij.ij_req);
 
 	if (o2info_to_user(oij, req))
-		goto bail;
+		return -EFAULT;
 
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oij.ij_req, req);
-
-	return status;
+	return 0;
 }
 
 int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
@@ -371,7 +328,7 @@ int ocfs2_info_handle_freeinode(struct inode *inode,
 	u32 i;
 	u64 blkno = -1;
 	char namebuf[40];
-	int status = -EFAULT, type = INODE_ALLOC_SYSTEM_INODE;
+	int status, type = INODE_ALLOC_SYSTEM_INODE;
 	struct ocfs2_info_freeinode *oifi = NULL;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 	struct inode *inode_alloc = NULL;
@@ -383,8 +340,10 @@ int ocfs2_info_handle_freeinode(struct inode *inode,
 		goto out_err;
 	}
 
-	if (o2info_from_user(*oifi, req))
-		goto bail;
+	if (o2info_from_user(*oifi, req)) {
+		status = -EFAULT;
+		goto out_free;
+	}
 
 	oifi->ifi_slotnum = osb->max_slots;
 
@@ -421,14 +380,16 @@ int ocfs2_info_handle_freeinode(struct inode *inode,
 
 	o2info_set_request_filled(&oifi->ifi_req);
 
-	if (o2info_to_user(*oifi, req))
-		goto bail;
+	if (o2info_to_user(*oifi, req)) {
+		status = -EFAULT;
+		goto out_free;
+	}
 
 	status = 0;
 bail:
 	if (status)
 		o2info_set_request_error(&oifi->ifi_req, req);
-
+out_free:
 	kfree(oifi);
 out_err:
 	return status;
@@ -655,7 +616,7 @@ int ocfs2_info_handle_freefrag(struct inode *inode,
 {
 	u64 blkno = -1;
 	char namebuf[40];
-	int status = -EFAULT, type = GLOBAL_BITMAP_SYSTEM_INODE;
+	int status, type = GLOBAL_BITMAP_SYSTEM_INODE;
 
 	struct ocfs2_info_freefrag *oiff;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
@@ -668,8 +629,10 @@ int ocfs2_info_handle_freefrag(struct inode *inode,
 		goto out_err;
 	}
 
-	if (o2info_from_user(*oiff, req))
-		goto bail;
+	if (o2info_from_user(*oiff, req)) {
+		status = -EFAULT;
+		goto out_free;
+	}
 	/*
 	 * chunksize from userspace should be power of 2.
 	 */
@@ -708,14 +671,14 @@ int ocfs2_info_handle_freefrag(struct inode *inode,
 
 	if (o2info_to_user(*oiff, req)) {
 		status = -EFAULT;
-		goto bail;
+		goto out_free;
 	}
 
 	status = 0;
 bail:
 	if (status)
 		o2info_set_request_error(&oiff->iff_req, req);
-
+out_free:
 	kfree(oiff);
 out_err:
 	return status;
@@ -724,23 +687,17 @@ out_err:
 int ocfs2_info_handle_unknown(struct inode *inode,
 			      struct ocfs2_info_request __user *req)
 {
-	int status = -EFAULT;
 	struct ocfs2_info_request oir;
 
 	if (o2info_from_user(oir, req))
-		goto bail;
+		return -EFAULT;
 
 	o2info_clear_request_filled(&oir);
 
 	if (o2info_to_user(oir, req))
-		goto bail;
+		return -EFAULT;
 
-	status = 0;
-bail:
-	if (status)
-		o2info_set_request_error(&oir, req);
-
-	return status;
+	return 0;
 }
 
 /*
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593031 — [PATCH 3.12 111/113] USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate()

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 070c0b17f6a1ba39dff9be112218127e7e8fd456 upstream.

If acm_submit_read_urbs() fails in acm_port_activate(), error handling
code calls usb_autopm_put_interface() while it is already called
before acm_submit_read_urbs(). The patch reorganizes error handling code
to avoid double decrement of USB interface's PM-usage counter.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/usb/class/cdc-acm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index c78c4f7efb40..545413b76c18 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -517,13 +517,16 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
 	if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
 		dev_err(&acm->control->dev,
 			"%s - usb_submit_urb(ctrl irq) failed\n", __func__);
+		usb_autopm_put_interface(acm->control);
 		goto error_submit_urb;
 	}
 
 	acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
 	if (acm_set_control(acm, acm->ctrlout) < 0 &&
-	    (acm->ctrl_caps & USB_CDC_CAP_LINE))
+	    (acm->ctrl_caps & USB_CDC_CAP_LINE)) {
+		usb_autopm_put_interface(acm->control);
 		goto error_set_control;
+	}
 
 	usb_autopm_put_interface(acm->control);
 
@@ -550,7 +553,6 @@ error_submit_read_urbs:
 error_set_control:
 	usb_kill_urb(acm->ctrlurb);
 error_submit_urb:
-	usb_autopm_put_interface(acm->control);
 error_get_interface:
 disconnected:
 	mutex_unlock(&acm->mutex);
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593032 — [PATCH 3.12 089/113] af_packet: remove a stray tab in packet_set_ring()

From: Dan Carpenter <dan.carpenter@oracle.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit d7cf0c34af067555737193b6c1aa7abaa677f29c upstream.

At first glance it looks like there is a missing curly brace but
actually the code works the same either way.  I have adjusted the
indenting but left the code the same.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/packet/af_packet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3b6e9f551175..dfea5968a582 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3677,7 +3677,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 		 */
 			if (!tx_ring)
 				init_prb_bdqc(po, rb, pg_vec, req_u, tx_ring);
-				break;
+			break;
 		default:
 			break;
 		}
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593034 — [PATCH 3.12 103/113] ipv6: simplify detection of first operational link-local address on interface

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 11ffff752c6a5adc86f7dd397b2f75af8f917c51 upstream.

In commit 1ec047eb4751e3 ("ipv6: introduce per-interface counter for
dad-completed ipv6 addresses") I build the detection of the first
operational link-local address much to complex. Additionally this code
now has a race condition.

Replace it with a much simpler variant, which just scans the address
list when duplicate address detection completes, to check if this is
the first valid link local address and send RS and MLD reports then.

Fixes: 1ec047eb4751e3 ("ipv6: introduce per-interface counter for dad-completed ipv6 addresses")
Reported-by: Jiri Pirko <jiri@resnulli.us>
Cc: Flavio Leitner <fbl@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Flavio Leitner <fbl@redhat.com>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 include/net/if_inet6.h |  1 -
 net/ipv6/addrconf.c    | 38 +++++++++++++++++---------------------
 2 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 02ef7727bb55..587e9dd3e3b4 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -166,7 +166,6 @@ struct inet6_dev {
 	struct net_device	*dev;
 
 	struct list_head	addr_list;
-	int			valid_ll_addr_cnt;
 
 	struct ifmcaddr6	*mc_list;
 	struct ifmcaddr6	*mc_tomb;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 74fe3375aa7a..1452e113e8e4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3237,6 +3237,22 @@ out:
 	in6_ifa_put(ifp);
 }
 
+/* ifp->idev must be at least read locked */
+static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
+{
+	struct inet6_ifaddr *ifpiter;
+	struct inet6_dev *idev = ifp->idev;
+
+	list_for_each_entry(ifpiter, &idev->addr_list, if_list) {
+		if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
+		    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
+				       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
+		    IFA_F_PERMANENT)
+			return false;
+	}
+	return true;
+}
+
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 {
 	struct net_device *dev = ifp->idev->dev;
@@ -3256,14 +3272,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 	 */
 
 	read_lock_bh(&ifp->idev->lock);
-	spin_lock(&ifp->lock);
-	send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL &&
-		   ifp->idev->valid_ll_addr_cnt == 1;
+	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
 	send_rs = send_mld &&
 		  ipv6_accept_ra(ifp->idev) &&
 		  ifp->idev->cnf.rtr_solicits > 0 &&
 		  (dev->flags&IFF_LOOPBACK) == 0;
-	spin_unlock(&ifp->lock);
 	read_unlock_bh(&ifp->idev->lock);
 
 	/* While dad is in progress mld report's source address is in6_addrany.
@@ -4558,19 +4571,6 @@ errout:
 		rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
 
-static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count)
-{
-	write_lock_bh(&ifp->idev->lock);
-	spin_lock(&ifp->lock);
-	if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|
-			    IFA_F_DADFAILED)) == IFA_F_PERMANENT) &&
-	    (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL))
-		ifp->idev->valid_ll_addr_cnt += count;
-	WARN_ON(ifp->idev->valid_ll_addr_cnt < 0);
-	spin_unlock(&ifp->lock);
-	write_unlock_bh(&ifp->idev->lock);
-}
-
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
 	struct net *net = dev_net(ifp->idev->dev);
@@ -4579,8 +4579,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
 	switch (event) {
 	case RTM_NEWADDR:
-		update_valid_ll_addr_cnt(ifp, 1);
-
 		/*
 		 * If the address was optimistic
 		 * we inserted the route at the start of
@@ -4596,8 +4594,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 					      ifp->idev->dev, 0, 0);
 		break;
 	case RTM_DELADDR:
-		update_valid_ll_addr_cnt(ifp, -1);
-
 		if (ifp->idev->cnf.forwarding)
 			addrconf_leave_anycast(ifp);
 		addrconf_leave_solict(ifp->idev, &ifp->addr);
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593035 — [PATCH 3.12 102/113] net: 6lowpan: fix lowpan_header_create non-compression memcpy call

From: Daniel Borkmann <dborkman@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 965801e1eb624154fe5e9dc5d2ff0b7f1951a11c upstream.

In function lowpan_header_create(), we invoke the following code
construct:

  struct ipv6hdr *hdr;
  ...
  hdr = ipv6_hdr(skb);
  ...
  if (...)
    memcpy(hc06_ptr + 1, &hdr->flow_lbl[1], 2);
  else
    memcpy(hc06_ptr, &hdr, 4);

Where the else path of the condition, that is, non-compression
path, calls memcpy() with a pointer to struct ipv6hdr *hdr as
source, thus two levels of indirection. This cannot be correct,
and likely only one level of pointer was intended as source
buffer for memcpy() here.

Fixes: 44331fe2aa0d ("IEEE802.15.4: 6LoWPAN basic support")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Cc: Werner Almesberger <werner@almesberger.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/ieee802154/6lowpan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 70348be444c1..a377d435756e 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -548,7 +548,7 @@ static int lowpan_header_create(struct sk_buff *skb,
 			hc06_ptr += 3;
 		} else {
 			/* compress nothing */
-			memcpy(hc06_ptr, &hdr, 4);
+			memcpy(hc06_ptr, hdr, 4);
 			/* replace the top byte with new ECN | DSCP format */
 			*hc06_ptr = tmp;
 			hc06_ptr += 4;
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593036 — [PATCH 3.12 109/113] net: filter: x86: fix JIT address randomization

From: Alexei Starovoitov <ast@plumgrid.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 773cd38f40b8834be991dbfed36683acc1dd41ee upstream.

bpf_alloc_binary() adds 128 bytes of room to JITed program image
and rounds it up to the nearest page size. If image size is close
to page size (like 4000), it is rounded to two pages:
round_up(4000 + 4 + 128) == 8192
then 'hole' is computed as 8192 - (4000 + 4) = 4188
If prandom_u32() % hole selects a number >= PAGE_SIZE - sizeof(*header)
then kernel will crash during bpf_jit_free():

kernel BUG at arch/x86/mm/pageattr.c:887!
Call Trace:
 [<ffffffff81037285>] change_page_attr_set_clr+0x135/0x460
 [<ffffffff81694cc0>] ? _raw_spin_unlock_irq+0x30/0x50
 [<ffffffff810378ff>] set_memory_rw+0x2f/0x40
 [<ffffffffa01a0d8d>] bpf_jit_free_deferred+0x2d/0x60
 [<ffffffff8106bf98>] process_one_work+0x1d8/0x6a0
 [<ffffffff8106bf38>] ? process_one_work+0x178/0x6a0
 [<ffffffff8106c90c>] worker_thread+0x11c/0x370

since bpf_jit_free() does:
  unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
  struct bpf_binary_header *header = (void *)addr;
to compute start address of 'bpf_binary_header'
and header->pages will pass junk to:
  set_memory_rw(addr, header->pages);

Fix it by making sure that &header->image[prandom_u32() % hole] and &header
are in the same page

Fixes: 314beb9bcabfd ("x86: bpf_jit_comp: secure bpf jit against spraying attacks")
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 1b72000b6be2..1fed139f8eae 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen,
 	memset(header, 0xcc, sz); /* fill whole space with int3 instructions */
 
 	header->pages = sz / PAGE_SIZE;
-	hole = sz - (proglen + sizeof(*header));
+	hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header));
 
 	/* insert a random number of int3 instructions before BPF code */
 	*image_ptr = &header->image[prandom_u32() % hole];
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593038 — [PATCH 3.12 065/113] vfs: fix uninitialized flags in splice_to_pipe()

From: Miklos Szeredi <mszeredi@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 5a81e6a171cdbd1fa8bc1fdd80c23d3d71816fac upstream.

Flags (PIPE_BUF_FLAG_PACKET, PIPE_BUF_FLAG_GIFT) could remain on the
unused part of the pipe ring buffer.  Previously splice_to_pipe() left
the flags value alone, which could result in incorrect behavior.

Uninitialized flags appears to have been there from the introduction of
the splice syscall.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/splice.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/splice.c b/fs/splice.c
index 51ce51b9af6a..2e012472f97b 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -215,6 +215,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
 			buf->len = spd->partial[page_nr].len;
 			buf->private = spd->partial[page_nr].private;
 			buf->ops = spd->ops;
+			buf->flags = 0;
 			if (spd->flags & SPLICE_F_GIFT)
 				buf->flags |= PIPE_BUF_FLAG_GIFT;
 
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593039 — [PATCH 3.12 077/113] tty: serial: msm: Fix module autoload

From: Javier Martinez Canillas <javier@osg.samsung.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit abe81f3b8ed2996e1712d26d38ff6b73f582c616 upstream.

If the driver is built as a module, autoload won't work because the module
alias information is not filled. So user-space can't match the registered
device with the corresponding module.

Export the module alias information using the MODULE_DEVICE_TABLE() macro.

Before this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
$

After this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
alias:          of:N*T*Cqcom,msm-uartdmC*
alias:          of:N*T*Cqcom,msm-uartdm
alias:          of:N*T*Cqcom,msm-uartC*
alias:          of:N*T*Cqcom,msm-uart

Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/tty/serial/msm_serial.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index c0f2b3e5452f..90ed37e45006 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -973,6 +973,7 @@ static struct of_device_id msm_match_table[] = {
 	{ .compatible = "qcom,msm-uartdm" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, msm_match_table);
 
 static struct platform_driver msm_platform_driver = {
 	.remove = msm_serial_remove,
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593040 — [PATCH 3.12 063/113] l2tp: do not use udp_ioctl()

From: Eric Dumazet <edumazet@google.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 72fb96e7bdbbdd4421b0726992496531060f3636 ]

udp_ioctl(), as its name suggests, is used by UDP protocols,
but is also used by L2TP :(

L2TP should use its own handler, because it really does not
look the same.

SIOCINQ for instance should not assume UDP checksum or headers.

Thanks to Andrey and syzkaller team for providing the report
and a nice reproducer.

While crashes only happen on recent kernels (after commit
7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")), this
probably needs to be backported to older kernels.

Fixes: 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Fixes: 85584672012e ("udp: Fix udp_poll() and ioctl()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/l2tp/l2tp_core.h |  1 +
 net/l2tp/l2tp_ip.c   | 27 ++++++++++++++++++++++++++-
 net/l2tp/l2tp_ip6.c  |  2 +-
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 6f251cbc2ed7..f8f1089ee8f2 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -261,6 +261,7 @@ extern int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int
 
 extern int l2tp_nl_register_ops(enum l2tp_pwtype pw_type, const struct l2tp_nl_cmd_ops *ops);
 extern void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 
 /* Session reference counts. Incremented when code obtains a reference
  * to a session.
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 81f317f841b4..b69b762159ad 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -11,6 +11,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <asm/ioctls.h>
 #include <linux/icmp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -555,6 +556,30 @@ out:
 	return err ? err : copied;
 }
 
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+{
+	struct sk_buff *skb;
+	int amount;
+
+	switch (cmd) {
+	case SIOCOUTQ:
+		amount = sk_wmem_alloc_get(sk);
+		break;
+	case SIOCINQ:
+		spin_lock_bh(&sk->sk_receive_queue.lock);
+		skb = skb_peek(&sk->sk_receive_queue);
+		amount = skb ? skb->len : 0;
+		spin_unlock_bh(&sk->sk_receive_queue.lock);
+		break;
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return put_user(amount, (int __user *)arg);
+}
+EXPORT_SYMBOL(l2tp_ioctl);
+
 static struct proto l2tp_ip_prot = {
 	.name		   = "L2TP/IP",
 	.owner		   = THIS_MODULE,
@@ -563,7 +588,7 @@ static struct proto l2tp_ip_prot = {
 	.bind		   = l2tp_ip_bind,
 	.connect	   = l2tp_ip_connect,
 	.disconnect	   = l2tp_ip_disconnect,
-	.ioctl		   = udp_ioctl,
+	.ioctl		   = l2tp_ioctl,
 	.destroy	   = l2tp_ip_destroy_sock,
 	.setsockopt	   = ip_setsockopt,
 	.getsockopt	   = ip_getsockopt,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 7c1a288f0b20..8783dfe5ac6c 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -721,7 +721,7 @@ static struct proto l2tp_ip6_prot = {
 	.bind		   = l2tp_ip6_bind,
 	.connect	   = l2tp_ip6_connect,
 	.disconnect	   = l2tp_ip6_disconnect,
-	.ioctl		   = udp_ioctl,
+	.ioctl		   = l2tp_ioctl,
 	.destroy	   = l2tp_ip6_destroy_sock,
 	.setsockopt	   = ipv6_setsockopt,
 	.getsockopt	   = ipv6_getsockopt,
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593041 — [PATCH 3.12 068/113] futex: Move futex_init() to core_initcall

From: Yang Yang <yang.yang29@zte.com.cn>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 25f71d1c3e98ef0e52371746220d66458eac75bc upstream.

The UEVENT user mode helper is enabled before the initcalls are executed
and is available when the root filesystem has been mounted.

The user mode helper is triggered by device init calls and the executable
might use the futex syscall.

futex_init() is marked __initcall which maps to device_initcall, but there
is no guarantee that futex_init() is invoked _before_ the first device init
call which triggers the UEVENT user mode helper.

If the user mode helper uses the futex syscall before futex_init() then the
syscall crashes with a NULL pointer dereference because the futex subsystem
has not been initialized yet.

Move futex_init() to core_initcall so futexes are initialized before the
root filesystem is mounted and the usermode helper becomes available.

[ tglx: Rewrote changelog ]

Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
Cc: jiang.biao2@zte.com.cn
Cc: jiang.zhengxiong@zte.com.cn
Cc: zhong.weidong@zte.com.cn
Cc: deng.huali@zte.com.cn
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1483085875-6130-1-git-send-email-yang.yang29@zte.com.cn
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 kernel/futex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 509bdd404414..9c6394afd10f 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2905,4 +2905,4 @@ static int __init futex_init(void)
 
 	return 0;
 }
-__initcall(futex_init);
+core_initcall(futex_init);
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593042 — [PATCH 3.12 076/113] net: socket: fix recvmmsg not returning error from sock_error

From: Maxime Jayat <maxime.jayat@mobile-devices.fr>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit e623a9e9dec29ae811d11f83d0074ba254aba374 ]

Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
changed the exit path of recvmmsg to always return the datagrams
variable and modified the error paths to set the variable to the error
code returned by recvmsg if necessary.

However in the case sock_error returned an error, the error code was
then ignored, and recvmmsg returned 0.

Change the error path of recvmmsg to correctly return the error code
of sock_error.

The bug was triggered by using recvmmsg on a CAN interface which was
not up. Linux 4.6 and later return 0 in this case while earlier
releases returned -ENETDOWN.

Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/socket.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/socket.c b/net/socket.c
index 64c47cd62e14..bc3f3f726d47 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2334,8 +2334,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 		return err;
 
 	err = sock_error(sock->sk);
-	if (err)
+	if (err) {
+		datagrams = err;
 		goto out_put;
+	}
 
 	entry = mmsg;
 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593043 — [PATCH 3.12 080/113] USB: serial: ftdi_sio: fix modem-status error handling

From: Johan Hovold <johan@kernel.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 427c3a95e3e29e65f59d99aaf320d7506f3eed57 upstream.

Make sure to detect short responses when fetching the modem status in
order to avoid parsing uninitialised buffer data and having bits of it
leak to user space.

Note that we still allow for short 1-byte responses.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/usb/serial/ftdi_sio.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d1b76b0a67df..5ed104787474 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2465,8 +2465,12 @@ static int ftdi_get_modem_status(struct usb_serial_port *port,
 			FTDI_SIO_GET_MODEM_STATUS_REQUEST_TYPE,
 			0, priv->interface,
 			buf, len, WDR_TIMEOUT);
-	if (ret < 0) {
+
+	/* NOTE: We allow short responses and handle that below. */
+	if (ret < 1) {
 		dev_err(&port->dev, "failed to get modem status: %d\n", ret);
+		if (ret >= 0)
+			ret = -EIO;
 		ret = usb_translate_errors(ret);
 		goto out;
 	}
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593044 — [PATCH 3.12 090/113] ext4: validate s_first_meta_bg at mount time

From: Eryu Guan <guaneryu@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.

Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.

ext4_calculate_overhead():
  buf = get_zeroed_page(GFP_NOFS);  <=== PAGE_SIZE buffer
  blks = count_overhead(sb, i, buf);

count_overhead():
  for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
          ext4_set_bit(EXT4_B2C(sbi, s++), buf);   <=== buffer overrun
          count++;
  }

This can be reproduced easily for me by this script:

  #!/bin/bash
  rm -f fs.img
  mkdir -p /mnt/ext4
  fallocate -l 16M fs.img
  mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
  debugfs -w -R "ssv first_meta_bg 842150400" fs.img
  mount -o loop fs.img /mnt/ext4

Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.

[js] use EXT4_HAS_INCOMPAT_FEATURE instead of new
     ext4_has_feature_meta_bg

Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ext4/super.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 6362896f5875..a263fa90edfa 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3852,6 +3852,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
 		   EXT4_DESC_PER_BLOCK(sb);
+	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG)) {
+		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+			ext4_msg(sb, KERN_WARNING,
+				 "first meta block group too large: %u "
+				 "(group descriptor block count %u)",
+				 le32_to_cpu(es->s_first_meta_bg), db_count);
+			goto failed_mount;
+		}
+	}
 	sbi->s_group_desc = ext4_kvmalloc(db_count *
 					  sizeof(struct buffer_head *),
 					  GFP_KERNEL);
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593045 — [PATCH 3.12 088/113] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down

From: Michael Schenk <michael.schenk@albis-elcon.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 575ddce0507789bf9830d089557d2199d2f91865 upstream.

In the function rtl_usb_start we pre-allocate a certain number of urbs
for RX path but they will not be freed when calling rtl_usb_stop. This
results in leaking urbs when doing ifconfig up and down. Eventually,
the system has no available urbs.

Signed-off-by: Michael Schenk <michael.schenk@albis-elcon.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/wireless/rtlwifi/usb.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 832560aa2274..2719ca31b469 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -830,6 +830,7 @@ static void rtl_usb_stop(struct ieee80211_hw *hw)
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+	struct urb *urb;
 
 	/* should after adapter start and interrupt enable. */
 	set_hal_stop(rtlhal);
@@ -837,6 +838,23 @@ static void rtl_usb_stop(struct ieee80211_hw *hw)
 	/* Enable software */
 	SET_USB_STOP(rtlusb);
 	rtl_usb_deinit(hw);
+
+	/* free pre-allocated URBs from rtl_usb_start() */
+	usb_kill_anchored_urbs(&rtlusb->rx_submitted);
+
+	tasklet_kill(&rtlusb->rx_work_tasklet);
+	cancel_work_sync(&rtlpriv->works.lps_change_work);
+
+	flush_workqueue(rtlpriv->works.rtl_wq);
+
+	skb_queue_purge(&rtlusb->rx_queue);
+
+	while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) {
+		usb_free_coherent(urb->dev, urb->transfer_buffer_length,
+				urb->transfer_buffer, urb->transfer_dma);
+		usb_free_urb(urb);
+	}
+
 	rtlpriv->cfg->ops->hw_disable(hw);
 }
 
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593046 — [PATCH 3.12 096/113] drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set()

From: Dan Carpenter <dan.carpenter@oracle.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit bdefc8cbdfc71ea73e0573dbd2d24c0a68232218 upstream.

We should be taking the minimum here instead of the max.  It could lead
to a buffer overflow.

Fixes: 438d99e3b175 ('drm/nvd0/disp: initial crtc object implementation')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

a/drm/nv50_display.c b/drm/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/gpu/drm/nouveau/nv50_display.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
 		    uint32_t start, uint32_t size)
 {
 	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-	u32 end = max(start + size, (u32)256);
+	u32 end = min_t(u32, start + size, 256);
 	u32 i;
 
 	for (i = start; i < end; i++) {
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593047 — [PATCH 3.12 086/113] x86/platform/goldfish: Prevent unconditional loading

From: Thomas Gleixner <tglx@linutronix.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb upstream.

The goldfish platform code registers the platform device unconditionally
which causes havoc in several ways if the goldfish_pdev_bus driver is
enabled:

 - Access to the hardcoded physical memory region, which is either not
   available or contains stuff which is completely unrelated.

 - Prevents that the interrupt of the serial port can be requested

 - In case of a spurious interrupt it goes into a infinite loop in the
   interrupt handler of the pdev_bus driver (which needs to be fixed
   seperately).

Add a 'goldfish' command line option to make the registration opt-in when
the platform is compiled in.

I'm seriously grumpy about this engineering trainwreck, which has seven
SOBs from Intel developers for 50 lines of code. And none of them figured
out that this is broken. Impressive fail!

Fixes: ddd70cf93d78 ("goldfish: platform device for x86")
Reported-by: Gabriel C <nix.or.die@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 Documentation/kernel-parameters.txt   |  4 ++++
 arch/x86/platform/goldfish/goldfish.c | 14 +++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 64c6734da6d8..1ebce8682832 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1013,6 +1013,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 			When zero, profiling data is discarded and associated
 			debugfs files are removed at module unload time.
 
+	goldfish	[X86] Enable the goldfish android emulator platform.
+			Don't use this when you are not running on the
+			android emulator
+
 	gpt		[EFI] Forces disk with valid GPT signature but
 			invalid Protective MBR to be treated as GPT.
 
diff --git a/arch/x86/platform/goldfish/goldfish.c b/arch/x86/platform/goldfish/goldfish.c
index 1693107a518e..0d17c0aafeb1 100644
--- a/arch/x86/platform/goldfish/goldfish.c
+++ b/arch/x86/platform/goldfish/goldfish.c
@@ -42,10 +42,22 @@ static struct resource goldfish_pdev_bus_resources[] = {
 	}
 };
 
+static bool goldfish_enable __initdata;
+
+static int __init goldfish_setup(char *str)
+{
+	goldfish_enable = true;
+	return 0;
+}
+__setup("goldfish", goldfish_setup);
+
 static int __init goldfish_init(void)
 {
+	if (!goldfish_enable)
+		return -ENODEV;
+
 	platform_device_register_simple("goldfish_pdev_bus", -1,
-						goldfish_pdev_bus_resources, 2);
+					goldfish_pdev_bus_resources, 2);
 	return 0;
 }
 device_initcall(goldfish_init);
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593048 — [PATCH 3.12 074/113] dccp: fix freeing skb too early for IPV6_RECVPKTINFO

From: Andrey Konovalov <andreyknvl@google.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 ]

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns.

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
is saved to ireq->pktopts and the ref count for skb is incremented in
dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
in dccp_rcv_state_process.

Fix by calling consume_skb instead of doing goto discard and therefore
calling __kfree_skb.

Similar fixes for TCP:

fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
simply consumed

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/dccp/input.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/dccp/input.c b/net/dccp/input.c
index 14cdafad7a90..e511ccc74a07 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
 								    skb) < 0)
 				return 1;
-			goto discard;
+			consume_skb(skb);
+			return 0;
 		}
 		if (dh->dccph_type == DCCP_PKT_RESET)
 			goto discard;
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

#1593049 — [PATCH 3.12 075/113] irda: Fix lockdep annotations in hashbin_delete().

From: "David S. Miller" <davem@davemloft.net>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 4c03b862b12f980456f9de92db6d508a4999b788 ]

A nested lock depth was added to the hasbin_delete() code but it
doesn't actually work some well and results in tons of lockdep splats.

Fix the code instead to properly drop the lock around the operation
and just keep peeking the head of the hashbin queue.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/irda/irqueue.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c
index 7152624ed5f1..26ccd65cdcab 100644
--- a/net/irda/irqueue.c
+++ b/net/irda/irqueue.c
@@ -385,9 +385,6 @@ EXPORT_SYMBOL(hashbin_new);
  *    for deallocating this structure if it's complex. If not the user can
  *    just supply kfree, which should take care of the job.
  */
-#ifdef CONFIG_LOCKDEP
-static int hashbin_lock_depth = 0;
-#endif
 int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 {
 	irda_queue_t* queue;
@@ -398,22 +395,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 	IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;);
 
 	/* Synchronize */
-	if ( hashbin->hb_type & HB_LOCK ) {
-		spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags,
-					 hashbin_lock_depth++);
-	}
+	if (hashbin->hb_type & HB_LOCK)
+		spin_lock_irqsave(&hashbin->hb_spinlock, flags);
 
 	/*
 	 *  Free the entries in the hashbin, TODO: use hashbin_clear when
 	 *  it has been shown to work
 	 */
 	for (i = 0; i < HASHBIN_SIZE; i ++ ) {
-		queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
-		while (queue ) {
-			if (free_func)
-				(*free_func)(queue);
-			queue = dequeue_first(
-				(irda_queue_t**) &hashbin->hb_queue[i]);
+		while (1) {
+			queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
+
+			if (!queue)
+				break;
+
+			if (free_func) {
+				if (hashbin->hb_type & HB_LOCK)
+					spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
+				free_func(queue);
+				if (hashbin->hb_type & HB_LOCK)
+					spin_lock_irqsave(&hashbin->hb_spinlock, flags);
+			}
 		}
 	}
 
@@ -422,12 +424,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 	hashbin->magic = ~HB_MAGIC;
 
 	/* Release lock */
-	if ( hashbin->hb_type & HB_LOCK) {
+	if (hashbin->hb_type & HB_LOCK)
 		spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
-#ifdef CONFIG_LOCKDEP
-		hashbin_lock_depth--;
-#endif
-	}
 
 	/*
 	 *  Free the hashbin structure
-- 
2.12.0

[toc] | [prev] | [next] | [standalone]

Page 1 of 5  [1] 2 3 4 5  Next page →

Back to top | Article view | linux.kernel

csiph-web