Skip to content

L
linux
Switch branch/tag
  1. 07 Nov, 2014 26 commits
  3. 05 Nov, 2014 12 commits
    • Felipe Balbi's avatar
      usb: dwc3: gadget: fix set_halt() bug with pending transfers · 2d0d499a
      Felipe Balbi authored 
      commit 7a608559 upstream.

According to our Gadget Framework API documentation,
->set_halt() *must* return -EAGAIN if we have pending
transfers (on either direction) or FIFO isn't empty (on
TX endpoints).

Fix this bug so that the mass storage gadget can be used
without stall=0 parameter.

This patch should be backported to all kernels since v3.2.
Suggested-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
[ kamal: backport to 3.13-stable: omitted ep_set_wedge() change ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      2d0d499a
    • Karl Beldan's avatar
      mac80211: fix typo in starting baserate for rts_cts_rate_idx · 863fdb61
      Karl Beldan authored 
      commit c7abf25a upstream.

It affects non-(V)HT rates and can lead to selecting an rts_cts rate
that is not a basic rate or way superior to the reference rate (ATM
rates[0] used for the 1st attempt of the protected frame data).

E.g, assuming drivers register growing (bitrate) sorted tables of
ieee80211_rate-s, having :
- rates[0].idx == d'2 and basic_rates == b'10100
will select rts_cts idx b'10011 & ~d'(BIT(2)-1), i.e. 1, likewise
- rates[0].idx == d'2 and basic_rates == b'10001
will select rts_cts idx b'10000
The first is not a basic rate and the second is > rates[0].

Also, wrt severity of the addressed misbehavior, ATM we only have one
rts_cts_rate_idx rather than one per rate table entry, so this idx might
still point to bitrates > rates[1..MAX_RATES].

Fixes: 5253ffb8 ("mac80211: always pick a basic rate to tx RTS/CTS for pre-HT rates")
Signed-off-by: default avatarKarl Beldan <karl.beldan@rivierawaves.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      863fdb61
    • Ray Jui's avatar
      spi: pl022: Fix incorrect dma_unmap_sg · 9b61b906
      Ray Jui authored 
      commit 3ffa6158 upstream.

When mapped RX DMA entries are unmapped in an error condition when DMA
is firstly configured in the driver, the number of TX DMA entries was
passed in, which is incorrect
Signed-off-by: default avatarRay Jui <rjui@broadcom.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      9b61b906
    • Fabio Estevam's avatar
      iio: adc: mxs-lradc: Disable the clock on probe failure · 2a895c4d
      Fabio Estevam authored 
      commit 75d7ed3b upstream.

We should disable lradc->clk in the case of errors in the probe function.
Signed-off-by: default avatarFabio Estevam <fabio.estevam@freescale.com>
Reviewed-by: default avatarMarek Vasut <marex@denx.de>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      2a895c4d
    • Fabio Estevam's avatar
      iio: mxs-lradc: Propagate the real error code on platform_get_irq() failure · b05712df
      Fabio Estevam authored 
      commit 9610e08e upstream.

No need to return a 'fake' return value on platform_get_irq() failure.

Just return the error code itself instead.
Signed-off-by: default avatarFabio Estevam <fabio.estevam@freescale.com>
Acked-by: default avatarMarek Vasut <marex@denx.de>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
[ kamal: 3.13-stable prereq for
  75d7ed3b iio: adc: mxs-lradc: Disable the clock on probe failure ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      b05712df
    • Robin van der Gracht's avatar
      iio: st_sensors: Fix buffer copy · 1d4c6b89
      Robin van der Gracht authored 
      commit 4250c90b upstream.

Use byte_for_channel as iterator to properly initialize the buffer.
Signed-off-by: default avatarRobin van der Gracht <robin@protonic.nl>
Acked-by: default avatarDenis Ciocca <denis.ciocca@st.com>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      1d4c6b89
    • Lars-Peter Clausen's avatar
      staging:iio:ad5933: Drop "raw" from channel names · 5cc642d8
      Lars-Peter Clausen authored 
      commit 6822ee34 upstream.

"raw" is the name of a channel property, but should not be part of the
channel name itself.
Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      5cc642d8
    • Lars-Peter Clausen's avatar
      staging:iio:ad5933: Fix NULL pointer deref when enabling buffer · 0e61c466
      Lars-Peter Clausen authored 
      commit 824269c5 upstream.

In older versions of the IIO framework it was possible to pass a
completely different set of channels to iio_buffer_register() as the one
that is assigned to the IIO device. Commit 959d2952 ("staging:iio: make
iio_sw_buffer_preenable much more general.") introduced a restriction that
requires that the set of channels that is passed to iio_buffer_register() is
a subset of the channels assigned to the IIO device as the IIO core will use
the list of channels that is assigned to the device to lookup a channel by
scan index in iio_compute_scan_bytes(). If it can not find the channel the
function will crash. This patch fixes the issue by making sure that the same
set of channels is assigned to the IIO device and passed to
iio_buffer_register().

Fixes the follow NULL pointer derefernce kernel crash:
	Unable to handle kernel NULL pointer dereference at virtual address 00000016
	pgd = d53d0000
	[00000016] *pgd=1534e831, *pte=00000000, *ppte=00000000
	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
	Modules linked in:
	CPU: 1 PID: 1626 Comm: bash Not tainted 3.15.0-19969-g2a180eb-dirty #9545
	task: d6c124c0 ti: d539a000 task.ti: d539a000
	PC is at iio_compute_scan_bytes+0x34/0xa8
	LR is at iio_compute_scan_bytes+0x34/0xa8
	pc : [<c03052e4>]    lr : [<c03052e4>]    psr: 60070013
	sp : d539beb8  ip : 00000001  fp : 00000000
	r10: 00000002  r9 : 00000000  r8 : 00000001
	r7 : 00000000  r6 : d6dc8800  r5 : d7571000  r4 : 00000002
	r3 : d7571000  r2 : 00000044  r1 : 00000001  r0 : 00000000
	Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
	Control: 18c5387d  Table: 153d004a  DAC: 00000015
	Process bash (pid: 1626, stack limit = 0xd539a240)
	Stack: (0xd539beb8 to 0xd539c000)
	bea0:                                                       c02fc0e4 d7571000
	bec0: d76c1640 d6dc8800 d757117c 00000000 d757112c c0305b04 d76c1690 d76c1640
	bee0: d7571188 00000002 00000000 d7571000 d539a000 00000000 000dd1c8 c0305d54
	bf00: d7571010 0160b868 00000002 c69d3900 d7573278 d7573308 c69d3900 c01ece90
	bf20: 00000002 c0103fac c0103f6c d539bf88 00000002 c69d3b00 c69d3b0c c0103468
	bf40: 00000000 00000000 d7694a00 00000002 000af408 d539bf88 c000dd84 c00b2f94
	bf60: d7694a00 000af408 00000002 d7694a00 d7694a00 00000002 000af408 c000dd84
	bf80: 00000000 c00b32d0 00000000 00000000 00000002 b6f1aa78 00000002 000af408
	bfa0: 00000004 c000dc00 b6f1aa78 00000002 00000001 000af408 00000002 00000000
	bfc0: b6f1aa78 00000002 000af408 00000004 be806a4c 000a6094 00000000 000dd1c8
	bfe0: 00000000 be8069cc b6e8ab77 b6ec125c 40070010 00000001 22940489 154a5007
	[<c03052e4>] (iio_compute_scan_bytes) from [<c0305b04>] (__iio_update_buffers+0x248/0x438)
	[<c0305b04>] (__iio_update_buffers) from [<c0305d54>] (iio_buffer_store_enable+0x60/0x7c)
	[<c0305d54>] (iio_buffer_store_enable) from [<c01ece90>] (dev_attr_store+0x18/0x24)
	[<c01ece90>] (dev_attr_store) from [<c0103fac>] (sysfs_kf_write+0x40/0x4c)
	[<c0103fac>] (sysfs_kf_write) from [<c0103468>] (kernfs_fop_write+0x110/0x154)
	[<c0103468>] (kernfs_fop_write) from [<c00b2f94>] (vfs_write+0xd0/0x160)
	[<c00b2f94>] (vfs_write) from [<c00b32d0>] (SyS_write+0x40/0x78)
	[<c00b32d0>] (SyS_write) from [<c000dc00>] (ret_fast_syscall+0x0/0x30)
	Code: ea00000e e1a01008 e1a00005 ebfff6fc (e5d0a016)

Fixes: 959d2952 ("staging:iio: make iio_sw_buffer_preenable much more general.")
Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      0e61c466
    • Nadav Amit's avatar
      KVM: x86: Fix far-jump to non-canonical check · f9bffe04
      Nadav Amit authored 
      commit 7e46dddd upstream.

Commit d1442d85 ("KVM: x86: Handle errors when RIP is set during far
jumps") introduced a bug that caused the fix to be incomplete.  Due to
incorrect evaluation, far jump to segment with L bit cleared (i.e., 32-bit
segment) and RIP with any of the high bits set (i.e, RIP[63:32] != 0) set may
not trigger #GP.  As we know, this imposes a security problem.

In addition, the condition for two warnings was incorrect.

Fixes: d1442d85Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
[Add #ifdef CONFIG_X86_64 to avoid complaints of undefined behavior. - Paolo]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
[ kamal: backport to 3.13-stable: omitted WARN_ON fixes (not in 3.13) ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      f9bffe04
    • Nadav Amit's avatar
      KVM: x86: Handle errors when RIP is set during far jumps · b8ba339d
      Nadav Amit authored 
      commit d1442d85 upstream.

Far jmp/call/ret may fault while loading a new RIP.  Currently KVM does not
handle this case, and may result in failed vm-entry once the assignment is
done.  The tricky part of doing so is that loading the new CS affects the
VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
unconsistent state.  Therefore, this patch saves on 64-bit the old CS
descriptor and restores it if loading RIP failed.

This fixes CVE-2014-3647.
Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
[ kamal: backport to 3.13-stable: context; __long_segment_descriptor args ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      b8ba339d
    • Paolo Bonzini's avatar
      KVM: x86: use new CS.RPL as CPL during task switch · 208f481f
      Paolo Bonzini authored 
      commit 2356aaeb upstream.

During task switch, all of CS.DPL, CS.RPL, SS.DPL must match (in addition
to all the other requirements) and will be the new CPL.  So far this
worked by carefully setting the CS selector and flag before doing the
task switch; setting CS.selector will already change the CPL.

However, this will not work once we get the CPL from SS.DPL, because
then you will have to set the full segment descriptor cache to change
the CPL.  ctxt->ops->cpl(ctxt) will then return the old CPL during the
task switch, and the check that SS.DPL == CPL will fail.

Temporarily assume that the CPL comes from CS.RPL during task switch
to a protected-mode task.  This is the same approach used in QEMU's
emulation code, which (until version 2.0) manually tracks the CPL.
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
[ kamal: 3.13-stable prereq for
  d1442d85 KVM: x86: Handle errors when RIP is set during far jumps ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      208f481f
    • Quentin Casasnovas's avatar
      kvm: fix excessive pages un-pinning in kvm_iommu_map error path. · 6f74f650
      Quentin Casasnovas authored 
      commit 3d32e4db upstream.

The third parameter of kvm_unpin_pages() when called from
kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
and not the page size.

This error was facilitated with an inconsistent API: kvm_pin_pages() takes
a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
by matching the two.

This was introduced by commit 350b8bdd ("kvm: iommu: fix the third parameter
of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
un-pinning for pages intended to be un-pinned (i.e. memory leak) but
unfortunately potentially aggravated the number of pages we un-pin that
should have stayed pinned. As far as I understand though, the same
practical mitigations apply.

This issue was found during review of Red Hat 6.6 patches to prepare
Ksplice rebootless updates.

Thanks to Vegard for his time on a late Friday evening to help me in
understanding this code.

Fixes: 350b8bdd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
Signed-off-by: default avatarQuentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: default avatarJamie Iles <jamie.iles@oracle.com>
Reviewed-by: default avatarSasha Levin <sasha.levin@oracle.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      6f74f650
  5. 31 Oct, 2014 2 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7