1. 24 Nov, 2016 10 commits
  2. 22 Nov, 2016 12 commits
  3. 20 Nov, 2016 1 commit
  4. 18 Nov, 2016 3 commits
    • Peter Hurley's avatar
      tty: Prevent ldisc drivers from re-using stale tty fields · e1a77178
      Peter Hurley authored
      commit dd42bf11 upstream.
      
      Line discipline drivers may mistakenly misuse ldisc-related fields
      when initializing. For example, a failure to initialize tty->receive_room
      in the N_GIGASET_M101 line discipline was recently found and fixed [1].
      Now, the N_X25 line discipline has been discovered accessing the previous
      line discipline's already-freed private data [2].
      
      Harden the ldisc interface against misuse by initializing revelant
      tty fields before instancing the new line discipline.
      
      [1]
          commit fd98e941
          Author: Tilman Schmidt <tilman@imap.cc>
          Date:   Tue Jul 14 00:37:13 2015 +0200
      
          isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
      
      [2] Report from Sasha Levin <sasha.levin@oracle.com>
          [  634.336761] ==================================================================
          [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
          [  634.339558] Read of size 4 by task syzkaller_execu/8981
          [  634.340359] =============================================================================
          [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
          ...
          [  634.405018] Call Trace:
          [  634.405277] dump_stack (lib/dump_stack.c:52)
          [  634.405775] print_trailer (mm/slub.c:655)
          [  634.406361] object_err (mm/slub.c:662)
          [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
          [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
          [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
          [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
          [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
          [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
          [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
          [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
          [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
      
      Cc: Tilman Schmidt <tilman@imap.cc>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      e1a77178
    • Yuta Kobayashi's avatar
      HID: microsoft: Add Surface 4 type cover pro 4 (JP) · 3309cd4e
      Yuta Kobayashi authored
      commit b490a853 upstream.
      
      Adding support for the Microsoft Surface 4 Type Cover Pro (JP).
      Signed-off-by: default avatarYuta Kobayashi <alu.ula@outlook.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Oliver Neukum <ONeukum@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      3309cd4e
    • AceLan Kao's avatar
      HID: input: add mic mute key on HP slim keyboard · bee0e10e
      AceLan Kao authored
      commit 08fc9473 upstream.
      
      Add MIC mute key which is found on HP Business Slim Keyboard
      
      T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 23 Spd=1.5 MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
      P:  Vendor=03f0 ProdID=2f4a Rev=00.10
      S:  Manufacturer=Chicony
      S:  Product=HP Business Slim Keyboard
      C:  #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=01 Driver=usbhid
      I:  If#= 1 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Oliver Neukum <ONeukum@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      bee0e10e
  5. 09 Nov, 2016 4 commits
    • James Hogan's avatar
      KVM: MIPS: Precalculate MMIO load resume PC · ff686d55
      James Hogan authored
      commit e1e575f6 upstream.
      
      The advancing of the PC when completing an MMIO load is done before
      re-entering the guest, i.e. before restoring the guest ASID. However if
      the load is in a branch delay slot it may need to access guest code to
      read the prior branch instruction. This isn't safe in TLB mapped code at
      the moment, nor in the future when we'll access unmapped guest segments
      using direct user accessors too, as it could read the branch from host
      user memory instead.
      
      Therefore calculate the resume PC in advance while we're still in the
      right context and save it in the new vcpu->arch.io_pc (replacing the no
      longer needed vcpu->arch.pending_load_cause), and restore it on MMIO
      completion.
      
      Fixes: e685c689 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: kvm@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      ff686d55
    • Nicholas Mc Guire's avatar
      MIPS: KVM: Fix unused variable build warning · fb357699
      Nicholas Mc Guire authored
      commit 5f508c43 upstream.
      
      As kvm_mips_complete_mmio_load() did not yet modify PC at this point
      as James Hogans <james.hogan@imgtec.com> explained the curr_pc variable
      and the comments along with it can be dropped.
      Signed-off-by: default avatarNicholas Mc Guire <hofrat@osadl.org>
      Link: http://lkml.org/lkml/2015/5/8/422
      Cc: Gleb Natapov <gleb@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: James Hogan <james.hogan@imgtec.com>
      Cc: kvm@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Cc: linux-kernel@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/9993/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      fb357699
    • James Hogan's avatar
      KVM: MIPS: Drop other CPU ASIDs on guest MMU changes · e01f1c70
      James Hogan authored
      commit 91e4f1b6 upstream.
      
      When a guest TLB entry is replaced by TLBWI or TLBWR, we only invalidate
      TLB entries on the local CPU. This doesn't work correctly on an SMP host
      when the guest is migrated to a different physical CPU, as it could pick
      up stale TLB mappings from the last time the vCPU ran on that physical
      CPU.
      
      Therefore invalidate both user and kernel host ASIDs on other CPUs,
      which will cause new ASIDs to be generated when it next runs on those
      CPUs.
      
      We're careful only to do this if the TLB entry was already valid, and
      only for the kernel ASID where the virtual address it mapped is outside
      of the guest user address range.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: kvm@vger.kernel.org
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      e01f1c70
    • Jiri Slaby's avatar
      Revert "KVM: MIPS: Drop other CPU ASIDs on guest MMU changes" · f668f2ee
      Jiri Slaby authored
      This reverts commit 168e5ebb, which is
      upstream commit 91e4f1b6. It caused
      build failures as it was improperly backported. New version is
      approaching, so revert this bad one.
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: James Hogan <james.hogan@imgtec.com>
      f668f2ee
  6. 08 Nov, 2016 10 commits
    • Jiri Slaby's avatar
      Linux 3.12.67 · f39d88a0
      Jiri Slaby authored
      f39d88a0
    • Yonglong Wu's avatar
      usb: hub: change CLEAR_FEATURE to SET_FEATURE · caba5960
      Yonglong Wu authored
      commit 4e248000 upstream.
      
      In USB20 specification, describes in chapter 9.4.5: The Remote Wakeup
      field can be modified by the SetFeature() and ClearFeature() requests
      using the DEVICE_REMOTE_WAKEUP feature selector.
      
      In USB30 specification, also describes in chapter 9.4.5: The Function
      Remote Wakeup field can be modified by the SetFeature() requests
      using the FUNCTION_SUSPEND feature selector. In chapter 9.4.9 Set
      Feature reference, it describes Function Remote Wake Enabled/Disabled
      at suspend options by SET_FEATURE.
      
      In USB30 specification only mentioned SetFeature(), so we need use
      SET_FEATURE replace CLEAR_FEATURE to disable USB30 function remote
      wakeup in suspend options.
      Signed-off-by: default avatarYonglong Wu <yonglong.wu@mediatek.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      caba5960
    • Dan Carpenter's avatar
      scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() · e50a6112
      Dan Carpenter authored
      commit 7bc2b55a upstream.
      
      We need to put an upper bound on "user_len" so the memcpy() doesn't
      overflow.
      
      [js] no ARCMSR_API_DATA_BUFLEN defined, use the number
      Reported-by: default avatarMarco Grassi <marco.gra@gmail.com>
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarTomas Henzl <thenzl@redhat.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      e50a6112
    • Vladimir Zapolskiy's avatar
      i2c: core: fix NULL pointer dereference under race condition · 0101f124
      Vladimir Zapolskiy authored
      commit 147b36d5 upstream.
      
      Race condition between registering an I2C device driver and
      deregistering an I2C adapter device which is assumed to manage that
      I2C device may lead to a NULL pointer dereference due to the
      uninitialized list head of driver clients.
      
      The root cause of the issue is that the I2C bus may know about the
      registered device driver and thus it is matched by bus_for_each_drv(),
      but the list of clients is not initialized and commonly it is NULL,
      because I2C device drivers define struct i2c_driver as static and
      clients field is expected to be initialized by I2C core:
      
        i2c_register_driver()             i2c_del_adapter()
          driver_register()                 ...
            bus_add_driver()                ...
              ...                           bus_for_each_drv(..., __process_removed_adapter)
            ...                               i2c_do_del_adapter()
          ...                                   list_for_each_entry_safe(..., &driver->clients, ...)
          INIT_LIST_HEAD(&driver->clients);
      
      To solve the problem it is sufficient to do clients list head
      initialization before calling driver_register().
      
      The problem was found while using an I2C device driver with a sluggish
      registration routine on a bus provided by a physically detachable I2C
      master controller, but practically the oops may be reproduced under
      the race between arbitraty I2C device driver registration and managing
      I2C bus device removal e.g. by unbinding the latter over sysfs:
      
      % echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind
        Unable to handle kernel NULL pointer dereference at virtual address 00000000
        Internal error: Oops: 17 [#1] SMP ARM
        CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61
        Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
        task: e5ada400 task.stack: e4936000
        PC is at i2c_do_del_adapter+0x20/0xcc
        LR is at __process_removed_adapter+0x14/0x1c
        Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
        Control: 10c5387d  Table: 35bd004a  DAC: 00000051
        Process sh (pid: 533, stack limit = 0xe4936210)
        Stack: (0xe4937d28 to 0xe4938000)
        Backtrace:
        [<c0667be0>] (i2c_do_del_adapter) from [<c0667cc0>] (__process_removed_adapter+0x14/0x1c)
        [<c0667cac>] (__process_removed_adapter) from [<c0516998>] (bus_for_each_drv+0x6c/0xa0)
        [<c051692c>] (bus_for_each_drv) from [<c06685ec>] (i2c_del_adapter+0xbc/0x284)
        [<c0668530>] (i2c_del_adapter) from [<bf0110ec>] (i2c_imx_remove+0x44/0x164 [i2c_imx])
        [<bf0110a8>] (i2c_imx_remove [i2c_imx]) from [<c051a838>] (platform_drv_remove+0x2c/0x44)
        [<c051a80c>] (platform_drv_remove) from [<c05183d8>] (__device_release_driver+0x90/0x12c)
        [<c0518348>] (__device_release_driver) from [<c051849c>] (device_release_driver+0x28/0x34)
        [<c0518474>] (device_release_driver) from [<c0517150>] (unbind_store+0x80/0x104)
        [<c05170d0>] (unbind_store) from [<c0516520>] (drv_attr_store+0x28/0x34)
        [<c05164f8>] (drv_attr_store) from [<c0298acc>] (sysfs_kf_write+0x50/0x54)
        [<c0298a7c>] (sysfs_kf_write) from [<c029801c>] (kernfs_fop_write+0x100/0x214)
        [<c0297f1c>] (kernfs_fop_write) from [<c0220130>] (__vfs_write+0x34/0x120)
        [<c02200fc>] (__vfs_write) from [<c0221088>] (vfs_write+0xa8/0x170)
        [<c0220fe0>] (vfs_write) from [<c0221e74>] (SyS_write+0x4c/0xa8)
        [<c0221e28>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
      Signed-off-by: default avatarVladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      0101f124
    • Jiri Slaby's avatar
      Revert "fix minor infoleak in get_user_ex()" · 2a6257bb
      Jiri Slaby authored
      This reverts commit d42924ab which is
      1c109fab upstream.
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      2a6257bb
    • Pan Xinhui's avatar
      powerpc/nvram: Fix an incorrect partition merge · d4f4a8c3
      Pan Xinhui authored
      commit 11b7e154 upstream.
      
      When we merge two contiguous partitions whose signatures are marked
      NVRAM_SIG_FREE, We need update prev's length and checksum, then write it
      to nvram, not cur's. So lets fix this mistake now.
      
      Also use memset instead of strncpy to set the partition's name. It's
      more readable if we want to fill up with duplicate chars .
      
      Fixes: fa2b4e54 ("powerpc/nvram: Improve partition removal")
      Signed-off-by: default avatarPan Xinhui <xinhui.pan@linux.vnet.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      d4f4a8c3
    • Arnaldo Carvalho de Melo's avatar
      perf symbols: Fixup symbol sizes before picking best ones · 8748ad71
      Arnaldo Carvalho de Melo authored
      commit 432746f8 upstream.
      
      When we call symbol__fixup_duplicate() we use algorithms to pick the
      "best" symbols for cases where there are various functions/aliases to an
      address, and those check zero size symbols, which, before calling
      symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file.
      
      So first fixup the end, then fixup the duplicates.
      
      Found while trying to figure out why 'perf test vmlinux' failed, see the
      output of 'perf test -v vmlinux' to see cases where the symbols picked
      as best for vmlinux don't match the ones picked for kallsyms.
      
      Cc: Anton Blanchard <anton@samba.org>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: David Ahern <dsahern@gmail.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Wang Nan <wangnan0@huawei.com>
      Fixes: 694bf407 ("perf symbols: Add some heuristics for choosing the best duplicate symbol")
      Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2ufn@git.kernel.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      8748ad71
    • Dave Gerlach's avatar
      hwrng: omap - Only fail if pm_runtime_get_sync returns < 0 · 8146d19c
      Dave Gerlach authored
      commit ad8529fd upstream.
      
      Currently omap-rng checks the return value of pm_runtime_get_sync and
      reports failure if anything is returned, however it should be checking
      if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
      1 if the device was already active which is not a failure case. Only
      values < 0 are actual failures.
      
      Fixes: 61dc0a44 ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed")
      Signed-off-by: default avatarDave Gerlach <d-gerlach@ti.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      8146d19c
    • Ondrej Mosnáček's avatar
      crypto: gcm - Fix IV buffer size in crypto_gcm_setkey · 83bffee1
      Ondrej Mosnáček authored
      commit 50d2e6dc upstream.
      
      The cipher block size for GCM is 16 bytes, and thus the CTR transform
      used in crypto_gcm_setkey() will also expect a 16-byte IV. However,
      the code currently reserves only 8 bytes for the IV, causing
      an out-of-bounds access in the CTR transform. This patch fixes
      the issue by setting the size of the IV buffer to 16 bytes.
      
      Fixes: 84c91152 ("[CRYPTO] gcm: Add support for async ciphers")
      Signed-off-by: default avatarOndrej Mosnacek <omosnacek@gmail.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      83bffee1
    • Jan Viktorin's avatar
      uio: fix dmem_region_start computation · a5177e00
      Jan Viktorin authored
      commit 4d31a258 upstream.
      
      The variable i contains a total number of resources (including
      IORESOURCE_IRQ). However, we want the dmem_region_start to point
      after the last resource of type IORESOURCE_MEM. The original behaviour
      leads (very likely) to skipping several UIO mapping regions and makes
      them useless. Fix this by computing dmem_region_start from the uiomem
      which points to the last used UIO mapping.
      
      Fixes: 0a0c3b5a ("Add new uio device for dynamic memory allocation")
      Signed-off-by: default avatarJan Viktorin <viktorin@rehivetech.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      a5177e00