1. 24 Nov, 2016 19 commits
  2. 22 Nov, 2016 12 commits
  3. 20 Nov, 2016 1 commit
  4. 18 Nov, 2016 3 commits
    • Peter Hurley's avatar
      tty: Prevent ldisc drivers from re-using stale tty fields · e1a77178
      Peter Hurley authored
      commit dd42bf11 upstream.
      
      Line discipline drivers may mistakenly misuse ldisc-related fields
      when initializing. For example, a failure to initialize tty->receive_room
      in the N_GIGASET_M101 line discipline was recently found and fixed [1].
      Now, the N_X25 line discipline has been discovered accessing the previous
      line discipline's already-freed private data [2].
      
      Harden the ldisc interface against misuse by initializing revelant
      tty fields before instancing the new line discipline.
      
      [1]
          commit fd98e941
          Author: Tilman Schmidt <tilman@imap.cc>
          Date:   Tue Jul 14 00:37:13 2015 +0200
      
          isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
      
      [2] Report from Sasha Levin <sasha.levin@oracle.com>
          [  634.336761] ==================================================================
          [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
          [  634.339558] Read of size 4 by task syzkaller_execu/8981
          [  634.340359] =============================================================================
          [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
          ...
          [  634.405018] Call Trace:
          [  634.405277] dump_stack (lib/dump_stack.c:52)
          [  634.405775] print_trailer (mm/slub.c:655)
          [  634.406361] object_err (mm/slub.c:662)
          [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
          [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
          [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
          [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
          [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
          [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
          [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
          [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
          [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
      
      Cc: Tilman Schmidt <tilman@imap.cc>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      e1a77178
    • Yuta Kobayashi's avatar
      HID: microsoft: Add Surface 4 type cover pro 4 (JP) · 3309cd4e
      Yuta Kobayashi authored
      commit b490a853 upstream.
      
      Adding support for the Microsoft Surface 4 Type Cover Pro (JP).
      Signed-off-by: default avatarYuta Kobayashi <alu.ula@outlook.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Oliver Neukum <ONeukum@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      3309cd4e
    • AceLan Kao's avatar
      HID: input: add mic mute key on HP slim keyboard · bee0e10e
      AceLan Kao authored
      commit 08fc9473 upstream.
      
      Add MIC mute key which is found on HP Business Slim Keyboard
      
      T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 23 Spd=1.5 MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
      P:  Vendor=03f0 ProdID=2f4a Rev=00.10
      S:  Manufacturer=Chicony
      S:  Product=HP Business Slim Keyboard
      C:  #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=01 Driver=usbhid
      I:  If#= 1 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
      Signed-off-by: default avatarAceLan Kao <acelan.kao@canonical.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Oliver Neukum <ONeukum@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      bee0e10e
  5. 09 Nov, 2016 4 commits
    • James Hogan's avatar
      KVM: MIPS: Precalculate MMIO load resume PC · ff686d55
      James Hogan authored
      commit e1e575f6 upstream.
      
      The advancing of the PC when completing an MMIO load is done before
      re-entering the guest, i.e. before restoring the guest ASID. However if
      the load is in a branch delay slot it may need to access guest code to
      read the prior branch instruction. This isn't safe in TLB mapped code at
      the moment, nor in the future when we'll access unmapped guest segments
      using direct user accessors too, as it could read the branch from host
      user memory instead.
      
      Therefore calculate the resume PC in advance while we're still in the
      right context and save it in the new vcpu->arch.io_pc (replacing the no
      longer needed vcpu->arch.pending_load_cause), and restore it on MMIO
      completion.
      
      Fixes: e685c689 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: kvm@vger.kernel.org
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      ff686d55
    • Nicholas Mc Guire's avatar
      MIPS: KVM: Fix unused variable build warning · fb357699
      Nicholas Mc Guire authored
      commit 5f508c43 upstream.
      
      As kvm_mips_complete_mmio_load() did not yet modify PC at this point
      as James Hogans <james.hogan@imgtec.com> explained the curr_pc variable
      and the comments along with it can be dropped.
      Signed-off-by: default avatarNicholas Mc Guire <hofrat@osadl.org>
      Link: http://lkml.org/lkml/2015/5/8/422
      Cc: Gleb Natapov <gleb@kernel.org>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: James Hogan <james.hogan@imgtec.com>
      Cc: kvm@vger.kernel.org
      Cc: linux-mips@linux-mips.org
      Cc: linux-kernel@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/9993/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      fb357699
    • James Hogan's avatar
      KVM: MIPS: Drop other CPU ASIDs on guest MMU changes · e01f1c70
      James Hogan authored
      commit 91e4f1b6 upstream.
      
      When a guest TLB entry is replaced by TLBWI or TLBWR, we only invalidate
      TLB entries on the local CPU. This doesn't work correctly on an SMP host
      when the guest is migrated to a different physical CPU, as it could pick
      up stale TLB mappings from the last time the vCPU ran on that physical
      CPU.
      
      Therefore invalidate both user and kernel host ASIDs on other CPUs,
      which will cause new ASIDs to be generated when it next runs on those
      CPUs.
      
      We're careful only to do this if the TLB entry was already valid, and
      only for the kernel ASID where the virtual address it mapped is outside
      of the guest user address range.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: "Radim Krčmář" <rkrcmar@redhat.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Cc: kvm@vger.kernel.org
      [james.hogan@imgtec.com: Backport to 3.10..3.16]
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      e01f1c70
    • Jiri Slaby's avatar
      Revert "KVM: MIPS: Drop other CPU ASIDs on guest MMU changes" · f668f2ee
      Jiri Slaby authored
      This reverts commit 168e5ebb, which is
      upstream commit 91e4f1b6. It caused
      build failures as it was improperly backported. New version is
      approaching, so revert this bad one.
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: James Hogan <james.hogan@imgtec.com>
      f668f2ee
  6. 08 Nov, 2016 1 commit