1. 30 Aug, 2014 1 commit
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · ad6ede80
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
      
       - Fix for an ACPI regression related to the handling of fixed events
         that caused netlink routines to be (incorrectly) run in interrupt
         context from Lan Tianyu
      
       - Fix for an ACPI EC driver regression on Acer Aspire V5-573G that
         caused AC/battery plug/unplug and video brightness change
         notifications to be delayed on that machine from Lv Zheng
      
       - Fix for an ACPI device enumeration regression that caused ACPI driver
         probe to fail for some devices where it succeeded before (Rafael J
         Wysocki)
      
       - intel_pstate driver fix to prevent it from printing an information
         message for every CPU in the system on every boot from Andi Kleen
      
       - s5pv210 cpufreq driver fix to remove an __init annotation from a
         routine that in fact can be called at any time after init too from
         Mark Brown
      
       - New Intel Braswell device ID for the ACPI LPSS (Low-Power Subsystem)
         driver from Alan Cox
      
       - New Intel Braswell CPU ID for intel_pstate from Mika Westerberg
      
      * tag 'pm+acpi-3.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: s5pv210: Remove spurious __init annotation
        cpufreq: intel_pstate: Add CPU ID for Braswell processor
        intel_pstate: Turn per cpu printk into pr_debug
        ACPI / LPSS: Add ACPI IDs for Intel Braswell
        ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
        ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
        ACPI: Run fixed event device notifications in process context
        ACPI / scan: Allow ACPI drivers to bind to PNP device objects
      ad6ede80
  2. 29 Aug, 2014 37 commits
  3. 28 Aug, 2014 2 commits
    • Mikulas Patocka's avatar
      dm crypt: fix access beyond the end of allocated space · d49ec52f
      Mikulas Patocka authored
      The DM crypt target accesses memory beyond allocated space resulting in
      a crash on 32 bit x86 systems.
      
      This bug is very old (it dates back to 2.6.25 commit 3a7f6c99 "dm
      crypt: use async crypto").  However, this bug was masked by the fact
      that kmalloc rounds the size up to the next power of two.  This bug
      wasn't exposed until 3.17-rc1 commit 298a9fa0 ("dm crypt: use per-bio
      data").  By switching to using per-bio data there was no longer any
      padding beyond the end of a dm-crypt allocated memory block.
      
      To minimize allocation overhead dm-crypt puts several structures into one
      block allocated with kmalloc.  The block holds struct ablkcipher_request,
      cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),
      struct dm_crypt_request and an initialization vector.
      
      The variable dmreq_start is set to offset of struct dm_crypt_request
      within this memory block.  dm-crypt allocates the block with this size:
      cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.
      
      When accessing the initialization vector, dm-crypt uses the function
      iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
      + 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).
      
      dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request
      structure.  However, when dm-crypt accesses the initialization vector, it
      takes a pointer to the end of dm_crypt_request, aligns it, and then uses
      it as the initialization vector.  If the end of dm_crypt_request is not
      aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the
      alignment causes the initialization vector to point beyond the allocated
      space.
      
      Fix this bug by calculating the variable iv_size_padding and adding it
      to the allocated size.
      
      Also correct the alignment of dm_crypt_request.  struct dm_crypt_request
      is specific to dm-crypt (it isn't used by the crypto subsystem at all),
      so it is aligned on __alignof__(struct dm_crypt_request).
      
      Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is
      aligned as if the block was allocated with kmalloc.
      Reported-by: default avatarKrzysztof Kolasa <kkolasa@winsoft.pl>
      Tested-by: default avatarMilan Broz <gmazyland@gmail.com>
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      d49ec52f
    • Linus Torvalds's avatar
      Merge tag 'backlight-fixes-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight · 59753a80
      Linus Torvalds authored
      Pull backlight fix from Lee Jones:
       "One simple fix to invalidate GPIO non-request"
      
      * tag 'backlight-fixes-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
        pwm-backlight: Fix bogus request for GPIO#0 when instantiated from DT
      59753a80