1. 12 Apr, 2015 23 commits
  2. 30 Mar, 2015 1 commit
    • Al Viro's avatar
      saner iov_iter initialization primitives · bc917be8
      Al Viro authored
      iovec-backed iov_iter instances are assumed to satisfy several properties:
      	* no more than UIO_MAXIOV elements in iovec array
      	* total size of all ranges is no more than MAX_RW_COUNT
      	* all ranges pass access_ok().
      
      The problem is, invariants of data structures should be established in the
      primitives creating those data structures, not in the code using those
      primitives.  And iov_iter_init() violates that principle.  For a while we
      managed to get away with that, but once the use of iov_iter started to
      spread, it didn't take long for shit to hit the fan - missed check in
      sys_sendto() had introduced a roothole.
      
      We _do_ have primitives for importing and validating iovecs (both native and
      compat ones) and those primitives are almost always followed by shoving the
      resulting iovec into iov_iter.  Life would be considerably simpler (and safer)
      if we combined those primitives with initializing iov_iter.
      
      That gives us two new primitives - import_iovec() and compat_import_iovec().
      Calling conventions:
      	iovec = iov_array;
      	err = import_iovec(direction, uvec, nr_segs,
      			   ARRAY_SIZE(iov_array), &iovec,
      			   &iter);
      imports user vector into kernel space (into iov_array if it fits, allocated
      if it doesn't fit or if iovec was NULL), validates it and sets iter up to
      refer to it.  On success 0 is returned and allocated kernel copy (or NULL
      if the array had fit into caller-supplied one) is returned via iovec.
      On failure all allocations are undone and -E... is returned.  If the total
      size of ranges exceeds MAX_RW_COUNT, the excess is silently truncated.
      
      compat_import_iovec() expects uvec to be a pointer to user array of compat_iovec;
      otherwise it's identical to import_iovec().
      
      Finally, import_single_range() sets iov_iter backed by single-element iovec
      covering a user-supplied range -
      
      	err = import_single_range(direction, address, size, iovec, &iter);
      
      does validation and sets iter up.  Again, size in excess of MAX_RW_COUNT gets
      silently truncated.
      
      Next commits will be switching the things up to use of those and reducing
      the amount of iov_iter_init() instances.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      bc917be8
  3. 26 Mar, 2015 1 commit
  4. 24 Mar, 2015 4 commits
  5. 23 Mar, 2015 3 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 90a5a895
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Validate iov ranges before feeding them into iov_iter_init(), from
          Al Viro.
      
       2) We changed copy_from_msghdr_from_user() to zero out the msg_namelen
          is a NULL pointer is given for the msg_name.  Do the same in the
          compat code too.  From Catalin Marinas.
      
       3) Fix partially initialized tuples in netfilter conntrack helper, from
          Ian Wilson.
      
       4) Missing continue; statement in nft_hash walker can lead to crashes,
          from Herbert Xu.
      
       5) tproxy_tg6_check looks for IP6T_INV_PROTO in ->flags instead of
          ->invflags, fix from Pablo Neira Ayuso.
      
       6) Incorrect memory account of TCP FINs can result in negative socket
          memory accounting values.  Fix from Josh Hunt.
      
       7) Don't allow virtual functions to enable VLAN promiscuous mode in
          be2net driver, from Vasundhara Volam.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set
        cx82310_eth: wait for firmware to become ready
        net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom
        net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour
        be2net: use PCI MMIO read instead of config read for errors
        be2net: restrict MODIFY_EQ_DELAY cmd to a max of 8 EQs
        be2net: Prevent VFs from enabling VLAN promiscuous mode
        tcp: fix tcp fin memory accounting
        ipv6: fix backtracking for throw routes
        net: ethernet: pcnet32: Setup the SRAM and NOUFLO on Am79C97{3, 5}
        ipv6: call ipv6_proxy_select_ident instead of ipv6_select_ident in udp6_ufo_fragment
        netfilter: xt_TPROXY: fix invflags check in tproxy_tg6_check()
        netfilter: restore rule tracing via nfnetlink_log
        netfilter: nf_tables: allow to change chain policy without hook if it exists
        netfilter: Fix potential crash in nft_hash walker
        netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()
      90a5a895
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · d5049617
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "Some perf bug fixes from David Ahern, and the fix for that nasty
        memmove() bug"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: Fix several bugs in memmove().
        sparc: Touch NMI watchdog when walking cpus and calling printk
        sparc: perf: Add support M7 processor
        sparc: perf: Make counting mode actually work
        sparc: perf: Remove redundant perf_pmu_{en|dis}able calls
      d5049617
    • David S. Miller's avatar
      sparc64: Fix several bugs in memmove(). · 2077cef4
      David S. Miller authored
      Firstly, handle zero length calls properly.  Believe it or not there
      are a few of these happening during early boot.
      
      Next, we can't just drop to a memcpy() call in the forward copy case
      where dst <= src.  The reason is that the cache initializing stores
      used in the Niagara memcpy() implementations can end up clearing out
      cache lines before we've sourced their original contents completely.
      
      For example, considering NG4memcpy, the main unrolled loop begins like
      this:
      
           load   src + 0x00
           load   src + 0x08
           load   src + 0x10
           load   src + 0x18
           load   src + 0x20
           store  dst + 0x00
      
      Assume dst is 64 byte aligned and let's say that dst is src - 8 for
      this memcpy() call.  That store at the end there is the one to the
      first line in the cache line, thus clearing the whole line, which thus
      clobbers "src + 0x28" before it even gets loaded.
      
      To avoid this, just fall through to a simple copy only mildly
      optimized for the case where src and dst are 8 byte aligned and the
      length is a multiple of 8 as well.  We could get fancy and call
      GENmemcpy() but this is good enough for how this thing is actually
      used.
      Reported-by: default avatarDavid Ahern <david.ahern@oracle.com>
      Reported-by: default avatarBob Picco <bpicco@meloft.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2077cef4
  6. 22 Mar, 2015 8 commits
    • Linus Torvalds's avatar
      Linux 4.0-rc5 · bc465aa9
      Linus Torvalds authored
      bc465aa9
    • Linus Torvalds's avatar
      Merge tag 'md/4.0-rc4-fix' of git://neil.brown.name/md · 1b717b1a
      Linus Torvalds authored
      Pull bugfix for md from Neil Brown:
       "One fix for md in 4.0-rc4
      
        Regression in recent patch causes crash on error path"
      
      * tag 'md/4.0-rc4-fix' of git://neil.brown.name/md:
        md: fix problems with freeing private data after ->run failure.
      1b717b1a
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · c0e41fa7
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Fix missing initialization of tuple structure in nfnetlink_cthelper
         to avoid mismatches when looking up to attach userspace helpers to
         flows, from Ian Wilson.
      
      2) Fix potential crash in nft_hash when we hit -EAGAIN in
         nft_hash_walk(), from Herbert Xu.
      
      3) We don't need to indicate the hook information to update the
         basechain default policy in nf_tables.
      
      4) Restore tracing over nfnetlink_log due to recent rework to
         accomodate logging infrastructure into nf_tables.
      
      5) Fix wrong IP6T_INV_PROTO check in xt_TPROXY.
      
      6) Set IP6T_F_PROTO flag in nft_compat so we can use SYNPROXY6 and
         REJECT6 from xt over nftables.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c0e41fa7
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · 4541c226
      Linus Torvalds authored
      Pull driver core fixes from Greg KH:
       "Here are two bugfixes for things reported.  One regression in kernfs,
        and another issue fixed in the LZ4 code that was fixed in the
        "upstream" codebase that solves a reported kernel crash
      
        Both have been in linux-next for a while"
      
      * tag 'driver-core-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        LZ4 : fix the data abort issue
        kernfs: handle poll correctly on 'direct_read' files.
      4541c226
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · b93dbeea
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are three fixes for 4.0-rc5 that revert 3 PCMCIA patches that
        were merged in 4.0-rc1 that cause regressions.  So let's revert them
        for now and they will be reworked and resent sometime in the future.
      
        All have been tested in linux-next for a while"
      
      * tag 'char-misc-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        Revert "pcmcia: add a new resource manager for non ISA systems"
        Revert "pcmcia: fix incorrect bracketing on a test"
        Revert "pcmcia: add missing include for new pci resource handler"
      b93dbeea
    • Linus Torvalds's avatar
      Merge tag 'staging-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 704fa7f7
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are four small staging driver fixes, all for the vt6656 and
        vt6655 drivers, that resolve some reported issues with them.
      
        All of these patches have been in linux next for a while"
      
      * tag 'staging-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        vt6655: Fix late setting of byRFType.
        vt6655: RFbSetPower fix missing rate RATE_12M
        staging: vt6656: vnt_rf_setpower: fix missing rate RATE_12M
        staging: vt6655: vnt_tx_packet fix dma_idx selection.
      704fa7f7
    • Linus Torvalds's avatar
      Merge tag 'tty-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · b2f45eef
      Linus Torvalds authored
      Pull tty/serial driver fix from Greg KH:
       "Here's a single 8250 serial driver that fixes a reported deadlock with
        the serial console and the tty driver.
      
        It's been in linux-next for a while now"
      
      * tag 'tty-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: 8250_dw: Fix deadlock in LCR workaround
      b2f45eef
    • Linus Torvalds's avatar
      Merge tag 'usb-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · cedd5f65
      Linus Torvalds authored
      Pull USB / PHY driver fixes from Greg KH:
       "Here's a number of USB and PHY driver fixes for 4.0-rc5.
      
        The largest thing here is a revert of a gadget function driver patch
        that removes 500 lines of code.  Other than that, it's a number of
        reported bugs fixes and new quirk/id entries.
      
        All have been in linux-next for a while"
      
      * tag 'usb-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (33 commits)
        usb: common: otg-fsm: only signal connect after switching to peripheral
        uas: Add US_FL_NO_ATA_1X for Initio Corporation controllers / devices
        USB: ehci-atmel: rework clk handling
        MAINTAINERS: add entry for USB OTG FSM
        usb: chipidea: otg: add a_alt_hnp_support response for B device
        phy: omap-usb2: Fix missing clk_prepare call when using old dt name
        phy: ti/omap: Fix modalias
        phy: core: Fixup return value of phy_exit when !pm_runtime_enabled
        phy: miphy28lp: Convert to devm_kcalloc and fix wrong sizof
        phy: miphy365x: Convert to devm_kcalloc and fix wrong sizeof
        phy: twl4030-usb: Remove redundant assignment for twl->linkstat
        phy: exynos5-usbdrd: Fix off-by-one valid value checking for args->args[0]
        phy: Find the right match in devm_phy_destroy()
        phy: rockchip-usb: Fixup rockchip_usb_phy_power_on failure path
        phy: ti-pipe3: Simplify ti_pipe3_dpll_wait_lock implementation
        phy: samsung-usb2: Remove NULL terminating entry from phys array
        phy: hix5hd2-sata: Check return value of platform_get_resource
        phy: exynos-dp-video: Kill exynos_dp_video_phy_pwr_isol function
        Revert "usb: gadget: zero: Add support for interrupt EP"
        Revert "xhci: Clear the host side toggle manually when endpoint is 'soft reset'"
        ...
      cedd5f65