1. 05 Apr, 2017 7 commits
    • James Hogan's avatar
      metag/usercopy: Add missing fixups · b884a190
      James Hogan authored
      The rapf copy loops in the Meta usercopy code is missing some extable
      entries for HTP cores with unaligned access checking enabled, where
      faults occur on the instruction immediately after the faulting access.
      
      Add the fixup labels and extable entries for these cases so that corner
      case user copy failures don't cause kernel crashes.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      b884a190
    • James Hogan's avatar
      metag/usercopy: Fix src fixup in from user rapf loops · 2c0b1df8
      James Hogan authored
      The fixup code to rewind the source pointer in
      __asm_copy_from_user_{32,64}bit_rapf_loop() always rewound the source by
      a single unit (4 or 8 bytes), however this is insufficient if the fault
      didn't occur on the first load in the loop, as the source pointer will
      have been incremented but nothing will have been stored until all 4
      register [pairs] are loaded.
      
      Read the LSM_STEP field of TXSTATUS (which is already loaded into a
      register), a bit like the copy_to_user versions, to determine how many
      iterations of MGET[DL] have taken place, all of which need rewinding.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      2c0b1df8
    • James Hogan's avatar
      metag/usercopy: Set flags before ADDZ · fd40eee1
      James Hogan authored
      The fixup code for the copy_to_user rapf loops reads TXStatus.LSM_STEP
      to decide how far to rewind the source pointer. There is a special case
      for the last execution of an MGETL/MGETD, since it leaves LSM_STEP=0
      even though the number of MGETLs/MGETDs attempted was 4. This uses ADDZ
      which is conditional upon the Z condition flag, but the AND instruction
      which masked the TXStatus.LSM_STEP field didn't set the condition flags
      based on the result.
      
      Fix that now by using ANDS which does set the flags, and also marking
      the condition codes as clobbered by the inline assembly.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      fd40eee1
    • James Hogan's avatar
      metag/usercopy: Zero rest of buffer from copy_from_user · 563ddc10
      James Hogan authored
      Currently we try to zero the destination for a failed read from userland
      in fixup code in the usercopy.c macros. The rest of the destination
      buffer is then zeroed from __copy_user_zeroing(), which is used for both
      copy_from_user() and __copy_from_user().
      
      Unfortunately we fail to zero in the fixup code as D1Ar1 is set to 0
      before the fixup code entry labels, and __copy_from_user() shouldn't even
      be zeroing the rest of the buffer.
      
      Move the zeroing out into copy_from_user() and rename
      __copy_user_zeroing() to raw_copy_from_user() since it no longer does
      any zeroing. This also conveniently matches the name needed for
      RAW_COPY_USER support in a later patch.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      563ddc10
    • James Hogan's avatar
      metag/usercopy: Add early abort to copy_to_user · fb8ea062
      James Hogan authored
      When copying to userland on Meta, if any faults are encountered
      immediately abort the copy instead of continuing on and repeatedly
      faulting, and worse potentially copying further bytes successfully to
      subsequent valid pages.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      fb8ea062
    • James Hogan's avatar
      metag/usercopy: Fix alignment error checking · 22572119
      James Hogan authored
      Fix the error checking of the alignment adjustment code in
      raw_copy_from_user(), which mistakenly considers it safe to skip the
      error check when aligning the source buffer on a 2 or 4 byte boundary.
      
      If the destination buffer was unaligned it may have started to copy
      using byte or word accesses, which could well be at the start of a new
      (valid) source page. This would result in it appearing to have copied 1
      or 2 bytes at the end of the first (invalid) page rather than none at
      all.
      
      Fixes: 373cd784 ("metag: Memory handling")
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      22572119
    • James Hogan's avatar
      metag/usercopy: Drop unused macros · ef62a2d8
      James Hogan authored
      Metag's lib/usercopy.c has a bunch of copy_from_user macros for larger
      copies between 5 and 16 bytes which are completely unused. Before fixing
      zeroing lets drop these macros so there is less to fix.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: linux-metag@vger.kernel.org
      Cc: stable@vger.kernel.org
      ef62a2d8
  2. 05 Mar, 2017 2 commits
    • Linus Torvalds's avatar
      Linux 4.11-rc1 · c1ae3cfa
      Linus Torvalds authored
      c1ae3cfa
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 8d70eeb8
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix double-free in batman-adv, from Sven Eckelmann.
      
       2) Fix packet stats for fast-RX path, from Joannes Berg.
      
       3) Netfilter's ip_route_me_harder() doesn't handle request sockets
          properly, fix from Florian Westphal.
      
       4) Fix sendmsg deadlock in rxrpc, from David Howells.
      
       5) Add missing RCU locking to transport hashtable scan, from Xin Long.
      
       6) Fix potential packet loss in mlxsw driver, from Ido Schimmel.
      
       7) Fix race in NAPI handling between poll handlers and busy polling,
          from Eric Dumazet.
      
       8) TX path in vxlan and geneve need proper RCU locking, from Jakub
          Kicinski.
      
       9) SYN processing in DCCP and TCP need to disable BH, from Eric
          Dumazet.
      
      10) Properly handle net_enable_timestamp() being invoked from IRQ
          context, also from Eric Dumazet.
      
      11) Fix crash on device-tree systems in xgene driver, from Alban Bedel.
      
      12) Do not call sk_free() on a locked socket, from Arnaldo Carvalho de
          Melo.
      
      13) Fix use-after-free in netvsc driver, from Dexuan Cui.
      
      14) Fix max MTU setting in bonding driver, from WANG Cong.
      
      15) xen-netback hash table can be allocated from softirq context, so use
          GFP_ATOMIC. From Anoob Soman.
      
      16) Fix MAC address change bug in bgmac driver, from Hari Vyas.
      
      17) strparser needs to destroy strp_wq on module exit, from WANG Cong.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (69 commits)
        strparser: destroy workqueue on module exit
        sfc: fix IPID endianness in TSOv2
        sfc: avoid max() in array size
        rds: remove unnecessary returned value check
        rxrpc: Fix potential NULL-pointer exception
        nfp: correct DMA direction in XDP DMA sync
        nfp: don't tell FW about the reserved buffer space
        net: ethernet: bgmac: mac address change bug
        net: ethernet: bgmac: init sequence bug
        xen-netback: don't vfree() queues under spinlock
        xen-netback: keep a local pointer for vif in backend_disconnect()
        netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails
        netfilter: nft_set_rbtree: incorrect assumption on lower interval lookups
        netfilter: nf_conntrack_sip: fix wrong memory initialisation
        can: flexcan: fix typo in comment
        can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer
        can: gs_usb: fix coding style
        can: gs_usb: Don't use stack memory for USB transfers
        ixgbe: Limit use of 2K buffers on architectures with 256B or larger cache lines
        ixgbe: update the rss key on h/w, when ethtool ask for it
        ...
      8d70eeb8
  3. 04 Mar, 2017 14 commits
    • Linus Torvalds's avatar
      Merge tag 'kvm-4.11-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 2d62e076
      Linus Torvalds authored
      Pull more KVM updates from Radim Krčmář:
       "Second batch of KVM changes for the 4.11 merge window:
      
        PPC:
         - correct assumption about ASDR on POWER9
         - fix MMIO emulation on POWER9
      
        x86:
         - add a simple test for ioperm
         - cleanup TSS (going through KVM tree as the whole undertaking was
           caused by VMX's use of TSS)
         - fix nVMX interrupt delivery
         - fix some performance counters in the guest
      
        ... and two cleanup patches"
      
      * tag 'kvm-4.11-2' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: nVMX: Fix pending events injection
        x86/kvm/vmx: remove unused variable in segment_base()
        selftests/x86: Add a basic selftest for ioperm
        x86/asm: Tidy up TSS limit code
        kvm: convert kvm.users_count from atomic_t to refcount_t
        KVM: x86: never specify a sample period for virtualized in_tx_cp counters
        KVM: PPC: Book3S HV: Don't use ASDR for real-mode HPT faults on POWER9
        KVM: PPC: Book3S HV: Fix software walk of guest process page tables
      2d62e076
    • Linus Torvalds's avatar
      Merge tag 'docs-4.11-fixes' of git://git.lwn.net/linux · be834aaf
      Linus Torvalds authored
      Pull documentation fixes from Jonathan Corbet:
       "A few fixes for the docs tree, including one for a 4.11 build
        regression"
      
      * tag 'docs-4.11-fixes' of git://git.lwn.net/linux:
        Documentation/sphinx: fix primary_domain configuration
        docs: Fix htmldocs build failure
        doc/ko_KR/memory-barriers: Update control-dependencies section
        pcieaer doc: update the link
        Documentation: Update path to sysrq.txt
      be834aaf
    • Linus Torvalds's avatar
      Merge tag 'staging-4.11-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 91aff98b
      Linus Torvalds authored
      Pull staging/IIO driver fixes from Greg KH:
       "Here are a few small staging and IIO driver fixes for issues that
        showed up after the big set if changes you merged last week.
      
        Nothing major, just small bugs resolved in some IIO drivers, a lustre
        allocation fix, and some RaspberryPi driver fixes for reported
        problems, as well as a MAINTAINERS entry update.
      
        All of these have been in linux-next for a week with no reported
        issues"
      
      * tag 'staging-4.11-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: fsl-mc: fix warning in DT ranges parser
        MAINTAINERS: Remove Noralf Trønnes as fbtft maintainer
        staging: vchiq_2835_arm: Make cache-line-size a required DT property
        staging: bcm2835/mmal-vchiq: unlock on error in buffer_from_host()
        staging/lustre/lnet: Fix allocation size for sv_cpt_data
        iio: adc: xilinx: Fix error handling
        iio: 104-quad-8: Fix off-by-one error when addressing flag register
        iio: adc: handle unknow of_device_id data
      91aff98b
    • Linus Torvalds's avatar
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 33a8b3e9
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
      
       - vmalloc stack regression in CCM
      
       - Build problem in CRC32 on ARM
      
       - Memory leak in cavium
      
       - Missing Kconfig dependencies in atmel and mediatek
      
       - XTS Regression on some platforms (s390 and ppc)
      
       - Memory overrun in CCM test vector
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: vmx - Use skcipher for xts fallback
        crypto: vmx - Use skcipher for cbc fallback
        crypto: testmgr - Pad aes_ccm_enc_tv_template vector
        crypto: arm/crc32 - add build time test for CRC instruction support
        crypto: arm/crc32 - fix build error with outdated binutils
        crypto: ccm - move cbcmac input off the stack
        crypto: xts - Propagate NEED_FALLBACK bit
        crypto: api - Add crypto_requires_off helper
        crypto: atmel - CRYPTO_DEV_MEDIATEK should depend on HAS_DMA
        crypto: atmel - CRYPTO_DEV_ATMEL_TDES and CRYPTO_DEV_ATMEL_SHA should depend on HAS_DMA
        crypto: cavium - fix leak on curr if curr->head fails to be allocated
        crypto: cavium - Fix couple of static checker errors
      33a8b3e9
    • Linus Torvalds's avatar
      Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 0710f3ff
      Linus Torvalds authored
      Pull misc final vfs updates from Al Viro:
       "A few unrelated patches that got beating in -next.
      
        Everything else will have to go into the next window ;-/"
      
      * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        hfs: fix hfs_readdir()
        selftest for default_file_splice_read() infoleak
        9p: constify ->d_name handling
      0710f3ff
    • Linus Torvalds's avatar
      Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · a3b4924b
      Linus Torvalds authored
      Pull more SCSI updates from James Bottomley:
       "This is the set of stuff that didn't quite make the initial pull and a
        set of fixes for stuff which did.
      
        The new stuff is basically lpfc (nvme), qedi and aacraid. The fixes
        cover a lot of previously submitted stuff, the most important of which
        probably covers some of the failing irq vectors allocation and other
        fallout from having the SCSI command allocated as part of the block
        allocation functions"
      
      * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (59 commits)
        scsi: qedi: Fix memory leak in tmf response processing.
        scsi: aacraid: remove redundant zero check on ret
        scsi: lpfc: use proper format string for dma_addr_t
        scsi: lpfc: use div_u64 for 64-bit division
        scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
        scsi: cciss: correct check map error.
        scsi: qla2xxx: fix spelling mistake: "seperator" -> "separator"
        scsi: aacraid: Fixed expander hotplug for SMART family
        scsi: mpt3sas: switch to pci_alloc_irq_vectors
        scsi: qedf: fixup compilation warning about atomic_t usage
        scsi: remove scsi_execute_req_flags
        scsi: merge __scsi_execute into scsi_execute
        scsi: simplify scsi_execute_req_flags
        scsi: make the sense header argument to scsi_test_unit_ready mandatory
        scsi: sd: improve TUR handling in sd_check_events
        scsi: always zero sshdr in scsi_normalize_sense
        scsi: scsi_dh_emc: return success in clariion_std_inquiry()
        scsi: fix memory leak of sdpk on when gd fails to allocate
        scsi: sd: make sd_devt_release() static
        scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.
        ...
      a3b4924b
    • WANG Cong's avatar
      strparser: destroy workqueue on module exit · f78ef7cd
      WANG Cong authored
      Fixes: 43a0c675 ("strparser: Stream parser for messages")
      Cc: Tom Herbert <tom@herbertland.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f78ef7cd
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 20b83643
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      The following patchset contains Netfilter fixes for your net tree,
      they are:
      
      1) Missing check for full sock in ip_route_me_harder(), from
         Florian Westphal.
      
      2) Incorrect sip helper structure initilization that breaks it when
         several ports are used, from Christophe Leroy.
      
      3) Fix incorrect assumption when looking up for matching with adjacent
         intervals in the nft_set_rbtree.
      
      4) Fix broken netlink event error reporting in nf_tables that results
         in misleading ESRCH errors propagated to userspace listeners.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      20b83643
    • Linus Torvalds's avatar
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · 0b94da8d
      Linus Torvalds authored
      Pull libnvdimm fixes from Dan Williams:
       "A fix and regression test case for nvdimm namespace label
        compatibility.
      
        Details:
      
         - An "nvdimm namespace label" is metadata on an nvdimm that
           provisions dimm capacity into a "namespace" that can host a block
           device / dax-filesytem, or a device-dax character device.
      
           A namespace is an object that other operating environment and
           platform firmware needs to comprehend for capabilities like booting
           from an nvdimm.
      
           The label metadata contains a checksum that Linux was not
           calculating correctly leading to other environments rejecting the
           Linux label.
      
         These have received a build success notification from the kbuild
         robot, and a positive test result from Nick who reported the problem"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        nfit, libnvdimm: fix interleave set cookie calculation
        tools/testing/nvdimm: make iset cookie predictable
      0b94da8d
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.11-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · e27fd02d
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
      
       - fix NULL pointer dereferences in many DesignWare-based drivers due to
         refactoring error
      
       - fix Altera config write breakage due to my refactoring error
      
      * tag 'pci-v4.11-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: altera: Fix TLP_CFG_DW0 for TLP write
        PCI: dwc: Fix crashes seen due to missing assignments
      e27fd02d
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · f47e2db4
      Linus Torvalds authored
      Pull parisc fixes and cleanups from Helge Deller:
       "Nothing really important in this patchset: fix resource leaks in error
        paths, coding style cleanups and code removal"
      
      * 'parisc-4.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Remove flush_user_dcache_range and flush_user_icache_range
        parisc: fix a printk
        parisc: ccio-dma: Handle return NULL error from ioremap_nocache
        parisc: Define access_ok() as macro
        parisc: eisa: Fix resource leaks in error paths
        parisc: eisa: Remove coding style errors
      f47e2db4
    • Linus Torvalds's avatar
      Merge tag 'xtensa-20170303' of git://github.com/jcmvbkbc/linux-xtensa · 606ed721
      Linus Torvalds authored
      Pull Xtensa updates from Max Filippov:
      
       - clean up bootable image build targets: provide separate 'Image',
         'zImage' and 'uImage' make targets that only build corresponding
         image type. Make 'all' build all images appropriate for a platform
      
       - allow merging vectors code into .text section as a preparation step
         for XIP support
      
       - fix handling external FDT when the kernel is built without
         BLK_DEV_INITRD support
      
      * tag 'xtensa-20170303' of git://github.com/jcmvbkbc/linux-xtensa:
        xtensa: allow merging vectors into .text section
        xtensa: clean up bootable image build targets
        xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
      606ed721
    • Linus Torvalds's avatar
      Merge tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · a1a0db36
      Linus Torvalds authored
      Pull ARM SoC late DT updates from Arnd Bergmann:
       "These updates have been kept in a separate branch mostly because they
        rely on updates to the respective clk drivers to keep the shared
        header files in sync.
      
        This includes two branches for arm64 dt updates, both following up on
        earlier changes for the same platforms that are already merged:
      
        Samsung:
         - add USB3 support in Exynos7
         - minor PM related updates
      
        Amlogic:
         - new machines: WeTek Set-top-boxes
         - various devices added to DT
      
        There are also a couple of bugfixes that trickled in since the start
        of the merge window:
      
         - The moxart_defconfig was not building the intended platform
         - CPU-hotplug was broken on ux500
         - Coresight was broken on Juno (never worked)"
      
      * tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (26 commits)
        ARM: deconfig: fix the moxart defconfig
        ARM: ux500: resume the second core properly
        arm64: dts: juno: update definition for programmable replicator
        arm64: dts: exynos: Add regulators for Vbus and Vbus-Boost
        arm64: dts: exynos: Add USB 3.0 controller node for Exynos7
        arm64: dts: exynos: Use macros for pinctrl configuration on Exynos7
        pinctrl: dt-bindings: samsung: Add Exynos7 specific pinctrl macro definitions
        arm64: dts: exynos: Add initial configuration for DISP clocks for TM2/TM2e
        ARM64: dts: meson-gxbb-p200: add ADC laddered keys
        ARM64: dts: meson: meson-gx: add the SAR ADC
        ARM64: dts: meson-gxl: add the pwm_ao_b pin
        ARM64: dts: meson-gx: add the missing pwm_AO_ab node
        clk: gxbb: fix CLKID_ETH defined twice
        ARM64: dts: meson-gxl: rename Nexbox A95x for consistency
        clk: gxbb: add the SAR ADC clocks and expose them
        dt-bindings: amlogic: Add WeTek boards
        ARM64: dts: meson-gxbb: Add support for WeTek Hub and Play
        dt-bindings: vendor-prefix: Add wetek vendor prefix
        ARM64: dts: meson-gxm: Rename q200 and q201 DT files for consistency
        ARM64: dts: meson-gx: Add HDMI HPD/DDC pinctrl nodes
        ...
      a1a0db36
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 0a040b21
      Linus Torvalds authored
      Pull SMB3 fixes from Steve French:
       "Some small bug fixes as well as SMB2.1/SMB3 enablement for DFS (global
        namespace) which previously was only enabled for CIFS"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        smb2: Enforce sec= mount option
        CIFS: Fix sparse warnings
        CIFS: implement get_dfs_refer for SMB2+
        CIFS: use DFS pathnames in SMB2+ Create requests
        CIFS: set signing flag in SMB2+ TreeConnect if needed
        CIFS: let ses->ipc_tid hold smb2 TreeIds
        CIFS: add use_ipc flag to SMB2_ioctl()
        CIFS: add build_path_from_dentry_optional_prefix()
        CIFS: move DFS response parsing out of SMB1 code
        CIFS: Fix possible use after free in demultiplex thread
      0a040b21
  4. 03 Mar, 2017 17 commits