1. 05 Jun, 2015 1 commit
  2. 04 Jun, 2015 2 commits
    • Helge Deller's avatar
      compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() · 9b7b819c
      Helge Deller authored
      In the functions compat_get_bitmap() and compat_put_bitmap() the
      variable nr_compat_longs stores how many compat_ulong_t words should be
      copied in a loop.
      
      The copy loop itself is this:
        if (nr_compat_longs-- > 0) {
            if (__get_user(um, umask)) return -EFAULT;
        } else {
            um = 0;
        }
      
      Since nr_compat_longs gets unconditionally decremented in each loop and
      since it's type is unsigned this could theoretically lead to out of
      bounds accesses to userspace if nr_compat_longs wraps around to
      (unsigned)(-1).
      
      Although the callers currently do not trigger out-of-bounds accesses, we
      should better implement the loop in a safe way to completely avoid such
      warp-arounds.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      9b7b819c
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · ff25ea8f
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "We have two small fixes:
      
         - pl330 termination hang fix by Krzysztof
      
         - hsu memory leak fix by Peter"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: hsu: Fix memory leak when stopping a running transfer
        dmaengine: pl330: Fix hang on dmaengine_terminate_all on certain boards
      ff25ea8f
  3. 03 Jun, 2015 3 commits
  4. 02 Jun, 2015 8 commits
    • Linus Torvalds's avatar
      Merge tag 'please-pull-rusty' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux · 8cd9234c
      Linus Torvalds authored
      Pull ia64 fix from Tony Luck:
       "Fix some build warnings for ia64 - cpu_callin_map doesn't need to be
        volatile"
      
      * tag 'please-pull-rusty' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
        ia64: make cpu_callin_map non-volatile.
      8cd9234c
    • Sasha Levin's avatar
      vfs: read file_handle only once in handle_to_path · 161f873b
      Sasha Levin authored
      We used to read file_handle twice.  Once to get the amount of extra
      bytes, and once to fetch the entire structure.
      
      This may be problematic since we do size verifications only after the
      first read, so if the number of extra bytes changes in userspace between
      the first and second calls, we'll have an incoherent view of
      file_handle.
      
      Instead, read the constant size once, and copy that over to the final
      structure without having to re-read it again.
      Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      161f873b
    • Jan Kara's avatar
      lib: Fix strnlen_user() to not touch memory after specified maximum · f18c34e4
      Jan Kara authored
      If the specified maximum length of the string is a multiple of unsigned
      long, we would load one long behind the specified maximum.  If that
      happens to be in a next page, we can hit a page fault although we were
      not expected to.
      
      Fix the off-by-one bug in the test whether we are at the end of the
      specified range.
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f18c34e4
    • Rusty Russell's avatar
      ia64: make cpu_callin_map non-volatile. · 5eda7861
      Rusty Russell authored
      cpumask_test_cpu() doesn't take volatile, unlike the obsoleted
      cpu_isset.  The only place ia64 really cares is the spin waiting for a
      bit; udelay() is probably a barrier but insert barrier() to be sure.
      Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      5eda7861
    • Peter Ujfalusi's avatar
      dmaengine: hsu: Fix memory leak when stopping a running transfer · 42977082
      Peter Ujfalusi authored
      The vd->node is removed from the lists when the transfer started so the
      vchan_get_all_descriptors() will not find it. This results memory leak.
      Signed-off-by: default avatarPeter Ujfalusi <peter.ujfalusi@ti.com>
      [andy: fix the typo to prevent a compilation error]
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
      42977082
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c46a024e
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Various VTI tunnel (mark handling, PMTU) bug fixes from Alexander
          Duyck and Steffen Klassert.
      
       2) Revert ethtool PHY query change, it wasn't correct.  The PHY address
          selected by the driver running the PHY to MAC connection decides
          what PHY address GET ethtool operations return information from.
      
       3) Fix handling of sequence number bits for encryption IV generation in
          ESP driver, from Herbert Xu.
      
       4) UDP can return -EAGAIN when we hit a bad checksum on receive, even
          when there are other packets in the receive queue which is wrong.
          Just respect the error returned from the generic socket recv
          datagram helper.  From Eric Dumazet.
      
       5) Fix BNA driver firmware loading on big-endian systems, from Ivan
          Vecera.
      
       6) Fix regression in that we were inheriting the congestion control of
          the listening socket for new connections, the intended behavior
          always was to use the default in this case.  From Neal Cardwell.
      
       7) Fix NULL deref in brcmfmac driver, from Arend van Spriel.
      
       8) OTP parsing fix in iwlwifi from Liad Kaufman.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
        vti6: Add pmtu handling to vti6_xmit.
        Revert "net: core: 'ethtool' issue with querying phy settings"
        bnx2x: Move statistics implementation into semaphores
        xen: netback: read hotplug script once at start of day.
        xen: netback: fix printf format string warning
        Revert "netfilter: ensure number of counters is >0 in do_replace()"
        net: dsa: Properly propagate errors from dsa_switch_setup_one
        tcp: fix child sockets to use system default congestion control if not set
        udp: fix behavior of wrong checksums
        sfc: free multiple Rx buffers when required
        bna: fix soft lock-up during firmware initialization failure
        bna: remove unreasonable iocpf timer start
        bna: fix firmware loading on big-endian machines
        bridge: fix br_multicast_query_expired() bug
        via-rhine: Resigning as maintainer
        brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
        mac80211: Fix mac80211.h docbook comments
        iwlwifi: nvm: fix otp parsing in 8000 hw family
        iwlwifi: pcie: fix tracking of cmd_in_flight
        ip_vti/ip6_vti: Preserve skb->mark after rcv_cb call
        ...
      c46a024e
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 2459c609
      Linus Torvalds authored
      Pull Sparc fixes from David Miller:
      
       1) Setup the core/threads/sockets bitmaps correctly so that 'lscpus'
          and friends operate properly.  Frtom Chris Hyser.
      
       2) The bit that normally means "Cached Virtually" on sun4v systems,
          actually changes meaning in M7 and later chips.  Fix from Khalid
          Aziz.
      
       3) One some PCI-E systems we need to probe different OF properties to
          fill in the PCI slot information properly, from Eric Snowberg.
      
       4) Kill an extraneous memset after kzalloc(), from Christophe Jaillet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc: Resolve conflict between sparc v9 and M7 on usage of bit 9 of TTE
        sparc64: pci slots information is not populated in sysfs
        sparc: kernel: GRPCI2: Remove a useless memset
        sparc64: Setup sysfs to mark LDOM sockets, cores and threads correctly
      2459c609
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · fec345ba
      Linus Torvalds authored
      Pull virtio fix from Michael Tsirkin:
       "Last-minute virtio fix for 4.1
      
        This tweaks an exported user-space header to fix build breakage for
        userspace using it"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        include/uapi/linux/virtio_balloon.h: include linux/virtio_types.h
      fec345ba
  5. 01 Jun, 2015 17 commits
  6. 31 May, 2015 9 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 8ba64dc3
      Linus Torvalds authored
      Pull vfs fix from Al Viro:
       "Off-by-one in d_walk()/__dentry_kill() race fix.
      
        It's very hard to hit; possible in the same conditions as the original
        bug, except that you need the skipped branch to contain all the
        remaining evictables, so that the d_walk()-calling loop in
        d_invalidate() decides there's nothing more to do and doesn't go for
        another pass - otherwise that next pass will sweep the sucker.
      
        So it's not too urgent, but seeing that the fix is obvious and the
        original commit has spread into all -stable branches..."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        d_walk() might skip too much
      8ba64dc3
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm · 36a8b9a7
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Three fixes this time around:
      
         - fix a memory leak which occurs when probing performance monitoring
           unit interrupts
      
         - fix handling of non-PMD aligned end of RAM causing boot failures
      
         - fix missing syscall trace exit path with syscall tracing enabled
           causing a kernel oops in the audit code"
      
      * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
        ARM: 8357/1: perf: fix memory leak when probing PMU PPIs
        ARM: fix missing syscall trace exit
        ARM: 8356/1: mm: handle non-pmd-aligned end of RAM
      36a8b9a7
    • Linus Torvalds's avatar
      Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux · e4ca714b
      Linus Torvalds authored
      Pull MIPS fixes from Ralf Baechle:
       "MIPS fixes for 4.1 all across the tree"
      
      * 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux:
        MIPS: strnlen_user.S: Fix a CPU_DADDI_WORKAROUNDS regression
        MIPS: BMIPS: Fix bmips_wr_vec()
        MIPS: ath79: fix build problem if CONFIG_BLK_DEV_INITRD is not set
        MIPS: Fuloong 2E: Replace CONFIG_USB_ISP1760_HCD by CONFIG_USB_ISP1760
        MIPS: irq: Use DECLARE_BITMAP
        ttyFDC: Fix to use native endian MMIO reads
        MIPS: Fix CDMM to use native endian MMIO reads
      e4ca714b
    • Linus Torvalds's avatar
      Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux · 50f5a1ee
      Linus Torvalds authored
      Pull turbostat tool fixes from Len Brown:
       "Just one minor kernel dependency in this batch -- added a #define to
        msr-index.h"
      
      * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
        tools/power turbostat: update version number to 4.7
        tools/power turbostat: allow running without cpu0
        tools/power turbostat: correctly decode of ENERGY_PERFORMANCE_BIAS
        tools/power turbostat: enable turbostat to support Knights Landing (KNL)
        tools/power turbostat: correctly display more than 2 threads/core
      50f5a1ee
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending · dae8f283
      Linus Torvalds authored
      Pull SCSI target fixes from Nicholas Bellinger:
       "These are mostly minor fixes, with the exception of the following that
        address fall-out from recent v4.1-rc1 changes:
      
         - regression fix related to the big fabric API registration changes
           and configfs_depend_item() usage, that required cherry-picking one
           of HCH's patches from for-next to address the issue for v4.1 code.
      
         - remaining TCM-USER -v2 related changes to enforce full CDB
           passthrough from Andy + Ilias.
      
        Also included is a target_core_pscsi driver fix from Andy that
        addresses a long standing issue with a Scsi_Host reference being
        leaked on PSCSI device shutdown"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
        iser-target: Fix error path in isert_create_pi_ctx()
        target: Use a PASSTHROUGH flag instead of transport_types
        target: Move passthrough CDB parsing into a common function
        target/user: Only support full command pass-through
        target/user: Update example code for new ABI requirements
        target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST
        target: Fix se_tpg_tfo->tf_subsys regression + remove tf_subsystem
        target: Drop signal_pending checks after interruptible lock acquire
        target: Add missing parentheses
        target: Fix bidi command handling
        target/user: Disallow full passthrough (pass_level=0)
        ISCSI: fix minor memory leak
      dae8f283
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v4.1-rc6' of... · 30a5f118
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
       "Some late hwmon patches, all headed for -stable
      
         - fix sysfs attribute initialization in nct6775 and nct6683 drivers
      
         - do not attempt to auto-detect tmp435 on I2C address 0x37
      
         - ensure iio channel is of type IIO_VOLTAGE in ntc_thermistor driver"
      
      * tag 'hwmon-for-linus-v4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (nct6683) Add missing sysfs attribute initialization
        hwmon: (nct6775) Add missing sysfs attribute initialization
        hwmon: (tmp401) Do not auto-detect chip on I2C address 0x37
        hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE
      30a5f118
    • David S. Miller's avatar
      Merge branch 'bna-fixes' · fdf7c644
      David S. Miller authored
      Ivan Vecera says:
      
      ====================
      bna: misc bugfixes
      
      These patches fix several bugs found during device initialization debugging.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fdf7c644
    • Ivan Vecera's avatar
      bna: fix soft lock-up during firmware initialization failure · 4818e856
      Ivan Vecera authored
      Bug in the driver initialization causes soft-lockup if firmware
      initialization timeout is reached. Polling function bfa_ioc_poll_fwinit()
      incorrectly calls bfa_nw_iocpf_timeout() when the timeout is reached.
      The problem is that bfa_nw_iocpf_timeout() calls again
      bfa_ioc_poll_fwinit()... etc. The bfa_ioc_poll_fwinit() should directly
      send timeout event for iocpf and the same should be done if firmware
      download into HW fails.
      
      Cc: Rasesh Mody <rasesh.mody@qlogic.com>
      Signed-off-by: default avatarIvan Vecera <ivecera@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4818e856
    • Ivan Vecera's avatar
      bna: remove unreasonable iocpf timer start · 4918eb1e
      Ivan Vecera authored
      Driver starts iocpf timer prior bnad_ioceth_enable() call and this is
      unreasonable. This piece of code probably originates from Brocade/Qlogic
      out-of-box driver during initial import into upstream. This driver uses
      only one timer and queue to implement multiple timers and this timer is
      started at this place. The upstream driver uses multiple timers instead
      of this.
      
      Cc: Rasesh Mody <rasesh.mody@qlogic.com>
      Signed-off-by: default avatarIvan Vecera <ivecera@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4918eb1e