1. 17 Oct, 2016 1 commit
    • Ard Biesheuvel's avatar
      mac80211: move struct aead_req off the stack · f4a067f9
      Ard Biesheuvel authored
      Some crypto implementations (such as the generic CCM wrapper in crypto/)
      use scatterlists to map fields of private data in their struct aead_req.
      This means these data structures cannot live in the vmalloc area, which
      means that they cannot live on the stack (with CONFIG_VMAP_STACK.)
      
      This currently occurs only with the generic software implementation, but
      the private data and usage is implementation specific, so move the whole
      data structures off the stack into heap by allocating every time we need
      to use them.
      
      In addition, take care not to put any of our own stack allocations into
      scatterlists. This involves reserving some extra room when allocating the
      aead_request structures, and referring to those allocations in the scatter-
      lists (while copying the data from the stack before the crypto operation)
      Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      f4a067f9
  2. 12 Oct, 2016 7 commits
    • Michael Braun's avatar
      mac80211: fix CMD_FRAME for AP_VLAN · 1d4de2e2
      Michael Braun authored
      When using IEEE 802.11r FT OVER-DS roaming with AP_VLAN, hostapd needs to
      send out a frame using CMD_FRAME for a station assigned to an AP_VLAN
      interface.
      
      Right now, the userspace needs to give the exact AP_VLAN interface index
      for CMD_FRAME; hostapd does not do this. Additionally, userspace cannot
      use GET_STATION to query the AP_VLAN ifidx, as while GET_STATION finds
      stations assigned to AP_VLAN even if the AP iface is queried, it does not
      return AP_VLAN ifidx (it returns the queried one).
      
      This breaks IEEE 802.11r over_ds with vlans, as the reply frame does not
      get out. This patch fixes this by using get_sta_bss for CMD_FRAME.
      Signed-off-by: default avatarMichael Braun <michael-dev@fami-braun.de>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      1d4de2e2
    • Johannes Berg's avatar
      mac80211: validate DA/SA during A-MSDU decapsulation · e2b5227f
      Johannes Berg authored
      As pointed out by Michael Braun, we don't check inner L2 addresses
      during A-MSDU decapsulation, leading to the possibility that, for
      example, a station associated to an AP sends frames as though they
      came from somewhere else.
      
      Fix this problem by letting cfg80211 validate the addresses, as
      indicated by passing in the ones that need to be validated.
      Reported-by: default avatarMichael Braun <michael-dev@fami-braun.de>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      e2b5227f
    • Johannes Berg's avatar
      cfg80211: add ability to check DA/SA in A-MSDU decapsulation · 8b935ee2
      Johannes Berg authored
      We should not accept arbitrary DA/SA inside A-MSDUs, it could be used
      to circumvent protections, like allowing a station to send frames and
      make them seem to come from somewhere else.
      
      Add the necessary infrastructure in cfg80211 to allow such checks, in
      further patches we'll start using them.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      8b935ee2
    • Johannes Berg's avatar
      cfg80211: let ieee80211_amsdu_to_8023s() take only header-less SKB · 7f6990c8
      Johannes Berg authored
      There's only a single case where has_80211_header is passed as true,
      which is in mac80211. Given that there's only simple code that needs
      to be done before calling it, export that function from cfg80211
      instead and let mac80211 call it itself.
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      7f6990c8
    • Johannes Berg's avatar
      mac80211: discard multicast and 4-addr A-MSDUs · ea720935
      Johannes Berg authored
      In mac80211, multicast A-MSDUs are accepted in many cases that
      they shouldn't be accepted in:
       * drop A-MSDUs with a multicast A1 (RA), as required by the
         spec in 9.11 (802.11-2012 version)
       * drop A-MSDUs with a 4-addr header, since the fourth address
         can't actually be useful for them; unless 4-address frame
         format is actually requested, even though the fourth address
         is still not useful in this case, but ignored
      
      Accepting the first case, in particular, is very problematic
      since it allows anyone else with possession of a GTK to send
      unicast frames encapsulated in a multicast A-MSDU, even when
      the AP has client isolation enabled.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      ea720935
    • Linus Torvalds's avatar
      Merge tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux · 6b25e21f
      Linus Torvalds authored
      Pull drm updates from Dave Airlie:
       "Core:
         - Fence destaging work
         - DRIVER_LEGACY to split off legacy drm drivers
         - drm_mm refactoring
         - Splitting drm_crtc.c into chunks and documenting better
         - Display info fixes
         - rbtree support for prime buffer lookup
         - Simple VGA DAC driver
      
        Panel:
         - Add Nexus 7 panel
         - More simple panels
      
        i915:
         - Refactoring GEM naming
         - Refactored vma/active tracking
         - Lockless request lookups
         - Better stolen memory support
         - FBC fixes
         - SKL watermark fixes
         - VGPU improvements
         - dma-buf fencing support
         - Better DP dongle support
      
        amdgpu:
         - Powerplay for Iceland asics
         - Improved GPU reset support
         - UVD/VEC powergating support for CZ/ST
         - Preinitialised VRAM buffer support
         - Virtual display support
         - Initial SI support
         - GTT rework
         - PCI shutdown callback support
         - HPD IRQ storm fixes
      
        amdkfd:
         - bugfixes
      
        tilcdc:
         - Atomic modesetting support
      
        mediatek:
         - AAL + GAMMA engine support
         - Hook up gamma LUT
         - Temporal dithering support
      
        imx:
         - Pixel clock from devicetree
         - drm bridge support for LVDS bridges
         - active plane reconfiguration
         - VDIC deinterlacer support
         - Frame synchronisation unit support
         - Color space conversion support
      
        analogix:
         - PSR support
         - Better panel on/off support
      
        rockchip:
         - rk3399 vop/crtc support
         - PSR support
      
        vc4:
         - Interlaced vblank timing
         - 3D rendering CPU overhead reduction
         - HDMI output fixes
      
        tda998x:
         - HDMI audio ASoC support
      
        sunxi:
         - Allwinner A33 support
         - better TCON support
      
        msm:
         - DT binding cleanups
         - Explicit fence-fd support
      
        sti:
         - remove sti415/416 support
      
        etnaviv:
         - MMUv2 refactoring
         - GC3000 support
      
        exynos:
         - Refactoring HDMI DCC/PHY
         - G2D pm regression fix
         - Page fault issues with wait for vblank
      
        There is no nouveau work in this tree, as Ben didn't get a pull
        request in, and he was fighting moving to atomic and adding mst
        support, so maybe best it waits for a cycle"
      
      * tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux: (1412 commits)
        drm/crtc: constify drm_crtc_index parameter
        drm/i915: Fix conflict resolution from backmerge of v4.8-rc8 to drm-next
        drm/i915/guc: Unwind GuC workqueue reservation if request construction fails
        drm/i915: Reset the breadcrumbs IRQ more carefully
        drm/i915: Force relocations via cpu if we run out of idle aperture
        drm/i915: Distinguish last emitted request from last submitted request
        drm/i915: Allow DP to work w/o EDID
        drm/i915: Move long hpd handling into the hotplug work
        drm/i915/execlists: Reinitialise context image after GPU hang
        drm/i915: Use correct index for backtracking HUNG semaphores
        drm/i915: Unalias obj->phys_handle and obj->userptr
        drm/i915: Just clear the mmiodebug before a register access
        drm/i915/gen9: only add the planes actually affected by ddb changes
        drm/i915: Allow PCH DPLL sharing regardless of DPLL_SDVO_HIGH_SPEED
        drm/i915/bxt: Fix HDMI DPLL configuration
        drm/i915/gen9: fix the watermark res_blocks value
        drm/i915/gen9: fix plane_blocks_per_line on watermarks calculations
        drm/i915/gen9: minimum scanlines for Y tile is not always 4
        drm/i915/gen9: fix the WaWmMemoryReadLatency implementation
        drm/i915/kbl: KBL also needs to run the SAGV code
        ...
      6b25e21f
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · a379f71a
      Linus Torvalds authored
      Merge more updates from Andrew Morton:
      
       - a few block updates that fell in my lap
      
       - lib/ updates
      
       - checkpatch
      
       - autofs
      
       - ipc
      
       - a ton of misc other things
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (100 commits)
        mm: split gfp_mask and mapping flags into separate fields
        fs: use mapping_set_error instead of opencoded set_bit
        treewide: remove redundant #include <linux/kconfig.h>
        hung_task: allow hung_task_panic when hung_task_warnings is 0
        kthread: add kerneldoc for kthread_create()
        kthread: better support freezable kthread workers
        kthread: allow to modify delayed kthread work
        kthread: allow to cancel kthread work
        kthread: initial support for delayed kthread work
        kthread: detect when a kthread work is used by more workers
        kthread: add kthread_destroy_worker()
        kthread: add kthread_create_worker*()
        kthread: allow to call __kthread_create_on_node() with va_list args
        kthread/smpboot: do not park in kthread_create_on_cpu()
        kthread: kthread worker API cleanup
        kthread: rename probe_kthread_data() to kthread_probe_data()
        scripts/tags.sh: enable code completion in VIM
        mm: kmemleak: avoid using __va() on addresses that don't have a lowmem mapping
        kdump, vmcoreinfo: report memory sections virtual addresses
        ipc/sem.c: add cond_resched in exit_sme
        ...
      a379f71a
  3. 11 Oct, 2016 32 commits