aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-09-13blackfin: fix copy_from_user()Al Viro1-4/+5
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13sparc32: fix copy_from_user()Al Viro1-1/+3
Cc: [email protected] Acked-by: David S. Miller <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-09-13sh: fix copy_from_user()Al Viro1-1/+4
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13sh64: failing __get_user() should zeroAl Viro1-0/+1
It could be done in exception-handling bits in __get_user_b() et.al., but the surgery involved would take more knowledge of sh64 details than I have or _want_ to have. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13score: fix copy_from_user() and friendsAl Viro1-21/+20
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13score: fix __get_user/get_userAl Viro1-1/+4
* should zero on any failure * __get_user() should use __copy_from_user(), not copy_from_user() Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13s390: get_user() should zero on failureAl Viro1-4/+4
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13ppc32: fix copy_from_user()Al Viro1-23/+2
should clear on access_ok() failures. Also remove the useless range truncation logics. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13parisc: fix copy_from_user()Al Viro1-2/+4
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13openrisc: fix copy_from_user()Al Viro1-24/+11
... that should zero on faults. Also remove the <censored> helpful logics wrt range truncation copied from ppc32. Where it had ever been needed only in case of copy_from_user() *and* had not been merged into the mainline until a month after the need had disappeared. A decade before openrisc went into mainline, I might add... Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13nios2: fix __get_user()Al Viro1-2/+2
a) should not leave crap on fault b) should _not_ require access_ok() in any cases. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13nios2: copy_from_user() should zero the tail of destinationAl Viro1-3/+6
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13mn10300: copy_from_user() should zero on access_ok() failure...Al Viro1-1/+3
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13mn10300: failing __get_user() and get_user() should zeroAl Viro1-0/+1
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13mips: copy_from_user() must zero the destination on access_ok() failureAl Viro1-0/+3
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13ARC: uaccess: get_user to zero out dest in cause of faultVineet Gupta1-2/+9
Al reported potential issue with ARC get_user() as it wasn't clearing out destination pointer in case of fault due to bad address etc. Verified using following | { | u32 bogus1 = 0xdeadbeef; | u64 bogus2 = 0xdead; | int rc1, rc2; | | pr_info("Orig values %x %llx\n", bogus1, bogus2); | rc1 = get_user(bogus1, (u32 __user *)0x40000000); | rc2 = get_user(bogus2, (u64 __user *)0x50000000); | pr_info("access %d %d, new values %x %llx\n", | rc1, rc2, bogus1, bogus2); | } | [ARCLinux]# insmod /mnt/kernel-module/qtn.ko | Orig values deadbeef dead | access -14 -14, new values 0 0 Reported-by: Al Viro <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Signed-off-by: Vineet Gupta <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-09-13metag: copy_from_user() should zero the destination on access_ok() failureAl Viro1-1/+2
Cc: [email protected] Acked-by: James Hogan <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-09-13ia64: copy_from_user() should zero the destination on access_ok() failureAl Viro1-14/+11
Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13hexagon: fix strncpy_from_user() error returnAl Viro1-1/+2
It's -EFAULT, not -1 (and contrary to the comment in there, __strnlen_user() can return 0 - on faults). Cc: [email protected] Acked-by: Richard Kuo <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-09-13frv: fix clear_user()Al Viro1-3/+9
It should check access_ok(). Otherwise a bunch of places turn into trivially exploitable rootholes. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13cris: buggered copy_from_user/copy_to_user/clear_userAl Viro1-39/+32
* copy_from_user() on access_ok() failure ought to zero the destination * none of those primitives should skip the access_ok() check in case of small constant size. Cc: [email protected] Acked-by: Jesper Nilsson <[email protected]> Signed-off-by: Al Viro <[email protected]>
2016-09-13asm-generic: make get_user() clear the destination on errorsAl Viro1-3/+7
both for access_ok() failures and for faults halfway through Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2016-09-13PCI: Fix bridge_d3 update on device removalLukas Wunner1-2/+1
Starting with v4.8, we allow a PCIe port to runtime suspend to D3hot if the port itself and its children satisfy a number of conditions. Once a child is removed, we recheck those conditions in case the removed device was blocking the port from suspending. The rechecking needs to happen *after* the device has been removed from the bus it resides on. Otherwise when walking the port's subordinate bus in pci_bridge_d3_update(), the device being removed would erroneously still be taken into account. However the device is removed from the bus_list in pci_destroy_dev() and we currently recheck *before* that. Fix it. Fixes: 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") Signed-off-by: Lukas Wunner <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]> Reviewed-by: Mika Westerberg <[email protected]> Acked-by: Rafael J. Wysocki <[email protected]>
2016-09-13Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds3-7/+16
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Three fixes: - AMD microcode loading fix with randomization - an lguest tooling fix - and an APIC enumeration boundary condition fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Fix num_processors value in case of failure tools/lguest: Don't bork the terminal in case of wrong args x86/microcode/AMD: Fix load of builtin microcode with randomized memory
2016-09-13Merge branch 'sched-urgent-for-linus' of ↵Linus Torvalds1-0/+22
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "A try_to_wake_up() memory ordering race fix causing a busy-loop in ttwu()" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Fix a race between try_to_wake_up() and a woken up task
2016-09-13Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds6-55/+180
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "This contains: - a set of fixes found by directed-random perf fuzzing efforts by Vince Weaver, Alexander Shishkin and Peter Zijlstra - a cqm driver crash fix - an AMD uncore driver use after free fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix PEBSv3 record drain perf/x86/intel/bts: Kill a silly warning perf/x86/intel/bts: Fix BTS PMI detection perf/x86/intel/bts: Fix confused ordering of PMU callbacks perf/core: Fix aux_mmap_count vs aux_refcount order perf/core: Fix a race between mmap_close() and set_output() of AUX events perf/x86/amd/uncore: Prevent use after free perf/x86/intel/cqm: Check cqm/mbm enabled state in event init perf/core: Remove WARN from perf_event_read()
2016-09-13Merge branch 'locking-urgent-for-linus' of ↵Linus Torvalds1-3/+4
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Another lockless_dereference() Sparse fix" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/barriers: Don't use sizeof(void) in lockless_dereference()
2016-09-13Merge branch 'efi-urgent-for-linus' of ↵Linus Torvalds6-120/+283
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "This contains a Xen fix, an arm64 fix and a race condition / robustization set of fixes related to ExitBootServices() usage and boundary conditions" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Use efi_exit_boot_services() efi/libstub: Use efi_exit_boot_services() in FDT efi/libstub: Introduce ExitBootServices helper efi/libstub: Allocate headspace in efi_get_memory_map() efi: Fix handling error value in fdt_find_uefi_params efi: Make for_each_efi_memory_desc_in_map() cope with running on Xen
2016-09-13Merge tag 'md/4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/mdLinus Torvalds3-41/+31
Pull MD fixes from Shaohua Li: "A few bug fixes for MD: - Guoqing fixed a bug compiling md-cluster in kernel - I fixed a potential deadlock in raid5-cache superblock write, a hang in raid5 reshape resume and a race condition introduced in rc4" * tag 'md/4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: raid5: fix a small race condition md-cluster: make md-cluster also can work when compiled into kernel raid5: guarantee enough stripes to avoid reshape hang raid5-cache: fix a deadlock in superblock write
2016-09-13Merge branch 'linus' of ↵Linus Torvalds1-2/+7
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto bugfix from Herbert Xu: "Fix a bug in the cryptd code that may lead to crashes" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: cryptd - initialize child shash_desc on import
2016-09-13usb: ohci: Allow ohci on omap5 alsoTony Lindgren1-1/+1
With LPAE config we don't have omap3 or omap4 selected for omap5 variants. Signed-off-by: Tony Lindgren <[email protected]> Acked-by: Alan Stern <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: core: setup dma_pfn_offset for USB devices and, interfacesRoger Quadros2-0/+16
If dma_pfn_offset is not inherited correctly from the host controller, it might result in sub-optimal configuration as bounce buffer limit might be set to less than optimal level. Consider the mass storage device case. USB storage driver creates a scsi host for the mass storage interface in drivers/usb/storage/usb.c The scsi host parent device is nothing but the the USB interface device. Now, __scsi_init_queue() calls scsi_calculate_bounce_limit() to find out and set the block layer bounce limit. scsi_calculate_bounce_limit() uses dma_max_pfn(host_dev) to get the bounce_limit. host_dev is nothing but the device representing the mass storage interface. If that device doesn't have the right dma_pfn_offset, then dma_max_pfn() is messed up and the bounce buffer limit is wrong. e.g. On Keystone 2 systems, dma_max_pfn() is 0x87FFFF and dma_mask_pfn is 0xFFFFF. Consider a mass storage use case: Without this patch, usb scsi host device (usb-storage) will get a dma_pfn_offset of 0 resulting in a dma_max_pfn() of 0xFFFFF within the scsi layer (scsi_calculate_bounce_limit()). This will result in bounce buffers being unnecessarily used. Hint: On 32-bit ARM platforms dma_max_pfn() = dma_mask_pfn + dma_pfn_offset Signed-off-by: Roger Quadros <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Acked-by: Alan Stern <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13USB: host: ohci-at91: fix non static symbol warningWei Yongjun1-1/+1
Fixes the following sparse warning: drivers/usb/host/ohci-at91.c:141:15: warning: symbol 'at91_dt_syscon_sfr' was not declared. Should it be static? Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: host: xhci-tegra: Fix error return code in tegra_xusb_probe()Wei Yongjun1-0/+1
Fix to return error code -ENOMEM from the usb_create_shared_hcd() error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13ezusb: constify local structuresJulia Lawall1-1/+1
For structure types defined in the same file or local header files, find top-level static structure declarations that have the following properties: 1. Never reassigned. 2. Address never taken 3. Not passed to a top-level macro call 4. No pointer or array-typed field passed to a function or stored in a variable. Declare structures having all of these properties as const. Done using Coccinelle. Based on a suggestion by Joe Perches <[email protected]>. Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13USB: wusbcore: add in missing white space in error message textColin Ian King1-2/+1
A dev_err message spans two lines and the literal string is missing a white space between words. Add the white space and reformat the message to not span multiple lines. Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13cdc-acm: cleaning up debug in data submission pathOliver Neukum1-10/+6
Further cleanup making the debug messages more precise, useful and removing mere trace points. Signed-off-by: Oliver Neukum <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13cdc-acm: cleanup debugging in submission pathOliver Neukum1-4/+4
Actually make it retutn useful information. Signed-off-by: Oliver Neukum <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: remove redundant stack buffersRasmus Villemoes1-7/+5
aDate is always the empty string, so entirely pointless. The aRevision formatting might as well be done as part of the pr_debug() call - that also avoids it altogether if pr_debug is compiled out. Signed-off-by: Rasmus Villemoes <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: am35x: fix error return code in am35x_probe()Wei Yongjun1-1/+3
Fix to return a negative error code from the usb_phy_generic_register() error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: da8xx: Remove mach codeDavid Lechner2-86/+51
Use the new phy-da8xx-usb driver to take the place of the mach code that pokes CFGCHIP2 in the da8xx musb glue driver. This unbreaks the driver. Signed-off-by: David Lechner <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: da8xx: Use devm in probeDavid Lechner1-14/+5
Simplify things a bit by using devm functions where possible. Signed-off-by: David Lechner <[email protected]> [[email protected]: fixed merge conflict] Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13musb: sunxi: Add support for platform_set_modeHans de Goede1-4/+57
This allows run-time dr_mode switching support via the "mode" musb sysfs attribute. Signed-off-by: Hans de Goede <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: Add PM runtime support for MUSB DSPS glue layerTony Lindgren1-41/+17
We can now just use PM runtime autoidle support as musb core keeps things enabled when the devctl session bit is set. And there's no need for dsps_musb_try_idle() so let's just remove it. Note that as cppi41 dma is clocked by musb, this only makes PM work for dsps glue layer if CONFIG_MUSB_PIO_ONLY=y and cppi41.ko is unloaded. This will get fixed when cppi41.c has PM runtime implemented. Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: Simplify PM runtime for 2430 glue layerTony Lindgren1-66/+10
With musb core now blocking PM based on the devctl status bit, we can remove related quirks from the 2430 glue layer and simplify PM runtime further. Lets's also use musb->controller instead of dev to make it clear we make the PM runtime calls for the core, not the glue layer. And we can now also lower the autoidle timeout. Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: Prepare dsps glue layer for PM runtime supportTony Lindgren1-4/+18
We want to be polling the state when nothing is connected. Let's change the polling logic in preparation for PM runtime support. Signed-off-by: Tony Lindgren <[email protected]> [[email protected]: undo unnecessary line leading whitespace change] Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13usb: musb: Implement session bit based runtime PM for musb-coreTony Lindgren2-0/+67
We want to keep musb enabled always when the session bit is set. This simplifies the PM runtime and allows making it more generic across the various glue layers. So far the only exception to just following the session bit is host mode disconnect where the session bit stays set. In that case, just allow PM and let the PM runtime autoidle timeout deal with it. Signed-off-by: Tony Lindgren <[email protected]> [[email protected]: changed using dev_dbg() to musb_dbg()] Signed-off-by: Bin Liu <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13Merge tag 'extcon-next-for-4.9' of ↵Greg Kroah-Hartman20-276/+1122
git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into usb-testing Chanwoo writes: Update extcon for 4.9 Detailed description for this pull request: 1. Support the extcon property and add the synchronization APIs. - This feature supports the extcon property for external connector because each external connector might have the property according to the H/W design. - The property name should keep the following style. : EXTCON_PROP_USB_[property_name] : EXTCON_PROP_CHG_[property_name] : EXTCON_PROP_JACK_[property_name] : EXTCON_PROP_DISP_[property_name] - Add the new extcon APIs to support the extcon property. : extcon_set_property() : extcon_get_property() : extcon_set_property_capability() : extcon_get_property_capability() - Add the new synchronization extcon APIs. : This feature adds the synchronization extcon APIs to support the noti for both state and property. When extcon_*_sync() functions is called, the extcon informs the information from extcon provider to extcon client. The extcon driver may need to change the both state and multiple properties at the same time. After setting the data of a external connector, the extcon send the notification to client driver with the extcon_*_sync(). : extcon_sync() : extcon_set_state_sync() : extcon_set_property_sync() - Change the name of existing APIs. : extcon_set_cable_state_() -> extcon_set_cable() : extcon_get_cable_state_() -> extcon_get_cable() 2. Add the extcon type to group the connector into five category. - EXTCON_TYPE_USB : USB connector - EXTCON_TYPE_CHG : Charger connector - EXTCON_TYPE_JACK : Jack connector - EXTCON_TYPE_DISP : Display connector - EXTCON_TYPE_MISC : Miscellaneous connector 3. Add the new property for external connector. - EXTCON_PROP_USB_VBUS - EXTCON_PROP_USB_TYPEC_POLARITY - EXTCON_PROP_USB_SS (SuperSpeed) - EXTCON_PROP_DISP_HPD (Hot Plug Detect) 4. Add the new type of external connector. - EXTCON_DISP_DP : Display Port - EXTCON_DISP_HMD : Head Mounted Device - EXTCON_CHG_WPT : Wireless Power Transfer device 5. Add the new extcon driver. - Qualcomm SPMI PMIC USB id detection driver detects whether EXTCON_USB_HOST is attached or detached. (extcon-qcom-spmi-mis.c) 6. Remove the usage of extcon_update_state() and old extcon_set_state() - Both extcon_update_state() and extcon_set_state() should change the state of all external connectors with bit masking handling. It may occur the problem. Instead, extcon provides the extcon_set/get_state() functions. 7. Fix the minor issues on extcon drivers.
2016-09-13irqchip/atmel-aic: Fix potential deadlock in ->xlate()Boris Brezillon2-4/+6
aic5_irq_domain_xlate() and aic_irq_domain_xlate() take the generic chip lock without disabling interrupts, which can lead to a deadlock if an interrupt occurs while the lock is held in one of these functions. Replace irq_gc_{lock,unlock}() calls by irq_gc_{lock_irqsave,unlock_irqrestore}() ones to prevent this bug from happening. Fixes: b1479ebb7720 ("irqchip: atmel-aic: Add atmel AIC/AIC5 drivers") Signed-off-by: Boris Brezillon <[email protected]> Acked-by: Marc Zyngier <[email protected]> Cc: Jason Cooper <[email protected]> Cc: Nicolas Ferre <[email protected]> Cc: [email protected] Cc: Alexandre Belloni <[email protected]> Link: http://lkml.kernel.org/r/1473775109-4192-2-git-send-email-boris.brezillon@free-electrons.com Signed-off-by: Thomas Gleixner <[email protected]>
2016-09-13genirq: Provide irq_gc_{lock_irqsave,unlock_irqrestore}() helpersBoris Brezillon1-0/+10
Some irqchip drivers need to take the generic chip lock outside of the irq context. Provide the irq_gc_{lock_irqsave,unlock_irqrestore}() helpers to allow one to disable irqs while entering a critical section protected by gc->lock. Note that we do not provide optimized version of these helpers for !SMP, because they are not called from the hot-path. [ tglx: Added a comment when these helpers should be [not] used ] Signed-off-by: Boris Brezillon <[email protected]> Cc: Jason Cooper <[email protected]> Cc: Marc Zyngier <[email protected]> Cc: Nicolas Ferre <[email protected]> Cc: [email protected] Cc: Alexandre Belloni <[email protected]> Link: http://lkml.kernel.org/r/1473775109-4192-1-git-send-email-boris.brezillon@free-electrons.com Signed-off-by: Thomas Gleixner <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.