linux-stable.git, branch v4.3.2

Linux 4.3.2

2015-12-10T23:11:40+00:00

X.509: Fix the time validation [ver #2]

2015-12-10T23:11:25+00:00

commit cc25b994acfbc901429da682d0f73c190e960206 upstream.

This fixes CVE-2015-5327.  It affects kernels from 4.3-rc1 onwards.

Fix the X.509 time validation to use month number-1 when looking up the
number of days in that month.  Also put the month number validation before
doing the lookup so as not to risk overrunning the array.

This can be tested by doing the following:

cat <
Signed-off-by: David Howells 
Tested-by: Mimi Zohar 
Acked-by: David Woodhouse 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

crypto: asymmetric_keys - remove always false comparison

2015-12-10T23:11:25+00:00

commit 4dd17c9c8a30c8d8cd1c9d4b94f08aca4b038d3e upstream.

hour, min and sec are unsigned int and they can never be less than zero.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

Linux 4.3.1

2015-12-09T19:40:26+00:00

xen/events: Always allocate legacy interrupts on PV guests

2015-12-09T19:34:43+00:00

commit b4ff8389ed14b849354b59ce9b360bdefcdbf99c upstream.

After commit 8c058b0b9c34 ("x86/irq: Probe for PIC presence before
allocating descs for legacy IRQs") early_irq_init() will no longer
preallocate descriptors for legacy interrupts if PIC does not
exist, which is the case for Xen PV guests.

Therefore we may need to allocate those descriptors ourselves.

Signed-off-by: Boris Ostrovsky 
Suggested-by: Thomas Gleixner 
Signed-off-by: David Vrabel 
Cc: Vitaly Kuznetsov 
Signed-off-by: Greg Kroah-Hartman

staging/lustre: use jiffies for lp_last_query times

2015-12-09T19:34:43+00:00

commit 9f088dba3cc267ea11ec0da318cd0175575b5f9b upstream.

The recently introduced lnet_peer_set_alive() function uses
get_seconds() to read the current time into a shared variable,
but all other uses of that variable compare it to jiffies values.

This changes the current use to jiffies as well for consistency.

Signed-off-by: Arnd Bergmann 
Fixes: af3fa7c71bf ("staging/lustre/lnet: peer aliveness status and NI status")
Cc: Liang Zhen 
Cc: James Simmons 
Cc: Isaac Huang 
Signed-off-by: Oleg Drokin 
Signed-off-by: Greg Kroah-Hartman

xhci: Workaround to get Intel xHCI reset working more reliably

2015-12-09T19:34:43+00:00

commit a5964396190d0c40dd549c23848c282fffa5d1f2 upstream.

Existing Intel xHCI controllers require a delay of 1 mS,
after setting the CMD_RESET bit in command register, before
accessing any HC registers. This allows the HC to complete
the reset operation and be ready for HC register access.
Without this delay, the subsequent HC register access,
may result in a system hang, very rarely.

Verified CherryView / Braswell platforms go through over
5000 warm reboot cycles (which was not possible without
this patch), without any xHCI reset hang.

Signed-off-by: Rajmohan Mani 
Tested-by: Joe Lawrence 
Signed-off-by: Mathias Nyman 
Signed-off-by: Greg Kroah-Hartman

tty: Fix tty_send_xchar() lock order inversion

2015-12-09T19:34:42+00:00

commit ee0c1a65cf95230d5eb3d9de94fd2ead9a428c67 upstream.

The correct lock order is atomic_write_lock => termios_rwsem, as
established by tty_write() => n_tty_write().

Fixes: c274f6ef1c666 ("tty: Hold termios_rwsem for tcflow(TCIxxx)")
Reported-and-Tested-by: Dmitry Vyukov 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: audit: Fix audit source

2015-12-09T19:34:42+00:00

commit 6b2a3d628aa752f0ab825fc6d4d07b09e274d1c1 upstream.

The data to audit/record is in the 'from' buffer (ie., the input
read buffer).

Fixes: 72586c6061ab ("n_tty: Fix auditing support for cannonical mode")
Cc: Miloslav Trmač 
Signed-off-by: Peter Hurley 
Acked-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

ttyFDC: Fix build problems due to use of module_{init,exit}

2015-12-09T19:34:42+00:00

commit 3e8137a185240fa6da0ff91cd9c604716371903b upstream.

Commit 0fd972a7d91d (module: relocate module_init from init.h to
module.h) broke the build of ttyFDC driver due to that driver's (mis)use
of module_mips_cdmm_driver() without first including module.h, for
example:

In file included from ./arch/mips/include/asm/cdmm.h +11 :0,
                 from drivers/tty/mips_ejtag_fdc.c +34 :
include/linux/device.h +1295 :1: warning: data definition has no type or storage class
./arch/mips/include/asm/cdmm.h +84 :2: note: in expansion of macro ‘module_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: note: in expansion of macro ‘module_mips_cdmm_driver’
include/linux/device.h +1295 :1: error: type defaults to ‘int’ in declaration of ‘module_init’ [-Werror=implicit-int]
./arch/mips/include/asm/cdmm.h +84 :2: note: in expansion of macro ‘module_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: note: in expansion of macro ‘module_mips_cdmm_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: warning: parameter names (without types) in function declaration

Instead of just adding the module.h include, switch to using the new
builtin_mips_cdmm_driver() helper macro and drop the remove callback,
since it isn't needed. If module support is added later, the code can
always be resurrected.

Signed-off-by: James Hogan 
Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: Paul Gortmaker 
Cc: linux-mips@linux-mips.org
Signed-off-by: Greg Kroah-Hartman