linux-stable.git/arch, branch v3.12.44

m68k/mac: Fix out-of-bounds array index in OSS IRQ source initialization

2015-06-10T13:20:27+00:00

commit b24f670b7f5b2058b95370caa9f104b3cefb9f1d upstream.

Reported-by: David Binderman 
Signed-off-by: Finn Thain 
Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Jiri Slaby

MIPS: KVM: Do not sign extend on unsigned MMIO load

2015-06-10T12:56:27+00:00

commit ed9244e6c534612d2b5ae47feab2f55a0d4b4ced upstream.

Fix possible unintended sign extension in unsigned MMIO loads by casting
to uint16_t in the case of mmio_needed != 2.

Signed-off-by: Nicholas Mc Guire 
Reviewed-by: James Hogan 
Tested-by: James Hogan 
Cc: Gleb Natapov 
Cc: Paolo Bonzini 
Cc: kvm@vger.kernel.org
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/9985/
Signed-off-by: Ralf Baechle 
Signed-off-by: Jiri Slaby

x86: bpf_jit: fix compilation of large bpf programs

2015-06-10T09:18:09+00:00

[ Upstream commit 3f7352bf21f8fd7ba3e2fcef9488756f188e12be ]

x86 has variable length encoding. x86 JIT compiler is trying
to pick the shortest encoding for given bpf instruction.
While doing so the jump targets are changing, so JIT is doing
multiple passes over the program. Typical program needs 3 passes.
Some very short programs converge with 2 passes. Large programs
may need 4 or 5. But specially crafted bpf programs may hit the
pass limit and if the program converges on the last iteration
the JIT compiler will be producing an image full of 'int 3' insns.
Fix this corner case by doing final iteration over bpf program.

Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64")
Reported-by: Daniel Borkmann 
Signed-off-by: Alexei Starovoitov 
Tested-by: Daniel Borkmann 
Acked-by: Daniel Borkmann 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

ARM: dts: imx27: only map 4 Kbyte for fec registers

2015-06-03T09:33:13+00:00

commit a29ef819f3f34f89a1b9b6a939b4c1cdfe1e85ce upstream.

According to the imx27 documentation, fec has a 4 Kbyte
memory space map. Moreover, the actual 16 Kbyte mapping
overlaps the SCC (Security Controller) memory register
space. So, we reduce the memory register space to 4 Kbyte.

Signed-off-by: Philippe Reynes 
Acked-by: Uwe Kleine-König 
Fixes: 9f0749e3eb88 ("ARM i.MX27: Add devicetree support")
Signed-off-by: Shawn Guo 
Signed-off-by: Jiri Slaby

crypto: s390/ghash - Fix incorrect ghash icv buffer handling.

2015-06-03T09:33:12+00:00

commit a1cae34e23b1293eccbcc8ee9b39298039c3952a upstream.

Multitheaded tests showed that the icv buffer in the current ghash
implementation is not handled correctly. A move of this working ghash
buffer value to the descriptor context fixed this. Code is tested and
verified with an multithreaded application via af_alg interface.

Signed-off-by: Harald Freudenberger 
Signed-off-by: Gerald Schaefer 
Reported-by: Herbert Xu 
Signed-off-by: Herbert Xu 
Signed-off-by: Jiri Slaby

powerpc: Align TOC to 256 bytes

2015-06-03T09:33:11+00:00

commit 5e95235ccd5442d4a4fe11ec4eb99ba1b7959368 upstream.

Recent toolchains force the TOC to be 256 byte aligned. We need
to enforce this alignment in our linker script, otherwise pointers
to our TOC variables (__toc_start, __prom_init_toc_start) could
be incorrect.

If they are bad, we die a few hundred instructions into boot.

Signed-off-by: Anton Blanchard 
Signed-off-by: Michael Ellerman 
Signed-off-by: Jiri Slaby

KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages

2015-06-03T09:33:06+00:00

commit 898761158be7682082955e3efa4ad24725305fc7 upstream.

smep_andnot_wp is initialized in kvm_init_shadow_mmu and shadow pages
should not be reused for different values of it.  Thus, it has to be
added to the mask in kvm_mmu_pte_write.

Reviewed-by: Xiao Guangrong 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Jiri Slaby

ARM: fix missing syscall trace exit

2015-06-02T15:01:14+00:00

commit 1b97937246d8b97c0760d16d8992c7937bdf5e6a upstream.

Josh Stone reports:

  I've discovered a case where both arm and arm64 will miss a ptrace
  syscall-exit that they should report.  If the syscall is entered
  without TIF_SYSCALL_TRACE set, then it goes on the fast path.  It's
  then possible to have TIF_SYSCALL_TRACE added in the middle of the
  syscall, but ret_fast_syscall doesn't check this flag again.

Fix this by always checking for a syscall trace in the fast exit path.

Reported-by: Josh Stone 
Signed-off-by: Russell King 
Signed-off-by: Jiri Slaby

powerpc/mm: Fix mmap errno when MAP_FIXED is set and mapping exceeds the allowed address space

2015-06-02T09:54:48+00:00

commit 19751c07b3728748c1253627ce94e6906fa5e273 upstream.

According to Posix, if MAP_FIXED is specified mmap shall set ENOMEM if
the requested mapping exceeds the allowed range for address space of
the process. The generic code set it right, but the specific powerpc
slice_get_unmapped_area() function currently returns -EINVAL in that
case.
This patch corrects it.

Signed-off-by: Jerome Marchand 
Signed-off-by: Benjamin Herrenschmidt 
Signed-off-by: Jiri Slaby

perf/x86/amd/ibs: Update IBS MSRs and feature definitions

2015-06-02T09:50:21+00:00

commit 904cb3677f3adcd3d837be0a0d0b14251ba8d6f7 upstream.

New Fam15h models carry extra feature bits and extend
the MSR register space for IBS ops. Adding them here.

While at it, add functionality to read IbsBrTarget and
OpData4 depending on their availability if user wants a
PERF_SAMPLE_RAW.

Signed-off-by: Aravind Gopalakrishnan 
Acked-by: Borislav Petkov 
Cc: Paolo Bonzini 
Cc: Jan Kiszka 
Cc: Len Brown 
Cc: Fenghua Yu 
Cc: Peter Zijlstra 
Cc: 
Cc: 
Link: http://lkml.kernel.org/r/1415651066-13523-1-git-send-email-Aravind.Gopalakrishnan@amd.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Jiri Slaby