linux-stable.git/drivers/net/hamradio, branch v4.4

mkiss: fix scribble on freed memory

2016-01-06T20:06:27+00:00

commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.

As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.

Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller

6pack: fix free memory scribbles

2016-01-06T06:25:01+00:00

commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free
memory scribble but in doing so replaced it with a different one that allows
the user to control the data and scribble even more.

sixpack_close is called by the tty layer in tty context. The tty context is
protected by sp_get() and sp_put(). However network layer activity via
sp_xmit() is not protected this way. We must therefore stop the queue
otherwise the user gets to dump a buffer mostly of their choice into freed
kernel pages.

Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller

mkiss: Fix use after free in mkiss_close().

2015-12-18T21:03:03+00:00

Need to do the unregister_device() after all references to the driver
private have been done.

Signed-off-by: David S. Miller

6pack: Fix use after free in sixpack_close().

2015-12-18T20:57:33+00:00

Need to do the unregister_device() after all references to the driver
private have been done.

Also we need to use del_timer_sync() for the timers so that we don't
have any asynchronous references after the unregister.

Signed-off-by: David S. Miller

Merge branch 'x86/urgent' into x86/asm to fix up conflicts and to pick up fixes

2015-08-18T07:39:47+00:00

Conflicts:
	arch/x86/entry/entry_64_compat.S
	arch/x86/math-emu/get_address.c

Signed-off-by: Ingo Molnar

mkiss: Fix error handling in mkiss_open()

2015-08-11T04:10:31+00:00

If register_netdev() fails we are not propagating the error and
we return success because ax_open() succeeded previously.

Fix this by checking the return value of ax_open() and
register_netdev() and propagate the error in case of failure.

Reported-by: RUC_Soft_Sec 
Signed-off-by: Fabio Estevam 
Signed-off-by: David S. Miller

Merge branch 'x86/urgent' into x86/asm, before applying dependent patches

2015-07-31T08:23:35+00:00

Signed-off-by: Ingo Molnar

NET: hamradio: Fix IP over bpq encapsulation.

2015-07-08T21:09:03+00:00

Since 1d5da757da860a6916adbf68b09e868062b4b3b8 (ax25: Stop using magic
neighbour cache operations.) any attempt to transmit IP packets over
a bpqether device will result in a message like "Dead loop on virtual
device bpq0, fix it urgently!"

Fix suggested by Eric W. Biederman .

Signed-off-by: Ralf Baechle 
Cc:  # 4.1
Signed-off-by: David S. Miller

x86/asm/tsc: Rename native_read_tsc() to rdtsc()

2015-07-06T13:23:28+00:00

Now that there is no paravirt TSC, the "native" is
inappropriate. The function does RDTSC, so give it the obvious
name: rdtsc().

Suggested-by: Borislav Petkov 
Signed-off-by: Andy Lutomirski 
Signed-off-by: Borislav Petkov 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Brian Gerst 
Cc: Denys Vlasenko 
Cc: H. Peter Anvin 
Cc: Huang Rui 
Cc: John Stultz 
Cc: Len Brown 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ralf Baechle 
Cc: Thomas Gleixner 
Cc: kvm ML 
Link: http://lkml.kernel.org/r/fd43e16281991f096c1e4d21574d9e1402c62d39.1434501121.git.luto@kernel.org
[ Ported it to v4.2-rc1. ]
Signed-off-by: Ingo Molnar

x86/asm/tsc, drivers/net/hamradio/baycom_epp: Replace rdtscl() with native_read_tsc()

2015-07-06T13:23:27+00:00

This is only used if BAYCOM_DEBUG is defined.

Signed-off-by: Andy Lutomirski 
Signed-off-by: Borislav Petkov 
Acked-by: Thomas Sailer 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Brian Gerst 
Cc: Denys Vlasenko 
Cc: H. Peter Anvin 
Cc: Huang Rui 
Cc: John Stultz 
Cc: Len Brown 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Ralf Baechle 
Cc: Thomas Gleixner 
Cc: kvm ML 
Cc: linux-hams@vger.kernel.org
Link: http://lkml.kernel.org/r/1195ce0c7f34169ff3006341b77806184a46b9bf.1434501121.git.luto@kernel.org
Signed-off-by: Ingo Molnar