linux-stable.git/drivers/net/irda, branch linux-3.2.y Linux kernel stable tree net: irda: irda-usb: fix firmware name on big-endian hosts 2017-09-15T17:30:40+00:00 Johan Hovold johan@kernel.org 2017-05-12T10:11:13+00:00 d6aa9b42bced124dabf736d94e3201143b211e45 commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream. Add missing endianness conversion when using the USB device-descriptor bcdDevice field to construct a firmware file name. Fixes: 8ef80aef118e ("[IRDA]: irda-usb.c: STIR421x cleanups") Cc: Nick Fedchik <nfedchik@atlantic-link.com.ua> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream.

Add missing endianness conversion when using the USB device-descriptor
bcdDevice field to construct a firmware file name.

Fixes: 8ef80aef118e ("[IRDA]: irda-usb.c: STIR421x cleanups")
Cc: Nick Fedchik <nfedchik@atlantic-link.com.ua>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net: irda: Fix use-after-free in irtty_open() 2016-04-30T22:05:14+00:00 Peter Hurley peter@hurleysoftware.com 2016-01-10T01:48:45+00:00 23397e31d3c8243b07b3b4cca6663a5672ffadfa commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream. The N_IRDA line discipline may access the previous line discipline's closed and already-fre private data on open [1]. The tty->disc_data field _never_ refers to valid data on entry to the line discipline's open() method. Rather, the ldisc is expected to initialize that field for its own use for the lifetime of the instance (ie. from open() to close() only). [1] ================================================================== BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068 Read of size 4 by task a.out/13960 ============================================================================= BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- ... Call Trace: [<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279 [<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436 [<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447 [<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567 [< inline >] tiocsetd drivers/tty/tty_io.c:2650 [<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613 [<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.

The N_IRDA line discipline may access the previous line discipline's closed
and already-fre private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    ==================================================================
    BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
    Read of size 4 by task a.out/13960
    =============================================================================
    BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
    -----------------------------------------------------------------------------
    ...
    Call Trace:
     [<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
     [<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
     [<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
     [<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
     [<     inline     >] tiocsetd drivers/tty/tty_io.c:2650
     [<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
     [<     inline     >] vfs_ioctl fs/ioctl.c:43
     [<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
     [<     inline     >] SYSC_ioctl fs/ioctl.c:622
     [<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
     [<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a

Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
irda: sir_dev: Fix copy/paste typo 2013-01-03T03:33:51+00:00 Alexander Shiyan shc_work@mail.ru 2012-11-20T09:59:11+00:00 38130178c3fb8160ce443c053e6d3082399ae69e [ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ] Signed-off-by: Alexander Shiyan <shc_work@mail.ru> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
[ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ]

Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2011-11-03T20:28:14+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-11-03T20:28:14+00:00 d6748066ad0e8b2514545998f8367ebb3906f299 * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (37 commits) MIPS: O32: Provide definition of registers ta0 .. ta3. MIPS: perf: Add Octeon support for hardware perf. MIPS: perf: Add support for 64-bit perf counters. MIPS: perf: Reorganize contents of perf support files. MIPS: perf: Cleanup formatting in arch/mips/kernel/perf_event.c MIPS: Add accessor macros for 64-bit performance counter registers. MIPS: Add probes for more Octeon II CPUs. MIPS: Add more CPU identifiers for Octeon II CPUs. MIPS: XLR, XLS: Add comment for smp setup MIPS: JZ4740: GPIO: Check correct IRQ in demux handler MIPS: JZ4740: GPIO: Simplify IRQ demuxer MIPS: JZ4740: Use generic irq chip MIPS: Alchemy: remove all CONFIG_SOC_AU1??? defines MIPS: Alchemy: kill au1xxx.h header MIPS: Alchemy: clean DMA code of CONFIG_SOC_AU1??? defines MIPS, IDE: Alchem, au1xxx-ide: Remove pb1200/db1200 header dep MIPS: Alchemy: Redo PCI as platform driver MIPS: Alchemy: more base address cleanup MIPS: Alchemy: rewrite USB platform setup. MIPS: Alchemy: abstract USB block control register access ... Fix up trivial conflicts in: arch/mips/alchemy/devboards/db1x00/platform.c drivers/ide/Kconfig drivers/mmc/host/au1xmmc.c drivers/video/Kconfig sound/mips/Kconfig 
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (37 commits)
  MIPS: O32: Provide definition of registers ta0 .. ta3.
  MIPS: perf: Add Octeon support for hardware perf.
  MIPS: perf: Add support for 64-bit perf counters.
  MIPS: perf: Reorganize contents of perf support files.
  MIPS: perf: Cleanup formatting in arch/mips/kernel/perf_event.c
  MIPS: Add accessor macros for 64-bit performance counter registers.
  MIPS: Add probes for more Octeon II CPUs.
  MIPS: Add more CPU identifiers for Octeon II CPUs.
  MIPS: XLR, XLS: Add comment for smp setup
  MIPS: JZ4740: GPIO: Check correct IRQ in demux handler
  MIPS: JZ4740: GPIO: Simplify IRQ demuxer
  MIPS: JZ4740: Use generic irq chip
  MIPS: Alchemy: remove all CONFIG_SOC_AU1??? defines
  MIPS: Alchemy: kill au1xxx.h header
  MIPS: Alchemy: clean DMA code of CONFIG_SOC_AU1??? defines
  MIPS, IDE: Alchem, au1xxx-ide: Remove pb1200/db1200 header dep
  MIPS: Alchemy: Redo PCI as platform driver
  MIPS: Alchemy: more base address cleanup
  MIPS: Alchemy: rewrite USB platform setup.
  MIPS: Alchemy: abstract USB block control register access
  ...

Fix up trivial conflicts in:
	arch/mips/alchemy/devboards/db1x00/platform.c
	drivers/ide/Kconfig
	drivers/mmc/host/au1xmmc.c
	drivers/video/Kconfig
	sound/mips/Kconfig
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2011-10-25T11:25:22+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-10-25T11:25:22+00:00 8a9ea3237e7eb5c25f09e429ad242ae5a3d5ea22 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1745 commits) dp83640: free packet queues on remove dp83640: use proper function to free transmit time stamping packets ipv6: Do not use routes from locally generated RAs |PATCH net-next] tg3: add tx_dropped counter be2net: don't create multiple RX/TX rings in multi channel mode be2net: don't create multiple TXQs in BE2 be2net: refactor VF setup/teardown code into be_vf_setup/clear() be2net: add vlan/rx-mode/flow-control config to be_setup() net_sched: cls_flow: use skb_header_pointer() ipv4: avoid useless call of the function check_peer_pmtu TCP: remove TCP_DEBUG net: Fix driver name for mdio-gpio.c ipv4: tcp: fix TOS value in ACK messages sent from TIME_WAIT rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces ipv4: fix ipsec forward performance regression jme: fix irq storm after suspend/resume route: fix ICMP redirect validation net: hold sock reference while processing tx timestamps tcp: md5: add more const attributes Add ethtool -g support to virtio_net ... Fix up conflicts in: - drivers/net/Kconfig: The split-up generated a trivial conflict with removal of a stale reference to Documentation/networking/net-modules.txt. Remove it from the new location instead. - fs/sysfs/dir.c: Fairly nasty conflicts with the sysfs rb-tree usage, conflicting with Eric Biederman's changes for tagged directories. 
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1745 commits)
  dp83640: free packet queues on remove
  dp83640: use proper function to free transmit time stamping packets
  ipv6: Do not use routes from locally generated RAs
  |PATCH net-next] tg3: add tx_dropped counter
  be2net: don't create multiple RX/TX rings in multi channel mode
  be2net: don't create multiple TXQs in BE2
  be2net: refactor VF setup/teardown code into be_vf_setup/clear()
  be2net: add vlan/rx-mode/flow-control config to be_setup()
  net_sched: cls_flow: use skb_header_pointer()
  ipv4: avoid useless call of the function check_peer_pmtu
  TCP: remove TCP_DEBUG
  net: Fix driver name for mdio-gpio.c
  ipv4: tcp: fix TOS value in ACK messages sent from TIME_WAIT
  rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces
  ipv4: fix ipsec forward performance regression
  jme: fix irq storm after suspend/resume
  route: fix ICMP redirect validation
  net: hold sock reference while processing tx timestamps
  tcp: md5: add more const attributes
  Add ethtool -g support to virtio_net
  ...

Fix up conflicts in:
 - drivers/net/Kconfig:
	The split-up generated a trivial conflict with removal of a
	stale reference to Documentation/networking/net-modules.txt.
	Remove it from the new location instead.
 - fs/sysfs/dir.c:
	Fairly nasty conflicts with the sysfs rb-tree usage, conflicting
	with Eric Biederman's changes for tagged directories.
MIPS: Alchemy: remove all CONFIG_SOC_AU1??? defines 2011-10-24T22:34:24+00:00 Manuel Lauss manuel.lauss@googlemail.com 2011-08-12T09:39:45+00:00 3766386037827fe7064f57f9aec27b3b5e9417aa Now that no driver any longer depends on the CONFIG_SOC_AU1??? symbols, it's time to get rid of them: Move some of the platform devices to the boards which can use them, Rename a few (unused) constants in the header, Replace them with MIPS_ALCHEMY in the various Kconfig files. Finally delete them altogether from the Alchemy Kconfig file. Signed-off-by: Manuel Lauss <manuel.lauss@googlemail.com> To: Linux-MIPS <linux-mips@linux-mips.org> Patchwork: https://patchwork.linux-mips.org/patch/2707/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 
Now that no driver any longer depends on the CONFIG_SOC_AU1???  symbols,
it's time to get rid of them: Move some of the platform devices to the
boards which can use them, Rename a few (unused) constants in the header,
Replace them with MIPS_ALCHEMY in the various Kconfig files.  Finally
delete them altogether from the Alchemy Kconfig file.

Signed-off-by: Manuel Lauss <manuel.lauss@googlemail.com>
To: Linux-MIPS <linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/2707/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Fix file references in Kconfig files 2011-10-11T13:24:17+00:00 Johann Felix Soden johfel@users.sourceforge.net 2011-10-10T23:10:49+00:00 0348299ad18e4b63e90b04e2698fd3d3e2cbe2e6 This patch fixes file references to moved or deleted files outside of Documentation/. Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 
This patch fixes file references to moved or deleted files
outside of Documentation/.

Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
net/irda: sh_irda: add PM support 2011-09-15T21:19:28+00:00 Kuninori Morimoto kuninori.morimoto.gx@renesas.com 2011-08-31T20:08:48+00:00 c5dac7c9984d8a034eb7ae149cedf23ec9259f98 Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/irda: sh_irda: update author's email address 2011-09-15T21:19:16+00:00 Kuninori Morimoto kuninori.morimoto.gx@renesas.com 2011-08-31T20:08:37+00:00 7af11b8d7cd4ee25c7fb7acc3f941162dc7d45fc it also cleanup white space Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
it also cleanup white space

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/irda: sh_irda: add sh_irda_ prefix to all functions 2011-09-15T21:19:16+00:00 Kuninori Morimoto kuninori.morimoto.gx@renesas.com 2011-08-31T20:08:22+00:00 b27fcddda74a3e37af86d44bcd9ff6445396d966 Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>