linux-stable.git/drivers, branch linux-3.14.y

s390/sclp_ctl: fix potential information leak with /dev/sclp

2016-09-11T07:59:58+00:00

commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6 upstream.

The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to
retrieve the sclp request from user space. The first copy_from_user
fetches the length of the request which is stored in the first two
bytes of the request. The second copy_from_user gets the complete
sclp request, but this copies the length field a second time.
A malicious user may have changed the length in the meantime.

Reported-by: Pengfei Wang 
Reviewed-by: Michael Holzheu 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Juerg Haefliger 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_mio_common: fix wrong insn_write handler

2016-09-11T07:59:58+00:00

commit 5ca05345c56cb979e1a25ab6146437002f95cac8 upstream.

For counter subdevices, the `s->insn_write` handler is being set to the
wrong function, `ni_tio_insn_read()`.  It should be
`ni_tio_insn_write()`.

Signed-off-by: Ian Abbott 
Reported-by: Éric Piel 
Fixes: 10f74377eec3 ("staging: comedi: ni_tio: make ni_tio_winsn() a proper comedi (*insn_write)")
Signed-off-by: Greg Kroah-Hartman

stb6100: fix buffer length check in stb6100_write_reg_range()

2016-09-11T07:59:58+00:00

commit 7e6bd12fb77b0067df13fb3ba3fadbdff2945396 upstream.

We are checking sizeof() the wrong variable!

Signed-off-by: Alexander Shiyan 
Signed-off-by: Michael Krufky 
Signed-off-by: Mauro Carvalho Chehab 
Cc: Willy Tarreau 
Signed-off-by: Greg Kroah-Hartman

HID: hid-input: Add parentheses to quell gcc warning

2016-09-11T07:59:58+00:00

commit 09a5c34e8d6b05663ec4c3d22b1fbd9fec89aaf9 upstream.

GCC reports a -Wlogical-not-parentheses warning here; therefore
add parentheses to shut it up and to express our intent more.

Signed-off-by: James C Boyd 
Signed-off-by: Jiri Kosina 
Cc: Willy Tarreau 
Signed-off-by: Greg Kroah-Hartman

be2iscsi: Fix bogus WARN_ON length check

2016-09-11T07:59:58+00:00

commit dd29dae00d39186890a5eaa2fe4ad8768bfd41a9 upstream.

drivers/scsi/be2iscsi/be_main.c: In function 'be_sgl_create_contiguous':
drivers/scsi/be2iscsi/be_main.c:3187:18: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  WARN_ON(!length > 0);

gcc version 5.2.1

Signed-off-by: Tim Gardner 
Cc: Jayamohan Kallickal 
Cc: Minh Tran 
Cc: John Soni Jose 
Cc: "James E.J. Bottomley" 
Reported-by: Joel Stanley 
Reviewed-by: Manoj Kumar 
Signed-off-by: Martin K. Petersen 
Cc: Willy Tarreau 
Signed-off-by: Greg Kroah-Hartman

Revert "can: fix handling of unmodifiable configuration options fix"

2016-09-11T07:59:58+00:00

This reverts commit 6f8f768a3586b6fbd50e249e7fe4f964a6994685 which was
bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream.

It was applied incorrectly, and isn't needed for 3.14-stable.

Reported-by: Willy Tarreau 
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

ACPI / sysfs: fix error code in get_status()

2016-09-07T06:30:01+00:00

commit f18ebc211e259d4f591e39e74b2aa2de226c9a1d upstream.

The problem with ornamental, do-nothing gotos is that they lead to
"forgot to set the error code" bugs.  We should be returning -EINVAL
here but we don't.  It leads to an uninitalized variable in
counter_show():

    drivers/acpi/sysfs.c:603 counter_show()
    error: uninitialized symbol 'status'.

Fixes: 1c8fce27e275 (ACPI: introduce drivers/acpi/sysfs.c)
Signed-off-by: Dan Carpenter 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: daqboard2000: bug fix board type matching code

2016-09-07T06:30:01+00:00

commit 80e162ee9b31d77d851b10f8c5299132be1e120f upstream.

`daqboard2000_find_boardinfo()` is supposed to check if the
DaqBoard/2000 series model is supported, based on the PCI subvendor and
subdevice ID.  The current code is wrong as it is comparing the PCI
device's subdevice ID to an expected, fixed value for the subvendor ID.
It should be comparing the PCI device's subvendor ID to this fixed
value.  Correct it.

Fixes: 7e8401b23e7f ("staging: comedi: daqboard2000: add back subsystem_device check")
Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

USB: serial: mos7840: fix non-atomic allocation in write path

2016-09-07T06:30:01+00:00

commit 3b7c7e52efda0d4640060de747768360ba70a7c0 upstream.

There is an allocation with GFP_KERNEL flag in mos7840_write(),
while it may be called from interrupt context.

Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic
allocation in write path")

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: serial: mos7720: fix non-atomic allocation in write path

2016-09-07T06:30:01+00:00

commit 5a5a1d614287a647b36dff3f40c2b0ceabbc83ec upstream.

There is an allocation with GFP_KERNEL flag in mos7720_write(),
while it may be called from interrupt context.

Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic
allocation in write path")

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman