linux-stable.git/drivers, branch v3.12.53

ppp, slip: Validate VJ compression slot parameters completely

2016-01-27T08:56:19+00:00

commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae upstream.

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

isdn_ppp: Add checks for allocation failure in isdn_ppp_open()

2016-01-27T08:56:18+00:00

commit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 upstream.

Compile-tested only.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

ipmi: move timer init to before irq is setup

2016-01-25T14:15:42+00:00

commit 27f972d3e00b50639deb4cc1392afaeb08d3cecc upstream.

We encountered a panic on boot in ipmi_si on a dell per320 due to an
uninitialized timer as follows.

static int smi_start_processing(void       *send_info,
                                ipmi_smi_t intf)
{
        /* Try to claim any interrupts. */
        if (new_smi->irq_setup)
                new_smi->irq_setup(new_smi);

 --> IRQ arrives here and irq handler tries to modify uninitialized timer

    which triggers BUG_ON(!timer->function) in __mod_timer().

 Call Trace:
   
   [] start_new_msg+0x47/0x80 [ipmi_si]
   [] start_check_enables+0x4e/0x60 [ipmi_si]
   [] smi_event_handler+0x1e8/0x640 [ipmi_si]
   [] ? __rcu_process_callbacks+0x54/0x350
   [] si_irq_handler+0x3c/0x60 [ipmi_si]
   [] handle_IRQ_event+0x60/0x170
   [] handle_edge_irq+0xde/0x180
   [] handle_irq+0x49/0xa0
   [] do_IRQ+0x6c/0xf0
   [] ret_from_intr+0x0/0x11

        /* Set up the timer that drives the interface. */
        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);

The following patch fixes the problem.

To: Openipmi-developer@lists.sourceforge.net
To: Corey Minyard 
CC: linux-kernel@vger.kernel.org

Signed-off-by: Jan Stancek 
Signed-off-by: Tony Camuso 
Signed-off-by: Corey Minyard 
Signed-off-by: Jiri Slaby

xen/gntdev: Grant maps should not be subject to NUMA balancing

2016-01-25T14:15:39+00:00

commit 9c17d96500f78d7ecdb71ca6942830158bc75a2b upstream.

Doing so will cause the grant to be unmapped and then, during
fault handling, the fault to be mistakenly treated as NUMA hint
fault.

In addition, even if those maps could partcipate in NUMA
balancing, it wouldn't provide any benefit since we are unable
to determine physical page's node (even if/when VNUMA is
implemented).

Marking grant maps' VMAs as VM_IO will exclude them from being
part of NUMA balancing.

Signed-off-by: Boris Ostrovsky 
Signed-off-by: David Vrabel 
Signed-off-by: Jiri Slaby

USB: quirks: Fix another ELAN touchscreen

2016-01-25T14:15:36+00:00

commit df36c5bede207f734e4750beb2b14fb892050280 upstream.

Like other buggy models that had their fixes [1], the touchscreen with
id 04f3:21b8 from ELAN Microelectronics needs the device-qualifier
quirk. Otherwise, it fails to respond, blocks the boot for a random
amount of time and pollutes dmesg with:

[ 2887.373196] usb 1-5: new full-speed USB device number 41 using xhci_hcd
[ 2889.502000] usb 1-5: unable to read config index 0 descriptor/start: -71
[ 2889.502005] usb 1-5: can't read configurations, error -71
[ 2889.654571] usb 1-5: new full-speed USB device number 42 using xhci_hcd
[ 2891.783438] usb 1-5: unable to read config index 0 descriptor/start: -71
[ 2891.783443] usb 1-5: can't read configurations, error -71

[1]: See commits c68929f, 876af5d, d749947, a32c99e and dc703ec.

Tested-by: Adrien Vergé 
Signed-off-by: Adrien Vergé 
Signed-off-by: Greg Kroah-Hartman 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

staging/dgnc: fix info leak in ioctl

2016-01-15T08:31:27+00:00

commit 4b6184336ebb5c8dc1eae7f7ab46ee608a748b05 upstream.

The dgnc_mgmt_ioctl() code fails to initialize the 16 _reserved bytes of
struct digi_dinfo after the ->dinfo_nboards member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Salva Peiró 
Signed-off-by: Greg Kroah-Hartman 
Cc: Yuki Machida 
Signed-off-by: Jiri Slaby

qla2xxx: Fix hardware lock/unlock issue causing kernel panic.

2016-01-11T21:02:33+00:00

commit ba9f6f64a0ff6b7ecaed72144c179061f8eca378 upstream.

This patch fixes a kernel panic for qla2xxx Target core
Module driver introduced by a fix in the qla2xxx initiator code.

Commit ef86cb2 ("qla2xxx: Mark port lost when we receive an RSCN for it.")
introduced the regression for qla2xxx Target driver.

Stack trace will have following signature

 ---  ---
[ffff88081faa3cc8] _raw_spin_lock_irqsave at ffffffff815b1f03
[ffff88081faa3cd0] qlt_fc_port_deleted at ffffffffa096ccd0 [qla2xxx]
[ffff88081faa3d20] qla2x00_schedule_rport_del at ffffffffa0913831[qla2xxx]
[ffff88081faa3d50] qla2x00_mark_device_lost at ffffffffa09159c5[qla2xxx]
[ffff88081faa3db0] qla2x00_async_event at ffffffffa0938d59 [qla2xxx]
[ffff88081faa3e30] qla24xx_msix_default at ffffffffa093a326 [qla2xxx]
[ffff88081faa3e90] handle_irq_event_percpu at ffffffff810a7b8d
[ffff88081faa3ee0] handle_irq_event at ffffffff810a7d32
[ffff88081faa3f10] handle_edge_irq at ffffffff810ab6b9
[ffff88081faa3f30] handle_irq at ffffffff8100619c
[ffff88081faa3f70] do_IRQ at ffffffff815b4b1c
 ---  ---

Signed-off-by: Saurav Kashyap 
Signed-off-by: Himanshu Madhani 
Reviewed-by: Nicholas Bellinger 
Signed-off-by: Nicholas Bellinger 
Cc: Michal Marek 
Fixes: ef86cb205 ("qla2xxx: Mark port lost when we receive an RSCN for it.")
Signed-off-by: Jiri Slaby

Input: aiptek - fix crash on detecting device without endpoints

2016-01-11T15:07:40+00:00

commit 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96 upstream.

The aiptek driver crashes in aiptek_probe() when a specially crafted USB
device without endpoints is detected. This fix adds a check that the device
has proper configuration expected by the driver. Also an error return value
is changed to more matching one in one of the error paths.

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

lpfc: Fix null ndlp dereference in target_reset_handler

2016-01-11T15:07:24+00:00

commit 63e480fd2f598e9ad37f89e79c36834e7dd60ba0 upstream.

Signed-off-by: Dick Kennedy 
Signed-off-by: James Smart 
Reviewed-by: Hannes Reinecke 
Signed-off-by: James Bottomley 
Acked-by: Johannes Thumshirn 
Signed-off-by: Jiri Slaby

drm/i915: Fix SRC_COPY width on 830/845g

2016-01-09T10:53:12+00:00

commit 611a7a4fd8b5fb6b25ab1f8bdcde61800a7feacf upstream.

One small change I forgot to make in

commit c4d69da167fa967749aeb70bc0e94a457e5d00c1
Author: Chris Wilson 
Date:   Mon Sep 8 14:25:41 2014 +0100

    drm/i915: Evict CS TLBs between batches

was to update the copy width for the compact BLT copy instruction.

Reported-by: Thomas Richter 
Signed-off-by: Chris Wilson 
Cc: Thomas Richter 
Cc: Jani Nikula 
Tested-by: Thomas Richter 
Acked-by: Daniel Vetter 
Signed-off-by: Jani Nikula 
Signed-off-by: Jiri Slaby