linux-stable.git/drivers, branch v3.16.69

scsi: megaraid_sas: return error when create DMA pool failed

2019-06-20T17:11:27+00:00

commit bcf3b67d16a4c8ffae0aa79de5853435e683945c upstream.

when create DMA pool for cmd frames failed, we should return -ENOMEM,
instead of 0.
In some case in:

    megasas_init_adapter_fusion()

    -->megasas_alloc_cmds()
       -->megasas_create_frame_pool
          create DMA pool failed,
        --> megasas_free_cmds() [1]

    -->megasas_alloc_cmds_fusion()
       failed, then goto fail_alloc_cmds.
    -->megasas_free_cmds() [2]

we will call megasas_free_cmds twice, [1] will kfree cmd_list,
[2] will use cmd_list.it will cause a problem:

Unable to handle kernel NULL pointer dereference at virtual address
00000000
pgd = ffffffc000f70000
[00000000] *pgd=0000001fbf893003, *pud=0000001fbf893003,
*pmd=0000001fbf894003, *pte=006000006d000707
Internal error: Oops: 96000005 [#1] SMP
 Modules linked in:
 CPU: 18 PID: 1 Comm: swapper/0 Not tainted
 task: ffffffdfb9290000 ti: ffffffdfb923c000 task.ti: ffffffdfb923c000
 PC is at megasas_free_cmds+0x30/0x70
 LR is at megasas_free_cmds+0x24/0x70
 ...
 Call trace:
 [] megasas_free_cmds+0x30/0x70
 [] megasas_init_adapter_fusion+0x2f4/0x4d8
 [] megasas_init_fw+0x2dc/0x760
 [] megasas_probe_one+0x3c0/0xcd8
 [] local_pci_probe+0x4c/0xb4
 [] pci_device_probe+0x11c/0x14c
 [] driver_probe_device+0x1ec/0x430
 [] __driver_attach+0xa8/0xb0
 [] bus_for_each_dev+0x74/0xc8
  [] driver_attach+0x28/0x34
 [] bus_add_driver+0x16c/0x248
 [] driver_register+0x6c/0x138
 [] __pci_register_driver+0x5c/0x6c
 [] megasas_init+0xc0/0x1a8
 [] do_one_initcall+0xe8/0x1ec
 [] kernel_init_freeable+0x1c8/0x284
 [] kernel_init+0x1c/0xe4

Signed-off-by: Jason Yan 
Acked-by: Sumit Saxena 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Ben Hutchings

drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl

2019-06-20T17:11:26+00:00

commit 6a024330650e24556b8a18cc654ad00cfecf6c6c upstream.

The "param.count" value is a u64 thatcomes from the user.  The code
later in the function assumes that param.count is at least one and if
it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR.

Also the addition can have an integer overflow which would lead us to
allocate a smaller "pages" array than required.  I can't immediately
tell what the possible run times implications are, but it's safest to
prevent the overflow.

Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Dan Carpenter 
Reviewed-by: Andrew Morton 
Cc: Timur Tabi 
Cc: Mihai Caraman 
Cc: Kumar Gala 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings

x86/speculation/mds: Add sysfs reporting for MDS

2019-05-22T22:15:23+00:00

commit 8a4b06d391b0a42a373808979b5028f5c84d9c6a upstream.

Add the sysfs reporting file for MDS. It exposes the vulnerability and
mitigation state similar to the existing files for the other speculative
hardware vulnerabilities.

Signed-off-by: Thomas Gleixner 
Reviewed-by: Greg Kroah-Hartman 
Reviewed-by: Borislav Petkov 
Reviewed-by: Jon Masters 
Tested-by: Jon Masters 
[bwh: Backported to 3.16:
 - Test x86_hyper instead of using hypervisor_is_type()
 - Adjust context]
Signed-off-by: Ben Hutchings

vxlan: Fix big-endian declaration of VNI

2019-05-11T14:22:48+00:00

In this version of the driver, VNIs are consistently kept in host
order.  However vxlan_fdb_create() erroneously declares its vni
parameter as __be32, which sparse warns about.  Change it to __u32.

This was resolved upstream by commit 54bfd872bf16 "vxlan: keep flags
and vni in network byte order".

Signed-off-by: Ben Hutchings

spi: omap-100k: Remove unused definitions

2019-05-11T14:22:47+00:00

commit 9f5b8b4f56dd194fd33021810636879036d2acdd upstream.

Remove unused definition which cause the following warnings

drivers/spi/spi-omap-100k.c:73:0: warning: "WRITE" redefined [enabled by default]
include/linux/fs.h:193:0: note: this is the location of the previous definition
drivers/spi/spi-omap-100k.c:74:0: warning: "READ" redefined [enabled by default]
include/linux/fs.h:192:0: note: this is the location of the previous definition

Signed-off-by: Nick Krause 
Acked-by: Geert Uytterhoeven 
Signed-off-by: Mark Brown 
Signed-off-by: Ben Hutchings

brcmfmac: add length checks in scheduled scan result handler

2019-05-11T14:22:47+00:00

commit 4835f37e3bafc138f8bfa3cbed2920dd56fed283 upstream.

Assure the event data buffer is long enough to hold the array
of netinfo items and that SSID length does not exceed the maximum
of 32 characters as per 802.11 spec.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16:
 - Move the assignment to "data" along with the assignment to "netinfo_start"
   that depends on it
 - Adjust filename, context, indentation]
Signed-off-by: Ben Hutchings

Revert "brcmfmac: assure SSID length from firmware is limited"

2019-05-11T14:22:46+00:00

This reverts commit 9657f3abd17772d3290a3545dfb4811d945e84e1, which
was similar to commit 1b5e2423164b3670e8bc9174e4762d297990deff
upstream.  The function fixed upstream doesn't exist in 3.16 and the
similar bug that does exist here needs a different fix.

Signed-off-by: Ben Hutchings

tty: mark Siemens R3964 line discipline as BROKEN

2019-05-02T20:42:07+00:00

commit c7084edc3f6d67750f50d4183134c4fb5712a5c8 upstream.

The n_r3964 line discipline driver was written in a different time, when
SMP machines were rare, and users were trusted to do the right thing.
Since then, the world has moved on but not this code, it has stayed
rooted in the past with its lovely hand-crafted list structures and
loads of "interesting" race conditions all over the place.

After attempting to clean up most of the issues, I just gave up and am
now marking the driver as BROKEN so that hopefully someone who has this
hardware will show up out of the woodwork (I know you are out there!)
and will help with debugging a raft of changes that I had laying around
for the code, but was too afraid to commit as odds are they would break
things.

Many thanks to Jann and Linus for pointing out the initial problems in
this codebase, as well as many reviews of my attempts to fix the issues.
It was a case of whack-a-mole, and as you can see, the mole won.

Reported-by: Jann Horn 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings

brcmfmac: add subtype check for event handling in data path

2019-05-02T20:42:06+00:00

commit a4176ec356c73a46c07c181c6d04039fafa34a9f upstream.

For USB there is no separate channel being used to pass events
from firmware to the host driver and as such are passed over the
data path. In order to detect mock event messages an additional
check is needed on event subtype. This check is added conditionally
using unlikely() keyword.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16:
 - Drop changes to PCIe bus support
 - Adjust filenames]
Signed-off-by: Ben Hutchings

brcmfmac: revise handling events in receive path

2019-05-02T20:42:06+00:00

commit 9c349892ccc90c6de2baaa69cc78449f58082273 upstream.

Move event handling out of brcmf_netif_rx() avoiding the need
to pass a flag. This flag is only ever true for USB hosts as
other interface use separate brcmf_rx_event() function.

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16 as dependency of commit a4176ec356c7
 "brcmfmac: add subtype check for event handling in data path"
 - Drop changes to PCIe bus support
 - Adjust filenames]
Signed-off-by: Ben Hutchings