linux-stable.git/drivers, branch v4.1.38

sg_write()/bsg_write() is not fit to be called under KERNEL_DS

2017-01-13T01:56:58+00:00

[ Upstream commit 128394eff343fc6d2f32172f03e24829539c5835 ]

Both damn things interpret userland pointers embedded into the payload;
worse, they are actually traversing those.  Leaving aside the bad
API design, this is very much _not_ safe to call with KERNEL_DS.
Bail out early if that happens.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

drivers/gpu/drm/ast: Fix infinite loop if read fails

2017-01-13T01:56:58+00:00

[ Upstream commit 298360af3dab45659810fdc51aba0c9f4097e4f6 ]

ast_get_dram_info() configures a window in order to access BMC memory.
A BMC register can be configured to disallow this, and if so, causes
an infinite loop in the ast driver which renders the system unusable.

Fix this by erroring out if an error is detected.  On powerpc systems with
EEH, this leads to the device being fenced and the system continuing to
operate.

Cc:  # 3.10+
Signed-off-by: Russell Currey 
Reviewed-by: Joel Stanley 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20161215051241.20815-1-ruscur@russell.cc
Signed-off-by: Sasha Levin

target/user: Fix use-after-free of tcmu_cmds if they are expired

2017-01-13T01:56:58+00:00

[ Upstream commit d0905ca757bc40bd1ebc261a448a521b064777d7 ]

Don't free the cmd in tcmu_check_expired_cmd, it's still referenced by
an entry in our cmd_id->cmd idr. If userspace ever resumes processing,
tcmu_handle_completions() will use the now-invalid cmd pointer.

Instead, don't free cmd. It will be freed by tcmu_handle_completion() if
userspace ever recovers, or tcmu_free_device if not.

Cc: stable@vger.kernel.org
Reported-by: Bryant G Ly 
Tested-by: Bryant G Ly 
Signed-off-by: Andy Grover 
Signed-off-by: Bart Van Assche 
Signed-off-by: Sasha Levin

scsi: avoid a permanent stop of the scsi device's request queue

2017-01-13T01:56:57+00:00

[ Upstream commit d2a145252c52792bc59e4767b486b26c430af4bb ]

A race between scanning and fc_remote_port_delete() may result in a
permanent stop if the device gets blocked before scsi_sysfs_add_sdev()
and unblocked after.  The reason is that blocking a device sets both the
SDEV_BLOCKED state and the QUEUE_FLAG_STOPPED.  However,
scsi_sysfs_add_sdev() unconditionally sets SDEV_RUNNING which causes the
device to be ignored by scsi_target_unblock() and thus never have its
QUEUE_FLAG_STOPPED cleared leading to a device which is apparently
running but has a stopped queue.

We actually have two places where SDEV_RUNNING is set: once in
scsi_add_lun() which respects the blocked flag and once in
scsi_sysfs_add_sdev() which doesn't.  Since the second set is entirely
spurious, simply remove it to fix the problem.

Cc: 
Reported-by: Zengxi Chen 
Signed-off-by: Wei Fang 
Reviewed-by: Ewan D. Milne 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

IB/multicast: Check ib_find_pkey() return value

2017-01-13T01:56:57+00:00

[ Upstream commit d3a2418ee36a59bc02e9d454723f3175dcf4bfd9 ]

This patch avoids that Coverity complains about not checking the
ib_find_pkey() return value.

Fixes: commit 547af76521b3 ("IB/multicast: Report errors on multicast groups if P_key changes")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Cc: 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IPoIB: Avoid reading an uninitialized member variable

2017-01-13T01:56:57+00:00

[ Upstream commit 11b642b84e8c43e8597de031678d15c08dd057bc ]

This patch avoids that Coverity reports the following:

    Using uninitialized value port_attr.state when calling printk

Fixes: commit 94232d9ce817 ("IPoIB: Start multicast join process only on active ports")
Signed-off-by: Bart Van Assche 
Cc: Erez Shitrit 
Cc: 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

Input: drv260x - fix input device's parent assignment

2017-01-13T01:56:57+00:00

[ Upstream commit 5a8a6b89c15766446d845671d574a9243b6d8786 ]

We were assigning I2C bus controller instead of client as parent device.
Besides being logically wrong, it messed up with devm handling of input
device. As a result we were leaving input device and event node behind
after rmmod-ing the driver, which lead to a kernel oops if one were to
access the event node later.

Let's remove the assignment and rely on devm_input_allocate_device() to
set it up properly for us.

Signed-off-by: Jingkui Wang 
Fixes: 7132fe4f5687 ("Input: drv260x - add TI drv260x haptics driver")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

s390/vmlogrdr: fix IUCV buffer allocation

2017-01-13T01:56:57+00:00

[ Upstream commit 5457e03de918f7a3e294eb9d26a608ab8a579976 ]

The buffer for iucv_message_receive() needs to be below 2 GB. In
__iucv_message_receive(), the buffer address is casted to an u32, which
would result in either memory corruption or an addressing exception when
using addresses >= 2 GB.

Fix this by using GFP_DMA for the buffer allocation.

Cc: stable@vger.kernel.org
Signed-off-by: Gerald Schaefer 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Sasha Levin

USB: serial: option: add dlink dwm-158

2017-01-13T01:56:56+00:00

[ Upstream commit d8a12b7117b42fd708f1e908498350232bdbd5ff ]

Adding registration for 3G modem DWM-158 in usb-serial-option

Signed-off-by: Giuseppe Lippolis 
Cc: stable 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041

2017-01-13T01:56:56+00:00

[ Upstream commit 5b09eff0c379002527ad72ea5ea38f25da8a8650 ]

This patch adds support for PIDs 0x1040, 0x1041 of Telit LE922A.

Since the interface positions are the same than the ones used
for other Telit compositions, previous defined blacklists are used.

Signed-off-by: Daniele Palmas 
Cc: stable 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin