linux-stable.git/include, branch v4.1.36

drm/dp/mst: add some defines for logical/physical ports

2016-11-26T03:57:02+00:00

[ Upstream commit ccf03d6995fa4b784f5b987726ba98f4859bf326 ]

This just removes the magic number.

Acked-by: Daniel Vetter 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin

irqchip/gic-v3-its: Fix entry size mask for GITS_BASER

2016-11-01T19:18:16+00:00

[ Upstream commit 9224eb77e63f70f16c0b6b7a20ca7d395f3bc077 ]

Entry Size in GITS_BASER occupies 5 bits [52:48], but we mask out 8
bits.

Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue")
Cc: stable@vger.kernel.org
Signed-off-by: Vladimir Murzin 
Signed-off-by: Marc Zyngier 
Signed-off-by: Sasha Levin

mm: remove gup_flags FOLL_WRITE games from __get_user_pages()

2016-10-23T23:37:51+00:00

[ Upstream commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 ]

This is an ancient bug that was actually attempted to be fixed once
(badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
get_user_pages() race for write access") but that was then undone due to
problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").

In the meantime, the s390 situation has long been fixed, and we can now
fix it by checking the pte_dirty() bit properly (and do it better).  The
s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
software dirty bits") which made it into v3.9.  Earlier kernels will
have to look at the page state itself.

Also, the VM has become more scalable, and what used a purely
theoretical race back then has become easier to trigger.

To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
we already did a COW" rather than play racy games with FOLL_WRITE that
is very fundamental, and then use the pte dirty flag to validate that
the FOLL_COW flag is still valid.

Reported-and-tested-by: Phil "not Paul" Oester 
Acked-by: Hugh Dickins 
Reviewed-by: Michal Hocko 
Cc: Andy Lutomirski 
Cc: Kees Cook 
Cc: Oleg Nesterov 
Cc: Willy Tarreau 
Cc: Nick Piggin 
Cc: Greg Thelen 
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

fix fault_in_multipages_...() on architectures with no-op access_ok()

2016-10-03T16:58:36+00:00

[ Upstream commit e23d4159b109167126e5bcd7f3775c95de7fee47 ]

Switching iov_iter fault-in to multipages variants has exposed an old
bug in underlying fault_in_multipages_...(); they break if the range
passed to them wraps around.  Normally access_ok() done by callers will
prevent such (and it's a guaranteed EFAULT - ERR_PTR() values fall into
such a range and they should not point to any valid objects).

However, on architectures where userland and kernel live in different
MMU contexts (e.g. s390) access_ok() is a no-op and on those a range
with a wraparound can reach fault_in_multipages_...().

Since any wraparound means EFAULT there, the fix is trivial - turn
those

    while (uaddr <= end)
	    ...
into

    if (unlikely(uaddr > end))
	    return -EFAULT;
    do
	    ...
    while (uaddr <= end);

Reported-by: Jan Stancek 
Tested-by: Jan Stancek 
Cc: stable@vger.kernel.org # v3.5+
Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

fanotify: fix list corruption in fanotify_get_response()

2016-10-03T16:58:10+00:00

[ Upstream commit 96d41019e3ac55f6f0115b0ce97e4f24a3d636d2 ]

fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).

However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock.  Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.

Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().

Fixes: 5838d4442bd5 ("fanotify: fix double free of pending permission events")
Link: http://lkml.kernel.org/r/1473797711-14111-3-git-send-email-jack@suse.cz
Signed-off-by: Jan Kara 
Reported-by: Miklos Szeredi 
Tested-by: Miklos Szeredi 
Reviewed-by: Miklos Szeredi 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

fsnotify: add a way to stop queueing events on group shutdown

2016-10-03T16:58:04+00:00

[ Upstream commit 12703dbfeb15402260e7554d32a34ac40c233990 ]

Implement a function that can be called when a group is being shutdown
to stop queueing new events to the group.  Fanotify will use this.

Fixes: 5838d4442bd5 ("fanotify: fix double free of pending permission events")
Link: http://lkml.kernel.org/r/1473797711-14111-2-git-send-email-jack@suse.cz
Signed-off-by: Jan Kara 
Reviewed-by: Miklos Szeredi 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

fix iov_iter_fault_in_readable()

2016-10-03T12:35:04+00:00

[ Upstream commit d4690f1e1cdabb4d61207b6787b1605a0dc0aeab ]

... by turning it into what used to be multipages counterpart

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

asm-generic: make get_user() clear the destination on errors

2016-10-03T01:12:56+00:00

[ Upstream commit 9ad18b75c2f6e4a78ce204e79f37781f8815c0fa ]

both for access_ok() failures and for faults halfway through

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

asm-generic: {get,put}_user ptr argument evaluate only 1 time

2016-10-03T01:12:48+00:00

[ Upstream commit a02613a4ba679eacec8251976d02809d533fa717 ]

Current implemantation ptr argument evaluate 2 times.
It'll be an unexpected result.

Changes v5:
Remove unnecessary const.
Changes v4:
Temporary pointer type change to const void*
Changes v3:
Some build error fix.
Changes v2:
Argument x protect.

Signed-off-by: Yoshinori Sato 
Signed-off-by: Sasha Levin

genirq: Provide irq_gc_{lock_irqsave,unlock_irqrestore}() helpers

2016-10-03T00:51:35+00:00

[ Upstream commit ebf9ff753c041b296241990aef76163bbb2cc9c8 ]

Some irqchip drivers need to take the generic chip lock outside of the
irq context.

Provide the irq_gc_{lock_irqsave,unlock_irqrestore}() helpers to allow
one to disable irqs while entering a critical section protected by
gc->lock.

Note that we do not provide optimized version of these helpers for !SMP,
because they are not called from the hot-path.

[ tglx: Added a comment when these helpers should be [not] used ]

Signed-off-by: Boris Brezillon 
Cc: Jason Cooper 
Cc: Marc Zyngier 
Cc: Nicolas Ferre 
Cc: stable@vger.kernel.org
Cc: Alexandre Belloni 
Link: http://lkml.kernel.org/r/1473775109-4192-1-git-send-email-boris.brezillon@free-electrons.com
Signed-off-by: Thomas Gleixner 
Signed-off-by: Sasha Levin