relay: prevent integer overflow in relay_open()
author	Dan Carpenter <dan.carpenter@oracle.com>
	Fri, 10 Feb 2012 08:03:58 +0000 (09:03 +0100)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:19 +0000 (09:49 -0800)
commit f6302f1bcd75a042df69866d98b8d775a668f8f1 upstream.

"subbuf_size" and "n_subbufs" come from the user and they need to be
capped to prevent an integer overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mac80211: timeout a single frame in the rx reorder buffer
author	Eliad Peller <eliad@wizery.com>
	Wed, 1 Feb 2012 16:48:09 +0000 (18:48 +0200)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:19 +0000 (09:49 -0800)
commit 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 upstream.

The current code checks for stored_mpdu_num > 1, causing
the reorder_timer to be triggered indefinitely, but the
frame is never timed-out (until the next packet is received)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel.h: fix wrong usage of __ratelimit()
author	Yong Zhang <yong.zhang@windriver.com>
	Tue, 6 Apr 2010 21:35:02 +0000 (14:35 -0700)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:19 +0000 (09:49 -0800)
commit bb1dc0bacb8ddd7ba6a5906c678a5a5a110cf695 upstream.

When __ratelimit() returns 1 this means that we can go ahead.

Signed-off-by: Yong Zhang <yong.zhang@windriver.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
printk_ratelimited(): fix uninitialized spinlock
author	OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
	Mon, 24 May 2010 21:33:11 +0000 (14:33 -0700)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:19 +0000 (09:49 -0800)
commit d8521fcc5e0ad3e79bbc4231bb20a6cdc2b50164 upstream.

ratelimit_state initialization of printk_ratelimited() seems broken.  This
fixes it by using DEFINE_RATELIMIT_STATE() to initialize spinlock
properly.

Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sven-Haegar Koch <haegar@sdinet.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: sha512 - Use binary and instead of modulus
author	Herbert Xu <herbert@gondor.apana.org.au>
	Thu, 26 Jan 2012 04:03:16 +0000 (15:03 +1100)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
commit 58d7d18b5268febb8b1391c6dffc8e2aaa751fcd upstream.

The previous patch used the modulus operator over a power of 2
unnecessarily which may produce suboptimal binary code.  This
patch changes changes them to binary ands instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: sha512 - Avoid stack bloat on i386
author	Herbert Xu <herbert@gondor.apana.org.au>
	Sun, 5 Feb 2012 04:09:28 +0000 (15:09 +1100)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
commit 3a92d687c8015860a19213e3c102cad6b722f83c upstream.

Unfortunately in reducing W from 80 to 16 we ended up unrolling
the loop twice.  As gcc has issues dealing with 64-bit ops on
i386 this means that we end up using even more stack space (>1K).

This patch solves the W reduction by moving LOAD_OP/BLEND_OP
into the loop itself, thus avoiding the need to duplicate it.

While the stack space still isn't great (>0.5K) it is at least
in the same ball park as the amount of stack used for our C sha1
implementation.

Note that this patch basically reverts to the original code so
the diff looks bigger than it really is.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eCryptfs: Remove mmap from directory operations
author	Tyler Hicks <tyhicks@linux.vnet.ibm.com>
	Wed, 15 Feb 2012 18:32:31 +0000 (11:32 -0700)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
backported from 38e3eaeedcac75360af8a92e7b66956ec4f334e5

Adrian reported that mkfontscale didn't work inside of eCryptfs mounts.
Strace revealed the following:

open("./", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3
fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC)
open("./fonts.scale", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
getdents(3, /* 80 entries */, 32768) = 2304
open("./.", O_RDONLY) = 5
fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
fstat64(5, {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
mmap2(NULL, 16384, PROT_READ, MAP_PRIVATE, 5, 0) = 0xb7fcf000
close(5) = 0
 --- SIGBUS (Bus error) @ 0 (0) ---
 +++ killed by SIGBUS +++

The mmap2() on a directory was successful, resulting in a SIGBUS
signal later.  This patch removes mmap() from the list of possible
ecryptfs_dir_fops so that mmap() isn't possible on eCryptfs directory
files.

http://bugs.launchpad.net/bugs/400443

Reported-by: Adrian C. <anrxc@sysphere.org>
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ban ecryptfs over ecryptfs
author	Al Viro <viro@zeniv.linux.org.uk>
	Wed, 15 Feb 2012 21:10:52 +0000 (14:10 -0700)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
(cherry picked from commit 4403158ba295c8e36f6736b1bb12d0f7e1923dac)

This is a seriously simplified patch from Eric Sandeen; copy of
rationale follows:
===
  mounting stacked ecryptfs on ecryptfs has been shown to lead to bugs
  in testing.  For crypto info in xattr, there is no mechanism for handling
  this at all, and for normal file headers, we run into other trouble:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  IP: [<ffffffffa015b0b3>] ecryptfs_d_revalidate+0x43/0xa0 [ecryptfs]
  ...

  There doesn't seem to be any good usecase for this, so I'd suggest just
  disallowing the configuration.

  Based on a patch originally, I believe, from Mike Halcrow.
===

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add mount option to check uid of device being mounted = expect uid, CVE-2011-1833
author	John Johansen <john.johansen@canonical.com>
	Wed, 15 Feb 2012 21:14:06 +0000 (14:14 -0700)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
(backported from commit 764355487ea220fdc2faf128d577d7f679b91f97)

Close a TOCTOU race for mounts done via ecryptfs-mount-private.  The mount
source (device) can be raced when the ownership test is done in userspace.
Provide Ecryptfs a means to force the uid check at mount time.

BugLink: http://bugs.launchpad.net/bugs/732628
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tyler Hicks <tyler.hicks@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: sha512 - use standard ror64()
author	Alexey Dobriyan <adobriyan@gmail.com>
	Sat, 14 Jan 2012 18:44:49 +0000 (21:44 +0300)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:20 +0000 (09:49 -0800)
commit f2ea0f5f04c97b48c88edccba52b0682fbe45087 upstream.

Use standard ror64() instead of hand-written.
There is no standard ror64, so create it.

The difference is shift value being "unsigned int" instead of uint64_t
(for which there is no reason). gcc starts to emit native ROR instructions
which it doesn't do for some reason currently. This should make the code
faster.

Patch survives in-tree crypto test and ping flood with hmac(sha512) on.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ecryptfs: read on a directory should return EISDIR if not supported
author	Andy Whitcroft <apw@canonical.com>
	Wed, 16 Feb 2011 04:49:59 +0000 (04:49 +0000)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit 323ef68faf1bbd9b1e66aea268fd09d358d7e8ab upstream.

read() calls against a file descriptor connected to a directory are
incorrectly returning EINVAL rather than EISDIR:

  [EISDIR]
    [XSI] [Option Start] The fildes argument refers to a directory and the
    implementation does not allow the directory to be read using read()
    or pread(). The readdir() function should be used instead. [Option End]

This occurs because we do not have a .read operation defined for
ecryptfs directories.  Connect this up to generic_read_dir().

BugLink: http://bugs.launchpad.net/bugs/719691
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
SCSI: 3w-9xxx fix bug in sgl loading
author	adam radford <aradford@gmail.com>
	Thu, 10 Dec 2009 19:53:31 +0000 (11:53 -0800)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit 53ca353594a254e6bd45ccf2d405aa31bcbb7091 upstream.

This small patch fixes a bug in the 3w-9xxx driver where it would load
an invalid sgl address in the ioctl path even if request length was zero.

Signed-off-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR
author	Stephen Boyd <sboyd@codeaurora.org>
	Tue, 7 Feb 2012 18:42:07 +0000 (19:42 +0100)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit b46c0f74657d1fe1c1b0c1452631cc38a9e6987f upstream.

armv7's flush_cache_all() flushes caches via set/way. To
determine the cache attributes (line size, number of sets,
etc.) the assembly first writes the CSSELR register to select a
cache level and then reads the CCSIDR register. The CSSELR register
is banked per-cpu and is used to determine which cache level CCSIDR
reads. If the task is migrated between when the CSSELR is written and
the CCSIDR is read the CCSIDR value may be for an unexpected cache
level (for example L1 instead of L2) and incorrect cache flushing
could occur.

Disable interrupts across the write and read so that the correct
cache attributes are read and used for the cache flushing
routine. We disable interrupts instead of disabling preemption
because the critical section is only 3 instructions and we want
to call v7_dcache_flush_all from __v7_setup which doesn't have a
full kernel stack with a struct thread_info.

This fixes a problem we see in scm_call() when flush_cache_all()
is called from preemptible context and sometimes the L2 cache is
not properly flushed out.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ARM: 7325/1: fix v7 boot with lockdep enabled
author	Rabin Vincent <rabin@rab.in>
	Wed, 15 Feb 2012 15:01:42 +0000 (16:01 +0100)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit 8e43a905dd574f54c5715d978318290ceafbe275 upstream.

Bootup with lockdep enabled has been broken on v7 since b46c0f74657d
("ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR").

This is because v7_setup (which is called very early during boot) calls
v7_flush_dcache_all, and the save_and_disable_irqs added by that patch
ends up attempting to call into lockdep C code (trace_hardirqs_off())
when we are in no position to execute it (no stack, MMU off).

Fix this by using a notrace variant of save_and_disable_irqs.  The code
already uses the notrace variant of restore_irqs.

Reviewed-by: Nicolas Pitre <nico@linaro.org>
Acked-by: Stephen Boyd <sboyd@codeaurora.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: Fix handoff when BIOS disables host PCI device.
author	Sarah Sharp <sarah.a.sharp@linux.intel.com>
	Tue, 7 Feb 2012 23:11:46 +0000 (15:11 -0800)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit cab928ee1f221c9cc48d6615070fefe2e444384a upstream.

On some systems with an Intel Panther Point xHCI host controller, the
BIOS disables the xHCI PCI device during boot, and switches the xHCI
ports over to EHCI.  This allows the BIOS to access USB devices without
having xHCI support.

The downside is that the xHCI BIOS handoff mechanism will fail because
memory mapped I/O is not enabled for the disabled PCI device.
Jesse Barnes says this is expected behavior.  The PCI core will enable
BARs before quirks run, but it will leave it in an undefined state, and
it may not have memory mapped I/O enabled.

Make the generic USB quirk handler call pci_enable_device() to re-enable
MMIO, and call pci_disable_device() once the host-specific BIOS handoff
is finished.  This will balance the ref counts in the PCI core.  When
the PCI probe function is called, usb_hcd_pci_probe() will call
pci_enable_device() again.

This should be back ported to kernels as old as 2.6.31.  That was the
first kernel with xHCI support, and no one has complained about BIOS
handoffs failing due to memory mapped I/O being disabled on other hosts
(EHCI, UHCI, or OHCI).

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: Oliver Neukum <oneukum@suse.de>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
xhci: Fix encoding for HS bulk/control NAK rate.
author	Sarah Sharp <sarah.a.sharp@linux.intel.com>
	Mon, 13 Feb 2012 22:42:11 +0000 (14:42 -0800)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit 340a3504fd39dad753ba908fb6f894ee81fc3ae2 upstream.

The xHCI 0.96 spec says that HS bulk and control endpoint NAK rate must
be encoded as an exponent of two number of microframes.  The endpoint
descriptor has the NAK rate encoded in number of microframes.  We were
just copying the value from the endpoint descriptor into the endpoint
context interval field, which was not correct.  This lead to the VIA
host rejecting the add of a bulk OUT endpoint from any USB 2.0 mass
storage device.

The fix is to use the correct encoding.  Refactor the code to convert
number of frames to an exponential number of microframes, and make sure
we convert the number of microframes in HS bulk and control endpoints to
an exponent.

This should be back ported to kernels as old as 2.6.31, that contain the
commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math
in xhci_get_endpoint_interval"

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: Felipe Contreras <felipe.contreras@gmail.com>
Suggested-by: Andiry Xu <andiry.xu@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hdpvr: fix race conditon during start of streaming
author	Janne Grunau <j@jannau.net>
	Thu, 2 Feb 2012 16:35:21 +0000 (13:35 -0300)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:21 +0000 (09:49 -0800)
commit afa159538af61f1a65d48927f4e949fe514fb4fc upstream.

status has to be set to STREAMING before the streaming worker is
queued. hdpvr_transmit_buffers() will exit immediately otherwise.

Reported-by: Joerg Desch <vvd.joede@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eCryptfs: Use notify_change for truncating lower inodes
author	Tyler Hicks <tyhicks@linux.vnet.ibm.com>
	Wed, 14 Oct 2009 21:18:27 +0000 (16:18 -0500)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:22 +0000 (09:49 -0800)
commit 5f3ef64f4da1c587cdcfaaac72311225b7df094c upstream.

When truncating inodes in the lower filesystem, eCryptfs directly
invoked vmtruncate(). As Christoph Hellwig pointed out, vmtruncate() is
a filesystem helper function, but filesystems may need to do more than
just a call to vmtruncate().

This patch moves the lower inode truncation out of ecryptfs_truncate()
and renames the function to truncate_upper().  truncate_upper() updates
an iattr for the lower inode to indicate if the lower inode needs to be
truncated upon return.  ecryptfs_setattr() then calls notify_change(),
using the updated iattr for the lower inode, to complete the truncation.

For eCryptfs functions needing to truncate, ecryptfs_truncate() is
reintroduced as a simple way to truncate the upper inode to a specified
size and then truncate the lower inode accordingly.

https://bugs.launchpad.net/bugs/451368

Reported-by: Christoph Hellwig <hch@lst.de>
Acked-by: Dustin Kirkland <kirkland@canonical.com>
Cc: ecryptfs-devel@lists.launchpad.net
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eCryptfs: Remove extra d_delete in ecryptfs_rmdir
author	Tyler Hicks <tyhicks@linux.vnet.ibm.com>
	Tue, 12 Apr 2011 16:21:36 +0000 (11:21 -0500)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:22 +0000 (09:49 -0800)
commit 35ffa948b2f7bdf79e488cd496232935d095087a upstream.

vfs_rmdir() already calls d_delete() on the lower dentry. That was being
duplicated in ecryptfs_rmdir() and caused a NULL pointer dereference
when NFSv3 was the lower filesystem.

BugLink: http://bugs.launchpad.net/bugs/723518
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Colin King <colin.king@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eCryptfs: Clear i_nlink in rmdir
author	Tyler Hicks <tyhicks@linux.vnet.ibm.com>
	Fri, 29 Apr 2011 21:26:27 +0000 (16:26 -0500)
committer	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Sun, 4 Mar 2012 17:49:22 +0000 (09:49 -0800)
commit 07850552b92b3637fa56767b5e460b4238014447 upstream.

eCryptfs wasn't clearing the eCryptfs inode's i_nlink after a successful
vfs_rmdir() on the lower directory. This resulted in the inode evict and
destroy paths to be missed.

https://bugs.launchpad.net/ecryptfs/+bug/723518

Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Colin King <colin.king@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>