xfrm_user: fix info leak in copy_to_user_auth()

copy_to_user_auth() fails to initialize the remainder of alg_name and
therefore discloses up to 54 bytes of heap memory via netlink to
userland.

Use strncpy() instead of strcpy() to fill the trailing bytes of alg_name
with null bytes.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm_user: fix info leak in copy_to_user_state()

The memory reserved to dump the xfrm state includes the padding bytes of
struct xfrm_usersa_info added by the compiler for alignment (7 for
amd64, 3 for i386). Add an explicit memset(0) before filling the buffer
to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm_user: fix info leak in copy_to_user_policy()

The memory reserved to dump the xfrm policy includes multiple padding
bytes added by the compiler for alignment (padding bytes in struct
xfrm_selector and struct xfrm_userpolicy_info). Add an explicit
memset(0) before filling the buffer to avoid the heap info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm_user: fix info leak in copy_to_user_tmpl()

The memory used for the template copy is a local stack variable. As
struct xfrm_user_tmpl contains multiple holes added by the compiler for
alignment, not initializing the memory will lead to leaking stack bytes
to userland. Add an explicit memset(0) to avoid the info leak.

Initial version of the patch by Brad Spengler.

Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm_user: ensure user supplied esn replay window is valid

The current code fails to ensure that the netlink message actually
contains as many bytes as the header indicates. If a user creates a new
state or updates an existing one but does not supply the bytes for the
whole ESN replay window, the kernel copies random heap bytes into the
replay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL
netlink attribute. This leads to following issues:

1. The replay window has random bits set confusing the replay handling
   code later on.

2. A malicious user could use this flaw to leak up to ~3.5kB of heap
   memory when she has access to the XFRM netlink interface (requires
   CAP_NET_ADMIN).

Known users of the ESN replay window are strongSwan and Steffen's
iproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter
uses the interface with a bitmap supplied while the former does not.
strongSwan is therefore prone to run into issue 1.

To fix both issues without breaking existing userland allow using the
XFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a
fully specified one. For the former case we initialize the in-kernel
bitmap with zero, for the latter we copy the user supplied bitmap. For
state updates the full bitmap must be supplied.

To prevent overflows in the bitmap length calculation the maximum size
of bmp_len is limited to 128 by this patch -- resulting in a maximum
replay window of 4096 packets. This should be sufficient for all real
life scenarios (RFC 4303 recommends a default replay window size of 64).

Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Martin Willi <martin@revosec.ch>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
xfrm_user: don't copy esn replay window twice for new states

The ESN replay window was already fully initialized in
xfrm_alloc_replay_state_esn(). No need to copy it again.

Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM: OMAP: AM33xx hwmod: fixup SPI after platform_data move

AM33xx hwmod data includes "mcspi.h" which has now been moved after
the platform_data move.  Fix it.

Signed-off-by: Kevin Hilman <khilman@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
pinctrl: exynos: Set pin function to EINT in irq_set_type of GPIO EINTa

Pins used as GPIO interrupts need to be configured as EINTs. This patch
adds the required configuration code to exynos_gpio_irq_set_type,
to set the pin as EINT when its interrupt trigger is configured.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: exynos: Fix typos in gpio/wkup _irq_mask

To mask GPIO/wakeup IRQ, the corresponding bit in mask register has to
be set.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: exynos: Handle only unmasked wakeup interrupts

A bit in EINTxx_PEND register is set regardless of interrupt mask, which
causes spurious interrupts. To avoid them, the read value of pending
register must be masked with current interrupt mask manually.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: exynos: Mark exynos_irq_demux_eint as inline

The exynos_irq_demux_eint utility function is used in chained IRQ
handler for EINT16-31 to handle multiplexed interrupts. Inlining it
should improve the performance a bit.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: exynos: Correct the detection of wakeup-eint node

Current way of finding the wakeup-eint node scans the whole device tree
not only children of the pinctrl node, so it might detect a wakeup-eint
node of another pinctrl device.

This patch limits the scope of looking for nodes only to subnodes of the
pinctrl node.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: samsung: Uninline samsung_pinctrl_get_soc_data

Although the function is used only a single time, it is not performance
critical and it is pretty heavy, so let the compiler decide whether to
inline it instead.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
pinctrl: exynos: Fix wakeup IRQ domain registration check

Because of a typo, incorrect field of a structure was being checked.
This patch fixes the check to use correct field.

Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
ARM: EXYNOS: Turn off clocks for NAND, OneNAND and TSI controllers

The clocks for NAND, OneNAND and Transport Stream Interface(TSI)
controllers could be either enabled or disabled at boot. To ensure
that these are turned off until used, add them to the list of clocks
to be turned off during boot.

Signed-off-by: Chander Kashyap <chander.kashyap@linaro.org>
Reviewed-by: Thomas Abraham <thomas.abraham@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
ARM: EXYNOS: Fix incorrect help text

Changed Exynos4 -> EXYNOS5.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
ARM: S3C24XX: Add .get_rate callback for "camif-upll" clock

Add missing get_rate callback for the "camif-upll" clock, so frequency
of this clock is properly reported with clk_get_rate().

Signed-off-by: Sylwester Nawrocki <sylvester.nawrocki@gmail.com>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
ARM: SAMSUNG: Fix HDMI related warnings

Silences the following warnings:
arch/arm/plat-samsung/devs.c:765:31: warning:
symbol 's5p_hdmi_def_platdata' was not declared. Should it be static?
arch/arm/plat-samsung/devs.c:767:13: warning:
symbol 's5p_hdmi_set_platdata' was not declared. Should it be static?

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Revert "PCI: Use hotplug-safe pci_get_domain_bus_and_slot()"

This reverts commit 433efd2247b0cbf5e7e86275e1f21281d3b99047.

When we remove an SR-IOV device, we have this call chain:

    driver .remove() method
        pci_disable_sriov()
            sriov_disable()
                virtfn_remove()
                    pci_get_domain_bus_and_slot()

sriov_disable() is only called for PFs, not for VFs.  When it's called
for a PF, it loops through all the VFs and calls virtfn_remove() for
each.  But we stop and remove VFs before PFs, so by the time we get
to virtfn_remove(), the VFs have already been stopped and deleted
from the device list.  Now pci_get_domain_bus_and_slot(), which uses
bus_find_device() and relies on that device list, doesn't find the
VFs, so the VF references aren't released correctly.

Reported-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
drivers: bus: omap_l3: use resources instead of hardcoded irqs

This fixes up a merge conflict due to the move of the driver and cleanups of
platform data around the same time. Moving to the resource is what we want
anyway, so do it in this branch.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[olof: rewrote with this branch as base, same end result]
Signed-off-by: Olof Johansson <olof@lixom.net>
Acked-by: Tony Lindgren <tony@atomide.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>