userns: Only allow the creator of the userns unprivileged mappings

If you did not create the user namespace and are allowed
to write to uid_map or gid_map you should already have the necessary
privilege in the parent user namespace to establish any mapping
you want so this will not affect userspace in practice.

Limiting unprivileged uid mapping establishment to the creator of the
user namespace makes it easier to verify all credentials obtained with
the uid mapping can be obtained without the uid mapping without
privilege.

Limiting unprivileged gid mapping establishment (which is temporarily
absent) to the creator of the user namespace also ensures that the
combination of uid and gid can already be obtained without privilege.

This is part of the fix for CVE-2014-8989.

Cc: stable@vger.kernel.org
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
userns: Rename id_map_mutex to userns_state_mutex

Generalize id_map_mutex so it can be used for more state of a user namespace.

Cc: stable@vger.kernel.org
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Merge tag 'master-2014-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
pull request: wireless-next 2014-12-08

Please pull this last batch of pending wireless updates for the 3.19 tree...

For the wireless bits, Johannes says:

"This time I have Felix's no-status rate control work, which will allow
drivers to work better with rate control even if they don't have perfect
status reporting. In addition to this, a small hwsim fix from Patrik,
one of the regulatory patches from Arik, and a number of cleanups and
fixes I did myself.

Of note is a patch where I disable CFG80211_WEXT so that compatibility
is no longer selectable - this is intended as a wake-up call for anyone
who's still using it, and is still easily worked around (it's a one-line
patch) before we fully remove the code as well in the future."

For the Bluetooth bits, Johan says:

"Here's one more bluetooth-next pull request for 3.19:

 - Minor cleanups for ieee802154 & mac802154
 - Fix for the kernel warning with !TASK_RUNNING reported by Kirill A.
   Shutemov
 - Support for another ath3k device
 - Fix for tracking link key based security level
 - Device tree bindings for btmrvl + a state update fix
 - Fix for wrong ACL flags on LE links"

And...

"In addition to the previous one this contains two more cleanups to
mac802154 as well as support for some new HCI features from the
Bluetooth 4.2 specification.

From the original request:

'Here's what should be the last bluetooth-next pull request for 3.19.
It's rather large but the majority of it is the Low Energy Secure
Connections feature that's part of the Bluetooth 4.2 specification. The
specification went public only this week so we couldn't publish the
corresponding code before that. The code itself can nevertheless be
considered fairly mature as it's been in development for over 6 months
and gone through several interoperability test events.

Besides LE SC the pull request contains an important fix for command
complete events for mgmt sockets which also fixes some leaks of hci_conn
objects when powering off or unplugging Bluetooth adapters.

A smaller feature that's part of the pull request is service discovery
support. This is like normal device discovery except that devices not
matching specific UUIDs or strong enough RSSI are filtered out.

Other changes that the pull request contains are firmware dump support
to the btmrvl driver, firmware download support for Broadcom BCM20702A0
variants, as well as some coding style cleanups in 6lowpan &
ieee802154/mac802154 code.'"

For the NFC bits, Samuel says:

"With this one we get:

- NFC digital improvements for DEP support: Chaining, NACK and ATN
  support added.

- NCI improvements: Support for p2p target, SE IO operand addition,
  SE operands extensions to support proprietary implementations, and
  a few fixes.

- NFC HCI improvements: OPEN_PIPE and NOTIFY_ALL_CLEARED support,
  and SE IO operand addition.

- A bunch of minor improvements and fixes for STMicro st21nfcb and
  st21nfca"

For the iwlwifi bits, Emmanuel says:

"Major works are CSA and TDLS. On top of that I have a new
firmware API for scan and a few rate control improvements.
Johannes find a few tricks to improve our CPU utilization
and adds support for a new spin of 7265 called 7265D.
Along with this a few random things that don't stand out."

And...

"I deprecate here -8.ucode since -9 has been published long ago.
Along with that I have a new activity, we have now better
a infrastructure for firmware debugging. This will allow to
have configurable probes insides the firmware.
Luca continues his work on NetDetect, this feature is now
complete. All the rest is minor fixes here and there."

For the Atheros bits, Kalle says:

"Only ath10k changes this time and no major changes. Most visible are:

o new debugfs interface for runtime firmware debugging (Yanbo)

o fix shared WEP (Sujith)

o don't rebuild whenever kernel version changes (Johannes)

o lots of refactoring to make it easier to add new hw support (Michal)

There's also smaller fixes and improvements with no point of listing
here."

In addition, there are a few last minute updates to ath5k,
ath9k, brcmfmac, brcmsmac, mwifiex, rt2x00, rtlwifi, and wil6210.
Also included is a pull of the wireless tree to pick-up the fixes
originally included in "pull request: wireless 2014-12-03"...

Please let me know if there are problems!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
bridge: new mode flag to indicate mode 'undefined'

This patch adds mode BRIDGE_MODE_UNDEF for cases where mode is not needed.

Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: Scott Feldman <sfeldma@gmail.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
rocker: remove swdev mode

Remove use of 'swdev' mode in rocker. rocker dev offloads
can use the BRIDGE_FLAGS_SELF to indicate offload to hardware.

Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: Scott Feldman <sfeldma@gmail.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
bridge: remove mode BRIDGE_MODE_SWDEV

This patch removes bridge mode swdev.
Users can use BRIDGE_FLAGS_SELF to indicate swdev offload
if needed.

Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: Scott Feldman <sfeldma@gmail.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge branch 'bridge_mode'

Roopa Prabhu says:

====================
remove bridge mode BRIDGE_MODE_SWDEV

BRIDGE_MODE_SWDEV was introduced to indicate switchdev offloads
for bridging from user space (In other words to call into the hw switch
port driver directly). But user can use existing BRIDGE_FLAGS_SELF
to call into the hw switch port driver today. swdev mode is not required
anymore. So, this patch removes it.

v4 - v5
    incorporate comments
    - Define BRIDGE_MODE_UNDEF to handle cases where mode is not defined
    - reverse the order of patches
    - include patch comments in all patches
====================

Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: systemport: allow changing MAC address

Hook a ndo_set_mac_address callback, update the internal Ethernet MAC in
the netdevice structure, and finally write that address down to the
UniMAC registers. If the interface is down, and most likely clock gated,
we do not update the registers but just the local copy, such that next
ndo_open() call will effectively write down the address.

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
tipc: avoid double lock 'spin_lock:&seq->lock'

The commit fb9962f3cefe ("tipc: ensure all name sequences are properly
protected with its lock") involves below errors:

net/tipc/name_table.c:980 tipc_purge_publications() error: double lock 'spin_lock:&seq->lock'

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net: fec: avoid kernal crash by NULL pointer when no phy connection

On i.MX6SX sabreauto board, when there have no phy daughter board connection,
there have kernel crash by NULL pointer:

fec 2188000.ethernet eth0: could not attach to PHY
Unable to handle kernel NULL pointer dereference at virtual address 00000220
pgd = 80004000
[00000220] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.14.24-01042-g27eaeea-dirty #405
task: d8078000 ti: d8076000 task.ti: d8076000
PC is at mutex_lock+0x10/0x54
LR is at phy_start+0x14/0x68
pc : [<806ad4e4>]    lr : [<803b0f90>]    psr: 60000113
sp : d8077d80  ip : 00000000  fp : d83cc000
r10: 0000100c  r9 : d83cc800  r8 : 00000000
r7 : d83bcd0c  r6 : 00000200  r5 : 00000220  r4 : 00000220
r3 : 00000000  r2 : 00000000  r1 : d83bcd90  r0 : 00000220
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 8000404a  DAC: 00000015
Process swapper/0 (pid: 1, stack limit = 0xd8076240)
Stack: (0xd8077d80 to 0xd8078000)
7d80: 00000000 803b0f90 00000001 00000000 d83bc800 803be034 00000007 805c3fb4
7da0: 00000003 80d4e0bc 805efcb8 fffffff1 fffffff0 00000000 00000000 d8077dfc
7dc0: 0000000d 80d6ce80 80d126b0 800499c8 d83bc800 d83bc800 806f0f40 d83bc82c
7de0: 00000000 00000000 80d6ce80 80d126b0 0000016b 80540250 d8076008 d83bc800
7e00: 0000016b d83bc800 00001003 00000001 00001002 805404d4 d83bc800 00000120
7e20: 00001002 00001002 00000000 805405d4 d83bc800 00000001 80d126c0 00001002
7e40: 80dbc5dc 80d02024 00000000 806ae360 00000002 d6128420 d6127198 12400000
7e60: 00000000 00000000 00000002 d61271e8 00000000 12400000 d801674c 800e49f0
7e80: d6127198 d6124e58 00000000 80238848 d61271c4 00000000 00000001 d8016700
7ea0: 80dd2e00 80d752c0 80d752c0 80cfdaec 0000010c 80239430 806c2e90 d800f080
7ec0: d800f380 804e46b4 ffffffbc 80d15cb0 00000007 80d752c0 80d752c0 80d01e94
7ee0: 0000010c d8076030 00000000 800088cc 80dbaba4 80bd411c d80a6f00 806b1e04
7f00: 00000000 00000000 00000000 80125b84 00000000 80d2c56c 60000113 00000001
7f20: ef7ff9df 806c80cc 0000010c 80043f5c 80c95eb8 00000007 ef7ffa1d 00000007
7f40: 80d2c55c 80d15cb0 00000007 80d752c0 80d752c0 80ccc50c 0000010c 80d0a114
7f60: 80d0a10c 80cccc04 00000007 00000007 80ccc50c 806ae410 00000000 8004cb84
7f80: 80d17bc0 00000000 806a4bd4 00000000 00000000 00000000 00000000 00000000
7fa0: 00000000 806a4bdc 00000000 8000e5f8 00000000 00000000 00000000 00000000
7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 1e79a7bb e5337f77
[<806ad4e4>] (mutex_lock) from [<803b0f90>] (phy_start+0x14/0x68)
[<803b0f90>] (phy_start) from [<803be034>] (fec_enet_open+0x448/0x5dc)
[<803be034>] (fec_enet_open) from [<80540250>] (__dev_open+0xa8/0x110)
[<80540250>] (__dev_open) from [<805404d4>] (__dev_change_flags+0x88/0x170)
[<805404d4>] (__dev_change_flags) from [<805405d4>] (dev_change_flags+0x18/0x48)
[<805405d4>] (dev_change_flags) from [<80d02024>] (ip_auto_config+0x190/0xf94)
[<80d02024>] (ip_auto_config) from [<800088cc>] (do_one_initcall+0xe8/0x144)
[<800088cc>] (do_one_initcall) from [<80cccc04>] (kernel_init_freeable+0x104/0x1c8)
[<80cccc04>] (kernel_init_freeable) from [<806a4bdc>] (kernel_init+0x8/0xec)
[<806a4bdc>] (kernel_init) from [<8000e5f8>] (ret_from_fork+0x14/0x3c)
Code: e92d4010 e3a03000 e1a04000 ee073fba (e1903f9f)

Add phydev check to fix the issue.

Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netback: don't store invalid vif pointer

When xenvif_alloc() fails, it returns a non-NULL error indicator. To
avoid eventual races, we shouldn't store that into struct backend_info
as readers of it only check for NULL.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
leds: leds-gpio: Fix the "default-state" property check

Commit a43f2cbbb009f9 ("leds: leds-gpio: Make use of device property API")
caused a regression by reading the incorrect string for the "default-state"
property.

Fix the property string check to restore the original behaviour.

Fixes: a43f2cbbb009 (leds: leds-gpio: Make use of device property API)
Reported-by: Jean-Michel Hautbois <jean-michel.hautbois@vodalys.com>
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Bryan Wu <cooloney@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Merge tag 'omap-gpmc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC/OMAP GPMC driver cleanup and move from Arnd Bergmann:
 "The GPMC driver has traditionally been considered a part of the OMAP
  platform code and tightly interweaved with some of the boards.

  With this cleanup, it has finally come to the point where it makes
  sense to move it out of arch/arm into drivers/memory, where we already
  have other drivers for similar hardware.  The cleanups are still
  ongoing, with the goal of eventually having a standalone driver that
  does not require an interface to architecture code.

  This is a separate branch because of dependencies on multiple other
  branches, and to keep the drivers changes separate from the normal
  cleanups"

* tag 'omap-gpmc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  memory: gpmc: Move omap gpmc code to live under drivers
  ARM: OMAP2+: Move GPMC initcall to devices.c
  ARM: OMAP2+: Prepare to move GPMC to drivers by platform data header
  ARM: OMAP2+: Remove unnecesary include in GPMC driver
  ARM: OMAP2+: Drop board file for 3430sdp
  ARM: OMAP2+: Drop board file for ti8168evm
  ARM: OMAP2+: Drop legacy code for gpmc-smc91x.c
  ARM: OMAP2+: Require proper GPMC timings for devices
  ARM: OMAP2+: Show bootloader GPMC timings to allow configuring the .dts file
  ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select
  ARM: OMAP2+: gpmc: Sanity check GPMC fck on probe
  ARM: OMAP2+: gpmc: Keep Chip Select disabled while configuring it
  ARM: OMAP2+: gpmc: Always enable A26-A11 for non NAND devices
  ARM: OMAP2+: gpmc: Error out if timings fail in gpmc_probe_generic_child()
  ARM: OMAP2+: gpmc: Print error message in set_gpmc_timing_reg()
Merge tag 'defconfig-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC defconfig changes from Arnd Bergmann:
 "This is a collection of the various changes to defconfig files, most
  importantly enabling some additional platforms in the
  multi_v7_defconfig file.  These are split out into a separate branch
  to avoid most of the merge conflicts in the defconfig files.

  This also touches 12 other defconfig files for shmobile, at91,
  hisilicon, keystone, mvebu, omap, and tegra"

* tag 'defconfig-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (36 commits)
  ARM: omap2plus_defconfig: enable ECAP and EHRPWM
  ARM: omap2plus_defconfig: enable XHCI
  ARM: omap2plus_defconfig: enable AM33XX SoC sound
  ARM: omap2plus_defconfig: enable EDT FT5X06 touchscreen
  ARM: omap2plus_defconfig: remove unwanted ethernet drivers
  ARM: multi_v7_defconfig: enable MAX77686 PMIC drivers for exynos4412-prime based SoCs
  ARM: at91/defconfig: add DM9000 to at91_dt
  ARM: at91/defconfig: add QT1070 to at91_dt
  ARM: at91/defconfig: add TCB PWM driver selection
  ARM: at91/defconfig: add the XDMA driver
  ARM: at91: sama5: update defconfig
  ARM: defconfig: imx_v6_v7_defconfig updates
  ARM: multi_v7_defconfig: add driver support for hix5hd2
  ARM: exynos_defconfig: Use 16 minors per MMC block device
  ARM: mvebu: add MTD_BLOCK to mvebu_v7_defconfig
  ARM: mvebu: enable i2c device in mvebu_v7_defconfig
  ARM: mvebu: re-enable SDHCI driver for Armada 38x SoC in v7 defconfig
  ARM: tegra: Regenerate default configuration
  ARM: multi_v7_defconfig: Enable cgroups
  ARM: multi_v7_defconfig: Enable Broadcom Cygnus
  ...
Merge tag 'arm64-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM64 SoC changes from Arnd Bergmann:
 "This adds support for two new ARM64 platforms:

   - ARM Juno
   - AMD Seattle

  We had submissions for a number of additional platforms from Samsung,
  Freescale and Spreadtrum but are still working out the best process
  for getting these merged"

* tag 'arm64-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm64: amd-seattle: Fix PCI bus range due to SMMU limitation
  arm64: ARM: Fix the Generic Timers interrupt active level description
  arm64: amd-seattle: Adding device tree for AMD Seattle platform
  arm64: Add Juno board device tree.
  arm64: Create link to include/dt-bindings to enable C preprocessor use.
Merge tag 'asm-generic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic asm/io.h rewrite from Arnd Bergmann:
 "While there normally is no reason to have a pull request for
  asm-generic but have all changes get merged through whichever tree
  needs them, I do have a series for 3.19.

  There are two sets of patches that change significant portions of
  asm/io.h, and this branch contains both in order to resolve the
  conflicts:

   - Will Deacon has done a set of patches to ensure that all
     architectures define {read,write}{b,w,l,q}_relaxed() functions or
     get them by including asm-generic/io.h.

     These functions are commonly used on ARM specific drivers to avoid
     expensive L2 cache synchronization implied by the normal
     {read,write}{b,w,l,q}, but we need to define them on all
     architectures in order to share the drivers across architectures
     and to enable CONFIG_COMPILE_TEST configurations for them

   - Thierry Reding has done an unrelated set of patches that extends
     the asm-generic/io.h file to the degree necessary to make it useful
     on ARM64 and potentially other architectures"

* tag 'asm-generic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: (29 commits)
  ARM64: use GENERIC_PCI_IOMAP
  sparc: io: remove duplicate relaxed accessors on sparc32
  ARM: sa11x0: Use void __iomem * in MMIO accessors
  arm64: Use include/asm-generic/io.h
  ARM: Use include/asm-generic/io.h
  asm-generic/io.h: Implement generic {read,write}s*()
  asm-generic/io.h: Reconcile I/O accessor overrides
  /dev/mem: Use more consistent data types
  Change xlate_dev_{kmem,mem}_ptr() prototypes
  ARM: ixp4xx: Properly override I/O accessors
  ARM: ixp4xx: Fix build with IXP4XX_INDIRECT_PCI
  ARM: ebsa110: Properly override I/O accessors
  ARC: Remove redundant PCI_IOBASE declaration
  documentation: memory-barriers: clarify relaxed io accessor semantics
  x86: io: implement dummy relaxed accessor macros for writes
  tile: io: implement dummy relaxed accessor macros for writes
  sparc: io: implement dummy relaxed accessor macros for writes
  powerpc: io: implement dummy relaxed accessor macros for writes
  parisc: io: implement dummy relaxed accessor macros for writes
  mn10300: io: implement dummy relaxed accessor macros for writes
  ...
PM / OPP: set new_opp->dev_opp to a valid dev_opp

We find/allocate dev_opp after using its value to fill new_opp->dev_opp right
now. Move this to a later point where dev_opp is valid.

Fixes: a7470db6fec4 (PM / OPP don't match for existing OPPs when list is empty)
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
PM / OPP: remove double calls to find_device_opp()

By mistake we called find_device_opp() twice in of_free_opp_table(), fix it.

Generated diff doesn't show the problem well and so here is the code snippet:

void of_free_opp_table(struct device *dev)
{
	struct device_opp *dev_opp = find_device_opp(dev);
	struct dev_pm_opp *opp, *tmp;

	/* Check for existing list for 'dev' */
	dev_opp = find_device_opp(dev);

	...
}

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Revert "ARM: shmobile: multiplatform: add Audo DMAC peri peri support on defconfig"

This reverts commit 2315f9fce4da7df9362e4baeb5250d14ea48bf63.

Unfortunately enabling RCAR_AUDMAC_PP support this patch breaks dmaengine
support on R-Car Gen2 boards. This should be resolved by driver updates
in v3.20. But v3.19 was too early for this defconfig change.

Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
tcp: fix more NULL deref after prequeue changes

When I cooked commit c3658e8d0f1 ("tcp: fix possible NULL dereference in
tcp_vX_send_reset()") I missed other spots we could deref a NULL
skb_dst(skb)

Again, if a socket is provided, we do not need skb_dst() to get a
pointer to network namespace : sock_net(sk) is good enough.

Reported-by: Dann Frazier <dann.frazier@canonical.com>
Bisected-by: Dann Frazier <dann.frazier@canonical.com>
Tested-by: Dann Frazier <dann.frazier@canonical.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode")
Signed-off-by: David S. Miller <davem@davemloft.net>