ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

commit 8404663f81d212918ff85f493649a7991209fa04 upstream.

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

Change-Id: I3e3ddeaa51e47798bcf27181afd3785ccc015317
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I38a42ec49af337e77472db5e43cfbc18786f1419
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix n_tty patch for older kernels

(backported by Ben Hutchings <ben@decadent.org.uk>)

Change-Id: I1d663cf704856ee0639f04b2fa28ebca2ae0b3f6
futex: Add another early deadlock detection check
futex: Make lookup_pi_state more robust
lzo: properly check for overruns

commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.
The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types.  Modify the checking logic to properly
detect overruns before they happen.
net/l2tp: don't fall back on UDP [get|set]sockopt

The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Iccb3384e7090e8c7cbcd717c12465c45d22c4393
Enable caching and buffering for all of physical RAM in the decompressor.

Old method is to enable caching and buffering only for the 256 MB at the
start of the decompressor image.  This makes a hardboot-kexec'd kernel very
slow to decompress since the decompressor is located far above the kernel
destination.  This patch reduces boot time from 35 to 8 seconds.

Change-Id: Ie37fd5092301bcf930652983a9cd8217e6312a74
Support copying of kernel tagged list (atags) in the decompressor.

This is needed to hardboot kexec a kernel with a new tags list (including a
new kernel command line), since the new atags would otherwise be lost with
the limited kernel memory mapping.  Without this patch, a hardboot-kexec'd
kernel uses the atags provided by the bootloader.

Change-Id: Ifafb9713952de7fb749a7bc64d20849649359a1f
Enable kexec syscall and fix support for ARMv7.

Essentially a backport of the relevant functions from Linux 3.1-rc4.  In
particular, it now actually disables the MMU in preparation for
soft boot.  Without this, relocate_new_kernel() would hang for an unknown
reason.  Although, it's known that there's no safe way to execute that
function with the MMU on as it may overwrite active page tables.

The suggestion to call cpu_reset by its physical address comes from an
earlier kexec support patch by Will Deacon [1].

[1] W. Deacon. [4/6] ARM: reset: add reset functionality for jumping to a
    physical address, Jun. 2011. https://patchwork.kernel.org/patch/852802/

Change-Id: Ib41728a1b4a5d02241266feed8e4bb75e35123c4
Support hard booting to a kexec kernel.

See KEXEC_HARDBOOT config option help for details.

Change-Id: If1a45732f1f10f28c44d179e0c7589968e146ac7
update to match my config
updated to ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) version file
Merge remote-tracking branch 'iyahman/kk-4.4' into kk-4.4