n_tty: Fix n_tty_write crash when echoing in raw mode

BugLink: http://bugs.launchpad.net/bugs/1314762

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
exploitable in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool

Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: Andy Whitcroft <andy.whitcroft@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: John Johansen<john.johansen@canonical.com>
Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Ubuntu-3.11.0-20.35

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Start new release

Ignore: yes
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
UBUNTU: [Config] d-i -- add virtio_scsi to virtio-modules

BugLink: http://bugs.launchpad.net/bugs/1315462

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Chris J Arges <chris.j.arges@canonical.com>
UBUNTU: Merged back Ubuntu-3.11.0-20.35 security release

Conflicts:
	debian.master/abi/3.11.0-19.33/amd64/generic
	debian.master/abi/3.11.0-19.33/amd64/generic.compiler
	debian.master/abi/3.11.0-19.33/amd64/generic.modules
	debian.master/abi/3.11.0-19.33/armhf/generic
	debian.master/abi/3.11.0-19.33/armhf/generic-lpae
	debian.master/abi/3.11.0-19.33/armhf/generic-lpae.compiler
	debian.master/abi/3.11.0-19.33/armhf/generic-lpae.modules
	debian.master/abi/3.11.0-19.33/armhf/generic.compiler
	debian.master/abi/3.11.0-19.33/armhf/generic.modules
	debian.master/abi/3.11.0-19.33/fwinfo
	debian.master/abi/3.11.0-19.33/i386/generic
	debian.master/abi/3.11.0-19.33/i386/generic.compiler
	debian.master/abi/3.11.0-19.33/i386/generic.modules
	debian.master/abi/3.11.0-20.34/amd64/generic
	debian.master/abi/3.11.0-20.34/amd64/generic.compiler
	debian.master/abi/3.11.0-20.34/amd64/generic.modules
	debian.master/abi/3.11.0-20.34/armhf/generic
	debian.master/abi/3.11.0-20.34/armhf/generic-lpae
	debian.master/abi/3.11.0-20.34/armhf/generic-lpae.compiler
	debian.master/abi/3.11.0-20.34/armhf/generic-lpae.modules
	debian.master/abi/3.11.0-20.34/armhf/generic.compiler
	debian.master/abi/3.11.0-20.34/armhf/generic.modules
	debian.master/abi/3.11.0-20.34/fwinfo
	debian.master/abi/3.11.0-20.34/i386/generic
	debian.master/abi/3.11.0-20.34/i386/generic.compiler
	debian.master/abi/3.11.0-20.34/i386/generic.modules
	debian.master/abi/3.11.0-21.35/amd64/generic
	debian.master/abi/3.11.0-21.35/amd64/generic.compiler
	debian.master/abi/3.11.0-21.35/amd64/generic.modules
	debian.master/abi/3.11.0-21.35/armhf/generic
	debian.master/abi/3.11.0-21.35/armhf/generic-lpae
	debian.master/abi/3.11.0-21.35/armhf/generic-lpae.compiler
	debian.master/abi/3.11.0-21.35/armhf/generic-lpae.modules
	debian.master/abi/3.11.0-21.35/armhf/generic.compiler
	debian.master/abi/3.11.0-21.35/armhf/generic.modules
	debian.master/abi/3.11.0-21.35/fwinfo
	debian.master/abi/3.11.0-21.35/i386/generic
	debian.master/abi/3.11.0-21.35/i386/generic.compiler
	debian.master/abi/3.11.0-21.35/i386/generic.modules
	debian.master/changelog

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
UBUNTU: Revert "n_tty: Fix n_tty_write crash when echoing in raw mode"

This reverts commit c1dc30ab9d3865e75b52b3aa379fe5baae903049.

BugLink: http://bugs.launchpad.net/bugs/1314762

This older version of this fix to be replaced with the correct mainline
version.

Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
n_tty: Fix n_tty_write crash when echoing in raw mode

commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

CVE-2014-0196

BugLink: http://bugs.launchpad.net/bugs/1314762

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
floppy: ignore kernel-only members in FDRAWCMD ioctl input

commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.

CVE-2014-1737

BugLink: http://bugs.launchpad.net/bugs/1316729

Always clear out these floppy_raw_cmd struct members after copying the
entire structure from userspace so that the in-kernel version is always
valid and never left in an interdeterminate state.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
floppy: don't write kernel-only members to FDRAWCMD ioctl output

commit 2145e15e0557a01b9195d1c7199a1b92cb9be81f upstream.

CVE-2014-1738

BugLink: http://bugs.launchpad.net/bugs/1316735

Do not leak kernel-only floppy_raw_cmd structure members to userspace.
This includes the linked-list pointer and the pointer to the allocated
DMA space.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Andy Whitcroft <andy.whitcroft@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
UBUNTU: Ubuntu-3.11.0-22.36

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
UBUNTU: Ubuntu-3.11.0-22.37

No-change rebuild to correct package file corruption glitch in
Ubuntu-3.11.0-22.36 (kernel/rcutree.h "TASK_iNTERRUPTIBLE").

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
UBUNTU: Start new release

Signed-off-by: Brad Figg <brad.figg@canonical.com>
Revert "rtlwifi: Set the link state"

This reverts commit 51df18454570e8a057141ad033a74ad7756e77c4.
UBUNTU: Ubuntu-3.11.0-22.38

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Start new release

Ignore: yes
drm/i915: quirk invert brightness for Acer Aspire 5336

BugLink: http://bugs.launchpad.net/bugs/1320892

commit 0f540c3a7cfb91c9d7a19eb0c95c24c5de1197d5 upstream.

Since
commit ee1452d7458451a7508e0663553ce88d63958157
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Fri Sep 20 15:05:30 2013 +0300

    drm/i915: assume all GM45 Acer laptops use inverted backlight PWM

failed and was later reverted in
commit be505f643925e257087247b996cd8ece787c12af
Author: Alexander van Heukelum <heukelum@fastmail.fm>
Date:   Sat Dec 28 21:00:39 2013 +0100

    Revert "drm/i915: assume all GM45 Acer laptops use inverted backlight PWM"

fix the individual broken machine instead.

Note to backporters:

http://patchwork.freedesktop.org/patch/17837/

is the patch you want for 3.13 and older.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=54171
Reference: http://mid.gmane.org/DUB115-W7628C7C710EA51AA110CD4A5000@phx.gbl
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
[danvet: Patch mangling for 3.14 plus adding the link to the original
for 3.13.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[ luis: backported to 3.11: used backport suggested in commit message ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
w1: fix w1_send_slave dropping a slave id

BugLink: http://bugs.launchpad.net/bugs/1320892

commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.

Previous logic,
if (avail > 8) {
	store slave;
	return;
}
send data; clear;

The logic error is, if there isn't space send the buffer and clear,
but the slave wasn't added to the now empty buffer loosing that slave
id.  It also should have been "if (avail >= 8)" because when it is 8,
there is space.

Instead, if there isn't space send and clear the buffer, then there is
always space for the slave id.

Signed-off-by: David Fries <David@Fries.net>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
ARM: 7954/1: mm: remove remaining domain support from ARMv6

BugLink: http://bugs.launchpad.net/bugs/1320892

commit b6ccb9803e90c16b212cf4ed62913a7591e79a39 upstream.

CPU_32v6 currently selects CPU_USE_DOMAINS if CPU_V6 and MMU. This is
because ARM 1136 r0pX CPUs lack the v6k extensions, and therefore do
not have hardware thread registers. The lack of these registers requires
the kernel to update the vectors page at each context switch in order to
write a new TLS pointer. This write must be done via the userspace
mapping, since aliasing caches can lead to expensive flushing when using
kmap. Finally, this requires the vectors page to be mapped r/w for
kernel and r/o for user, which has implications for things like put_user
which must trigger CoW appropriately when targetting user pages.

The upshot of all this is that a v6/v7 kernel makes use of domains to
segregate kernel and user memory accesses. This has the nasty
side-effect of making device mappings executable, which has been
observed to cause subtle bugs on recent cores (e.g. Cortex-A15
performing a speculative instruction fetch from the GIC and acking an
interrupt in the process).

This patch solves this problem by removing the remaining domain support
from ARMv6. A new memory type is added specifically for the vectors page
which allows that page (and only that page) to be mapped as user r/o,
kernel r/w. All other user r/o pages are mapped also as kernel r/o.
Patch co-developed with Russell King.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
matroxfb: restore the registers M_ACCESS and M_PITCH

BugLink: http://bugs.launchpad.net/bugs/1320892

commit a772d4736641ec1b421ad965e13457c17379fc86 upstream.

When X11 is running and the user switches back to console, the card
modifies the content of registers M_MACCESS and M_PITCH in periodic
intervals.

This patch fixes it by restoring the content of these registers before
issuing any accelerator command.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
framebuffer: fix cfb_copyarea

BugLink: http://bugs.launchpad.net/bugs/1320892

commit 00a9d699bc85052d2d3ed56251cd928024ce06a3 upstream.

The function cfb_copyarea is buggy when the copy operation is not aligned on
long boundary (4 bytes on 32-bit machines, 8 bytes on 64-bit machines).

How to reproduce:
- use x86-64 machine
- use a framebuffer driver without acceleration (for example uvesafb)
- set the framebuffer to 8-bit depth
	(for example fbset -a 1024x768-60 -depth 8)
- load a font with character width that is not a multiple of 8 pixels
	note: the console-tools package cannot load a font that has
	width different from 8 pixels. You need to install the packages
	"kbd" and "console-terminus" and use the program "setfont" to
	set font width (for example: setfont Uni2-Terminus20x10)
- move some text left and right on the bash command line and you get a
	screen corruption

To expose more bugs, put this line to the end of uvesafb_init_info:
info->flags |= FBINFO_HWACCEL_COPYAREA | FBINFO_READS_FAST;
- Now framebuffer console will use cfb_copyarea for console scrolling.
You get a screen corruption when console is scrolled.

This patch is a rewrite of cfb_copyarea. It fixes the bugs, with this
patch, console scrolling in 8-bit depth with a font width that is not a
multiple of 8 pixels works fine.

The cfb_copyarea code was very buggy and it looks like it was written
and never tried with non-8-pixel font.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>