+++ /dev/null
-From da9910ac4a816b4340944c78d94c02a35527db46 Mon Sep 17 00:00:00 2001
-From: Jaganath Kanakkassery <jaganath.k@samsung.com>
-Date: Fri, 21 Jun 2013 19:55:11 +0530
-Subject: Bluetooth: Fix invalid length check in l2cap_information_rsp()
-
-From: Jaganath Kanakkassery <jaganath.k@samsung.com>
-
-commit da9910ac4a816b4340944c78d94c02a35527db46 upstream.
-
-The length check is invalid since the length varies with type of
-info response.
-
-This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888
-
-Because of this, l2cap info rsp is not handled and command reject is sent.
-
-> ACL data: handle 11 flags 0x02 dlen 16
- L2CAP(s): Info rsp: type 2 result 0
- Extended feature mask 0x00b8
- Enhanced Retransmission mode
- Streaming mode
- FCS Option
- Fixed Channels
-< ACL data: handle 11 flags 0x00 dlen 10
- L2CAP(s): Command rej: reason 0
- Command not understood
-
-Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
-Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
-Acked-by: Johan Hedberg <johan.hedberg@intel.com>
-Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- net/bluetooth/l2cap_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -4240,7 +4240,7 @@ static inline int l2cap_disconnect_rsp(s
- u16 dcid, scid;
- struct l2cap_chan *chan;
-
-- if (cmd_len != sizeof(*rsp))
-+ if (cmd_len < sizeof(*rsp))
- return -EPROTO;
-
- scid = __le16_to_cpu(rsp->scid);
--- /dev/null
+From 22e8099f4f6621b8d165e238cdef2a1cf655e159 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 23 Apr 2013 15:39:50 +0200
+Subject: hwrng: bcm2835: fix MODULE_LICENSE tag
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 22e8099f4f6621b8d165e238cdef2a1cf655e159 upstream.
+
+The MODULE_LICENSE macro invocation must use either "GPL" or "GPL v2",
+but not "GPLv2" in order to be detected by the module loader.
+
+This fixes the allmodconfig build error:
+
+FATAL: modpost: GPL-incompatible module bcm2835-rng.ko uses GPL-only symbol 'platform_driver_unregister'
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Lubomir Rintel <lkundrak@v3.sk>
+Cc: Dom Cobley <popcornmix@gmail.com>
+Cc: Stephen Warren <swarren@wwwdotorg.org>
+Cc: Matt Mackall <mpm@selenic.com>
+Cc: linux-rpi-kernel@lists.infradead.org
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/hw_random/bcm2835-rng.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -110,4 +110,4 @@ module_platform_driver(bcm2835_rng_drive
+
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("BCM2835 Random Number Generator (RNG) driver");
+-MODULE_LICENSE("GPLv2");
++MODULE_LICENSE("GPL v2");
mac80211-fix-monitor-interface-suspend-crash-regression.patch
ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch
ath-wil6210-fix-build-error.patch
-bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch
bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch
bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch
bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch
s390-bitops-fix-find_next_bit_left.patch
workqueue-copy-workqueue_attrs-with-all-fields.patch
userns-unshare_userns-cred-should-not-populate-cred-on-failure.patch
+userns-limit-the-maximum-depth-of-user_namespace-parent-chain.patch
x86-iommu-vt-d-expand-interrupt-remapping-quirk-to-cover-x58-chipset.patch
spi-spi-davinci-fix-direction-in-dma_map_single.patch
arcnet-cleanup-sizeof-parameter.patch
net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch
iwlwifi-mvm-set-ssid-bits-for-passive-channels.patch
iwlwifi-dvm-don-t-send-bt_config-on-devices-w-o-bluetooth.patch
+hwrng-bcm2835-fix-module_license-tag.patch
--- /dev/null
+From 8742f229b635bf1c1c84a3dfe5e47c814c20b5c8 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 8 Aug 2013 18:55:32 +0200
+Subject: userns: limit the maximum depth of user_namespace->parent chain
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 8742f229b635bf1c1c84a3dfe5e47c814c20b5c8 upstream.
+
+Ensure that user_namespace->parent chain can't grow too much.
+Currently we use the hardroded 32 as limit.
+
+Reported-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/user_namespace.h | 1 +
+ kernel/user_namespace.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/include/linux/user_namespace.h
++++ b/include/linux/user_namespace.h
+@@ -23,6 +23,7 @@ struct user_namespace {
+ struct uid_gid_map projid_map;
+ atomic_t count;
+ struct user_namespace *parent;
++ int level;
+ kuid_t owner;
+ kgid_t group;
+ unsigned int proc_inum;
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -62,6 +62,9 @@ int create_user_ns(struct cred *new)
+ kgid_t group = new->egid;
+ int ret;
+
++ if (parent_ns->level > 32)
++ return -EUSERS;
++
+ /*
+ * Verify that we can not violate the policy of which files
+ * may be accessed that is specified by the root directory,
+@@ -92,6 +95,7 @@ int create_user_ns(struct cred *new)
+ atomic_set(&ns->count, 1);
+ /* Leave the new->user_ns reference with the new user namespace. */
+ ns->parent = parent_ns;
++ ns->level = parent_ns->level + 1;
+ ns->owner = owner;
+ ns->group = group;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
