--- /dev/null
+From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Dec 2014 18:25:19 +0100
+Subject: KEYS: Fix stale key registration at error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.
+
+When loading encrypted-keys module, if the last check of
+aes_get_sizes() in init_encrypted() fails, the driver just returns an
+error without unregistering its key type. This results in the stale
+entry in the list. In addition to memory leaks, this leads to a kernel
+crash when registering a new key type later.
+
+This patch fixes the problem by swapping the calls of aes_get_sizes()
+and register_key_type(), and releasing resources properly at the error
+paths.
+
+Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/encrypted-keys/encrypted.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -1017,10 +1017,13 @@ static int __init init_encrypted(void)
+ ret = encrypted_shash_alloc();
+ if (ret < 0)
+ return ret;
++ ret = aes_get_sizes();
++ if (ret < 0)
++ goto out;
+ ret = register_key_type(&key_type_encrypted);
+ if (ret < 0)
+ goto out;
+- return aes_get_sizes();
++ return 0;
+ out:
+ encrypted_shash_release();
+ return ret;
--- /dev/null
+From 7e6225a1604d0c6aa4140289bf5761868ffc9c83 Mon Sep 17 00:00:00 2001
+From: Jes Sorensen <Jes.Sorensen@redhat.com>
+Date: Wed, 10 Dec 2014 14:14:07 -0500
+Subject: mac80211: avoid using uninitialized stack data
+
+From: Jes Sorensen <Jes.Sorensen@redhat.com>
+
+commit 7e6225a1604d0c6aa4140289bf5761868ffc9c83 upstream.
+
+Avoid a case where we would access uninitialized stack data if the AP
+advertises HT support without 40MHz channel support.
+
+Fixes: f3000e1b43f1 ("mac80211: fix broken use of VHT/20Mhz with some APs")
+Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -174,6 +174,7 @@ ieee80211_determine_chantype(struct ieee
+ if (!(ht_cap->cap_info &
+ cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
+ ret = IEEE80211_STA_DISABLE_40MHZ;
++ vht_chandef = *chandef;
+ goto out;
+ }
+
--- /dev/null
+From 2967e031d4d737d9cc8252d878a17924d7b704f0 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 24 Nov 2014 18:12:16 +0100
+Subject: mac80211: copy chandef from AP vif to VLANs
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 2967e031d4d737d9cc8252d878a17924d7b704f0 upstream.
+
+Instead of keeping track of all those special cases where
+VLAN interfaces have no bss_conf.chandef, just make sure
+they have the same as the AP interface they belong to.
+
+Among others, this fixes a crash getting a VLAN's channel
+from userspace since a NULL channel is returned as a good
+result (return value 0) for VLANs since the commit below.
+
+Fixes: c12bc4885f4b3 ("mac80211: return the vif's chandef in ieee80211_cfg_get_channel()")
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+[rewrite commit log]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/chan.c | 23 +++++++++++++++++++----
+ net/mac80211/iface.c | 1 +
+ 2 files changed, 20 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -929,6 +929,21 @@ ieee80211_vif_chanctx_reservation_comple
+ }
+ }
+
++static void
++ieee80211_vif_update_chandef(struct ieee80211_sub_if_data *sdata,
++ const struct cfg80211_chan_def *chandef)
++{
++ struct ieee80211_sub_if_data *vlan;
++
++ sdata->vif.bss_conf.chandef = *chandef;
++
++ if (sdata->vif.type != NL80211_IFTYPE_AP)
++ return;
++
++ list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
++ vlan->vif.bss_conf.chandef = *chandef;
++}
++
+ static int
+ ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
+ {
+@@ -991,7 +1006,7 @@ ieee80211_vif_use_reserved_reassign(stru
+ if (sdata->vif.bss_conf.chandef.width != sdata->reserved_chandef.width)
+ changed = BSS_CHANGED_BANDWIDTH;
+
+- sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
++ ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
+
+ if (changed)
+ ieee80211_bss_info_change_notify(sdata, changed);
+@@ -1333,7 +1348,7 @@ static int ieee80211_vif_use_reserved_sw
+ sdata->reserved_chandef.width)
+ changed = BSS_CHANGED_BANDWIDTH;
+
+- sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
++ ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
+ if (changed)
+ ieee80211_bss_info_change_notify(sdata,
+ changed);
+@@ -1504,7 +1519,7 @@ int ieee80211_vif_use_channel(struct iee
+ goto out;
+ }
+
+- sdata->vif.bss_conf.chandef = *chandef;
++ ieee80211_vif_update_chandef(sdata, chandef);
+
+ ret = ieee80211_assign_vif_chanctx(sdata, ctx);
+ if (ret) {
+@@ -1646,7 +1661,7 @@ int ieee80211_vif_change_bandwidth(struc
+ break;
+ }
+
+- sdata->vif.bss_conf.chandef = *chandef;
++ ieee80211_vif_update_chandef(sdata, chandef);
+
+ ieee80211_recalc_chanctx_chantype(local, ctx);
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -511,6 +511,7 @@ int ieee80211_do_open(struct wireless_de
+ sdata->vif.cab_queue = master->vif.cab_queue;
+ memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
+ sizeof(sdata->vif.hw_queue));
++ sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
+ break;
+ }
+ case NL80211_IFTYPE_AP:
--- /dev/null
+From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+Date: Fri, 12 Dec 2014 12:11:11 +0100
+Subject: mac80211: fix multicast LED blinking and counter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+
+commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream.
+
+As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount"
+stopped being incremented after the use-after-free fix. Furthermore, the
+RX-LED will be triggered by every multicast frame (which wouldn't happen
+before) which wouldn't allow the LED to rest at all.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the
+patch.
+
+Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation")
+Signed-off-by: Andreas Müller <goo@stapelspeicher.org>
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1678,14 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee802
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+- goto out;
+-
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ rx->local->dot11MulticastReceivedFrameCount++;
+- goto out;
++ goto out_no_led;
+ }
+
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1776,9 +1776,10 @@ ieee80211_rx_h_defragment(struct ieee802
+ status->rx_flags |= IEEE80211_RX_FRAGMENTED;
+
+ out:
++ ieee80211_led_rx(rx->local);
++ out_no_led:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
--- /dev/null
+From 28a9bc68124c319b2b3dc861e80828a8865fd1ba Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 17 Dec 2014 13:55:49 +0100
+Subject: mac80211: free management frame keys when removing station
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 28a9bc68124c319b2b3dc861e80828a8865fd1ba upstream.
+
+When writing the code to allow per-station GTKs, I neglected to
+take into account the management frame keys (index 4 and 5) when
+freeing the station and only added code to free the first four
+data frame keys.
+
+Fix this by iterating the array of keys over the right length.
+
+Fixes: e31b82136d1a ("cfg80211/mac80211: allow per-station GTKs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -647,7 +647,7 @@ void ieee80211_free_sta_keys(struct ieee
+ int i;
+
+ mutex_lock(&local->key_mtx);
+- for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
+ key = key_mtx_dereference(local, sta->gtk[i]);
+ if (!key)
+ continue;
--- /dev/null
+From c297abfdf15b4480704d6b566ca5ca9438b12456 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Thu, 18 Dec 2014 10:57:19 -0600
+Subject: mnt: Fix a memory stomp in umount
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit c297abfdf15b4480704d6b566ca5ca9438b12456 upstream.
+
+While reviewing the code of umount_tree I realized that when we append
+to a preexisting unmounted list we do not change pprev of the former
+first item in the list.
+
+Which means later in namespace_unlock hlist_del_init(&mnt->mnt_hash) on
+the former first item of the list will stomp unmounted.first leaving
+it set to some random mount point which we are likely to free soon.
+
+This isn't likely to hit, but if it does I don't know how anyone could
+track it down.
+
+[ This happened because we don't have all the same operations for
+ hlist's as we do for normal doubly-linked lists. In particular,
+ list_splice() is easy on our standard doubly-linked lists, while
+ hlist_splice() doesn't exist and needs both start/end entries of the
+ hlist. And commit 38129a13e6e7 incorrectly open-coded that missing
+ hlist_splice().
+
+ We should think about making these kinds of "mindless" conversions
+ easier to get right by adding the missing hlist helpers - Linus ]
+
+Fixes: 38129a13e6e71f666e0468e99fdd932a687b4d7e switch mnt_hash to hlist
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1369,6 +1369,8 @@ void umount_tree(struct mount *mnt, int
+ }
+ if (last) {
+ last->mnt_hash.next = unmounted.first;
++ if (unmounted.first)
++ unmounted.first->pprev = &last->mnt_hash.next;
+ unmounted.first = tmp_list.first;
+ unmounted.first->pprev = &unmounted.first;
+ }
x86-microcode-don-t-initialize-microcode-code-on-paravirt.patch
x86-microcode-reload-microcode-on-resume.patch
x86-microcode-intel-fish-out-the-stashed-microcode-for-the-bsp.patch
+keys-fix-stale-key-registration-at-error-path.patch
+mac80211-copy-chandef-from-ap-vif-to-vlans.patch
+mac80211-avoid-using-uninitialized-stack-data.patch
+mac80211-fix-multicast-led-blinking-and-counter.patch
+mac80211-free-management-frame-keys-when-removing-station.patch
+mnt-fix-a-memory-stomp-in-umount.patch
+thermal-fix-error-path-in-thermal_init.patch
+userns-unbreak-the-unprivileged-remount-tests.patch
--- /dev/null
+From 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc Mon Sep 17 00:00:00 2001
+From: Luis Henriques <luis.henriques@canonical.com>
+Date: Wed, 3 Dec 2014 21:20:21 +0000
+Subject: thermal: Fix error path in thermal_init()
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+commit 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc upstream.
+
+thermal_unregister_governors() and class_unregister() were being called in
+the wrong order.
+
+Fixes: 80a26a5c22b9 ("Thermal: build thermal governors into thermal_sys module")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/thermal/thermal_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1835,10 +1835,10 @@ static int __init thermal_init(void)
+
+ exit_netlink:
+ genetlink_exit();
+-unregister_governors:
+- thermal_unregister_governors();
+ unregister_class:
+ class_unregister(&thermal_class);
++unregister_governors:
++ thermal_unregister_governors();
+ error:
+ idr_destroy(&thermal_tz_idr);
+ idr_destroy(&thermal_cdev_idr);
--- /dev/null
+From db86da7cb76f797a1a8b445166a15cb922c6ff85 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 2 Dec 2014 13:56:30 -0600
+Subject: userns: Unbreak the unprivileged remount tests
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream.
+
+A security fix in caused the way the unprivileged remount tests were
+using user namespaces to break. Tweak the way user namespaces are
+being used so the test works again.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/mount/unprivileged-remount-test.c | 32 ++++++++++----
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/mount/unprivileged-remount-test.c
++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
+@@ -48,17 +48,14 @@ static void die(char *fmt, ...)
+ exit(EXIT_FAILURE);
+ }
+
+-static void write_file(char *filename, char *fmt, ...)
++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
+ {
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+- va_list ap;
+
+- va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+- va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+@@ -69,6 +66,8 @@ static void write_file(char *filename, c
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
++ if ((errno == ENOENT) && enoent_ok)
++ return;
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+@@ -87,6 +86,26 @@ static void write_file(char *filename, c
+ }
+ }
+
++static void maybe_write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(true, filename, fmt, ap);
++ va_end(ap);
++
++}
++
++static void write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(false, filename, fmt, ap);
++ va_end(ap);
++
++}
++
+ static void create_and_enter_userns(void)
+ {
+ uid_t uid;
+@@ -100,13 +119,10 @@ static void create_and_enter_userns(void
+ strerror(errno));
+ }
+
++ maybe_write_file("/proc/self/setgroups", "deny");
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+- if (setgroups(0, NULL) != 0) {
+- die("setgroups failed: %s\n",
+- strerror(errno));
+- }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
projects / thirdparty / kernel / stable-queue.git / commitdiff
