--- /dev/null
+From 811a2407a3cf7bbd027fbe92d73416f17485a3d8 Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+Date: Fri, 25 Jul 2014 09:17:12 +0100
+Subject: ARM: 8115/1: LPAE: reduce damage caused by idmap to virtual memory layout
+
+From: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+
+commit 811a2407a3cf7bbd027fbe92d73416f17485a3d8 upstream.
+
+On LPAE, each level 1 (pgd) page table entry maps 1GiB, and the level 2
+(pmd) entries map 2MiB.
+
+When the identity mapping is created on LPAE, the pgd pointers are copied
+from the swapper_pg_dir. If we find that we need to modify the contents
+of a pmd, we allocate a new empty pmd table and insert it into the
+appropriate 1GB slot, before then filling it with the identity mapping.
+
+However, if the 1GB slot covers the kernel lowmem mappings, we obliterate
+those mappings.
+
+When replacing a PMD, first copy the old PMD contents to the new PMD, so
+that we preserve the existing mappings, particularly the mappings of the
+kernel itself.
+
+[rewrote commit message and added code comment -- rmk]
+
+Fixes: ae2de101739c ("ARM: LPAE: Add identity mapping support for the 3-level page table format")
+Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/idmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/mm/idmap.c
++++ b/arch/arm/mm/idmap.c
+@@ -24,6 +24,13 @@ static void idmap_add_pmd(pud_t *pud, un
+ pr_warning("Failed to allocate identity pmd.\n");
+ return;
+ }
++ /*
++ * Copy the original PMD to ensure that the PMD entries for
++ * the kernel image are preserved.
++ */
++ if (!pud_none(*pud))
++ memcpy(pmd, pmd_offset(pud, 0),
++ PTRS_PER_PMD * sizeof(pmd_t));
+ pud_populate(&init_mm, pud, pmd);
+ pmd += pmd_index(addr);
+ } else
--- /dev/null
+From 8c26d458394be44e135d1c6bd4557e1c4e1a0535 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Thu, 17 Jul 2014 15:00:56 +0300
+Subject: cfg80211: fix mic_failure tracing
+
+From: Eliad Peller <eliad@wizery.com>
+
+commit 8c26d458394be44e135d1c6bd4557e1c4e1a0535 upstream.
+
+tsc can be NULL (mac80211 currently always passes NULL),
+resulting in NULL-dereference. check before copying it.
+
+Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/trace.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -1972,7 +1972,8 @@ TRACE_EVENT(cfg80211_michael_mic_failure
+ MAC_ASSIGN(addr, addr);
+ __entry->key_type = key_type;
+ __entry->key_id = key_id;
+- memcpy(__entry->tsc, tsc, 6);
++ if (tsc)
++ memcpy(__entry->tsc, tsc, 6);
+ ),
+ TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT ", key type: %d, key id: %d, tsc: %pm",
+ NETDEV_PR_ARG, MAC_PR_ARG(addr), __entry->key_type,
--- /dev/null
+From 4c63f83c2c2e16a13ce274ee678e28246bd33645 Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Tue, 29 Jul 2014 18:41:09 +0000
+Subject: crypto: af_alg - properly label AF_ALG socket
+
+From: Milan Broz <gmazyland@gmail.com>
+
+commit 4c63f83c2c2e16a13ce274ee678e28246bd33645 upstream.
+
+Th AF_ALG socket was missing a security label (e.g. SELinux)
+which means that socket was in "unlabeled" state.
+
+This was recently demonstrated in the cryptsetup package
+(cryptsetup v1.6.5 and later.)
+See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
+
+This patch clones the sock's label from the parent sock
+and resolves the issue (similar to AF_BLUETOOTH protocol family).
+
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/af_alg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -21,6 +21,7 @@
+ #include <linux/module.h>
+ #include <linux/net.h>
+ #include <linux/rwsem.h>
++#include <linux/security.h>
+
+ struct alg_type_list {
+ const struct af_alg_type *type;
+@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struc
+
+ sock_init_data(newsock, sk2);
+ sock_graft(sk2, newsock);
++ security_sk_clone(sk, sk2);
+
+ err = type->accept(ask->private, sk2);
+ if (err) {
--- /dev/null
+From 0193ed8225e1a79ed64632106ec3cc81798cb13c Mon Sep 17 00:00:00 2001
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+Date: Wed, 30 Jul 2014 16:08:26 -0700
+Subject: rapidio/tsi721_dma: fix failure to obtain transaction descriptor
+
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+
+commit 0193ed8225e1a79ed64632106ec3cc81798cb13c upstream.
+
+This is a bug fix for the situation when function tsi721_desc_get() fails
+to obtain a free transaction descriptor.
+
+The bug usually results in a memory access crash dump when data transfer
+scatter-gather list has more entries than size of hardware buffer
+descriptors ring. This fix ensures that error is properly returned to a
+caller instead of an invalid entry.
+
+This patch is applicable to kernel versions starting from v3.5.
+
+Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Andre van Herk <andre.van.herk@prodrive-technologies.com>
+Cc: Stef van Os <stef.van.os@prodrive-technologies.com>
+Cc: Vinod Koul <vinod.koul@intel.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rapidio/devices/tsi721_dma.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/rapidio/devices/tsi721_dma.c
++++ b/drivers/rapidio/devices/tsi721_dma.c
+@@ -287,6 +287,12 @@ struct tsi721_tx_desc *tsi721_desc_get(s
+ "desc %p not ACKed\n", tx_desc);
+ }
+
++ if (ret == NULL) {
++ dev_dbg(bdma_chan->dchan.device->dev,
++ "%s: unable to obtain tx descriptor\n", __func__);
++ goto err_out;
++ }
++
+ i = bdma_chan->wr_count_next % bdma_chan->bd_num;
+ if (i == bdma_chan->bd_num - 1) {
+ i = 0;
+@@ -297,7 +303,7 @@ struct tsi721_tx_desc *tsi721_desc_get(s
+ tx_desc->txd.phys = bdma_chan->bd_phys +
+ i * sizeof(struct tsi721_dma_desc);
+ tx_desc->hw_desc = &((struct tsi721_dma_desc *)bdma_chan->bd_base)[i];
+-
++err_out:
+ spin_unlock_bh(&bdma_chan->lock);
+
+ return ret;
--- /dev/null
+From 89fb4cd1f717a871ef79fa7debbe840e3225cd54 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Thu, 3 Jul 2014 19:17:34 +0200
+Subject: scsi: handle flush errors properly
+
+From: James Bottomley <JBottomley@Parallels.com>
+
+commit 89fb4cd1f717a871ef79fa7debbe840e3225cd54 upstream.
+
+Flush commands don't transfer data and thus need to be special cased
+in the I/O completion handler so that we can propagate errors to
+the block layer and filesystem.
+
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Reported-by: Steven Haber <steven@qumulo.com>
+Tested-by: Steven Haber <steven@qumulo.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_lib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -815,6 +815,14 @@ void scsi_io_completion(struct scsi_cmnd
+ scsi_next_command(cmd);
+ return;
+ }
++ } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
++ /*
++ * Certain non BLOCK_PC requests are commands that don't
++ * actually transfer anything (FLUSH), so cannot use
++ * good_bytes != blk_rq_bytes(req) as the signal for an error.
++ * This sets the error explicitly for the problem case.
++ */
++ error = __scsi_error_from_host_byte(cmd, result);
+ }
+
+ /* no bidi support for !REQ_TYPE_BLOCK_PC yet */
projects / thirdparty / kernel / stable-queue.git / commitdiff
