From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 17:59:22 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.75~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e09ba0b213873a361de2e76bf9df22f18e7210d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch hwmon-w83l768ng-fix-fan-speed-control-range.patch hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch --- diff --git a/queue-3.10/.kvm-x86-convert-vapic-synchronization-to-_cached-functions-cve-2013-6368.patch.swp b/queue-3.10/.kvm-x86-convert-vapic-synchronization-to-_cached-functions-cve-2013-6368.patch.swp deleted file mode 100644 index 2e6f87d72e5..00000000000 Binary files a/queue-3.10/.kvm-x86-convert-vapic-synchronization-to-_cached-functions-cve-2013-6368.patch.swp and /dev/null differ diff --git a/queue-3.10/hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch b/queue-3.10/hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch new file mode 100644 index 00000000000..401e7854979 --- /dev/null +++ b/queue-3.10/hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch @@ -0,0 +1,70 @@ +From efabcc2123f0ed47870033b8d6fc73b50d76d635 Mon Sep 17 00:00:00 2001 +From: José Miguel Gonçalves +Date: Wed, 11 Dec 2013 11:11:13 +0000 +Subject: hwmon: HIH-6130: Support I2C bus drivers without I2C_FUNC_SMBUS_QUICK + +From: José Miguel Gonçalves + +commit efabcc2123f0ed47870033b8d6fc73b50d76d635 upstream. + +Some I2C bus drivers do not allow zero-length data transfers which are +required to start a measurement with the HIH6130/1 sensor. Nevertheless, +we can overcome this limitation by writing a zero dummy byte. This byte +is ignored by the sensor and was verified to be working with the OMAP +I2C bus driver in a BeagleBone board. + +Signed-off-by: José Miguel Gonçalves +[Guenter Roeck: Simplified complexity of write_length initialization] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/hih6130.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/hih6130.c ++++ b/drivers/hwmon/hih6130.c +@@ -43,6 +43,7 @@ + * @last_update: time of last update (jiffies) + * @temperature: cached temperature measurement value + * @humidity: cached humidity measurement value ++ * @write_length: length for I2C measurement request + */ + struct hih6130 { + struct device *hwmon_dev; +@@ -51,6 +52,7 @@ struct hih6130 { + unsigned long last_update; + int temperature; + int humidity; ++ size_t write_length; + }; + + /** +@@ -121,8 +123,15 @@ static int hih6130_update_measurements(s + */ + if (time_after(jiffies, hih6130->last_update + HZ) || !hih6130->valid) { + +- /* write to slave address, no data, to request a measurement */ +- ret = i2c_master_send(client, tmp, 0); ++ /* ++ * Write to slave address to request a measurement. ++ * According with the datasheet it should be with no data, but ++ * for systems with I2C bus drivers that do not allow zero ++ * length packets we write one dummy byte to allow sensor ++ * measurements on them. ++ */ ++ tmp[0] = 0; ++ ret = i2c_master_send(client, tmp, hih6130->write_length); + if (ret < 0) + goto out; + +@@ -252,6 +261,9 @@ static int hih6130_probe(struct i2c_clie + goto fail_remove_sysfs; + } + ++ if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK)) ++ hih6130->write_length = 1; ++ + return 0; + + fail_remove_sysfs: diff --git a/queue-3.10/hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch b/queue-3.10/hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch new file mode 100644 index 00000000000..cb3859e3095 --- /dev/null +++ b/queue-3.10/hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch @@ -0,0 +1,57 @@ +From 3806b45ba4655147a011df03242cc197ab986c43 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 12 Dec 2013 08:05:33 +0100 +Subject: hwmon: Prevent some divide by zeros in FAN_TO_REG() + +From: Dan Carpenter + +commit 3806b45ba4655147a011df03242cc197ab986c43 upstream. + +The "rpm * div" operations can overflow here, so this patch adds an +upper limit to rpm to prevent that. Jean Delvare helped me with this +patch. + +Signed-off-by: Dan Carpenter +Acked-by: Roger Lucas +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm78.c | 2 ++ + drivers/hwmon/sis5595.c | 2 ++ + drivers/hwmon/vt8231.c | 2 +- + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/lm78.c ++++ b/drivers/hwmon/lm78.c +@@ -94,6 +94,8 @@ static inline u8 FAN_TO_REG(long rpm, in + { + if (rpm <= 0) + return 255; ++ if (rpm > 1350000) ++ return 1; + return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254); + } + +--- a/drivers/hwmon/sis5595.c ++++ b/drivers/hwmon/sis5595.c +@@ -141,6 +141,8 @@ static inline u8 FAN_TO_REG(long rpm, in + { + if (rpm <= 0) + return 255; ++ if (rpm > 1350000) ++ return 1; + return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254); + } + +--- a/drivers/hwmon/vt8231.c ++++ b/drivers/hwmon/vt8231.c +@@ -145,7 +145,7 @@ static const u8 regtempmin[] = { 0x3a, 0 + */ + static inline u8 FAN_TO_REG(long rpm, int div) + { +- if (rpm == 0) ++ if (rpm <= 0 || rpm > 1310720) + return 0; + return clamp_val(1310720 / (rpm * div), 1, 255); + } diff --git a/queue-3.10/hwmon-w83l768ng-fix-fan-speed-control-range.patch b/queue-3.10/hwmon-w83l768ng-fix-fan-speed-control-range.patch new file mode 100644 index 00000000000..4cf5cde227b --- /dev/null +++ b/queue-3.10/hwmon-w83l768ng-fix-fan-speed-control-range.patch @@ -0,0 +1,50 @@ +From 33a7ab91d509fa33b4bcd3ce0038cc80298050da Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Thu, 12 Dec 2013 08:05:32 +0100 +Subject: hwmon: (w83l768ng) Fix fan speed control range + +From: Jean Delvare + +commit 33a7ab91d509fa33b4bcd3ce0038cc80298050da upstream. + +The W83L786NG stores the fan speed on 4 bits while the sysfs interface +uses a 0-255 range. Thus the driver should scale the user input down +to map it to the device range, and scale up the value read from the +device before presenting it to the user. The reserved register nibble +should be left unchanged. + +Signed-off-by: Jean Delvare +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/w83l786ng.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/w83l786ng.c ++++ b/drivers/hwmon/w83l786ng.c +@@ -481,9 +481,11 @@ store_pwm(struct device *dev, struct dev + if (err) + return err; + val = clamp_val(val, 0, 255); ++ val = DIV_ROUND_CLOSEST(val, 0x11); + + mutex_lock(&data->update_lock); +- data->pwm[nr] = val; ++ data->pwm[nr] = val * 0x11; ++ val |= w83l786ng_read_value(client, W83L786NG_REG_PWM[nr]) & 0xf0; + w83l786ng_write_value(client, W83L786NG_REG_PWM[nr], val); + mutex_unlock(&data->update_lock); + return count; +@@ -777,8 +779,9 @@ static struct w83l786ng_data *w83l786ng_ + ? 0 : 1; + data->pwm_enable[i] = + ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1; +- data->pwm[i] = w83l786ng_read_value(client, +- W83L786NG_REG_PWM[i]); ++ data->pwm[i] = ++ (w83l786ng_read_value(client, W83L786NG_REG_PWM[i]) ++ & 0x0f) * 0x11; + } + + diff --git a/queue-3.10/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch b/queue-3.10/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch new file mode 100644 index 00000000000..165cde7ddc1 --- /dev/null +++ b/queue-3.10/hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch @@ -0,0 +1,43 @@ +From cf7559bc053471f32373d71d04a9aa19e0b48d59 Mon Sep 17 00:00:00 2001 +From: Brian Carnes +Date: Thu, 12 Dec 2013 08:05:32 +0100 +Subject: hwmon: (w83l786ng) Fix fan speed control mode setting and reporting + +From: Brian Carnes + +commit cf7559bc053471f32373d71d04a9aa19e0b48d59 upstream. + +The wrong mask is used, which causes some fan speed control modes +(pwmX_enable) to be incorrectly reported, and some modes to be +impossible to set. + +[JD: add subject and description.] + +Signed-off-by: Brian Carnes +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/w83l786ng.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/w83l786ng.c ++++ b/drivers/hwmon/w83l786ng.c +@@ -510,7 +510,7 @@ store_pwm_enable(struct device *dev, str + mutex_lock(&data->update_lock); + reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG); + data->pwm_enable[nr] = val; +- reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]); ++ reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]); + reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr]; + w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg); + mutex_unlock(&data->update_lock); +@@ -776,7 +776,7 @@ static struct w83l786ng_data *w83l786ng_ + ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1) + ? 0 : 1; + data->pwm_enable[i] = +- ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1; ++ ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1; + data->pwm[i] = w83l786ng_read_value(client, + W83L786NG_REG_PWM[i]); + } diff --git a/queue-3.10/series b/queue-3.10/series index 5bd4feadf9e..a3444a917d8 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -14,3 +14,9 @@ kvm-improve-create-vcpu-parameter-cve-2013-4587.patch kvm-x86-fix-potential-divide-by-0-in-lapic-cve-2013-6367.patch kvm-x86-convert-vapic-synchronization-to-_cached-functions-cve-2013-6368.patch kvm-x86-fix-guest-initiated-crash-with-x2apic-cve-2013-6376.patch +hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch +hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch +hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch +hwmon-w83l768ng-fix-fan-speed-control-range.patch +xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch +xfs-underflow-bug-in-xfs_attrlist_by_handle.patch diff --git a/queue-3.10/xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch b/queue-3.10/xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch new file mode 100644 index 00000000000..eab81296b6f --- /dev/null +++ b/queue-3.10/xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch @@ -0,0 +1,58 @@ +From f94c44573e7c22860e2c3dfe349c45f72ba35ad3 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Thu, 21 Nov 2013 15:41:06 +1100 +Subject: xfs: growfs overruns AGFL buffer on V4 filesystems + +From: Dave Chinner + +commit f94c44573e7c22860e2c3dfe349c45f72ba35ad3 upstream. + +This loop in xfs_growfs_data_private() is incorrect for V4 +superblocks filesystems: + + for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++) + agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); + +For V4 filesystems, we don't have a agfl header structure, and so +XFS_AGFL_SIZE() returns an entire sector's worth of entries, which +we then index from an offset into the sector. Hence: buffer overrun. + +This problem was introduced in 3.10 by commit 77c95bba ("xfs: add +CRC checks to the AGFL") which changed the AGFL structure but failed +to update the growfs code to handle the different structures. + +Fix it by using the correct offset into the buffer for both V4 and +V5 filesystems. + +Signed-off-by: Dave Chinner +Reviewed-by: Jie Liu +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_fsops.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/xfs/xfs_fsops.c ++++ b/fs/xfs/xfs_fsops.c +@@ -216,6 +216,8 @@ xfs_growfs_data_private( + */ + nfree = 0; + for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) { ++ __be32 *agfl_bno; ++ + /* + * AG freespace header block + */ +@@ -275,8 +277,10 @@ xfs_growfs_data_private( + agfl->agfl_seqno = cpu_to_be32(agno); + uuid_copy(&agfl->agfl_uuid, &mp->m_sb.sb_uuid); + } ++ ++ agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, bp); + for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++) +- agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); ++ agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); + + error = xfs_bwrite(bp); + xfs_buf_relse(bp); diff --git a/queue-3.10/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch b/queue-3.10/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch new file mode 100644 index 00000000000..1f15f58a0c9 --- /dev/null +++ b/queue-3.10/xfs-underflow-bug-in-xfs_attrlist_by_handle.patch @@ -0,0 +1,50 @@ +From 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 31 Oct 2013 21:00:10 +0300 +Subject: xfs: underflow bug in xfs_attrlist_by_handle() + +From: Dan Carpenter + +commit 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 upstream. + +If we allocate less than sizeof(struct attrlist) then we end up +corrupting memory or doing a ZERO_PTR_SIZE dereference. + +This can only be triggered with CAP_SYS_ADMIN. + +Reported-by: Nico Golde +Reported-by: Fabian Yamaguchi +Signed-off-by: Dan Carpenter +Reviewed-by: Dave Chinner +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_ioctl.c | 3 ++- + fs/xfs/xfs_ioctl32.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -409,7 +409,8 @@ xfs_attrlist_by_handle( + return -XFS_ERROR(EPERM); + if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t))) + return -XFS_ERROR(EFAULT); +- if (al_hreq.buflen > XATTR_LIST_MAX) ++ if (al_hreq.buflen < sizeof(struct attrlist) || ++ al_hreq.buflen > XATTR_LIST_MAX) + return -XFS_ERROR(EINVAL); + + /* +--- a/fs/xfs/xfs_ioctl32.c ++++ b/fs/xfs/xfs_ioctl32.c +@@ -359,7 +359,8 @@ xfs_compat_attrlist_by_handle( + if (copy_from_user(&al_hreq, arg, + sizeof(compat_xfs_fsop_attrlist_handlereq_t))) + return -XFS_ERROR(EFAULT); +- if (al_hreq.buflen > XATTR_LIST_MAX) ++ if (al_hreq.buflen < sizeof(struct attrlist) || ++ al_hreq.buflen > XATTR_LIST_MAX) + return -XFS_ERROR(EINVAL); + + /*