From: Greg Kroah-Hartman Date: Sun, 1 Dec 2013 19:59:51 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.72~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=63d92f3c1b0845471e55dabd626ecd67500195b7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: dm-allocate-buffer-for-messages-with-small-number-of-arguments-using-gfp_noio.patch pm-hibernate-avoid-overflow-in-hibernate_preallocate_memory.patch qeth-avoid-buffer-overflow-in-snmp-ioctl.patch rt2400pci-fix-rssi-read.patch --- diff --git a/queue-3.4/dm-allocate-buffer-for-messages-with-small-number-of-arguments-using-gfp_noio.patch b/queue-3.4/dm-allocate-buffer-for-messages-with-small-number-of-arguments-using-gfp_noio.patch new file mode 100644 index 00000000000..fee907db7d3 --- /dev/null +++ b/queue-3.4/dm-allocate-buffer-for-messages-with-small-number-of-arguments-using-gfp_noio.patch @@ -0,0 +1,61 @@ +From f36afb3957353d2529cb2b00f78fdccd14fc5e9c Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 31 Oct 2013 13:55:45 -0400 +Subject: dm: allocate buffer for messages with small number of arguments using GFP_NOIO + +From: Mikulas Patocka + +commit f36afb3957353d2529cb2b00f78fdccd14fc5e9c upstream. + +dm-mpath and dm-thin must process messages even if some device is +suspended, so we allocate argv buffer with GFP_NOIO. These messages have +a small fixed number of arguments. + +On the other hand, dm-switch needs to process bulk data using messages +so excessive use of GFP_NOIO could cause trouble. + +The patch also lowers the default number of arguments from 64 to 8, so +that there is smaller load on GFP_NOIO allocations. + +Signed-off-by: Mikulas Patocka +Acked-by: Alasdair G Kergon +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-table.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -581,14 +581,28 @@ static int adjoin(struct dm_table *table + + /* + * Used to dynamically allocate the arg array. ++ * ++ * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must ++ * process messages even if some device is suspended. These messages have a ++ * small fixed number of arguments. ++ * ++ * On the other hand, dm-switch needs to process bulk data using messages and ++ * excessive use of GFP_NOIO could cause trouble. + */ + static char **realloc_argv(unsigned *array_size, char **old_argv) + { + char **argv; + unsigned new_size; ++ gfp_t gfp; + +- new_size = *array_size ? *array_size * 2 : 64; +- argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL); ++ if (*array_size) { ++ new_size = *array_size * 2; ++ gfp = GFP_KERNEL; ++ } else { ++ new_size = 8; ++ gfp = GFP_NOIO; ++ } ++ argv = kmalloc(new_size * sizeof(*argv), gfp); + if (argv) { + memcpy(argv, old_argv, *array_size * sizeof(*argv)); + *array_size = new_size; diff --git a/queue-3.4/pm-hibernate-avoid-overflow-in-hibernate_preallocate_memory.patch b/queue-3.4/pm-hibernate-avoid-overflow-in-hibernate_preallocate_memory.patch new file mode 100644 index 00000000000..4b75140ef16 --- /dev/null +++ b/queue-3.4/pm-hibernate-avoid-overflow-in-hibernate_preallocate_memory.patch @@ -0,0 +1,44 @@ +From fd432b9f8c7c88428a4635b9f5a9c6e174df6e36 Mon Sep 17 00:00:00 2001 +From: Aaron Lu +Date: Wed, 6 Nov 2013 08:41:31 +0800 +Subject: PM / hibernate: Avoid overflow in hibernate_preallocate_memory() + +From: Aaron Lu + +commit fd432b9f8c7c88428a4635b9f5a9c6e174df6e36 upstream. + +When system has a lot of highmem (e.g. 16GiB using a 32 bits kernel), +the code to calculate how much memory we need to preallocate in +normal zone may cause overflow. As Leon has analysed: + + It looks that during computing 'alloc' variable there is overflow: + alloc = (3943404 - 1970542) - 1978280 = -5418 (signed) + And this function goes to err_out. + +Fix this by avoiding that overflow. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=60817 +Reported-and-tested-by: Leon Drugi +Signed-off-by: Aaron Lu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/power/snapshot.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -1398,7 +1398,11 @@ int hibernate_preallocate_memory(void) + * highmem and non-highmem zones separately. + */ + pages_highmem = preallocate_image_highmem(highmem / 2); +- alloc = (count - max_size) - pages_highmem; ++ alloc = count - max_size; ++ if (alloc > pages_highmem) ++ alloc -= pages_highmem; ++ else ++ alloc = 0; + pages = preallocate_image_memory(alloc, avail_normal); + if (pages < alloc) { + /* We have exhausted non-highmem pages, try highmem. */ diff --git a/queue-3.4/qeth-avoid-buffer-overflow-in-snmp-ioctl.patch b/queue-3.4/qeth-avoid-buffer-overflow-in-snmp-ioctl.patch new file mode 100644 index 00000000000..df7443d2cbe --- /dev/null +++ b/queue-3.4/qeth-avoid-buffer-overflow-in-snmp-ioctl.patch @@ -0,0 +1,46 @@ +From 6fb392b1a63ae36c31f62bc3fc8630b49d602b62 Mon Sep 17 00:00:00 2001 +From: Ursula Braun +Date: Wed, 6 Nov 2013 09:04:52 +0100 +Subject: qeth: avoid buffer overflow in snmp ioctl + +From: Ursula Braun + +commit 6fb392b1a63ae36c31f62bc3fc8630b49d602b62 upstream. + +Check user-defined length in snmp ioctl request and allow request +only if it fits into a qeth command buffer. + +Signed-off-by: Ursula Braun +Signed-off-by: Frank Blaschka +Reviewed-by: Heiko Carstens +Reported-by: Nico Golde +Reported-by: Fabian Yamaguchi +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/net/qeth_core_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -4357,7 +4357,7 @@ int qeth_snmp_command(struct qeth_card * + struct qeth_cmd_buffer *iob; + struct qeth_ipa_cmd *cmd; + struct qeth_snmp_ureq *ureq; +- int req_len; ++ unsigned int req_len; + struct qeth_arp_query_info qinfo = {0, }; + int rc = 0; + +@@ -4373,6 +4373,10 @@ int qeth_snmp_command(struct qeth_card * + /* skip 4 bytes (data_len struct member) to get req_len */ + if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int))) + return -EFAULT; ++ if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE - ++ sizeof(struct qeth_ipacmd_hdr) - ++ sizeof(struct qeth_ipacmd_setadpparms_hdr))) ++ return -EINVAL; + ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr)); + if (IS_ERR(ureq)) { + QETH_CARD_TEXT(card, 2, "snmpnome"); diff --git a/queue-3.4/rt2400pci-fix-rssi-read.patch b/queue-3.4/rt2400pci-fix-rssi-read.patch new file mode 100644 index 00000000000..3e4cf90cde8 --- /dev/null +++ b/queue-3.4/rt2400pci-fix-rssi-read.patch @@ -0,0 +1,30 @@ +From 2bf127a5cc372b9319afcbae10b090663b621c8b Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 15 Oct 2013 14:28:48 +0200 +Subject: rt2400pci: fix RSSI read + +From: Stanislaw Gruszka + +commit 2bf127a5cc372b9319afcbae10b090663b621c8b upstream. + +RSSI value is provided on word3 not on word2. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2400pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2400pci.c ++++ b/drivers/net/wireless/rt2x00/rt2400pci.c +@@ -1253,7 +1253,7 @@ static void rt2400pci_fill_rxdone(struct + */ + rxdesc->timestamp = ((u64)rx_high << 32) | rx_low; + rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08; +- rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) - ++ rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) - + entry->queue->rt2x00dev->rssi_offset; + rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT); + diff --git a/queue-3.4/series b/queue-3.4/series index 989cf627e2f..b81892968b7 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -28,3 +28,7 @@ staging-vt6656-fix-for-tx-usb-resets-from-vendors-driver.patch rtlwifi-rtl8192de-fix-incorrect-signal-strength-for-unassociated-ap.patch rtlwifi-rtl8192se-fix-incorrect-signal-strength-for-unassociated-ap.patch rtlwifi-rtl8192cu-fix-incorrect-signal-strength-for-unassociated-ap.patch +qeth-avoid-buffer-overflow-in-snmp-ioctl.patch +rt2400pci-fix-rssi-read.patch +dm-allocate-buffer-for-messages-with-small-number-of-arguments-using-gfp_noio.patch +pm-hibernate-avoid-overflow-in-hibernate_preallocate_memory.patch