From: Greg Kroah-Hartman Date: Mon, 4 Aug 2014 21:06:37 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.102~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd92ea9328129f7fb61b6caaae71dd4c00e7a549;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: arm-8115-1-lpae-reduce-damage-caused-by-idmap-to-virtual-memory-layout.patch cfg80211-fix-mic_failure-tracing.patch crypto-af_alg-properly-label-af_alg-socket.patch rapidio-tsi721_dma-fix-failure-to-obtain-transaction-descriptor.patch scsi-handle-flush-errors-properly.patch --- diff --git a/queue-3.10/arm-8115-1-lpae-reduce-damage-caused-by-idmap-to-virtual-memory-layout.patch b/queue-3.10/arm-8115-1-lpae-reduce-damage-caused-by-idmap-to-virtual-memory-layout.patch new file mode 100644 index 00000000000..aa510bf64f1 --- /dev/null +++ b/queue-3.10/arm-8115-1-lpae-reduce-damage-caused-by-idmap-to-virtual-memory-layout.patch @@ -0,0 +1,51 @@ +From 811a2407a3cf7bbd027fbe92d73416f17485a3d8 Mon Sep 17 00:00:00 2001 +From: Konstantin Khlebnikov +Date: Fri, 25 Jul 2014 09:17:12 +0100 +Subject: ARM: 8115/1: LPAE: reduce damage caused by idmap to virtual memory layout + +From: Konstantin Khlebnikov + +commit 811a2407a3cf7bbd027fbe92d73416f17485a3d8 upstream. + +On LPAE, each level 1 (pgd) page table entry maps 1GiB, and the level 2 +(pmd) entries map 2MiB. + +When the identity mapping is created on LPAE, the pgd pointers are copied +from the swapper_pg_dir. If we find that we need to modify the contents +of a pmd, we allocate a new empty pmd table and insert it into the +appropriate 1GB slot, before then filling it with the identity mapping. + +However, if the 1GB slot covers the kernel lowmem mappings, we obliterate +those mappings. + +When replacing a PMD, first copy the old PMD contents to the new PMD, so +that we preserve the existing mappings, particularly the mappings of the +kernel itself. + +[rewrote commit message and added code comment -- rmk] + +Fixes: ae2de101739c ("ARM: LPAE: Add identity mapping support for the 3-level page table format") +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/idmap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/arm/mm/idmap.c ++++ b/arch/arm/mm/idmap.c +@@ -24,6 +24,13 @@ static void idmap_add_pmd(pud_t *pud, un + pr_warning("Failed to allocate identity pmd.\n"); + return; + } ++ /* ++ * Copy the original PMD to ensure that the PMD entries for ++ * the kernel image are preserved. ++ */ ++ if (!pud_none(*pud)) ++ memcpy(pmd, pmd_offset(pud, 0), ++ PTRS_PER_PMD * sizeof(pmd_t)); + pud_populate(&init_mm, pud, pmd); + pmd += pmd_index(addr); + } else diff --git a/queue-3.10/cfg80211-fix-mic_failure-tracing.patch b/queue-3.10/cfg80211-fix-mic_failure-tracing.patch new file mode 100644 index 00000000000..cde4abdcea6 --- /dev/null +++ b/queue-3.10/cfg80211-fix-mic_failure-tracing.patch @@ -0,0 +1,33 @@ +From 8c26d458394be44e135d1c6bd4557e1c4e1a0535 Mon Sep 17 00:00:00 2001 +From: Eliad Peller +Date: Thu, 17 Jul 2014 15:00:56 +0300 +Subject: cfg80211: fix mic_failure tracing + +From: Eliad Peller + +commit 8c26d458394be44e135d1c6bd4557e1c4e1a0535 upstream. + +tsc can be NULL (mac80211 currently always passes NULL), +resulting in NULL-dereference. check before copying it. + +Signed-off-by: Eliad Peller +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/trace.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -1972,7 +1972,8 @@ TRACE_EVENT(cfg80211_michael_mic_failure + MAC_ASSIGN(addr, addr); + __entry->key_type = key_type; + __entry->key_id = key_id; +- memcpy(__entry->tsc, tsc, 6); ++ if (tsc) ++ memcpy(__entry->tsc, tsc, 6); + ), + TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT ", key type: %d, key id: %d, tsc: %pm", + NETDEV_PR_ARG, MAC_PR_ARG(addr), __entry->key_type, diff --git a/queue-3.10/crypto-af_alg-properly-label-af_alg-socket.patch b/queue-3.10/crypto-af_alg-properly-label-af_alg-socket.patch new file mode 100644 index 00000000000..d7f261d449d --- /dev/null +++ b/queue-3.10/crypto-af_alg-properly-label-af_alg-socket.patch @@ -0,0 +1,46 @@ +From 4c63f83c2c2e16a13ce274ee678e28246bd33645 Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Tue, 29 Jul 2014 18:41:09 +0000 +Subject: crypto: af_alg - properly label AF_ALG socket + +From: Milan Broz + +commit 4c63f83c2c2e16a13ce274ee678e28246bd33645 upstream. + +Th AF_ALG socket was missing a security label (e.g. SELinux) +which means that socket was in "unlabeled" state. + +This was recently demonstrated in the cryptsetup package +(cryptsetup v1.6.5 and later.) +See https://bugzilla.redhat.com/show_bug.cgi?id=1115120 + +This patch clones the sock's label from the parent sock +and resolves the issue (similar to AF_BLUETOOTH protocol family). + +Signed-off-by: Milan Broz +Acked-by: Paul Moore +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/af_alg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + struct alg_type_list { + const struct af_alg_type *type; +@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struc + + sock_init_data(newsock, sk2); + sock_graft(sk2, newsock); ++ security_sk_clone(sk, sk2); + + err = type->accept(ask->private, sk2); + if (err) { diff --git a/queue-3.10/rapidio-tsi721_dma-fix-failure-to-obtain-transaction-descriptor.patch b/queue-3.10/rapidio-tsi721_dma-fix-failure-to-obtain-transaction-descriptor.patch new file mode 100644 index 00000000000..46ab3d64372 --- /dev/null +++ b/queue-3.10/rapidio-tsi721_dma-fix-failure-to-obtain-transaction-descriptor.patch @@ -0,0 +1,57 @@ +From 0193ed8225e1a79ed64632106ec3cc81798cb13c Mon Sep 17 00:00:00 2001 +From: Alexandre Bounine +Date: Wed, 30 Jul 2014 16:08:26 -0700 +Subject: rapidio/tsi721_dma: fix failure to obtain transaction descriptor + +From: Alexandre Bounine + +commit 0193ed8225e1a79ed64632106ec3cc81798cb13c upstream. + +This is a bug fix for the situation when function tsi721_desc_get() fails +to obtain a free transaction descriptor. + +The bug usually results in a memory access crash dump when data transfer +scatter-gather list has more entries than size of hardware buffer +descriptors ring. This fix ensures that error is properly returned to a +caller instead of an invalid entry. + +This patch is applicable to kernel versions starting from v3.5. + +Signed-off-by: Alexandre Bounine +Cc: Matt Porter +Cc: Andre van Herk +Cc: Stef van Os +Cc: Vinod Koul +Cc: Dan Williams +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rapidio/devices/tsi721_dma.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/rapidio/devices/tsi721_dma.c ++++ b/drivers/rapidio/devices/tsi721_dma.c +@@ -287,6 +287,12 @@ struct tsi721_tx_desc *tsi721_desc_get(s + "desc %p not ACKed\n", tx_desc); + } + ++ if (ret == NULL) { ++ dev_dbg(bdma_chan->dchan.device->dev, ++ "%s: unable to obtain tx descriptor\n", __func__); ++ goto err_out; ++ } ++ + i = bdma_chan->wr_count_next % bdma_chan->bd_num; + if (i == bdma_chan->bd_num - 1) { + i = 0; +@@ -297,7 +303,7 @@ struct tsi721_tx_desc *tsi721_desc_get(s + tx_desc->txd.phys = bdma_chan->bd_phys + + i * sizeof(struct tsi721_dma_desc); + tx_desc->hw_desc = &((struct tsi721_dma_desc *)bdma_chan->bd_base)[i]; +- ++err_out: + spin_unlock_bh(&bdma_chan->lock); + + return ret; diff --git a/queue-3.10/scsi-handle-flush-errors-properly.patch b/queue-3.10/scsi-handle-flush-errors-properly.patch new file mode 100644 index 00000000000..b7148954c8e --- /dev/null +++ b/queue-3.10/scsi-handle-flush-errors-properly.patch @@ -0,0 +1,41 @@ +From 89fb4cd1f717a871ef79fa7debbe840e3225cd54 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Thu, 3 Jul 2014 19:17:34 +0200 +Subject: scsi: handle flush errors properly + +From: James Bottomley + +commit 89fb4cd1f717a871ef79fa7debbe840e3225cd54 upstream. + +Flush commands don't transfer data and thus need to be special cased +in the I/O completion handler so that we can propagate errors to +the block layer and filesystem. + +Signed-off-by: James Bottomley +Reported-by: Steven Haber +Tested-by: Steven Haber +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_lib.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -815,6 +815,14 @@ void scsi_io_completion(struct scsi_cmnd + scsi_next_command(cmd); + return; + } ++ } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) { ++ /* ++ * Certain non BLOCK_PC requests are commands that don't ++ * actually transfer anything (FLUSH), so cannot use ++ * good_bytes != blk_rq_bytes(req) as the signal for an error. ++ * This sets the error explicitly for the problem case. ++ */ ++ error = __scsi_error_from_host_byte(cmd, result); + } + + /* no bidi support for !REQ_TYPE_BLOCK_PC yet */