Skip to content

Commit

Permalink
Merge tag 'v4.9.63' into linux-4.9.x-unofficial_grsec
Browse files Browse the repository at this point in the history
This is the 4.9.63 stable release

Signed-off-by: Mathias Krause <minipli@googlemail.com>

Conflicts:
	net/packet/af_packet.c
  • Loading branch information
minipli committed Nov 22, 2017
2 parents a15b2c0 + ea88d5c commit c40dad0
Show file tree
Hide file tree
Showing 54 changed files with 402 additions and 292 deletions.
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 9
SUBLEVEL = 62
SUBLEVEL = 63
EXTRAVERSION =
NAME = Roaring Lionus

Expand Down
20 changes: 10 additions & 10 deletions arch/arm/boot/dts/imx53-qsb-common.dtsi
Original file line number Diff line number Diff line change
Expand Up @@ -215,16 +215,16 @@

pinctrl_fec: fecgrp {
fsl,pins = <
MX53_PAD_FEC_MDC__FEC_MDC 0x4
MX53_PAD_FEC_MDIO__FEC_MDIO 0x1fc
MX53_PAD_FEC_REF_CLK__FEC_TX_CLK 0x180
MX53_PAD_FEC_RX_ER__FEC_RX_ER 0x180
MX53_PAD_FEC_CRS_DV__FEC_RX_DV 0x180
MX53_PAD_FEC_RXD1__FEC_RDATA_1 0x180
MX53_PAD_FEC_RXD0__FEC_RDATA_0 0x180
MX53_PAD_FEC_TX_EN__FEC_TX_EN 0x4
MX53_PAD_FEC_TXD1__FEC_TDATA_1 0x4
MX53_PAD_FEC_TXD0__FEC_TDATA_0 0x4
MX53_PAD_FEC_MDC__FEC_MDC 0x80000000
MX53_PAD_FEC_MDIO__FEC_MDIO 0x80000000
MX53_PAD_FEC_REF_CLK__FEC_TX_CLK 0x80000000
MX53_PAD_FEC_RX_ER__FEC_RX_ER 0x80000000
MX53_PAD_FEC_CRS_DV__FEC_RX_DV 0x80000000
MX53_PAD_FEC_RXD1__FEC_RDATA_1 0x80000000
MX53_PAD_FEC_RXD0__FEC_RDATA_0 0x80000000
MX53_PAD_FEC_TX_EN__FEC_TX_EN 0x80000000
MX53_PAD_FEC_TXD1__FEC_TDATA_1 0x80000000
MX53_PAD_FEC_TXD0__FEC_TDATA_0 0x80000000
>;
};

Expand Down
5 changes: 0 additions & 5 deletions arch/powerpc/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -1089,11 +1089,6 @@ source "arch/powerpc/Kconfig.debug"

source "security/Kconfig"

config KEYS_COMPAT
bool
depends on COMPAT && KEYS
default y

source "crypto/Kconfig"

config PPC_LIB_RHEAP
Expand Down
3 changes: 0 additions & 3 deletions arch/s390/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -359,9 +359,6 @@ config COMPAT
config SYSVIPC_COMPAT
def_bool y if COMPAT && SYSVIPC

config KEYS_COMPAT
def_bool y if COMPAT && KEYS

config SMP
def_bool y
prompt "Symmetric multi-processing support"
Expand Down
3 changes: 0 additions & 3 deletions arch/sparc/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -569,9 +569,6 @@ config SYSVIPC_COMPAT
depends on COMPAT && SYSVIPC
default y

config KEYS_COMPAT
def_bool y if COMPAT && KEYS

endmenu

source "net/Kconfig"
Expand Down
4 changes: 0 additions & 4 deletions arch/x86/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -2748,10 +2748,6 @@ config COMPAT_FOR_U64_ALIGNMENT
config SYSVIPC_COMPAT
def_bool y
depends on SYSVIPC

config KEYS_COMPAT
def_bool y
depends on KEYS
endif

endmenu
Expand Down
16 changes: 14 additions & 2 deletions drivers/input/misc/ims-pcu.c
Original file line number Diff line number Diff line change
Expand Up @@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
return NULL;
}

while (buflen > 0) {
while (buflen >= sizeof(*union_desc)) {
union_desc = (struct usb_cdc_union_desc *)buf;

if (union_desc->bLength > buflen) {
dev_err(&intf->dev, "Too large descriptor\n");
return NULL;
}

if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
dev_dbg(&intf->dev, "Found union header\n");
return union_desc;

if (union_desc->bLength >= sizeof(*union_desc))
return union_desc;

dev_err(&intf->dev,
"Union descriptor to short (%d vs %zd\n)",
union_desc->bLength, sizeof(*union_desc));
return NULL;
}

buflen -= union_desc->bLength;
Expand Down
23 changes: 19 additions & 4 deletions drivers/misc/panel.c
Original file line number Diff line number Diff line change
Expand Up @@ -1423,17 +1423,25 @@ static ssize_t lcd_write(struct file *file,

static int lcd_open(struct inode *inode, struct file *file)
{
int ret;

ret = -EBUSY;
if (!atomic_dec_and_test(&lcd_available))
return -EBUSY; /* open only once at a time */
goto fail; /* open only once at a time */

ret = -EPERM;
if (file->f_mode & FMODE_READ) /* device is write-only */
return -EPERM;
goto fail;

if (lcd.must_clear) {
lcd_clear_display();
lcd.must_clear = false;
}
return nonseekable_open(inode, file);

fail:
atomic_inc(&lcd_available);
return ret;
}

static int lcd_release(struct inode *inode, struct file *file)
Expand Down Expand Up @@ -1696,14 +1704,21 @@ static ssize_t keypad_read(struct file *file,

static int keypad_open(struct inode *inode, struct file *file)
{
int ret;

ret = -EBUSY;
if (!atomic_dec_and_test(&keypad_available))
return -EBUSY; /* open only once at a time */
goto fail; /* open only once at a time */

ret = -EPERM;
if (file->f_mode & FMODE_WRITE) /* device is read-only */
return -EPERM;
goto fail;

keypad_buflen = 0; /* flush the buffer on opening */
return 0;
fail:
atomic_inc(&keypad_available);
return ret;
}

static int keypad_release(struct inode *inode, struct file *file)
Expand Down
20 changes: 11 additions & 9 deletions drivers/net/macvtap.c
Original file line number Diff line number Diff line change
Expand Up @@ -559,6 +559,10 @@ static int macvtap_open(struct inode *inode, struct file *file)
&macvtap_proto, 0);
if (!q)
goto err;
if (skb_array_init(&q->skb_array, dev->tx_queue_len, GFP_KERNEL)) {
sk_free(&q->sk);
goto err;
}

RCU_INIT_POINTER(q->sock.wq, &q->wq);
init_waitqueue_head(&q->wq.wait);
Expand All @@ -582,22 +586,18 @@ static int macvtap_open(struct inode *inode, struct file *file)
if ((dev->features & NETIF_F_HIGHDMA) && (dev->features & NETIF_F_SG))
sock_set_flag(&q->sk, SOCK_ZEROCOPY);

err = -ENOMEM;
if (skb_array_init(&q->skb_array, dev->tx_queue_len, GFP_KERNEL))
goto err_array;

err = macvtap_set_queue(dev, file, q);
if (err)
goto err_queue;
if (err) {
/* macvtap_sock_destruct() will take care of freeing skb_array */
goto err_put;
}

dev_put(dev);

rtnl_unlock();
return err;

err_queue:
skb_array_cleanup(&q->skb_array);
err_array:
err_put:
sock_put(&q->sk);
err:
if (dev)
Expand Down Expand Up @@ -1077,6 +1077,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
case TUNSETSNDBUF:
if (get_user(s, sp))
return -EFAULT;
if (s <= 0)
return -EINVAL;

q->sk.sk_sndbuf = s;
return 0;
Expand Down
20 changes: 20 additions & 0 deletions drivers/net/ppp/ppp_generic.c
Original file line number Diff line number Diff line change
Expand Up @@ -1336,7 +1336,17 @@ ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64)

static int ppp_dev_init(struct net_device *dev)
{
struct ppp *ppp;

netdev_lockdep_set_classes(dev);

ppp = netdev_priv(dev);
/* Let the netdevice take a reference on the ppp file. This ensures
* that ppp_destroy_interface() won't run before the device gets
* unregistered.
*/
atomic_inc(&ppp->file.refcnt);

return 0;
}

Expand All @@ -1359,6 +1369,15 @@ static void ppp_dev_uninit(struct net_device *dev)
wake_up_interruptible(&ppp->file.rwait);
}

static void ppp_dev_priv_destructor(struct net_device *dev)
{
struct ppp *ppp;

ppp = netdev_priv(dev);
if (atomic_dec_and_test(&ppp->file.refcnt))
ppp_destroy_interface(ppp);
}

static const struct net_device_ops ppp_netdev_ops = {
.ndo_init = ppp_dev_init,
.ndo_uninit = ppp_dev_uninit,
Expand All @@ -1384,6 +1403,7 @@ static void ppp_setup(struct net_device *dev)
dev->tx_queue_len = 3;
dev->type = ARPHRD_PPP;
dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
dev->destructor = ppp_dev_priv_destructor;
netif_keep_dst(dev);
}

Expand Down
7 changes: 7 additions & 0 deletions drivers/net/tun.c
Original file line number Diff line number Diff line change
Expand Up @@ -1787,6 +1787,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)

if (!dev)
return -ENOMEM;
err = dev_get_valid_name(net, dev, name);
if (err < 0)
goto err_free_dev;

dev_net_set(dev, net);
dev->rtnl_link_ops = &tun_link_ops;
Expand Down Expand Up @@ -2183,6 +2186,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
ret = -EFAULT;
break;
}
if (sndbuf <= 0) {
ret = -EINVAL;
break;
}

tun->sndbuf = sndbuf;
tun_set_sndbuf(tun);
Expand Down
3 changes: 0 additions & 3 deletions drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Original file line number Diff line number Diff line change
Expand Up @@ -4754,9 +4754,6 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
if (err < 0)
brcmf_err("setting AP mode failed %d\n", err);
err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
if (err < 0)
brcmf_err("setting INFRA mode failed %d\n", err);
if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
brcmf_fil_iovar_int_set(ifp, "mbss", 0);
brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
Expand Down
33 changes: 0 additions & 33 deletions drivers/scsi/qla2xxx/tcm_qla2xxx.c
Original file line number Diff line number Diff line change
Expand Up @@ -484,25 +484,13 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
{
struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
unsigned long flags;

/*
* Ensure that the complete FCP WRITE payload has been received.
* Otherwise return an exception via CHECK_CONDITION status.
*/
cmd->cmd_in_wq = 0;

spin_lock_irqsave(&cmd->cmd_lock, flags);
cmd->cmd_flags |= CMD_FLAG_DATA_WORK;
if (cmd->aborted) {
cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
spin_unlock_irqrestore(&cmd->cmd_lock, flags);

tcm_qla2xxx_free_cmd(cmd);
return;
}
spin_unlock_irqrestore(&cmd->cmd_lock, flags);

cmd->vha->tgt_counters.qla_core_ret_ctio++;
if (!cmd->write_data_transferred) {
/*
Expand Down Expand Up @@ -682,34 +670,13 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
qlt_xmit_tm_rsp(mcmd);
}


#define DATA_WORK_NOT_FREE(_flags) \
(( _flags & (CMD_FLAG_DATA_WORK|CMD_FLAG_DATA_WORK_FREE)) == \
CMD_FLAG_DATA_WORK)
static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
{
struct qla_tgt_cmd *cmd = container_of(se_cmd,
struct qla_tgt_cmd, se_cmd);
unsigned long flags;

if (qlt_abort_cmd(cmd))
return;

spin_lock_irqsave(&cmd->cmd_lock, flags);
if ((cmd->state == QLA_TGT_STATE_NEW)||
((cmd->state == QLA_TGT_STATE_DATA_IN) &&
DATA_WORK_NOT_FREE(cmd->cmd_flags)) ) {

cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/* Cmd have not reached firmware.
* Use this trigger to free it. */
tcm_qla2xxx_free_cmd(cmd);
return;
}
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
return;

}

static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
Expand Down
19 changes: 7 additions & 12 deletions drivers/target/iscsi/iscsi_target.c
Original file line number Diff line number Diff line change
Expand Up @@ -1940,7 +1940,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
struct iscsi_tm *hdr;
int out_of_order_cmdsn = 0, ret;
bool sess_ref = false;
u8 function;
u8 function, tcm_function = TMR_UNKNOWN;

hdr = (struct iscsi_tm *) buf;
hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
Expand Down Expand Up @@ -1986,10 +1986,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
* LIO-Target $FABRIC_MOD
*/
if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {

u8 tcm_function;
int ret;

transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
conn->sess->se_sess, 0, DMA_NONE,
TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
Expand Down Expand Up @@ -2025,15 +2021,14 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
return iscsit_add_reject_cmd(cmd,
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
}

ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req,
tcm_function, GFP_KERNEL);
if (ret < 0)
return iscsit_add_reject_cmd(cmd,
}
ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req, tcm_function,
GFP_KERNEL);
if (ret < 0)
return iscsit_add_reject_cmd(cmd,
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);

cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
}
cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;

cmd->iscsi_opcode = ISCSI_OP_SCSI_TMFUNC;
cmd->i_state = ISTATE_SEND_TASKMGTRSP;
Expand Down
5 changes: 3 additions & 2 deletions drivers/usb/misc/usbtest.c
Original file line number Diff line number Diff line change
Expand Up @@ -209,12 +209,13 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
return tmp;
}

if (in) {
if (in)
dev->in_pipe = usb_rcvbulkpipe(udev,
in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
if (out)
dev->out_pipe = usb_sndbulkpipe(udev,
out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
}

if (iso_in) {
dev->iso_in = &iso_in->desc;
dev->in_iso_pipe = usb_rcvisocpipe(udev,
Expand Down
Loading

0 comments on commit c40dad0

Please sign in to comment.