Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38c73e90 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 3.18.116 into android-3.18 



Changes in 3.18.116
	ibmasm: don't write out of bounds in read handler
	USB: serial: keyspan_pda: fix modem-status error handling
	USB: yurex: fix out-of-bounds uaccess in read handler
	USB: serial: mos7840: fix status-register error handling
	usb: quirks: add delay quirks for Corsair Strafe
	xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
	Fix up non-directory creation in SGID directories
	netfilter: x_tables: initialise match/target check parameter struct
	loop: add recursion validation to LOOP_CHANGE_FD
	PM / hibernate: Fix oops at snapshot_write()
	RDMA/ucm: Mark UCM interface as BROKEN
	loop: remember whether sysfs_create_group() was done
	bcm63xx_enet: correct clock usage
	bcm63xx_enet: do not write to random DMA channel on BCM6345
	crypto: crypto4xx - remove bad list_del
	crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak
	net: dccp: avoid crash in ccid3_hc_rx_send_feedback()
	net: dccp: switch rx_tstamp_last_feedback to monotonic clock
	net/mlx5: Fix incorrect raw command length parsing
	net: sungem: fix rx checksum support
	tcp: fix Fast Open key endianness
	tcp: prevent bogus FRTO undos with non-SACK flows
	vhost_net: validate sock before trying to put its fd
	net_sched: blackhole: tell upper qdisc about dropped packets
	net/mlx5: Fix command interface race in polling mode
	netfilter: ebtables: reject non-bridge targets
	KEYS: DNS: fix parsing multiple options
	rds: avoid unenecessary cong_update in loop transport
	net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.
	Linux 3.18.116

Change-Id: Iaa436f90938eb01603dfdce8d85c713d73ef6b6c
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents 047ee99d 7612025f

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 3

PATCHLEVEL = 18

SUBLEVEL = 115

SUBLEVEL = 116

EXTRAVERSION =

NAME = Diseased Newt

drivers/block/loop.c

+44 −35
Original line number Diff line number Diff line
@@ -628,6 +628,36 @@ out: 
}





static inline int is_loop_device(struct file *file)

{

	struct inode *i = file->f_mapping->host;



	return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;

}



static int loop_validate_file(struct file *file, struct block_device *bdev)

{

	struct inode	*inode = file->f_mapping->host;

	struct file	*f = file;



	/* Avoid recursion */

	while (is_loop_device(f)) {

		struct loop_device *l;



		if (f->f_mapping->host->i_bdev == bdev)

			return -EBADF;



		l = f->f_mapping->host->i_bdev->bd_disk->private_data;

		if (l->lo_state == Lo_unbound) {

			return -EINVAL;

		}

		f = l->lo_backing_file;

	}

	if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))

		return -EINVAL;

	return 0;

}



/*

 * loop_change_fd switched the backing store of a loopback device to

 * a new file. This is useful for operating system installers to free up
@@ -657,14 +687,15 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, 
	if (!file)

		goto out;



	error = loop_validate_file(file, bdev);

	if (error)

		goto out_putf;



	inode = file->f_mapping->host;

	old_file = lo->lo_backing_file;



	error = -EINVAL;



	if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))

		goto out_putf;



	/* size of the new backing store needs to be the same */

	if (get_loop_size(lo, file) != get_loop_size(lo, old_file))

		goto out_putf;
@@ -685,13 +716,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, 
	return error;

}



static inline int is_loop_device(struct file *file)

{

	struct inode *i = file->f_mapping->host;



	return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;

}



/* loop sysfs attributes */



static ssize_t loop_attr_show(struct device *dev, char *page,
@@ -779,14 +803,15 @@ static struct attribute_group loop_attribute_group = { 
	.attrs= loop_attrs,

};



static int loop_sysfs_init(struct loop_device *lo)

static void loop_sysfs_init(struct loop_device *lo)

{

	return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,

	lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,

						&loop_attribute_group);

}



static void loop_sysfs_exit(struct loop_device *lo)

{

	if (lo->sysfs_inited)

		sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,

				   &loop_attribute_group);

}
@@ -823,7 +848,7 @@ static void loop_config_discard(struct loop_device *lo) 
static int loop_set_fd(struct loop_device *lo, fmode_t mode,

		       struct block_device *bdev, unsigned int arg)

{

	struct file	*file, *f;

	struct file	*file;

	struct inode	*inode;

	struct address_space *mapping;

	unsigned lo_blocksize;
@@ -843,29 +868,13 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, 
	if (lo->lo_state != Lo_unbound)

		goto out_putf;



	/* Avoid recursion */

	f = file;

	while (is_loop_device(f)) {

		struct loop_device *l;



		if (f->f_mapping->host->i_bdev == bdev)

			goto out_putf;



		l = f->f_mapping->host->i_bdev->bd_disk->private_data;

		if (l->lo_state == Lo_unbound) {

			error = -EINVAL;

	error = loop_validate_file(file, bdev);

	if (error)

		goto out_putf;

		}

		f = l->lo_backing_file;

	}



	mapping = file->f_mapping;

	inode = mapping->host;



	error = -EINVAL;

	if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))

		goto out_putf;



	if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||

	    !file->f_op->write)

		lo_flags |= LO_FLAGS_READ_ONLY;

drivers/block/loop.h

+1 −0
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ struct loop_device { 
	wait_queue_head_t	lo_event;

	/* wait queue for incoming requests */

	wait_queue_head_t	lo_req_wait;

	bool			sysfs_inited;



	struct request_queue	*lo_queue;

	struct gendisk		*lo_disk;

drivers/crypto/amcc/crypto4xx_core.c

+11 −12
Original line number Diff line number Diff line
@@ -240,13 +240,15 @@ static u32 crypto4xx_build_pdr(struct crypto4xx_device *dev) 


static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev)

{

	if (dev->pdr != NULL)

	if (dev->pdr)

		dma_free_coherent(dev->core_dev->device,

				  sizeof(struct ce_pd) * PPC4XX_NUM_PD,

				  dev->pdr, dev->pdr_pa);



	if (dev->shadow_sa_pool)

		dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD,

				  dev->shadow_sa_pool, dev->shadow_sa_pool_pa);



	if (dev->shadow_sr_pool)

		dma_free_coherent(dev->core_dev->device,

			sizeof(struct sa_state_record) * PPC4XX_NUM_PD,
@@ -416,12 +418,12 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) 


static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev)

{

	if (dev->sdr != NULL)

	if (dev->sdr)

		dma_free_coherent(dev->core_dev->device,

				  sizeof(struct ce_sd) * PPC4XX_NUM_SD,

				  dev->sdr, dev->sdr_pa);



	if (dev->scatter_buffer_va != NULL)

	if (dev->scatter_buffer_va)

		dma_free_coherent(dev->core_dev->device,

				  dev->scatter_buffer_size * PPC4XX_NUM_SD,

				  dev->scatter_buffer_va,
@@ -1049,13 +1051,11 @@ int crypto4xx_register_alg(struct crypto4xx_device *sec_dev, 
			break;

		}



		if (rc) {

			list_del(&alg->entry);

		if (rc)

			kfree(alg);

		} else {

		else

			list_add_tail(&alg->entry, &sec_dev->alg_list);

	}

	}



	return 0;

}
@@ -1208,7 +1208,7 @@ static int __init crypto4xx_probe(struct platform_device *ofdev) 


	rc = crypto4xx_build_gdr(core_dev->dev);

	if (rc)

		goto err_build_gdr;

		goto err_build_pdr;



	rc = crypto4xx_build_sdr(core_dev->dev);

	if (rc)
@@ -1250,12 +1250,11 @@ err_iomap: 
err_request_irq:

	irq_dispose_mapping(core_dev->irq);

	tasklet_kill(&core_dev->tasklet);

	crypto4xx_destroy_sdr(core_dev->dev);

err_build_sdr:

	crypto4xx_destroy_sdr(core_dev->dev);

	crypto4xx_destroy_gdr(core_dev->dev);

err_build_gdr:

	crypto4xx_destroy_pdr(core_dev->dev);

err_build_pdr:

	crypto4xx_destroy_pdr(core_dev->dev);

	kfree(core_dev->dev);

err_alloc_dev:

	kfree(core_dev);

drivers/infiniband/Kconfig

+12 −0
Original line number Diff line number Diff line
@@ -33,6 +33,18 @@ config INFINIBAND_USER_ACCESS 
	  libibverbs, libibcm and a hardware driver library from

	  <http://www.openfabrics.org/git/>.



config INFINIBAND_USER_ACCESS_UCM

	bool "Userspace CM (UCM, DEPRECATED)"

	depends on BROKEN

	depends on INFINIBAND_USER_ACCESS

	help

	  The UCM module has known security flaws, which no one is

	  interested to fix. The user-space part of this code was

	  dropped from the upstream a long time ago.



	  This option is DEPRECATED and planned to be removed.





config INFINIBAND_USER_MEM

	bool

	depends on INFINIBAND_USER_ACCESS != n