Merge changes from sid up to 3.14.4-1

Except for:
- ABI reference
- ABI workarounds
- rt patch changes
- Backported patches not needed here

svn path=/dists/trunk/linux/; revision=21348
This commit is contained in:
Ben Hutchings 2014-05-14 13:35:05 +00:00
commit 18c24a0d32
18 changed files with 402 additions and 44 deletions

142
debian/changelog vendored
View File

@ -18,6 +18,148 @@ linux (3.15~rc5-1~exp1) UNRELEASED; urgency=medium
-- Ben Hutchings <ben@decadent.org.uk> Fri, 02 May 2014 01:54:56 +0100
linux (3.14.4-1) unstable; urgency=high
* New upstream stable update:
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.3
- ASoC: pcm: Drop incorrect double/extra frees
- [s390] KVM: Optimize ucontrol path (regression in 3.11)
- [s390] bitops,atomic: add missing memory barriers
- [s390] fix control register update (regression in 3.14)
- mei: me: do not load the driver if the FW doesn't support MEI interface
- staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private
data
- [x86] AVX-512: AVX-512 Feature Detection
- [x86] AVX-512: Enable AVX-512 States Context Switch
- [x86] ftrace: One more missing sync after fixup of function modification
failure
- [amd64] modify_ldt: Ban 16-bit segments on 64-bit kernels
- [armhf] PCI: imx6: Wait for retraining (regression in 3.14)
- [arm] PCI: mvebu: Fix potential issue in range parsing
(regression in 3.12)
- NFSv4: Fix a use-after-free problem in open()
- nfsd: revert v2 half of "nfsd: don't return high mode bits"
(regression in 3.14)
- nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
- nfsd4: fix test_stateid error reply encoding
- nfsd: notify_change needs elevated write count
- nfsd: check passed socket's net matches NFSd superblock's one
- nfsd4: fix memory leak in nfsd4_encode_fattr()
- nfsd4: fix setclientid encode size
- NFSD: Traverse unconfirmed client through hash-table
- IB/ipath: Fix potential buffer overrun in sending diag packet routine
- IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL
- IB/mthca: Return an error on ib_copy_to_udata() failure
- IB/ehca: Returns an error on ib_copy_to_udata() failure
- IB/core: Don't resolve passive side RoCE L2 address in CMA REQ handler
(regression in 3.14)
- ib_srpt: Use correct ib_sg_dma primitives
- SCSI: arcmsr: upper 32 of dma address lost
- iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
- target/iblock: Fix double bioset_integrity_free bug
- target/tcm_fc: Fix use-after-free of ft_tpg
- [x86] efi: Correct EFI boot stub use of code32_start
- efi: Pass correct file handle to efi_file_{read,close}
- reiserfs: fix race in readdir
- media: v4l2-dv-timings: add module name, description, license
- media: em28xx-audio: fix user counting in snd_em28xx_capture_open()
- [armhf] usb: musb: fix PHY power on/off (regression in 3.14)
- mtip32xx: Unmap the DMA segments before completing the IO request
- mtip32xx: mtip_async_complete() bug fixes
- iser-target: Match FRMR descriptors to available session tags
- iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err
- [sh] fix format string bug in stack tracer
- mm: page_alloc: spill to remote nodes before waking kswapd
(regression in 3.12/3.13)
- mm: try_to_unmap_cluster() should lock_page() before mlocking
(CVE-2014-3122) (Closes: #747326)
- xattr: guard against simultaneous glibc header inclusion
- ocfs2: do not put bh when buffer_uptodate failed
- ocfs2: fix panic on kfree(xattr->name)
- vfs: smarter propagate_mnt()
- block: Fix for_each_bvec()
- ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS
- ext4: note the error in ext4_end_bio()
- ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent()
- ext4: use i_size_read in ext4_unaligned_aio()
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.4
- tty: Fix lockless tty buffer race
- n_tty: Fix n_tty_write crash when echoing in raw mode (CVE-2014-0196)
(Closes: #747166)
- floppy: ignore kernel-only members in FDRAWCMD ioctl input (CVE-2014-1737)
- floppy: don't write kernel-only members to FDRAWCMD ioctl output
(CVE-2014-1738)
- KVM: async_pf: mm->mm_users can not pin apf->mm
- KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi
(CVE-2014-0155)
- [powerpc] KVM: Book3S HV: Fix KVM hang with CONFIG_KVM_XICS=n
(regression in 3.14)
- [mips] Hibernate: Flush TLB entries in swsusp_arch_resume()
- [powerpc] Fix Oops in rtas_stop_self() (regression in 3.14)
- [s390] bpf,jit: initialize A register if 1st insn is BPF_S_LDX_B_MSH
- SUNRPC: Ensure that call_connect times out correctly (regression in 3.13)
- SUNRPC: Ensure call_connect_status() deals correctly with SOFTCONN tasks
(regression in 3.13)
- Revert "net: mvneta: fix usage as a module on RGMII configurations"
(regression in 3.14)
- iwlwifi: dvm: take mutex when sending SYNC BT config command
- mac80211: fix potential use-after-free
- mac80211: fix WPA with VLAN on AP side with ps-sta again
- locks: allow __break_lease to sleep even when break_time is 0
- rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb
(regression in 3.13)
- dm cache: prevent corruption caused by discard_block_size >
cache_block_size
- dm transaction manager: fix corruption due to non-atomic transaction
commit
- dm: take care to copy the space map roots before locking the superblock
- dm thin: fix dangling bio in process_deferred_bios error path
- aio: v4 ensure access to ctx->ring_pages is correctly serialised for
migration
- cpufreq: loongson2_cpufreq: don't declare local variable as static
(regression in 3.14)
[ Ben Hutchings ]
* [or1k] Build a linux-libc-dev package (Closes: #746309)
* net: Start with correct mac_len in skb_network_protocol (Closes: #746453)
* [x86] ACPI/Processor: Fix failure of loading acpi-cpufreq driver
(Closes: #746448)
* [armhf] ARM: sun4i: dt: Add bindings for USB clocks (fixes FTBFS,
Closes: #746420)
* [x86] udeb: Add hyperv-keyboard to hyperv-modules
* drm: Enable auto-loading of ast, udl
* [ppc64el] Build a linux-libc-dev package (Closes: #747367)
* net: ipv4: current group_info should be put after using. (CVE-2014-2851)
* filter: prevent nla extensions to peek beyond the end of the message
(CVE-2014-3144, CVE-2014-3145)
* [powerpc,ppc64] Add versioned build-dependency on gcc-4.8, as compiler
changes have resulted in a different kernel module ABI
- [powerpc] Bump ABI to 1a as 3.14.2-1 was built with an older compiler
* [armhf] Enable IR_GPIO_CIR as module (Closes: #747762)
* [hppa/parisc64-smp] ipmi: Enable IPMI_HANDLER, IPMI_DEVICE_INTERFACE,
IPMI_SI, IPMI_WATCHDOG, IPMI_POWEROFF as modules (Closes: #747482)
* [armhf] Enable various drivers to support BeagleBone Black
(Closes: #747364)
* [hppa] udeb: Add xfs-modules (Closes: #746506)
* udeb: Add mtip32xx, nvme to sata-modules
* [rt] Update to 3.14.3-rt5:
- tracing: use migrate_disable() to prevent beeing pushed off the cpu
- rwsem-rt: Do not allow readers to nest
- Revert "migrate_disable pushd down in atomic_dec_and_spin_lock"
- rwlock: disable migration before taking a lock
- timer: do not spin_trylock() on UP
- stomp-machine: Fix wait for completion
- stomp-machine: create lg_global_trylock_relax() primitive
- stomp-machine: use lg_global_trylock_relax() to dead with
stop_cpus_lock lglock
- blk-mq: revert raw locks, post pone notifier to POST_DEAD
- use EXPORT_SYMBOL() on __rt_mutex_init() and rt_down_write_nested_lock()
- netconsole: Allow use with PREEMPT_RT_FULL
* aufs: Update to aufs3.14-20140512:
- bugfix, stop calling security_mmap_file() again
-- Ben Hutchings <ben@decadent.org.uk> Wed, 14 May 2014 00:46:05 +0100
linux (3.14.2-1) unstable; urgency=medium
* New upstream stable update:

View File

@ -135,6 +135,12 @@ CONFIG_BT_WILINK=m
CONFIG_OMAP_OCP2SCP=m
CONFIG_OMAP_INTERCONNECT=m
##
## file: drivers/char/hw_random/Kconfig
##
CONFIG_HW_RANDOM=m
CONFIG_HW_RANDOM_OMAP=m
##
## file: drivers/clk/Kconfig
##
@ -170,6 +176,8 @@ CONFIG_IMX_SDMA=y
CONFIG_IMX_DMA=y
CONFIG_MXS_DMA=y
CONFIG_DMA_OMAP=y
CONFIG_TI_CPPI41=m
CONFIG_TI_EDMA=y
##
## file: drivers/gpio/Kconfig
@ -178,12 +186,33 @@ CONFIG_GPIO_SYSFS=y
CONFIG_GPIO_DA9052=m
CONFIG_GPIO_TWL4030=y
CONFIG_GPIO_TWL6040=y
CONFIG_GPIO_GENERIC_PLATFORM=m
##
## file: drivers/gpu/drm/Kconfig
##
CONFIG_DRM=m
##
## file: drivers/gpu/drm/i2c/Kconfig
##
CONFIG_DRM_I2C_NXP_TDA998X=m
##
## file: drivers/gpu/drm/tilcdc/Kconfig
##
CONFIG_DRM_TILCDC=m
##
## file: drivers/hwspinlock/Kconfig
##
CONFIG_HWSPINLOCK_OMAP=m
##
## file: drivers/i2c/Kconfig
##
CONFIG_I2C_CHARDEV=m
##
## file: drivers/i2c/busses/Kconfig
##
@ -198,6 +227,11 @@ CONFIG_I2C_VERSATILE=m
##
CONFIG_IIO=m
##
## file: drivers/iio/adc/Kconfig
##
CONFIG_TI_AM335X_ADC=m
##
## file: drivers/iio/light/Kconfig
##
@ -229,6 +263,7 @@ CONFIG_SERIO_AMBAKMI=m
##
CONFIG_INPUT_TOUCHSCREEN=y
CONFIG_TOUCHSCREEN_TSC2005=m
CONFIG_TOUCHSCREEN_TI_AM335X_TSC=m
##
## file: drivers/iommu/Kconfig
@ -280,6 +315,11 @@ CONFIG_RADIO_SI4713=m
##
CONFIG_RADIO_WL128X=m
##
## file: drivers/media/rc/Kconfig
##
CONFIG_IR_GPIO_CIR=m
##
## file: drivers/mfd/Kconfig
##
@ -490,6 +530,11 @@ CONFIG_WLCORE_SDIO=m
##
CONFIG_PHY_SUN4I_USB=m
##
## file: drivers/pinctrl/Kconfig
##
CONFIG_PINCTRL_SINGLE=y
##
## file: drivers/pinctrl/vt8500/Kconfig
##
@ -592,6 +637,8 @@ CONFIG_SERIAL_VT8500_CONSOLE=y
CONFIG_SERIAL_ARC=y
CONFIG_SERIAL_ARC_CONSOLE=y
CONFIG_SERIAL_ARC_NR_PORTS=1
CONFIG_SERIAL_OMAP=y
CONFIG_SERIAL_OMAP_CONSOLE=y
##
## file: drivers/tty/serial/8250/Kconfig
@ -663,6 +710,8 @@ CONFIG_OMAP_USB3=m
CONFIG_TWL4030_USB=m
CONFIG_TWL6030_USB=m
CONFIG_USB_MXS_PHY=m
CONFIG_AM335X_CONTROL_USB=m
CONFIG_AM335X_PHY_USB=m
##
## file: drivers/video/Kconfig

View File

@ -14,9 +14,11 @@ arches:
m68k
mips
mipsel
or1k
powerpc
powerpcspe
ppc64
ppc64el
s390
s390x
sh4

View File

@ -30,6 +30,15 @@ CONFIG_DRM_KMS_HELPER=y
CONFIG_DRM_TTM=m
CONFIG_DRM_RADEON=m
##
## file: drivers/char/ipmi/Kconfig
##
CONFIG_IPMI_HANDLER=m
CONFIG_IPMI_DEVICE_INTERFACE=m
CONFIG_IPMI_SI=m
CONFIG_IPMI_WATCHDOG=m
CONFIG_IPMI_POWEROFF=m
##
## file: mm/Kconfig
##

4
debian/config/or1k/defines vendored Normal file
View File

@ -0,0 +1,4 @@
[base]
kernel-arch: openrisc
featuresets:
# empty; we don't have initramfs working yet

View File

@ -0,0 +1,3 @@
#. Temporary hack to maintain ABI as 3.14.2-1 was built with a compiler
#. version that had broken asm goto... though only with -m64!
# CONFIG_JUMP_LABEL is not set

View File

@ -11,6 +11,10 @@ configs:
suggests: mkvmlinuz
install-stem: vmlinux
[relations]
# This ensures we get asm goto support and avoid an ABI change
gcc-4.8: gcc-4.8 (>= 4.8.2-21)
[powerpc64_description]
hardware: 64-bit PowerPC

4
debian/config/ppc64el/defines vendored Normal file
View File

@ -0,0 +1,4 @@
[base]
kernel-arch: powerpc
featuresets:
# empty

View File

@ -0,0 +1 @@
#include "../hppa/xfs-modules"

View File

@ -0,0 +1 @@
#include <xfs-modules>

View File

@ -4,3 +4,4 @@ hv_netvsc
hv_storvsc
hv_utils
hv_vmbus
hyperv-keyboard

View File

@ -17,3 +17,6 @@ sx8 ?
sata_sx4 ?
sata_mv ?
pdc_adma ?
mtip32xx ?
# XXX not actually SATA
nvme ?

View File

@ -0,0 +1,78 @@
From: Mathias Krause <minipli@googlemail.com>
Date: Sun, 13 Apr 2014 18:23:33 +0200
Subject: filter: prevent nla extensions to peek beyond the end of the message
Origin: https://git.kernel.org/linus/05ab8f2647e4221cbdb3856dd7d32bd5407316b3
The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
for a minimal message length before testing the supplied offset to be
within the bounds of the message. This allows the subtraction of the nla
header to underflow and therefore -- as the data type is unsigned --
allowing far to big offset and length values for the search of the
netlink attribute.
The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
also wrong. It has the minuend and subtrahend mixed up, therefore
calculates a huge length value, allowing to overrun the end of the
message while looking for the netlink attribute.
The following three BPF snippets will trigger the bugs when attached to
a UNIX datagram socket and parsing a message with length 1, 2 or 3.
,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
| ld #0x87654321
| ldx #42
| ld #nla
| ret a
`---
,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
| ld #0x87654321
| ldx #42
| ld #nlan
| ret a
`---
,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
| ; (needs a fake netlink header at offset 0)
| ld #0
| ldx #42
| ld #nlan
| ret a
`---
Fix the first issue by ensuring the message length fulfills the minimal
size constrains of a nla header. Fix the second bug by getting the math
for the remainder calculation right.
Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
Cc: Patrick McHardy <kaber@trash.net>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.14: This code is all in sk_run_filter(), not
separate functions]
---
net/core/filter.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -371,11 +371,15 @@ load_b:
if (skb_is_nonlinear(skb))
return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
if (A > skb->len - sizeof(struct nlattr))
return 0;
nla = (struct nlattr *)&skb->data[A];
- if (nla->nla_len > A - skb->len)
+ if (nla->nla_len > skb->len - A)
return 0;
nla = nla_find_nested(nla, X);

View File

@ -0,0 +1,40 @@
From: Vlad Yasevich <vyasevic@redhat.com>
Date: Mon, 14 Apr 2014 17:37:26 -0400
Subject: net: Start with correct mac_len in skb_network_protocol
Origin: https://git.kernel.org/linus/1e785f48d29a09b6cf96db7b49b6320dada332e1
Sometimes, when the packet arrives at skb_mac_gso_segment()
its skb->mac_len already accounts for some of the mac lenght
headers in the packet. This seems to happen when forwarding
through and OpenSSL tunnel.
When we start looking for any vlan headers in skb_network_protocol()
we seem to ignore any of the already known mac headers and start
with an ETH_HLEN. This results in an incorrect offset, dropped
TSO frames and general slowness of the connection.
We can start counting from the known skb->mac_len
and return at least that much if all mac level headers
are known and accounted for.
Fixes: 53d6471cef17262d3ad1c7ce8982a234244f68ec (net: Account for all vlan headers in skb_mac_gso_segment)
CC: Eric Dumazet <eric.dumazet@gmail.com>
CC: Daniel Borkman <dborkman@redhat.com>
Tested-by: Martin Filip <nexus+kernel@smoula.net>
Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/core/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2289,7 +2289,7 @@ EXPORT_SYMBOL(skb_checksum_help);
__be16 skb_network_protocol(struct sk_buff *skb, int *depth)
{
__be16 type = skb->protocol;
- int vlan_depth = ETH_HLEN;
+ int vlan_depth = skb->mac_len;
/* Tunnel gso handlers can set protocol to ethernet. */
if (type == htons(ETH_P_TEB)) {

View File

@ -0,0 +1,61 @@
From: "Wang, Xiaoming" <xiaoming.wang@intel.com>
Date: Mon, 14 Apr 2014 12:30:45 -0400
Subject: net: ipv4: current group_info should be put after using.
Origin: https://git.kernel.org/linus/b04c46190219a4f845e46a459e3102137b7f6cac
Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv4/ping.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index f4b19e5..8210964 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -252,26 +252,33 @@ int ping_init_sock(struct sock *sk)
{
struct net *net = sock_net(sk);
kgid_t group = current_egid();
- struct group_info *group_info = get_current_groups();
- int i, j, count = group_info->ngroups;
+ struct group_info *group_info;
+ int i, j, count;
kgid_t low, high;
+ int ret = 0;
inet_get_ping_group_range_net(net, &low, &high);
if (gid_lte(low, group) && gid_lte(group, high))
return 0;
+ group_info = get_current_groups();
+ count = group_info->ngroups;
for (i = 0; i < group_info->nblocks; i++) {
int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
for (j = 0; j < cp_count; j++) {
kgid_t gid = group_info->blocks[i][j];
if (gid_lte(low, gid) && gid_lte(gid, high))
- return 0;
+ goto out_release_group;
}
count -= cp_count;
}
- return -EACCES;
+ ret = -EACCES;
+
+out_release_group:
+ put_group_info(group_info);
+ return ret;
}
EXPORT_SYMBOL_GPL(ping_init_sock);

View File

@ -1,21 +0,0 @@
From: Ben Hutchings <ben@decadent.org.uk>
Subject: ast: Disable autoload
Date: Mon, 24 Dec 2012 00:05:07 +0000
Forwarded: not-needed
This kernel driver is incompatible with older versions of
xserver-xorg-video-ast, so do not autoload it yet. It will
have to be loaded either by local configuration or as part of a
package of a compatible X driver.
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -58,7 +58,7 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist
{0, 0, 0},
};
-MODULE_DEVICE_TABLE(pci, pciidlist);
+/*MODULE_DEVICE_TABLE(pci, pciidlist);*/
static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{

View File

@ -1,21 +0,0 @@
From: Ben Hutchings <ben@decadent.org.uk>
Subject: udl: Disable autoload
Date: Sun, 23 Dec 2012 23:58:16 +0000
Forwarded: not-needed
This kernel driver is incompatible with older versions of
xserver-xorg-video-displaylink, so do not autoload it yet. It will
have to be loaded either by local configuration or as part of a
package of a compatible X driver.
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -30,7 +30,7 @@ static struct usb_device_id id_table[] =
USB_DEVICE_ID_MATCH_INT_PROTOCOL,},
{},
};
-MODULE_DEVICE_TABLE(usb, id_table);
+/*MODULE_DEVICE_TABLE(usb, id_table);*/
MODULE_LICENSE("GPL");

View File

@ -41,8 +41,6 @@ debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
# Disable autoloading/probing of various drivers by default
debian/cirrus-disable-modeset-by-default.patch
debian/udl-disable-autoload.patch
debian/ast-disable-autoload.patch
debian/mgag200-disable-autoload.patch
debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch
debian/snd-pcsp-disable-autoload.patch