Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[PATCH 4.1 16/86] [media] si2168: Bounds check firmware

53 views
Skip to first unread message

Greg Kroah-Hartman

unread,
Nov 6, 2015, 3:30:08 PM11/6/15
to
4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laura Abbott <lab...@fedoraproject.org>

commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream.

When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:

si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f

Add the proper check.

Reported-by: Stuart Auchterlonie <sauc...@redhat.com>
Reviewed-by: Antti Palosaari <cr...@iki.fi>
Signed-off-by: Laura Abbott <lab...@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mch...@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
drivers/media/dvb-frontends/si2168.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -457,6 +457,10 @@ static int si2168_init(struct dvb_fronte
/* firmware is in the new format */
for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining];
+ if (len > SI2168_ARGLEN) {
+ ret = -EINVAL;
+ break;
+ }
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len;
cmd.rlen = 1;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Greg Kroah-Hartman

unread,
Nov 6, 2015, 3:30:09 PM11/6/15
to
4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Charles Keepax <cke...@opensource.wolfsonmicro.com>

commit 34198710f55b5f359f43e67d9a08fe5aadfbca1b upstream.

SX_TLV controls are intended for situations where the register behind
the control has some non-zero value indicating the minimum gain
and then gains increasing from there and eventually overflowing through
zero.

Currently every CODEC implementing these controls specifies the minimum
as the non-zero value for the minimum and the maximum as the number of
gain settings available.

This means when the info callback subtracts the minimum value from the
maximum value to calculate the number of gain levels available it is
actually under reporting the available levels. This patch fixes this
issue by adding a new snd_soc_info_volsw_sx callback that does not
subtract the minimum value.

Fixes: 1d99f2436d0d ("ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV")
Signed-off-by: Charles Keepax <cke...@opensource.wolfsonmicro.com>
Acked-by: Brian Austin <brian....@cirrus.com>
Tested-by: Brian Austin <brian....@cirrus.com>
Signed-off-by: Mark Brown <bro...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
include/sound/soc.h | 6 ++++--
sound/soc/soc-ops.c | 28 ++++++++++++++++++++++++++++
2 files changed, 32 insertions(+), 2 deletions(-)

--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -85,7 +85,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array),\
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx,\
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -155,7 +155,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array), \
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx, \
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -563,6 +563,8 @@ int snd_soc_put_enum_double(struct snd_k
struct snd_ctl_elem_value *ucontrol);
int snd_soc_info_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo);
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo);
#define snd_soc_info_bool_ext snd_ctl_boolean_mono_info
int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol);
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -207,6 +207,34 @@ int snd_soc_info_volsw(struct snd_kcontr
EXPORT_SYMBOL_GPL(snd_soc_info_volsw);

/**
+ * snd_soc_info_volsw_sx - Mixer info callback for SX TLV controls
+ * @kcontrol: mixer control
+ * @uinfo: control element information
+ *
+ * Callback to provide information about a single mixer control, or a double
+ * mixer control that spans 2 registers of the SX TLV type. SX TLV controls
+ * have a range that represents both positive and negative values either side
+ * of zero but without a sign bit.
+ *
+ * Returns 0 for success.
+ */
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo)
+{
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+
+ snd_soc_info_volsw(kcontrol, uinfo);
+ /* Max represents the number of levels in an SX control not the
+ * maximum value, so add the minimum value back on
+ */
+ uinfo->value.integer.max += mc->min;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(snd_soc_info_volsw_sx);
+
+/**
* snd_soc_get_volsw - single mixer get callback
* @kcontrol: mixer control
* @ucontrol: control element information

Greg Kroah-Hartman

unread,
Nov 6, 2015, 3:30:10 PM11/6/15
to
This is the start of the stable review cycle for the 4.1.13 release.
There are 86 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun Nov 8 19:21:32 UTC 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.13-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gre...@linuxfoundation.org>
Linux 4.1.13-rc1

Dong Aisheng <aishen...@freescale.com>
dts: imx6: fix sd card gpio polarity specified in device tree

Greg Kroah-Hartman <gre...@linuxfoundation.org>
xen: fix backport of previous kexec patch

Soeren Grunewald <soeren.g...@desy.de>
serial: 8250_pci: Add support for 12 port Exar boards

Mika Westerberg <mika.we...@linux.intel.com>
pinctrl: baytrail: Use raw_spinlock for locking

Mika Westerberg <mika.we...@linux.intel.com>
pinctrl: baytrail: Serialize all register access

Minchan Kim <min...@kernel.org>
thp: use is_zero_pfn() only after pte_present() check

Thomas Hellstrom <thell...@vmware.com>
drm/vmwgfx: Fix up user_dmabuf refcounting

Keith Busch <keith...@intel.com>
NVMe: Fix memory leak on retried commands

Will Deacon <will....@arm.com>
arm64: compat: fix stxr failure case in SWP emulation

Lorenzo Pieralisi <lorenzo....@arm.com>
arm64: kernel: fix tcr_el1.t0sz restore on systems with extended idmap

Sudeep Holla <sudeep...@arm.com>
arm64: kernel: rename __cpu_suspend to keep it aligned with arm

Srinivas Pandruvada <srinivas....@linux.intel.com>
cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL)

Doron Tsur <dor...@mellanox.com>
IB/cm: Fix rb-tree duplicate free and use-after-free

Christian Engelmayer <ceng...@gmx.at>
btrfs: fix possible leak in btrfs_ioctl_balance()

Linus Walleij <linus....@linaro.org>
MFD/OF: document MFD devices and handle simple-mfd

Dāvis Mosāns <davi...@gmail.com>
mvsas: Fix NULL pointer dereference in mvs_slot_task_free

Lucas Stach <d...@lynxeye.de>
irqchip/tegra: Propagate IRQ type setting to parent

Seth Jennings <sjen...@redhat.com>
EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs()

NeilBrown <ne...@suse.com>
Revert "md: allow a partially recovered device to be hot-added to an array."

Roman Gushchin <kl...@yandex-team.ru>
md/raid5: fix locking in handle_stripe_clean_event()

Jes Sorensen <Jes.So...@redhat.com>
md/raid10: submit_bio_wait() returns 0 on success

Jes Sorensen <Jes.So...@redhat.com>
md/raid1: submit_bio_wait() returns 0 on success

Herbert Xu <her...@gondor.apana.org.au>
crypto: api - Only abort operations on fatal signal

Hans de Goede <hdeg...@redhat.com>
Input: alps - only the Dell Latitude D420/430/620/630 have separate stick button bits

David Howells <dhow...@redhat.com>
ovl: fix dentry reference leak

David Howells <dhow...@redhat.com>
ovl: use O_LARGEFILE in ovl_copy_up()

Konstantin Khlebnikov <khleb...@yandex-team.ru>
ovl: free lower_mnt array in ovl_put_super

Konstantin Khlebnikov <khleb...@yandex-team.ru>
ovl: free stack of paths in ovl_fill_super

Sasha Levin <sasha...@oracle.com>
PCI: Prevent out of bounds access in numa_node override

Peter Zijlstra <pet...@infradead.org>
module: Fix locking in symbol_put_addr()

Cathy Avery <cathy...@oracle.com>
xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)

Laura Abbott <lab...@fedoraproject.org>
xhci: Add spurious wakeup quirk for LynxPoint-LP controllers

Mathias Nyman <mathia...@linux.intel.com>
xhci: handle no ping response error properly

Hezi Shahmoon <he...@marvell.com>
i2c: mv64xxx: really allow I2C offloading

Bjørn Mork <bj...@mork.no>
USB: qcserial: add Sierra Wireless MC74xx/EM74xx

Frederic Danis <frederi...@linux.intel.com>
Revert "serial: 8250_dma: don't bother DMA with small transfers"

Mike Snitzer <sni...@redhat.com>
dm btree: fix leak of bufio-backed block in btree_split_beneath error path

Joe Thornber <e...@redhat.com>
dm btree remove: fix a bug when rebalancing nodes after removal

Will Deacon <will....@arm.com>
Revert "ARM64: unwind: Fix PC calculation"

H. Nikolaus Schaller <h...@goldelico.com>
ARM: 8449/1: fix bug in vdsomunge swab32 macro

H. Nikolaus Schaller <h...@goldelico.com>
ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h

Timo Sigurdsson <public...@silentcreek.de>
ARM: dts: sunxi: Raise minimum CPU voltage for sun7i-a20 to meet SoC specifications

Tomi Valkeinen <tomi.va...@ti.com>
ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on

Alim Akhtar <alim....@samsung.com>
ARM: dts: Fix audio card detection on Peach boards

Marcin Wojtas <m...@semihalf.com>
ARM: mvebu: correct a385-db-ap compatible string

Florian Fainelli <f.fai...@gmail.com>
ARM: orion: Fix DSA platform device after mvmdio conversion

Ilya Dryomov <idry...@gmail.com>
rbd: prevent kernel stack blow up on rbd map

Ilya Dryomov <idry...@gmail.com>
rbd: don't leak parent_spec in rbd_dev_probe_parent()

Ronny Hegewald <ronny.h...@online.de>
rbd: require stable pages if message data CRCs are enabled

Dan Carpenter <dan.ca...@oracle.com>
iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()

Linus Walleij <linus....@linaro.org>
iio: st_accel: fix interrupt handling on LIS3LV02

Alexandre Belloni <alexandr...@free-electrons.com>
iio: mxs-lradc: Fix temperature offset

Alex Deucher <alexande...@amd.com>
drm/radeon: move bl encoder assignment into bl init

Alex Deucher <alexande...@amd.com>
drm/radeon: fix dpms when driver backlight control is disabled

Alex Deucher <alexande...@amd.com>
drm/radeon: don't try to recreate sysfs entries on resume

Chris Wilson <ch...@chris-wilson.co.uk>
drm/i915: Deny wrapping an userptr into a framebuffer

Ville Syrjälä <ville....@linux.intel.com>
drm/i915: Restore lost DPLL register write on gen2-4

Chris Wilson <ch...@chris-wilson.co.uk>
drm/i915: Flush pipecontrol post-sync writes

Alex Deucher <alexande...@amd.com>
drm/radeon/dpm: don't add pwm attributes if DPM is disabled

Ilia Mirkin <imi...@alum.mit.edu>
drm/nouveau/gem: return only valid domain when there's only one

Florian Westphal <f...@strlen.de>
fault-inject: fix inverted interval/probability values in printk

Jan Kara <ja...@suse.com>
mm: make sendfile(2) killable

Paolo Bonzini <pbon...@redhat.com>
x86/setup: Extend low identity map to cover whole kernel range

Kővágó, Zoltán <DirtY....@gmail.com>
x86/efi: Fix multiple GOP device support

Charles Keepax <cke...@opensource.wolfsonmicro.com>
ASoC: wm8904: Correct number of EQ registers

Charles Keepax <cke...@opensource.wolfsonmicro.com>
ASoC: Add info callback for SX_TLV controls

Takashi Iwai <ti...@suse.de>
ALSA: hda - Fix deadlock at error in building PCM

David Henningsson <david.he...@canonical.com>
ALSA: hda - Fix inverted internal mic on Lenovo G50-80

Arnd Bergmann <ar...@arndb.de>
KVM: arm: use GIC support unconditionally

Antti Palosaari <cr...@iki.fi>
rtl28xxu: fix control message flaws

Laura Abbott <lab...@fedoraproject.org>
si2168: Bounds check firmware

Laura Abbott <lab...@fedoraproject.org>
si2157: Bounds check firmware

Adam Richter <adamri...@gmail.com>
drm: fix mutex leak in drm_dp_get_mst_branch_device

Vasant Hegde <hegde...@linux.vnet.ibm.com>
powerpc/rtas: Validate rtas.entry before calling enter_rtas()

Joerg Roedel <jro...@suse.de>
iommu/amd: Don't clear DTE flags when modifying it

Jay Cornwall <j...@jcornwall.me>
iommu/amd: Fix BUG when faulting a PROT_NONE VMA

Christian Zander <chri...@nervanasys.com>
iommu/vt-d: fix range computation when making room for large pages

Luca Coelho <luciano...@intel.com>
iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series

Andrei Otcheretianski <andrei.otc...@intel.com>
iwlwifi: mvm: flush fw_dump_wk when mvm fails to start

Arik Nemtsov <ar...@wizery.com>
iwlwifi: mvm: init card correctly on ctkill exit check

Johannes Berg <johann...@intel.com>
iwlwifi: mvm: fix D3 firmware PN programming

Avraham Stern <avraha...@intel.com>
iwlwifi: mvm: clear csa countdown when AP is stopped

Larry Finger <Larry....@lwfinger.net>
rtlwifi: rtl8821ae: Fix system lockups on boot

Johannes Berg <johann...@intel.com>
iwlwifi: fix firmware filename for 3160

Johannes Berg <johann...@intel.com>
iwlwifi: dvm: fix D3 firmware PN programming

Felix Fietkau <n...@openwrt.org>
ath9k: declare required extra tx headroom


-------------

Diffstat:

Documentation/devicetree/bindings/mfd/mfd.txt | 41 ++++++++++++++
Makefile | 4 +-
arch/arm/boot/dts/am57xx-beagle-x15.dts | 3 +-
arch/arm/boot/dts/armada-385-db-ap.dts | 2 +-
arch/arm/boot/dts/exynos5420-peach-pit.dts | 5 ++
arch/arm/boot/dts/exynos5800-peach-pi.dts | 5 ++
arch/arm/boot/dts/imx6dl-riotboard.dts | 8 +--
arch/arm/boot/dts/imx6q-arm2.dts | 5 +-
arch/arm/boot/dts/imx6q-gk802.dts | 3 +-
arch/arm/boot/dts/imx6q-tbs2910.dts | 4 +-
arch/arm/boot/dts/imx6qdl-aristainetos.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-cubox-i.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-hummingboard.dtsi | 3 +-
arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 8 +--
arch/arm/boot/dts/imx6qdl-rex.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-sabrelite.dtsi | 6 +--
arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 8 +--
arch/arm/boot/dts/imx6qdl-tx6.dtsi | 4 +-
arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 6 ++-
arch/arm/boot/dts/imx6sl-evk.dts | 10 ++--
arch/arm/boot/dts/imx6sx-sabreauto.dts | 4 +-
arch/arm/boot/dts/imx6sx-sdb.dtsi | 4 +-
arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
arch/arm/kvm/Kconfig | 1 +
arch/arm/plat-orion/common.c | 2 +-
arch/arm/vdso/vdsomunge.c | 17 ++++--
arch/arm64/include/asm/cpuidle.h | 8 +--
arch/arm64/include/asm/suspend.h | 2 +-
arch/arm64/kernel/armv8_deprecated.c | 18 ++++---
arch/arm64/kernel/cpuidle.c | 4 +-
arch/arm64/kernel/psci.c | 2 +-
arch/arm64/kernel/stacktrace.c | 6 +--
arch/arm64/kernel/suspend.c | 26 +++++----
arch/powerpc/kernel/rtas.c | 3 ++
arch/x86/boot/compressed/eboot.c | 8 ++-
arch/x86/kernel/setup.c | 8 +++
arch/x86/xen/enlighten.c | 6 +--
crypto/ablkcipher.c | 2 +-
crypto/algapi.c | 2 +-
crypto/api.c | 6 +--
crypto/crypto_user.c | 2 +-
drivers/block/nvme-core.c | 9 ++--
drivers/block/rbd.c | 71 ++++++++++++++-----------
drivers/block/xen-blkfront.c | 3 +-
drivers/cpufreq/intel_pstate.c | 5 ++
drivers/edac/sb_edac.c | 8 +--
drivers/gpu/drm/drm_dp_mst_topology.c | 7 +--
drivers/gpu/drm/i915/i915_gem_userptr.c | 5 +-
drivers/gpu/drm/i915/intel_display.c | 7 +++
drivers/gpu/drm/i915/intel_lrc.c | 1 +
drivers/gpu/drm/i915/intel_ringbuffer.c | 2 +
drivers/gpu/drm/nouveau/nouveau_gem.c | 5 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 19 +++++--
drivers/gpu/drm/radeon/radeon.h | 1 +
drivers/gpu/drm/radeon/radeon_encoders.c | 1 -
drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 +
drivers/gpu/drm/radeon/radeon_pm.c | 43 +++++++++------
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 3 ++
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++-
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 29 +++++++---
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 12 +++--
drivers/i2c/busses/i2c-mv64xxx.c | 2 -
drivers/iio/accel/st_accel_core.c | 6 ---
drivers/infiniband/core/cm.c | 10 +++-
drivers/input/mouse/alps.c | 48 ++++++++++++++---
drivers/iommu/amd_iommu.c | 4 +-
drivers/iommu/amd_iommu_types.h | 1 +
drivers/iommu/amd_iommu_v2.c | 7 +++
drivers/iommu/intel-iommu.c | 12 +++--
drivers/irqchip/irq-tegra.c | 1 +
drivers/md/md.c | 3 +-
drivers/md/persistent-data/dm-btree-remove.c | 17 +++---
drivers/md/persistent-data/dm-btree.c | 2 +-
drivers/md/raid1.c | 2 +-
drivers/md/raid10.c | 2 +-
drivers/md/raid5.c | 6 ++-
drivers/media/dvb-frontends/si2168.c | 4 ++
drivers/media/tuners/si2157.c | 4 ++
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++-
drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
drivers/net/wireless/ath/ath9k/init.c | 1 +
drivers/net/wireless/iwlwifi/dvm/lib.c | 2 +-
drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +-
drivers/net/wireless/iwlwifi/mvm/d3.c | 12 ++---
drivers/net/wireless/iwlwifi/mvm/fw.c | 4 +-
drivers/net/wireless/iwlwifi/mvm/mac80211.c | 1 +
drivers/net/wireless/iwlwifi/mvm/mvm.h | 5 ++
drivers/net/wireless/iwlwifi/mvm/ops.c | 1 +
drivers/net/wireless/iwlwifi/pcie/drv.c | 5 ++
drivers/net/wireless/rtlwifi/pci.h | 2 +
drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 ++++++
drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 ++
drivers/net/wireless/rtlwifi/wifi.h | 3 ++
drivers/of/platform.c | 1 +
drivers/pci/pci-sysfs.c | 2 +-
drivers/pinctrl/intel/pinctrl-baytrail.c | 59 +++++++++++---------
drivers/scsi/mvsas/mv_sas.c | 2 +
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
drivers/staging/iio/adc/mxs-lradc.c | 9 ++--
drivers/tty/serial/8250/8250_dma.c | 4 --
drivers/tty/serial/8250/8250_pci.c | 21 ++++++++
drivers/usb/host/xhci-pci.c | 1 +
drivers/usb/host/xhci-ring.c | 20 +++++--
drivers/usb/serial/qcserial.c | 2 +
fs/btrfs/ioctl.c | 5 +-
fs/overlayfs/copy_up.c | 6 +--
fs/overlayfs/super.c | 2 +
include/sound/soc.h | 6 ++-
include/sound/wm8904.h | 2 +-
kernel/module.c | 8 ++-
lib/fault-inject.c | 2 +-
mm/filemap.c | 9 ++--
mm/huge_memory.c | 3 +-
sound/pci/hda/hda_codec.c | 4 +-
sound/pci/hda/patch_conexant.c | 1 +
sound/soc/soc-ops.c | 28 ++++++++++
125 files changed, 653 insertions(+), 288 deletions(-)

Greg Kroah-Hartman

unread,
Nov 6, 2015, 3:30:10 PM11/6/15
to
4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Antti Palosaari <cr...@iki.fi>

commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.

Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")

Signed-off-by: Antti Palosaari <cr...@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++++++++++--
drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
2 files changed, 14 insertions(+), 3 deletions(-)

--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_
unsigned int pipe;
u8 requesttype;

+ mutex_lock(&d->usb_mutex);
+
+ if (req->size > sizeof(dev->buf)) {
+ dev_err(&d->intf->dev, "too large message %u\n", req->size);
+ ret = -EINVAL;
+ goto err_mutex_unlock;
+ }
+
if (req->index & CMD_WR_FLAG) {
/* write */
memcpy(dev->buf, req->data, req->size);
@@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
req->index, dev->buf, req->size);
if (ret < 0)
- goto err;
+ goto err_mutex_unlock;

/* read request, copy returned data to return buf */
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
memcpy(req->data, dev->buf, req->size);

+ mutex_unlock(&d->usb_mutex);
+
return 0;
-err:
+err_mutex_unlock:
+ mutex_unlock(&d->usb_mutex);
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
return ret;
}
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
@@ -69,7 +69,7 @@


struct rtl28xxu_dev {
- u8 buf[28];
+ u8 buf[128];
u8 chip_id;
u8 tuner;
char *tuner_name;

Greg Kroah-Hartman

unread,
Nov 6, 2015, 3:30:11 PM11/6/15
to
4.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Westphal <f...@strlen.de>

commit bb387002693ed28b2bb0408c5dec65521b71e5f1 upstream.

interval displays the probability and vice versa.

Fixes: 6adc4a22f20bb ("fault-inject: add ratelimit option")
Acked-by: Akinobu Mita <akinob...@gmail.com>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
lib/fault-inject.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -44,7 +44,7 @@ static void fail_dump(struct fault_attr
printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
"name %pd, interval %lu, probability %lu, "
"space %d, times %d\n", attr->dname,
- attr->probability, attr->interval,
+ attr->interval, attr->probability,
atomic_read(&attr->space),
atomic_read(&attr->times));
if (attr->verbose > 1)

Guenter Roeck

unread,
Nov 6, 2015, 8:50:07 PM11/6/15
to
On 11/06/2015 11:21 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.1.13 release.
> There are 86 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Nov 8 19:21:32 UTC 2015.
> Anything received after that time might be too late.
>

Build results:
total: 137 pass: 137 fail: 0
Qemu test results:
total: 94 pass: 94 fail: 0

Details are available at http://server.roeck-us.net:8010/builders.

Guenter

Shuah Khan

unread,
Nov 6, 2015, 10:00:07 PM11/6/15
to
On 11/06/2015 12:21 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.1.13 release.
> There are 86 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Nov 8 19:21:32 UTC 2015.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.13-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah


--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shu...@osg.samsung.com | (970) 217-8978
0 new messages