26 Jan, 2015

8 commits

  • Linus Torvalds
     
  • Pull x86 fixes from Thomas Gleixner:
    "Hopefully the last round of fixes for 3.19

    - regression fix for the LDT changes
    - regression fix for XEN interrupt handling caused by the APIC
    changes
    - regression fixes for the PAT changes
    - last minute fixes for new the MPX support
    - regression fix for 32bit UP
    - fix for a long standing relocation issue on 64bit tagged for stable
    - functional fix for the Hyper-V clocksource tagged for stable
    - downgrade of a pr_err which tends to confuse users

    Looks a bit on the large side, but almost half of it are valuable
    comments"

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/tsc: Change Fast TSC calibration failed from error to info
    x86/apic: Re-enable PCI_MSI support for non-SMP X86_32
    x86, mm: Change cachemode exports to non-gpl
    x86, tls: Interpret an all-zero struct user_desc as "no segment"
    x86, tls, ldt: Stop checking lm in LDT_empty
    x86, mpx: Strictly enforce empty prctl() args
    x86, mpx: Fix potential performance issue on unmaps
    x86, mpx: Explicitly disable 32-bit MPX support on 64-bit kernels
    x86, hyperv: Mark the Hyper-V clocksource as being continuous
    x86: Don't rely on VMWare emulating PAT MSR correctly
    x86, irq: Properly tag virtualization entry in /proc/interrupts
    x86, boot: Skip relocs when load address unchanged
    x86/xen: Override ACPI IRQ management callback __acpi_unregister_gsi
    ACPI: pci: Do not clear pci_dev->irq in acpi_pci_irq_disable()
    x86/xen: Treat SCI interrupt as normal GSI interrupt

    Linus Torvalds
     
  • Pull irq fixes from Thomas Gleixner:
    "From the irqchip departement you get:

    - regression fix for omap-intc

    - regression fix for atmel-aic-common

    - functional correctness fix for hip04

    - type mismatch fix for gic-v3-its

    - proper error pointer check for mtd-sysirq

    Mostly one and two liners except for the omap regression fix which is
    slightly larger than desired"

    * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    irqchip: atmel-aic-common: Prevent clobbering of priority when changing IRQ type
    irqchip: omap-intc: Fix legacy DMA regression
    irqchip: gic-v3-its: Fix use of max with decimal constant
    irqchip: hip04: Initialize hip04_cpu_map to 0xffff
    irqchip: mtk-sysirq: Use IS_ERR() instead of NULL pointer check

    Linus Torvalds
     
  • Pull timer fixes from Thomas Gleixner:
    "A set of small fixes:

    - regression fix for exynos_mct clocksource

    - trivial build fix for kona clocksource

    - functional one liner fix for the sh_tmu clocksource

    - two validation fixes to prevent (root only) data corruption in the
    kernel via settimeofday and adjtimex. Tagged for stable"

    * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    time: adjtimex: Validate the ADJ_FREQUENCY values
    time: settimeofday: Validate the values of tv from user
    clocksource: sh_tmu: Set cpu_possible_mask to fix SMP broadcast
    clocksource: kona: fix __iomem annotation
    clocksource: exynos_mct: Fix bitmask regression for exynos4_mct_write

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "A week's worth of fixes for various ARM platforms. Diff wise, the
    largest fix is for OMAP to deal with how GIC now registers interrupts
    (irq_domain_add_legacy() -> irq_domain_add_linear() changes).

    Besides this, a few more renesas platforms needed the GIC instatiation
    done for legacy boards. There's also a fix that disables coherency of
    mvebu due to issues, and a few other smaller fixes"

    * tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    arm64: dts: add baud rate to Juno stdout-path
    ARM: dts: imx25: Fix PWM "per" clocks
    bus: mvebu-mbus: fix support of MBus window 13
    Merge tag 'mvebu-fixes-3.19-3' of git://git.infradead.org/linux-mvebu into fixes
    ARM: mvebu: completely disable hardware I/O coherency
    ARM: OMAP: Work around hardcoded interrupts
    ARM: shmobile: r8a7779: Instantiate GIC from C board code in legacy builds
    ARM: shmobile: r8a7778: Instantiate GIC from C board code in legacy builds
    arm: boot: dts: dra7: enable dwc3 suspend PHY quirk

    Linus Torvalds
     
  • Pull vfs fixes from Al Viro:
    "A couple of fixes - deadlock in CIFS and build breakage in cris serial
    driver (resurfaced f_dentry in there)"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    VFS: Convert file->f_dentry->d_inode to file_inode()
    fix deadlock in cifs_ioctl_clone()

    Linus Torvalds
     
  • Pull device mapper fixes from Mike Snitzer:
    "Two stable fixes for dm-cache and one 3.19 DM core fix:

    - fix potential for dm-cache metadata corruption via stale metadata
    buffers being used when switching an inactive cache table to
    active; this could occur due to each table having it's own bufio
    client rather than sharing the client between tables.

    - fix dm-cache target to properly account for discard IO while
    suspending otherwise IO quiescing could complete prematurely.

    - fix DM core's handling of multiple internal suspends by maintaining
    an 'internal_suspend_count' and only resuming the device when this
    count drops to zero"

    * tag 'dm-3.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
    dm: fix handling of multiple internal suspends
    dm cache: fix problematic dual use of a single migration count variable
    dm cache: share cache-metadata object across inactive and active DM tables

    Linus Torvalds
     
  • Pull two block layer fixes from Jens Axboe:
    "Two small patches that should make it into 3.19:

    - a fixup from me for NVMe, making the cq_vector a signed variable.
    Otherwise our -1 comparison fails, and commit 2b25d981790b doesn't
    do what it was supposed to.

    - a fixup for the hotplug handling for blk-mq from Ming Lei, using
    the proper kobject referencing to ensure we release resources at
    the right time"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    blk-mq: fix hctx/ctx kobject use-after-free
    NVMe: cq_vector should be signed

    Linus Torvalds
     

25 Jan, 2015

5 commits

  • pULL SCSI fixes from James Bottomley:
    "This consists of four real fixes and three MAINTAINER updates.

    Three of the fixes are obvious (the DIX and atomic allocation are bug
    on and warn on fixes and the other is just trivial) and the ipr one is
    a bit more involved but is required because without it, the card
    double completes aborted commands and causes a kernel oops"

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
    MAINTAINERS: ibmvscsi driver maintainer change
    MAINTAINERS: ibmvfc driver maintainer change
    MAINTAINERS: Remove self as isci maintainer
    scsi_debug: test always evaluates to false, || should be used instead
    scsi: Avoid crashing if device uses DIX but adapter does not support it
    scsi_debug: use atomic allocation in resp_rsup_opcodes
    ipr: wait for aborted command responses

    Linus Torvalds
     
  • Pull watchdog fixes from Wim Van Sebroeck:
    "This will fix reboot issues with the imx2_wdt driver and it also drops
    some forgotten owner assignments from platform_drivers"

    * git://www.linux-watchdog.org/linux-watchdog:
    watchdog: drop owner assignment from platform_drivers
    watchdog: imx2_wdt: Disable power down counter on boot
    watchdog: imx2_wdt: Improve power management support.

    Linus Torvalds
     
  • Pull hwmon update from Jean Delvare:
    "This contains a single thing: a new driver for the temperature sensor
    embedded in the Intel 5500/5520/X58 chipsets.

    Sorry for the late request, it's been so long since I last sent a pull
    request and I've been so busy with other tasks meanwhile that I simply
    forgot about these patches. But given that this is a new driver, it
    can't introduce any regression so I thought it could still be OK.

    This has been in linux-next for months now"

    * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
    hwmon: (i5500_temp) Convert to use ATTRIBUTE_GROUPS macro
    hwmon: (i5500_temp) Convert to module_pci_driver
    hwmon: (i5500_temp) Don't bind to disabled sensors
    hwmon: (i5500_temp) Convert to devm_hwmon_device_register_with_groups
    hwmon: (i5500_temp) New driver for the Intel 5500/5520/X58 chipsets

    Linus Torvalds
     
  • Pull media fixes from Mauro Carvalho Chehab:
    - fix some race conditions caused by a regression on videobuf2
    - fix a interrupt release bug on cx23885
    - fix support for Mygica T230 and HVR4400
    - fix compilation breakage when USB is not selected on tlg2300
    - fix capabilities report on ompa3isp, soc-camera, rcar_vin and
    pvrusb2

    * tag 'media/v3.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
    [media] omap3isp: Correctly set QUERYCAP capabilities
    [media] cx23885: fix free interrupt bug
    [media] pvrusb2: fix missing device_caps in querycap
    [media] vb2: fix vb2_thread_stop race conditions
    [media] rcar_vin: Update device_caps and capabilities in querycap
    [media] soc-camera: fix device capabilities in multiple camera host drivers
    [media] Fix Mygica T230 support
    [media] cx23885: Split Hauppauge WinTV Starburst from HVR4400 card entry
    [media] tlg2300: Fix media dependencies

    Linus Torvalds
     
  • Commit ffcc393641 ("dm: enhance internal suspend and resume interface")
    attempted to handle multiple internal suspends on the same device, but
    it did that incorrectly. When these functions are called in this order
    on the same device the device is no longer suspended, but it should be:
    dm_internal_suspend_noflush
    dm_internal_suspend_noflush
    dm_internal_resume

    Fix this bug by maintaining an 'internal_suspend_count' and resuming
    the device when this count drops to zero.

    Signed-off-by: Mikulas Patocka
    Signed-off-by: Mike Snitzer

    Mikulas Patocka
     

24 Jan, 2015

18 commits

  • Use ATTRIBUTE_GROUPS macro to simplify the code a bit.

    Signed-off-by: Axel Lin
    Signed-off-by: Jean Delvare

    Axel Lin
     
  • Use module_pci_driver to simplify the code a bit.

    Signed-off-by: Axel Lin
    Reviewed-by: Guenter Roeck
    Signed-off-by: Jean Delvare

    Axel Lin
     
  • On many motherboards, for an unknown reason, the thermal sensor seems
    to be disabled and will return a constant temperature value of 36.5
    degrees Celsius. Don't bind to the device in that case, so that we
    don't report this bogus value to userspace.

    Signed-off-by: Jean Delvare
    Cc: Romain Dolbeau
    Reviewed-by: Guenter Roeck

    Jean Delvare
     
  • Use devm_hwmon_device_register_with_groups() to simplify the code a
    bit.

    Signed-off-by: Jean Delvare
    Cc: Romain Dolbeau
    Reviewed-by: Guenter Roeck

    Jean Delvare
     
  • The Intel 5500, 5520 and X58 chipsets embed a digital thermal sensor.
    This new driver supports it.

    Note that on many boards the sensor seems to be disabled and reports
    the minimum value (36.5 degrees Celsius) all the time.

    Signed-off-by: Jean Delvare
    Tested-by: Romain Dolbeau
    Reviewed-by: Guenter Roeck

    Jean Delvare
     
  • Pull btrfs fixes from Chris Mason:
    "We have a few fixes in my for-linus branch.

    Qu Wenruo's batch fix a regression between some our merge window pull
    and the inode_cache feature. The rest are smaller bugs"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    btrfs: Don't call btrfs_start_transaction() on frozen fs to avoid deadlock.
    btrfs: Fix the bug that fs_info->pending_changes is never cleared.
    btrfs: fix state->private cast on 32 bit machines
    Btrfs: fix race deleting block group from space_info->ro_bgs list
    Btrfs: fix incorrect freeing in scrub_stripe
    btrfs: sync ioctl, handle errors after transaction start

    Linus Torvalds
     
  • …/linux-platform-drivers-x86

    Pull platform driver fix from Darren Hart:
    "Revert keyboard backlight sysfs support and documentation.

    The support for the dell-laptop keyboard backlight was flawed and the
    fix:

    https://lkml.org/lkml/2015/1/14/539

    was more invasive that I felt comfortable sending at RC5.

    This series reverts the support for the dell-laptop keyboard backlight
    as well as the documentation for the newly created sysfs attributes.

    We'll get this implemented correctly for 3.20"

    * tag 'platform-drivers-x86-v3.19-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
    Revert "platform: x86: dell-laptop: Add support for keyboard backlight"
    Revert "Documentation: Add entry for dell-laptop sysfs interface"

    Linus Torvalds
     
  • Pull PCI fixes from Bjorn Helgaas:
    "These are fixes for:

    - a resource management problem that causes a Radeon "Fatal error
    during GPU init" on machines where the BIOS programmed an invalid
    Root Port window. This was a regression in v3.16.

    - an Atheros AR93xx device that doesn't handle PCI bus resets
    correctly. This was a regression in v3.14.

    - an out-of-date email address"

    * tag 'pci-v3.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
    MAINTAINERS: Update Richard Zhu's email address
    sparc/PCI: Clip bridge windows to fit in upstream windows
    powerpc/PCI: Clip bridge windows to fit in upstream windows
    parisc/PCI: Clip bridge windows to fit in upstream windows
    mn10300/PCI: Clip bridge windows to fit in upstream windows
    microblaze/PCI: Clip bridge windows to fit in upstream windows
    ia64/PCI: Clip bridge windows to fit in upstream windows
    frv/PCI: Clip bridge windows to fit in upstream windows
    alpha/PCI: Clip bridge windows to fit in upstream windows
    x86/PCI: Clip bridge windows to fit in upstream windows
    PCI: Add pci_claim_bridge_resource() to clip window if necessary
    PCI: Add pci_bus_clip_resource() to clip to fit upstream window
    PCI: Pass bridge device, not bus, when updating bridge windows
    PCI: Mark Atheros AR93xx to avoid bus reset
    PCI: Add flag for devices where we can't use bus reset

    Linus Torvalds
     
  • Pull devicetree bug fixes and documentation updates from Grant Likely:
    "A few bugfixes for the new DT overlay feature, documentation updates,
    spelling corrections, and changes to MAINTAINERS. Nothing earth
    shattering here"

    * tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
    of/unittest: Overlays with sub-devices tests
    of/platform: Handle of_populate drivers in notifier
    of/overlay: Do not generate duplicate nodes
    devicetree: document the "qemu" and "virtio" vendor prefixes
    devicetree: document ARM bindings for QEMU's Firmware Config interface
    Documentation: of: fix typo in graph bindings
    dma-mapping: fix debug print to display correct dma_pfn_offset
    of: replace Asahi Kasei Corp vendor prefix
    ARM: dt: GIC: Spelling s/specific/specifier/, s/flaggs/flags/
    dt/bindings: arm-boards: Spelling s/pointong/pointing/
    MAINTAINERS: Update DT website and git repository
    MAINTAINERS: drop DT regex matching on of_get_property and of_match_table

    Linus Torvalds
     
  • …awnguo/linux into fixes

    Merge "ARM: imx: fixes for 3.19, 2nd round" from Shawn Guo:

    The i.MX fixes for 3.19, 2nd round:
    - Correct pwm clock assignment in i.MX25 device tree to fix the broken
    pwm support on i.MX25

    * tag 'imx-fixes-3.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
    ARM: dts: imx25: Fix PWM "per" clocks

    Signed-off-by: Olof Johansson <olof@lixom.net>

    Olof Johansson
     
  • Without explicit command-line parameters, the Juno UART ends up running
    at 57600 baud in the kernel, which is at odds with the 115200 baud used
    by the rest of the firmware. Since commit 7914a7c5651a5161 now lets us
    fix this by specifying default options in stdout-path, do so.

    Acked-by: Mark Rutland
    Signed-off-by: Robin Murphy
    Signed-off-by: Olof Johansson

    Robin Murphy
     
  • Merge "mvebu/fixes #3" from Andrew Lunn:

    mvebu fixes for 3.19. (Part 4)

    bus: mvebu-mbus: fix support of MBus window 13

    * tag 'mvebu-fixes-3.19-4' of git://git.infradead.org/linux-mvebu:
    bus: mvebu-mbus: fix support of MBus window 13
    ARM: mvebu: completely disable hardware I/O coherency

    Signed-off-by: Olof Johansson

    Olof Johansson
     
  • Pull kvm fixes from Paolo Bonzini:
    "Three small fixes.

    Two for x86 and one avoids that sparse bails out"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    KVM: x86: SYSENTER emulation is broken
    KVM: x86: Fix of previously incomplete fix for CVE-2014-8480
    KVM: fix sparse warning in include/trace/events/kvm.h

    Linus Torvalds
     
  • Pull ARM fixes from Russell King:
    "Another round of small ARM fixes.

    restore_user_regs early stack deallocation is buggy in the presence of
    FIQs which switch to SVC mode, and could lead to corrupted registers
    being returned to a user process given an inopportune FIQ event.

    Another bug was spotted in the ARM perf code where it could lose track
    of perf counter overflows, leading to incorrect perf results.

    Lastly, a bug in arm_add_memory() was spotted where the memory sizes
    aren't properly rounded. As most people pass properly rounded sizes,
    this hasn't been noticed"

    * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
    ARM: 8292/1: mm: fix size rounding-down of arm_add_memory() function
    ARM: 8255/1: perf: Prevent wraparound during overflow
    ARM: 8266/1: Remove early stack deallocation from restore_user_regs

    Linus Torvalds
     
  • Pull two arm64 fixes from Will Deacon:
    "Arm64 fixes seem to come in pairs recently. We've got a fix for
    removing device-tree blobs when doing a make clean and another one
    addressing a missing include, which fixes build failures in -next for
    allmodconfig (spotted by Mark's buildbot).

    Summary from signed tag:

    - fix cleaning of .dtbs following directory restructuring
    - fix allmodconfig build breakage in -next due to missing include"

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    arm64: dump: Fix implicit inclusion of definition for PCI_IOBASE
    arm64: Add dtb files to archclean rule

    Linus Torvalds
     
  • This reverts commit 02b2aaaa57ab41504e8d03a3b2ceeb9440a2c188.

    This interface was determined to be flawed and required too invasive a
    fix for the RC cycle. This will be revisited in 3.20.

    Signed-off-by: Darren Hart

    Darren Hart
     
  • This reverts commit 3161293ba6dfceee9c1efe75185677445def05d4.

    This interface was determined to be flawed and required too invasive a
    fix for the RC cycle. This will be revisited in 3.20.

    Signed-off-by: Darren Hart

    Darren Hart
     
  • Introduce a new variable to count the number of allocated migration
    structures. The existing variable cache->nr_migrations became
    overloaded. It was used to:

    i) track of the number of migrations in flight for the purposes of
    quiescing during suspend.

    ii) to estimate the amount of background IO occuring.

    Recent discard changes meant that REQ_DISCARD bios are processed with
    a migration. Discards are not background IO so nr_migrations was not
    incremented. However this could cause quiescing to complete early.

    (i) is now handled with a new variable cache->nr_allocated_migrations.
    cache->nr_migrations has been renamed cache->nr_io_migrations.
    cleanup_migration() is now called free_io_migration(), since it
    decrements that variable.

    Also, remove the unused cache->next_migration variable that got replaced
    with with prealloc_structs a while ago.

    Signed-off-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org

    Joe Thornber
     

23 Jan, 2015

9 commits

  • If a DM table is reloaded with an inactive table when the device is not
    suspended (normal procedure for LVM2), then there will be two dm-bufio
    objects that can diverge. This can lead to a situation where the
    inactive table uses bufio to read metadata at the same time the active
    table writes metadata -- resulting in the inactive table having stale
    metadata buffers once it is promoted to the active table slot.

    Fix this by using reference counting and a global list of cache metadata
    objects to ensure there is only one metadata object per metadata device.

    Signed-off-by: Joe Thornber
    Signed-off-by: Mike Snitzer
    Cc: stable@vger.kernel.org

    Joe Thornber
     
  • Introduce selftests for overlays using sub-devices present
    in children nodes.

    Signed-off-by: Pantelis Antoniou
    Signed-off-by: Grant Likely

    Pantelis Antoniou
     
  • SYSENTER emulation is broken in several ways:
    1. It misses the case of 16-bit code segments completely (CVE-2015-0239).
    2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can
    still be set without causing #GP).
    3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in
    legacy-mode.
    4. There is some unneeded code.

    Fix it.

    Cc: stable@vger.linux.org
    Signed-off-by: Nadav Amit
    Signed-off-by: Paolo Bonzini

    Nadav Amit
     
  • STR and SLDT with rip-relative operand can cause a host kernel oops.
    Mark them as DstMem as well.

    Cc: stable@vger.linux.org
    Signed-off-by: Nadav Amit
    Signed-off-by: Paolo Bonzini

    Nadav Amit
     
  • Since c9465b4ec37a68425 (arm64: add support to dump the kernel page tables)
    allmodconfig has failed to build on arm64 as a result of:

    ../arch/arm64/mm/dump.c:55:20: error: 'PCI_IOBASE' undeclared here (not in a function)

    Fix this by explicitly including io.h to ensure that a definition is
    present.

    Signed-off-by: Mark Brown
    Signed-off-by: Will Deacon

    Mark Brown
     
  • Many users see this message when booting without knowning that it is
    of no importance and that TSC calibration may have succeeded by
    another way.

    As explained by Paul Bolle in
    http://lkml.kernel.org/r/1348488259.1436.22.camel@x61.thuisdomein

    "Fast TSC calibration failed" should not be considered as an error
    since other calibration methods are being tried afterward. At most,
    those send a warning if they fail (not an error). So let's change
    the message from error to warning.

    [ tglx: Make if pr_info. It's really not important at all ]

    Fixes: c767a54ba065 x86/debug: Add KERN_ to bare printks, convert printks to pr_
    Signed-off-by: Alexandre Demers
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernel.org/r/1418106470-6906-1-git-send-email-alexandre.f.demers@gmail.com
    Signed-off-by: Thomas Gleixner

    Alexandre Demers
     
  • Commit 0dbc6078c06bc0 ('x86, build, pci: Fix PCI_MSI build on !SMP')
    introduced the dependency that X86_UP_APIC is only available when
    PCI_MSI is false. This effectively prevents PCI_MSI support on 32bit
    UP systems because it disables both APIC and IO-APIC. But APIC support
    is architecturally required for PCI_MSI.

    The intention of the patch was to enforce APIC support when PCI_MSI is
    enabled, but failed to do so.

    Remove the !PCI_MSI dependency from X86_UP_APIC and enforce
    X86_UP_APIC when PCI_MSI support is enabled on 32bit UP systems.

    [ tglx: Massaged changelog ]

    Fixes 0dbc6078c06bc0 'x86, build, pci: Fix PCI_MSI build on !SMP'
    Signed-off-by: Bryan O'Donoghue
    Suggested-by: Thomas Gleixner
    Reviewed-by: Andy Shevchenko
    Cc: Thomas Petazzoni
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernel.org/r/1421967529-9037-1-git-send-email-pure.logic@nexus-software.ie
    Signed-off-by: Thomas Gleixner

    Bryan O'Donoghue
     
  • Commit 281d4078bec3 ("x86: Make page cache mode a real type")
    introduced the symbols __cachemode2pte_tbl and __pte2cachemode_tbl and
    exported them via EXPORT_SYMBOL_GPL. The exports are part of a
    replacement of code which has been EXPORT_SYMBOL before these changes
    resulting in build breakage of out-of-tree non-gpl modules.

    Change EXPORT_SYMBOL_GPL to EXPORT-SYMBOL for these two symbols.

    Fixes: 281d4078bec3 "x86: Make page cache mode a real type"
    Reported-and-tested-by: Steven Noonan
    Signed-off-by: Juergen Gross
    Reviewed-by: Toshi Kani
    Link: http://lkml.kernel.org/r/1421926997-28615-1-git-send-email-jgross@suse.com
    Signed-off-by: Thomas Gleixner

    Juergen Gross
     
  • The Witcher 2 did something like this to allocate a TLS segment index:

    struct user_desc u_info;
    bzero(&u_info, sizeof(u_info));
    u_info.entry_number = (uint32_t)-1;

    syscall(SYS_set_thread_area, &u_info);

    Strictly speaking, this code was never correct. It should have set
    read_exec_only and seg_not_present to 1 to indicate that it wanted
    to find a free slot without putting anything there, or it should
    have put something sensible in the TLS slot if it wanted to allocate
    a TLS entry for real. The actual effect of this code was to
    allocate a bogus segment that could be used to exploit espfix.

    The set_thread_area hardening patches changed the behavior, causing
    set_thread_area to return -EINVAL and crashing the game.

    This changes set_thread_area to interpret this as a request to find
    a free slot and to leave it empty, which isn't *quite* what the game
    expects but should be close enough to keep it working. In
    particular, using the code above to allocate two segments will
    allocate the same segment both times.

    According to FrostbittenKing on Github, this fixes The Witcher 2.

    If this somehow still causes problems, we could instead allocate
    a limit==0 32-bit data segment, but that seems rather ugly to me.

    Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix
    Signed-off-by: Andy Lutomirski
    Cc: stable@vger.kernel.org
    Cc: torvalds@linux-foundation.org
    Link: http://lkml.kernel.org/r/0cb251abe1ff0958b8e468a9a9a905b80ae3a746.1421954363.git.luto@amacapital.net
    Signed-off-by: Thomas Gleixner

    Andy Lutomirski