user/sven/linux.git, branch v3.12.61

Linux 3.12.61

2016-06-15T13:51:48Z

Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data

2016-06-15T13:51:47Z

commit 84cb3df02aea4b00405521e67c4c67c2d525c364 upstream. HCI_UART_PROTO_SET flag is set before hci_uart_set_proto call. If we receive data from tty layer during this procedure, proto pointer may not be assigned yet, leading to null pointer dereference in rx method hci_uart_tty_receive. This patch fixes this issue by introducing HCI_UART_PROTO_READY flag in order to avoid any proto operation before proto opening and assignment. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann Cc: Oliver Neukum Signed-off-by: Jiri Slaby

Bluetooth: btmrvl_sdio: fix firmware activation failure

2016-06-15T13:51:47Z

commit 9a01242dc7fc4d5fe3f722afbf35b33aa414cd2f upstream. In some case, the btmrvl_sdio firmware would fail to active within the polling time. Increase the polling interval to 100 msec to fix the issue. Signed-off-by: Wei-Ning Huang Signed-off-by: Wei-Ning Huang Signed-off-by: Marcel Holtmann Cc: Oliver Neukum Signed-off-by: Jiri Slaby

pch_phub: return -ENODATA if ROM can't be mapped

2016-06-15T13:51:46Z

commit a75fa128236bc2fdaa5e412145cbd577e42e14c2 upstream. The error return err is not initialized for the case when pci_map_rom fails and no ROM can me mapped. Fix this by setting ret to -ENODATA; (this is the same error value that is returned if the ROM data is successfully mapped but does not match the expected ROM signature.). Issue found from static code analysis using CoverityScan. Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman Cc: Oliver Neukum Signed-off-by: Jiri Slaby

misc: ad525x_dpot: Fix the enabling of the "otpXen" attributes

2016-06-15T13:51:46Z

commit 1bb850a1b7f68b66361e658e334f9fdf8231f17d upstream. Currently writing the attributes with "echo" will result in comparing: "enabled\n" with "enabled\0" and attribute is always set to false. Use the sysfs_streq() instead because it treats both NUL and new-line-then-NUL as equivalent string terminations. Signed-off-by: Dan Bogdan Nechita Signed-off-by: Greg Kroah-Hartman Cc: Oliver Neukum Signed-off-by: Jiri Slaby

xfs: skip stale inodes in xfs_iflush_cluster

2016-06-15T07:32:19Z

commit 7d3aa7fe970791f1a674b14572a411accf2f4d4e upstream. We don't write back stale inodes so we should skip them in xfs_iflush_cluster, too. Signed-off-by: Dave Chinner Reviewed-by: Brian Foster Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner Signed-off-by: Jiri Slaby

xfs: fix inode validity check in xfs_iflush_cluster

2016-06-15T07:32:18Z

commit 51b07f30a71c27405259a0248206ed4e22adbee2 upstream. Some careless idiot(*) wrote crap code in commit 1a3e8f3 ("xfs: convert inode cache lookups to use RCU locking") back in late 2010, and so xfs_iflush_cluster checks the wrong inode for whether it is still valid under RCU protection. Fix it to lock and check the correct inode. (*) Careless-idiot: Dave Chinner Discovered-by: Brain Foster Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner Signed-off-by: Jiri Slaby

xfs: xfs_iflush_cluster fails to abort on error

2016-06-15T07:32:18Z

commit b1438f477934f5a4d5a44df26f3079a7575d5946 upstream. When a failure due to an inode buffer occurs, the error handling fails to abort the inode writeback correctly. This can result in the inode being reclaimed whilst still in the AIL, leading to use-after-free situations as well as filesystems that cannot be unmounted as the inode log items left in the AIL never get removed. Fix this by ensuring fatal errors from xfs_imap_to_bp() result in the inode flush being aborted correctly. [js] 3.12 needs EAGAIN, not -EAGAIN Reported-by: Shyam Kaushik Diagnosed-by: Shyam Kaushik Tested-by: Shyam Kaushik Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner Signed-off-by: Jiri Slaby

dma-debug: avoid spinlock recursion when disabling dma-debug

2016-06-15T07:32:17Z

commit 3017cd63f26fc655d56875aaf497153ba60e9edf upstream. With netconsole (at least) the pr_err("... disablingn") call can recurse back into the dma-debug code, where it'll try to grab free_entries_lock again. Avoid the problem by doing the printk after dropping the lock. Link: http://lkml.kernel.org/r/1463678421-18683-1-git-send-email-ville.syrjala@linux.intel.com Signed-off-by: Ville Syrjälä Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby

ext4: silence UBSAN in ext4_mb_init()

2016-06-15T07:32:17Z

commit 935244cd54b86ca46e69bc6604d2adfb1aec2d42 upstream. Currently, in ext4_mb_init(), there's a loop like the following: do { ... offset += 1 << (sb->s_blocksize_bits - i); i++; } while (i <= sb->s_blocksize_bits + 1); Note that the updated offset is used in the loop's next iteration only. However, at the last iteration, that is at i == sb->s_blocksize_bits + 1, the shift count becomes equal to (unsigned)-1 > 31 (c.f. C99 6.5.7(3)) and UBSAN reports UBSAN: Undefined behaviour in fs/ext4/mballoc.c:2621:15 shift exponent 4294967295 is too large for 32-bit type 'int' [...] Call Trace: [] dump_stack+0xbc/0x117 [] ? _atomic_dec_and_lock+0x169/0x169 [] ubsan_epilogue+0xd/0x4e [] __ubsan_handle_shift_out_of_bounds+0x1fb/0x254 [] ? __ubsan_handle_load_invalid_value+0x158/0x158 [] ? kmem_cache_alloc+0x101/0x390 [] ? ext4_mb_init+0x13b/0xfd0 [] ? create_cache+0x57/0x1f0 [] ? create_cache+0x11a/0x1f0 [] ? mutex_lock+0x38/0x60 [] ? mutex_unlock+0x1b/0x50 [] ? put_online_mems+0x5b/0xc0 [] ? kmem_cache_create+0x117/0x2c0 [] ext4_mb_init+0xc49/0xfd0 [...] Observe that the mentioned shift exponent, 4294967295, equals (unsigned)-1. Unless compilers start to do some fancy transformations (which at least GCC 6.0.0 doesn't currently do), the issue is of cosmetic nature only: the such calculated value of offset is never used again. Silence UBSAN by introducing another variable, offset_incr, holding the next increment to apply to offset and adjust that one by right shifting it by one position per loop iteration. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=114701 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112161 Signed-off-by: Nicolai Stange Signed-off-by: Theodore Ts'o Signed-off-by: Jiri Slaby