user/sven/linux.git, branch v3.16.66

Linux 3.16.66

2019-05-02T20:42:08Z

tty: mark Siemens R3964 line discipline as BROKEN

2019-05-02T20:42:07Z

commit c7084edc3f6d67750f50d4183134c4fb5712a5c8 upstream. The n_r3964 line discipline driver was written in a different time, when SMP machines were rare, and users were trusted to do the right thing. Since then, the world has moved on but not this code, it has stayed rooted in the past with its lovely hand-crafted list structures and loads of "interesting" race conditions all over the place. After attempting to clean up most of the issues, I just gave up and am now marking the driver as BROKEN so that hopefully someone who has this hardware will show up out of the woodwork (I know you are out there!) and will help with debugging a raft of changes that I had laying around for the code, but was too afraid to commit as odds are they would break things. Many thanks to Jann and Linus for pointing out the initial problems in this codebase, as well as many reviews of my attempts to fix the issues. It was a case of whack-a-mole, and as you can see, the mole won. Reported-by: Jann Horn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings

apparmor: provide userspace flag indicating binfmt_elf_mmap change

2019-05-02T20:42:07Z

commit 34c426acb75cc21bdf84685e106db0c1a3565057 upstream. Commit 9f834ec18def ("binfmt_elf: switch to new creds when switching to new mm") changed when the creds are installed by the binfmt_elf handler. This affects which creds are used to mmap the executable into the address space. Which can have an affect on apparmor policy. Add a flag to apparmor at /sys/kernel/security/apparmor/features/domain/fix_binfmt_elf_mmap to make it possible to detect this semantic change so that the userspace tools and the regression test suite can correctly deal with the change. BugLink: http://bugs.launchpad.net/bugs/1630069 Signed-off-by: John Johansen Signed-off-by: Ben Hutchings

binfmt_elf: switch to new creds when switching to new mm

2019-05-02T20:42:07Z

commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46 upstream. We used to delay switching to the new credentials until after we had mapped the executable (and possible elf interpreter). That was kind of odd to begin with, since the new executable will actually then _run_ with the new creds, but whatever. The bigger problem was that we also want to make sure that we turn off prof events and tracing before we start mapping the new executable state. So while this is a cleanup, it's also a fix for a possible information leak. Reported-by: Robert Święcki Tested-by: Peter Zijlstra Acked-by: David Howells Acked-by: Oleg Nesterov Acked-by: Andy Lutomirski Acked-by: Eric W. Biederman Cc: Willy Tarreau Cc: Kees Cook Cc: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings

binfmt_elf: Fix missing SIGKILL for empty PIE

2019-05-02T20:42:06Z

Commit ea08dc5191d9 "fs/binfmt_elf.c: fix bug in loading of PIE binaries", which was a backport of commit a87938b2e246 upstream, added a new failure path to load_elf_binary(). Before commit 19d860a140be "handle suicide on late failure exits in execve() in search_binary_handler()", load_elf_binary() wass responsible for sending a fatal signal to the task in case of an error after flushing the old executable. Add that to the new failure path. Signed-off-by: Ben Hutchings

brcmfmac: add subtype check for event handling in data path

2019-05-02T20:42:06Z

commit a4176ec356c73a46c07c181c6d04039fafa34a9f upstream. For USB there is no separate channel being used to pass events from firmware to the host driver and as such are passed over the data path. In order to detect mock event messages an additional check is needed on event subtype. This check is added conditionally using unlikely() keyword. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo [bwh: Backported to 3.16: - Drop changes to PCIe bus support - Adjust filenames] Signed-off-by: Ben Hutchings

brcmfmac: revise handling events in receive path

2019-05-02T20:42:06Z

commit 9c349892ccc90c6de2baaa69cc78449f58082273 upstream. Move event handling out of brcmf_netif_rx() avoiding the need to pass a flag. This flag is only ever true for USB hosts as other interface use separate brcmf_rx_event() function. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo [bwh: Backported to 3.16 as dependency of commit a4176ec356c7 "brcmfmac: add subtype check for event handling in data path" - Drop changes to PCIe bus support - Adjust filenames] Signed-off-by: Ben Hutchings

brcmfmac: fix incorrect event channel deduction

2019-05-02T20:42:05Z

commit 8e290cecdd0178f3d4cf7d463c51dc7e462843b4 upstream. brcmf_sdio_fromevntchan() was being called on the the data frame rather than the software header, causing some frames to be mischaracterized as on the event channel rather than the data channel. This fixes a major performance regression (due to dropped packets). With this patch the download speed jumped from 1Mbit/s back up to 40MBit/s due to the sheer amount of packets being incorrectly processed. Fixes: c56caa9db8ab ("brcmfmac: screening firmware event packet") Signed-off-by: Gavin Li Acked-by: Arend van Spriel [kvalo@codeaurora.org: improve commit logs based on email discussion] Signed-off-by: Kalle Valo [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings

brcmfmac: screening firmware event packet

2019-05-02T20:42:05Z

commit c56caa9db8abbbfb9e31325e0897705aa897db37 upstream. Firmware uses asynchronized events as a communication method to the host. The event packets are marked as ETH_P_LINK_CTL protocol type. For SDIO and PCIe bus, this kind of packets are delivered through virtual event channel not data channel. This patch adds a screening logic to make sure the event handler only processes the events coming from the correct channel. Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo [bwh: Backported to 3.16: - Drop changes to PCIe bus support - Adjust filenames] Signed-off-by: Ben Hutchings

brcmfmac: make brcmf_proto_hdrpull() return struct brcmf_if instance

2019-05-02T20:42:05Z

commit 796cfb65e3ed01a9b08e3a0b93e34120c54bbbd2 upstream. Avoid spreading the ifidx in the driver, but have it return the struct brcmf_if instance. Reviewed-by: Hante Meuleman Reviewed-by: Franky (Zhenhui) Lin Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo [bwh: Backported to 3.16: - Drop changes to PCIe bus support - Adjust filenames] Signed-off-by: Ben Hutchings