Skip to content
  1. Apr 07, 2014
  2. Mar 14, 2014
  3. Mar 10, 2014
    • Linus Torvalds's avatar
      Linux 3.14-rc6 · fa389e22
      Linus Torvalds authored
      fa389e22
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 79e61542
      Linus Torvalds authored
      Pull ARM SoC fixes from from Olof Johansson:
       "A collection of fixes for ARM platforms.  A little large due to us
        missing to do one last week, but there's nothing in particular here
        that is in itself large and scary.
      
        Mostly a handful of smaller fixes all over the place.  The majority is
        made up of fixes for OMAP, but there are a few for others as well.  In
        particular, there was a decision to rename a binding for the Broadcom
        pinctrl block that we need to go in before the final release since we
        then treat it as ABI"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: omap3-gta04: Add ti,omap36xx to compatible property to avoid problems with booting
        ARM: tegra: add LED options back into tegra_defconfig
        ARM: dts: omap3-igep: fix boot fail due wrong compatible match
        ARM: OMAP3: Fix pinctrl interrupts for core2
        pinctrl: Rename Broadcom Capri pinctrl binding
        pinctrl: refer to updated dt binding string.
        Update dtsi with new pinctrl compatible string
        ARM: OMAP: Kill warning in CPUIDLE code with !CONFIG_SMP
        ARM: OMAP2+: Add support for thumb mode on DT booted N900
        ARM: OMAP2+: clock: fix clkoutx2 with CLK_SET_RATE_PARENT
        ARM: OMAP4: hwmod: Fix SOFTRESET logic for OMAP4
        ARM: DRA7: hwmod data: correct the sysc data for spinlock
        ARM: OMAP5: PRM: Fix reboot handling
        ARM: sunxi: dt: Change the touchscreen compatibles
        ARM: sun7i: dt: Fix interrupt trigger types
      79e61542
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.14-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · fe9ea91c
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "Highlights include:
      
         - Fix another nfs4_sequence corruptor in RELEASE_LOCKOWNER
         - Fix an Oopsable delegation callback race
         - Fix another bad stateid infinite loop
         - Fail the data server I/O is the stateid represents a lost lock
         - Fix an Oopsable sunrpc trace event"
      
      * tag 'nfs-for-3.14-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Fix oops when trace sunrpc_task events in nfs client
        NFSv4: Fail the truncate() if the lock/open stateid is invalid
        NFSv4.1 Fail data server I/O if stateid represents a lost lock
        NFSv4: Fix the return value of nfs4_select_rw_stateid
        NFSv4: nfs4_stateid_is_current should return 'true' for an invalid stateid
        NFS: Fix a delegation callback race
        NFSv4: Fix another nfs4_sequence corruptor
      fe9ea91c
    • Linus Torvalds's avatar
      Merge tag 'usb-3.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · cf8bf7cd
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are 4 USB fixes for your current tree.
      
        Two of them are reverts to hopefully resolve the nasty XHCI
        regressions we have been having on some types of devices.  The other
        two are quirks for some Logitech video devices"
      
      * tag 'usb-3.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        Revert "USBNET: ax88179_178a: enable tso if usb host supports sg dma"
        Revert "xhci 1.0: Limit arbitrarily-aligned scatter gather."
        usb: Make DELAY_INIT quirk wait 100ms between Get Configuration requests
        usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e
      cf8bf7cd
    • Linus Torvalds's avatar
      Merge tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · a491ce72
      Linus Torvalds authored
      Pull staging driver tree fix from Greg KH:
       "Here is a single staging driver fix for your tree.
      
        It resolves an issue with arbritary writes to memory if a specific
        driver is loaded"
      
      * tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()
      a491ce72
    • David Howells's avatar
      KEYS: Make the keyring cycle detector ignore other keyrings of the same name · 979e0d74
      David Howells authored
      This fixes CVE-2014-0102.
      
      The following command sequence produces an oops:
      
      	keyctl new_session
      	i=`keyctl newring _ses @s`
      	keyctl link @s $i
      
      The problem is that search_nested_keyrings() sees two keyrings that have
      matching type and description, so keyring_compare_object() returns true.
      s_n_k() then passes the key to the iterator function -
      keyring_detect_cycle_iterator() - which *should* check to see whether this is
      the keyring of interest, not just one with the same name.
      
      Because assoc_array_find() will return one and only one match, I assumed that
      the iterator function would only see an exact match or never be called - but
      the iterator isn't only called from assoc_array_find()...
      
      The oops looks something like this:
      
      	kernel BUG at /data/fs/linux-2.6-fscache/security/keys/keyring.c:1003!
      	invalid opcode: 0000 [#1] SMP
      	...
      	RIP: keyring_detect_cycle_iterator+0xe/0x1f
      	...
      	Call Trace:
      	  search_nested_keyrings+0x76/0x2aa
      	  __key_link_check_live_key+0x50/0x5f
      	  key_link+0x4e/0x85
      	  keyctl_keyring_link+0x60/0x81
      	  SyS_keyctl+0x65/0xe4
      	  tracesys+0xdd/0xe2
      
      The fix is to make keyring_detect_cycle_iterator() check that the key it
      has is the key it was actually looking for rather than calling BUG_ON().
      
      A testcase has been included in the keyutils testsuite for this:
      
      	http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/commit/?id=891f3365d07f1996778ade0e3428f01878a1790b
      
      
      
      Reported-by: default avatarTommi Rantala <tt.rantala@gmail.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarJames Morris <james.l.morris@oracle.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      979e0d74