The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2889
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Many drivers need to validate the characteristics of their HID report
during initialization to avoid misusing the reports. This adds a common
helper to perform validation of the report exisitng, the field existing,
and the expected number of values within the field.
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This reverts commits 61e00655, 73f8645d and 8e22ecb6:
  "Input: introduce BTN/ABS bits for drums and guitars"
  "HID: wiimote: add support for Guitar-Hero drums"
  "HID: wiimote: add support for Guitar-Hero guitars"

The extra new ABS_xx values resulted in ABS_MAX no longer being a
power-of-two, which broke the comparison logic.  It also caused the
ioctl numbers to overflow into the next byte, causing problems for that.

We'll try again for 3.13.
Reported-by: NMarkus Trippelsdorf <markus@trippelsdorf.de>
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Acked-by: NDavid Herrmann <dh.herrmann@gmail.com>
Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Merge commit 06c54055 did a bad conflict resolution accidentally
leaving out a closing brace.  Add it back.

This breaks a handful of defconfigs on ARM, so it'd be good to see it
applied pretty quickly.
Signed-off-by: NOlof Johansson <olof@lixom.net>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

ioc4_ide_attach_one() is used only in this file.
Fix the following sparse warnings:

drivers/ide/sgiioc4.c:603:5: warning: symbol 'ioc4_ide_attach_one' was not declared. Should it be static?
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Added missing __iomem annotation in order to fix the following
sparse warnings:

drivers/ide/palm_bk3710.c:194:31: warning: incorrect type in initializer (different address spaces)
drivers/ide/palm_bk3710.c:194:31:    expected void [noderef] <asn:2>*base
drivers/ide/palm_bk3710.c:194:31:    got void *<noident>
drivers/ide/palm_bk3710.c:212:31: warning: incorrect type in initializer (different address spaces)
drivers/ide/palm_bk3710.c:212:31:    expected void [noderef] <asn:2>*base
drivers/ide/palm_bk3710.c:212:31:    got void *<noident>
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Use the wrapper function for retrieving the platform data instead of
accessing dev->platform_data directly.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NXinghai Yu <yuxinghai@cn.fujitsu.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The usage of strict_strtol() is not preferred, because
strict_strtol() is obsolete. Thus, kstrtol() should be
used.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The indentation here implies that the intent was for this to be a multiline if.
Introduced a few years ago in commit ec146a6f ("bnx2x: Modify XGXS functions")
Signed-off-by: NDave Jones <davej@fedoraproject.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

On vxlan device create if socket create fails vxlan device is not
added to hash table. Therefore we need to check if device
is in hashtable before we delete it from hlist.
Following patch avoid the crash. net-next already has this fix.

---8<---
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffffa05f9ca7>] vxlan_dellink+0x77/0xf0 [vxlan]
PGD 42b2d9067 PUD 42e04c067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in: vxlan(-)
Hardware name: Dell Inc. PowerEdge R620/0KCKR5, BIOS 1.4.8 10/25/2012
task: ffff88042ecf8760 ti: ffff88042f106000 task.ti: ffff88042f106000
RIP: 0010:[<ffffffffa05f9ca7>]  [<ffffffffa05f9ca7>]
vxlan_dellink+0x77/0xf0 [vxlan]
RSP: 0018:ffff88042f107e28  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88082af08000 RCX: ffff88083fd80000
RDX: 0000000000000000 RSI: ffff88042f107e58 RDI: ffff88042e12f810
RBP: ffff88042f107e48 R08: ffffffff8166eca0 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88082af087c0
R13: ffff88042e12f000 R14: ffff88042f107e58 R15: ffff88042f107e58
FS:  00007f4ed2de7700(0000) GS:ffff88043fc80000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000042e076000 CR4: 00000000000407e0
Stack:
 ffff88082af08000 ffffffff81654848 ffffffffa05fb4e0 ffffffff81654780
 ffff88042f107e98 ffffffff813b9c7a ffff88042f107e58 ffff88042f107e58
 ffff88042f107e88 ffffffffa05fb4e0 ffffffffa05fb780 ffff88042f107f18
Call Trace:
 [<ffffffff813b9c7a>] __rtnl_link_unregister+0xca/0xd0
 [<ffffffff813bb0e9>] rtnl_link_unregister+0x19/0x30
 [<ffffffffa05faa4c>] vxlan_cleanup_module+0x10/0x2f [vxlan]
 [<ffffffff81099fef>] SyS_delete_module+0x1cf/0x2c0
 [<ffffffff8146c069>] ? do_page_fault+0x9/0x10
 [<ffffffff8146f012>] system_call_fastpath+0x16/0x1b
Code: 4d 85 ed 0f 84 95 00 00 00 4c 8d a7 c0 07 00 00 49 8d bd 10 08 00
00 e8 28 e8 e6 e0 48 8b 83 c0 07 00 00 49 8b 54 24 08 48 85 c0 <48> 89
02 74 04 48 89 50 08 49 b8 00 02 20 00 00 00 ad de 4d 89
RIP  [<ffffffffa05f9ca7>] vxlan_dellink+0x77/0xf0 [vxlan]
 RSP <ffff88042f107e28>
CR2: 0000000000000000
Signed-off-by: NPravin B Shelar <pshelar@nicira.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This commit implements the ->ndo_do_ioctl() operation so that the
PHY-related ioctl() calls can work from userspace, which allows
applications like mii-tool or mii-diag to do their job.
Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Tested-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This commit fixes a long-standing bug that has been reported by many
users: on some Armada 370 platforms, only the network interface that
has been used in U-Boot to tftp the kernel works properly in
Linux. The other network interfaces can see a 'link up', but are
unable to transmit data. The reports were generally made on the Armada
370-based Mirabox, but have also been given on the Armada 370-RD
board.

The network MAC in the Armada 370/XP (supported by the mvneta driver
in Linux) has a functionality that allows it to continuously poll the
PHY and directly update the MAC configuration accordingly (speed,
duplex, etc.). The very first versions of the driver submitted for
review were using this hardware mechanism, but due to this, the driver
was not integrated with the kernel phylib. Following reviews, the
driver was changed to use the phylib, and therefore a software based
polling. In software based polling, Linux regularly talks to the PHY
over the MDIO bus, and sees if the link status has changed. If it's
the case then the adjust_link() callback of the driver is called to
update the MAC configuration accordingly.

However, it turns out that the adjust_link() callback was not
configuring the hardware in a completely correct way: while it was
setting the speed and duplex bits correctly, it wasn't telling the
hardware to actually take into account those bits rather than what the
hardware-based PHY polling mechanism has concluded. So, in fact the
adjust_link() callback was basically a no-op.

However, the network happened to be working because on the network
interfaces used by U-Boot for tftp on Armada 370 platforms because the
hardware PHY polling was enabled by the bootloader, and left enabled
by Linux. However, the second network interface not used for tftp (or
both network interfaces if the kernel is loaded from USB, NAND or SD
card) didn't had the hardware PHY polling enabled.

This patch fixes this situation by:

 (1) Making sure that the hardware PHY polling is disabled by clearing
     the MVNETA_PHY_POLLING_ENABLE bit in the MVNETA_UNIT_CONTROL
     register in the driver ->probe() function.

 (2) Making sure that the duplex and speed selections made by the
     adjust_link() callback are taken into account by clearing the
     MVNETA_GMAC_AN_SPEED_EN and MVNETA_GMAC_AN_DUPLEX_EN bits in the
     MVNETA_GMAC_AUTONEG_CONFIG register.

This patch has been tested on Armada 370 Mirabox, and now both network
interfaces are usable after boot.

[ Problem introduced by commit c5aff182 ("net: mvneta: driver for
  Marvell Armada 370/XP network unit") ]
Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Jochen De Smet <jochen.armkernel@leahnim.org>
Cc: Peter Sanford <psanford@nearbuy.io>
Cc: Ethan Tuttle <ethan@ethantuttle.com>
Cc: Chény Yves-Gael <yves@cheny.fr>
Cc: Ryan Press <ryan@presslab.us>
Cc: Simon Guinot <simon.guinot@sequanux.org>
Cc: vdonnefort@lacie.com
Cc: stable@vger.kernel.org
Acked-by: NJason Cooper <jason@lakedaemon.net>
Tested-by: NVincent Donnefort <vdonnefort@gmail.com>
Tested-by: NYves-Gael Cheny <yves@cheny.fr>
Tested-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Remove the __LINK_STATE_START check to verify the device is running, in
favor of netif_running().  netif_running() performs the same check of
__LINK_STATE_START, so the code should behave the same.
Signed-off-by: NJon Mason <jdmason@kudzu.us>
Cc: Francois Romieu <romieu@fr.zoreil.com>
Cc: Sorbica Shieh <sorbica@icplus.com.tw>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

copying large files to a NFS mounted host was taking absurdly large
time.

Turns out that TX BD reclaim had a sublte bug.

Loop starts off from @txbd_dirty cursor and stops when it hits a BD
still in use by controller. However when it stops it needs to keep the
cursor at that very BD to resume scanning in next iteration. However it
was erroneously incrementing the cursor, causing the next scan(s) to
fail too, unless the BD chain was completely drained out.

[ARCLinux]$ ls -l -sh /disk/log.txt
 17976 -rw-r--r--    1 root     root       17.5M Sep  /disk/log.txt

========== Before =====================
[ARCLinux]$ time cp /disk/log.txt /mnt/.
real    31m 7.95s
user    0m 0.00s
sys     0m 0.10s

========== After =====================
[ARCLinux]$ time cp /disk/log.txt /mnt/.
real    0m 24.33s
user    0m 0.00s
sys     0m 0.19s
Signed-off-by: NVineet Gupta <vgupta@synopsys.com>
Cc: Alexey Brodkin <abrodkin@synopsys.com> (commit_signer:3/4=75%)
Cc: "David S. Miller" <davem@davemloft.net> (commit_signer:3/4=75%)
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: arc-linux-dev@synopsys.com
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

sock_tx_timestamp() will clear all zerocopy flags of skb which may lead the
frags never to be orphaned. This will break guest to guest traffic when zerocopy
is enabled. Fix this by orphaning the frags before trying to set tx time stamp.

The issue were introduced by commit eda29772
(tun: Support software transmit time stamping).

Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Acked-by: NRichard Cochran <richardcochran@gmail.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit eda29772
(tun: Support software transmit time stamping) will queue skbs into error queue
when tx stamping is enabled. But it forgets to purge the error queue during
detach. This patch fixes this.

Cc: Richard Cochran <richardcochran@gmail.com>
Acked-by: NRichard Cochran <richardcochran@gmail.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since commit 82dc3c63 ("net: introduce NAPI_POLL_WEIGHT")
netif_napi_add() produces an error message if a NAPI poll weight
greater than 64 is requested.

qlcnic requests the weight as large as 256 for some of its rings, and
smaller values for other rings. For instance in qlcnic_82xx_napi_add()
I think the intention was to give the tx+rx ring a bigger weight than
to rx-only rings, but it's actually doing the opposite. So I'm assuming
the weights do not really matter much.

Just use the standard NAPI weights for all rings.
Signed-off-by: NMichal Schmidt <mschmidt@redhat.com>
Acked-by: NHimanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In this patch capabilities are added to the Vf driver to request
multiple queues over the VF PF channel, and the logic for requesting
rss configuration for said queues.
Signed-off-by: NAriel Elior <ariele@broadcom.com>
Signed-off-by: NEilong Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch adds support for Receive Side Scaling for queues of
Virtual Functions on the PF side. This includes support for the
requests for multiple queues from VF drivers, configuration of the
HW for multiple queues per VF, and support for rss configuration
of said queues.
Signed-off-by: NAriel Elior <ariele@broadcom.com>
Signed-off-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch adds two more ndo ops: ndo_add_rx_vxlan_port() and
ndo_del_rx_vxlan_port().

Drivers can get notifications through the above functions about changes
of the UDP listening port of VXLAN. Also, when physical ports come up,
now they can call vxlan_get_rx_port() in order to obtain the port number(s)
of the existing VXLAN interface in case they already up before them.

This information about the listening UDP port would be used for VXLAN
related offloads.

A big thank you to John Fastabend (john.r.fastabend@intel.com) for his
input and his suggestions on this patch set.

CC: John Fastabend <john.r.fastabend@intel.com>
CC: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: NJoseph Gasparakis <joseph.gasparakis@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This module generates a common default address on init,
using eth_random_addr. Set addr_assign_type to let
userspace know the address is random unless it was
overridden by the minidriver.
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Acked-by: NOliver Neukum <oliver@neukum.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NGovindarajulu Varadarajan <govindarajulu90@gmail.com>
Signed-off-by: NSujith Sankar <ssujith@cisco.com>
Signed-off-by: NNishank Trivedi <nistrive@cisco.com>
Signed-off-by: NChristian Benvenuti <benve@cisco.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch exposes symbols for usnic low latency driver that can be used to
register and unregister vNics as well to traverse the resources on vNics.
Signed-off-by: NUpinder Malhi <umalhi@cisco.com>
Signed-off-by: NNishank Trivedi <nistrive@cisco.com>
Signed-off-by: NChristian Benvenuti <benve@cisco.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In servers with more than 1.1 TB of RAM, the existing 40/32 bit DMA
could cause failure as the DMA-able address could go outside the range
addressable using 40/32 bits.

The following patch first tried 64 bit DMA if possible, failover to 32
bit.
Signed-off-by: NSujith Sankar <ssujith@cisco.com>
Signed-off-by: NChristian Benvenuti <benve@cisco.com>
Signed-off-by: NGovindarajulu Varadarajan <govindarajulu90@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The following patch sets the skb->rxhash and skb->q_number.
This is used by RPS and RFS. Kernel can make use of hw provided hash
instead of calculating the hash.
Signed-off-by: NGovindarajulu Varadarajan <govindarajulu90@gmail.com>
Signed-off-by: NNishank Trivedi <nistrive@cisco.com>
Signed-off-by: NChristian Benvenuti <benve@cisco.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The following patch adds multi tx support for enic.
Signed-off-by: NNishank Trivedi <nistrive@cisco.com>
Signed-off-by: NChristian Benvenuti <benve@cisco.com>
Signed-off-by: NGovindarajulu Varadarajan <govindarajulu90@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The last line of PARISC machines (C8000, RP34x0, etc.) have a BMC for
controlling temperature, fan speed and other stuff.  The BMC is
connected via a special bus and listed in the firmware device tree.
This change adds support for these BMCs to the IPMI driver.
Signed-off-by: NThomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I'd submitted this about a year ago but it never made it upstream.

The latest versions of the kernel drivers for ipmi can use ACPI to
determine the type of BMC device used in the system.  The following
patch adds a module alias so that udev will autoload the ipmi_si driver.
Signed-off-by: NJordan Hargrave <jordan_hargrave@dell.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

A couple of variables were getting warnings about being uninitialized.
It was a false warning, but initialize them, anyway.
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

On x86_64 there is a 4 byte hole between ->recv_type and ->addr.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

exynos_drm_connector.c now uses videomode helper API. Hence select
VIDEOMODE_HELPERS at DRM_EXYNOS level itself instead of at
DRM_EXYNOS_FIMD to avoid the following compilation error when FIMD
is not selected (introduced by commit cf796235a6 "drm/exynos: fimd:
replace struct fb_videomode with videomode"):
drivers/built-in.o: In function `exynos_drm_connector_get_modes':
drivers/gpu/drm/exynos/exynos_drm_connector.c:86:
undefined reference to `drm_display_mode_from_videomode'
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Since commit 383ffda2 ("ARM: EXYNOS: no more support non-DT
for EXYNOS SoCs"), Exynos platform is DT only. Hence remove
all the conditional macros and make the driver DT only.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Since commit 383ffda2 ("ARM: EXYNOS: no more support non-DT
for EXYNOS SoCs"), Exynos platform is DT only. Hence remove
all the conditional macros and make the driver DT only.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Since commit 383ffda2 ("ARM: EXYNOS: no more support non-DT
for EXYNOS SoCs"), Exynos platform is DT only. Hence remove
all the conditional macros and make the driver DT only.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Since commit 383ffda2 ("ARM: EXYNOS: no more support non-DT
for EXYNOS SoCs"), Exynos platform is DT only. Hence remove
all the conditional macros and make the driver DT only.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Since commit 383ffda2 ("ARM: EXYNOS: no more support non-DT
for EXYNOS SoCs"), Exynos platform is DT only. Hence remove
all the conditional macros and make the driver DT only.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

Exynos is a DT-only platform. Add this info to Kconfig.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

To address the case where physically contiguous memory
MAY NOT be a mandatory requirement for framebuffer for
the application calling exynos_drm_gem_dumb_create,
the patch adds a feature to get non physically contiguous
memory for framebuffer, if physically contiguous memory
allocation fails and if IOMMU is supported.
Signed-off-by: NVikas Sajjan <vikas.sajjan@linaro.org>
Signed-off-by: NArun Kumar <arun.kk@samsung.com>
Signed-off-by: NInki Dae <inki.dae@samsung.com>

The patch moves platfrom_data and device tree parsing
to separate function.
Signed-off-by: NAndrzej Hajda <a.hajda@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NInki Dae <inki.dae@samsung.com>