1
0
Fork 0
Commit Graph

524940 Commits (bbe96994b97d26d294965661c91e50cab8e35467)

Author SHA1 Message Date
Martin T. H. Sandsmark bbe96994b9 Add a default config based on imx6 default config 2016-07-28 13:27:21 +02:00
Martin T. H. Sandsmark e2d1a1c01b Add our DTS to the Makefile 2016-07-28 13:27:21 +02:00
Martin T. H. Sandsmark a631b2446b dts: let uboot set up and configure ldo 2016-07-28 13:27:20 +02:00
Martin T. H. Sandsmark aaf267a241 dts: Remove camera controller 2016-07-28 13:27:20 +02:00
Martin T. H. Sandsmark 660c64f31e dts: re-add ethernet controller 2016-07-28 13:27:19 +02:00
Martin T. H. Sandsmark 787ee94714 dts: Add digitizer 2016-07-28 13:27:19 +02:00
Martin T. H. Sandsmark 71de99f382 dts: Update i2c address of EPDC PMIC 2016-07-28 13:27:18 +02:00
Martin T. H. Sandsmark 73ef0f7c4a dts: Remove key rows we don't have 2016-07-28 13:27:18 +02:00
Martin T. H. Sandsmark a2f2f25ce7 dts: Remove hdmi and audio controllers 2016-07-28 13:27:17 +02:00
Martin T. H. Sandsmark dec3b828a8 dts: Set correct battery component 2016-07-28 13:27:17 +02:00
Pali Rohár d1cd0b23f4 power_supply: bq27xxx_battery: Add of modalias and match table when CONFIG_OF is enabled
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:17 +02:00
Liu Xiang fa1657e2d4 power: bq27xxx_battery: Fix bq27541 AveragePower register address
Currently in bq27541 driver, the average power register address is
incorrectly set to 0x76, which would result in an error:
bq27xxx-battery 2-0055: error reading average power register  10: -11
According to the bq27541 datasheet, fix this problem by setting
the average power register address to 0x24.

Fixes: d74534c277 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: Liu Xiang <liu.xiang6@zte.com.cn>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:16 +02:00
H. Nikolaus Schaller b43aef19f3 power: bq27xxx: fix register numbers of bq27500
bug: according to data sheet some register numbers are wrong.

tested: no

Fixes: d74534c277 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:16 +02:00
H. Nikolaus Schaller b51e7a7b2a power: bq27xxx: fix reading for bq27000 and bq27010
bug: the driver reports funny capacity values:

root@letux:/sys/class/power_supply/bq27000-battery# cat uevent
POWER_SUPPLY_NAME=bq27000-battery
POWER_SUPPLY_STATUS=Charging
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_VOLTAGE_NOW=3702000
POWER_SUPPLY_CURRENT_NOW=-464635
POWER_SUPPLY_CAPACITY=1536			<- over 100% is magic
POWER_SUPPLY_CAPACITY_LEVEL=Normal
POWER_SUPPLY_TEMP=311
POWER_SUPPLY_TIME_TO_FULL_NOW=10440
POWER_SUPPLY_TECHNOLOGY=Li-ion
POWER_SUPPLY_CHARGE_FULL=805450
POWER_SUPPLY_CHARGE_NOW=1068
POWER_SUPPLY_CHARGE_FULL_DESIGN=8844998	<- battery has just 1200 mAh
POWER_SUPPLY_CYCLE_COUNT=21
POWER_SUPPLY_ENERGY_NOW=0
POWER_SUPPLY_POWER_AVG=0
POWER_SUPPLY_HEALTH=Good
POWER_SUPPLY_MANUFACTURER=Texas Instruments

reason: the state of charge and the design capacity register are single
byte only. The design capacity returns the higer order byte.

tested: GTA04 with Openmoko/FIC HF08x battery (using hdq)

Fixes: d74534c277 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:15 +02:00
Andrew F. Davis 2b88c9bda2 power: bq27xxx_battery: Reorganize I2C into a module
Separate out I2C functionality into a module. This fixes several small
issues and simplifies the driver initialization.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:15 +02:00
NeilBrown 9b4d9c947b power: bq27xxx: don't fill system log by missing battery
Print message that battery is not calibrated only once
to avoid spamming the log.

Suggested-By: H. Nikolaus Schaller <hns@goldelico.com>
Suggested-By: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:14 +02:00
Sebastian Reichel feb14f6e28 power: bq27xxx_battery: move irq handler to i2c section
The IRQ handler is not used by the platform based
code resulting in a 'defined but not used' warning,
if CONFIG_BQ27XXX_I2C is not enabled.

Signed-off-by: Sebastian Reichel <sre@kernel.org>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Andrew F. Davis <afd@ti.com>
2016-07-28 13:27:14 +02:00
Sebastian Reichel bd7b740c59 power: bq27xxx_battery: fix platform probe
Add missing initialization of register mapping table to
platform probe function.

Signed-off-by: Sebastian Reichel <sre@kernel.org>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Andrew F. Davis <afd@ti.com>
2016-07-28 13:27:14 +02:00
Andrzej Hajda 63c0266711 power: bq27xxx_battery: fix signedness bug in bq27xxx_battery_read_health()
We need flags to be signed for the error handling to work.

The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].

[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576

Fixes: 74aab849f3 ('power: bq27xxx_battery: Cleanup health checking')
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-By: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:13 +02:00
Andrew F. Davis b71e73833a power: bq27xxx_battery: Add interrupt handling support
Some devices have a pin that can generate an interrupt when
the battery's status changes. Add an interrupt handler to
read the new battery status.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:13 +02:00
Andrew F. Davis adb40ce783 power: bq27xxx_battery: Cleanup health checking
Reorganize the logic checking battery health and add under temperature
condition checking.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:12 +02:00
Andrew F. Davis a54a37f565 power: bq27xxx_battery: Add support for additional bq27xxx family devices
Add support for additional devices and register equivalent family devices
including the bq27010, bq27210, bq27500, bq27510, bq27520, bq27530,
bq27531, bq27541, bq27542, bq27546, bq27545, bq27441, bq27421, and the
bq27641.

To facilitate this process the register mapings have been moved to tables
and other small cleanups have been made.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:12 +02:00
Andrew F. Davis 02c1df11c4 power: bq27xxx_battery: Fix typos and change naming for state of charge functions
Fix typos and change "relative state of charge" to "state of charge" as not
all supported devices use relative state of charge.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:12 +02:00
Andrew F. Davis bb64740518 power: bq27xxx_battery: Platform initialization must declare a device
When initialized as a platform device the initializer must now specify
a device. An empty device name is no longer valid.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:11 +02:00
Andrew F. Davis 84c2d7d76e power: bq27x00_battery: Renaming for consistency
Rename functions that are used by multiple devices. New devices
have been added and the function names and driver name are no longer
general enough for the functionality they provide.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Acked-by: GUAN Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:11 +02:00
Andrew F. Davis 64f71c5e04 power: bq27x00_battery: Remove unneeded i2c MODULE_ALIAS
The MODULE_DEVICE_TABLE macro automatically adds all needed
i2c MODULE_ALIASes so remove the extra MODULE_ALIAS.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:10 +02:00
Andrew F. Davis 71cfc19f47 power: bq27x00_battery: Checkpatch fixes
Remove space before tab.
Remove unnecessary line continuations.
Add braces to else statement.
Remove unnecessary parentheses.
Remove unneeded blank lines.
Remove unnecessary 'out of memory' message.
Add missing line after declarations.
Change use of printk to pr_err.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:10 +02:00
Andrew F. Davis 6555e3ca2b power: bq27x00_battery: Fix function parameter alignment
Fix the alignment of function parameters on new lines.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:09 +02:00
Andrew F. Davis b15789392d power: bq27x00_battery: Fix lines over 80 characters long
Shorted lines over 80 characters long by reducing tab count.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:09 +02:00
Andrew F. Davis 9d22b8a56e power: bq27x00_battery: Add manufacturer property
Add the manufacturer property to the bq27x00 driver.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
2016-07-28 13:27:09 +02:00
Martin T. H. Sandsmark 30cf46451a Port wacom_i2c to device tree 2016-07-28 13:27:00 +02:00
Martin T. H. Sandsmark 312eed7c11 Create DTS for Zero Gravitas, based on IMX6SLEVK 2016-07-26 16:23:50 +02:00
Steven Rostedt 0c0844f9fa 4.1.28 Fix bad backport of 8f182270df "mm/swap.c: flush lru pvecs on compound page arrival"
When I pulled in 4.1.28 into my stable 4.1-rt tree and ran the tests,
it crashed with a severe OOM killing everything. I then tested 4.1.28
without -rt and it had the same issue. I did a bisect between 4.1.27
and 4.1.28 and found that the bug started at:

commit 8f182270df "mm/swap.c: flush lru pvecs on compound page
arrival"

Looking at that patch and what's in mainline, I see that there's a
mismatch in one of the hunks:

Mainline:

@@ -391,9 +391,8 @@ static void __lru_cache_add(struct page *page)
        struct pagevec *pvec = &get_cpu_var(lru_add_pvec);

        get_page(page);
-       if (!pagevec_space(pvec))
+       if (!pagevec_add(pvec, page) || PageCompound(page))
                __pagevec_lru_add(pvec);
-       pagevec_add(pvec, page);
        put_cpu_var(lru_add_pvec);
 }

Stable 4.1.28:

@@ -631,9 +631,8 @@ static void __lru_cache_add(struct page *page)
        struct pagevec *pvec = &get_cpu_var(lru_add_pvec);

        page_cache_get(page);
-       if (!pagevec_space(pvec))
+       if (!pagevec_space(pvec) || PageCompound(page))
                __pagevec_lru_add(pvec);
-       pagevec_add(pvec, page);
        put_cpu_var(lru_add_pvec);
 }

Where mainline replace pagevec_space() with pagevec_add, and stable did
not.

Fixing this makes the OOM go away.

Note, 3.18 has the same bug.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
2016-07-22 10:30:03 -03:00
Otavio Salvador 00850640da Linux 4.1.28
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXhoYGAAoJEN6mb/eXdyzc82MP/0yCx7A52zsa2OwiMp/07+Gl
 +/wMJqJQgW2xFM4BLtAaPFdPPhW1b7RZy4+E+/xWVgsxOMZpHebBU4NS9D3R5TA0
 GlxU7JrRYdHyiYlfsAcde3/2CplHoXemHf5MDUm3keVrMAbNIvc7NYE+vWzYqehB
 GLWTKn/48+c/pNly8BqF1kaZeSpVZwUTwqqXkhZ/GoU4d+u5BxvPntNRoypyVlMj
 wG0SXIF/JW4a6pDE8BUgYrlcB4NTgmDD+ZDykW+nzpMxQrREAGI8Pk6OoFraG7aM
 MIp/19rCxytOJROvE2O84dS7/AC/ou6wQ9BvVjv1udDFF9S83ZhaBsiQ8of8Ipin
 yN+P5GTD3jNh665FHmCDO3qpDnA8owah38/I/2Cy9T45dz87QlvH/bEvQ0mRv5nb
 0fwBLBaXCCbdRmfFGuh9G6Mz/mF4A5aj8VhPLCDNFsXBIkJBnuLRDpyZoRN/pML5
 Y61EES90n6Rwe+WvKgRLo2YBkbs9Cc9Su9COr/CkwfCbKEZgQ65CA0DaYxK/OyBe
 XyObVovImnzC6rRrdNvoFgsbZkR32zNVNjtNjAAYJhUZTUIFV61quhOJdkIQfLoH
 RYL5CfhkzPV7qocNLuoQeuESigsYfVsdlWmExohjsZyHGiPmTb+gkWjexvILK0WV
 /rTajzu793hKkEwnfLSo
 =p3K7
 -----END PGP SIGNATURE-----

Merge tag 'v4.1.28' into 4.1-1.0.x-imx

Linux 4.1.28

* tag 'v4.1.28': (312 commits)
  Linux 4.1.28
  tmpfs: fix regression hang in fallocate undo
  netfilter: x_tables: introduce and use xt_copy_counters_from_user
  netfilter: x_tables: do compat validation via translate_table
  netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
  netfilter: ip6_tables: simplify translate_compat_table args
  netfilter: ip_tables: simplify translate_compat_table args
  netfilter: arp_tables: simplify translate_compat_table args
  netfilter: x_tables: don't reject valid target size on some architectures
  netfilter: x_tables: validate all offsets and sizes in a rule
  netfilter: x_tables: check for bogus target offset
  netfilter: x_tables: check standard target size too
  netfilter: x_tables: add compat version of xt_check_entry_offsets
  netfilter: x_tables: assert minimum target size
  netfilter: x_tables: kill check_entry helper
  netfilter: x_tables: add and use xt_check_entry_offsets
  netfilter: x_tables: validate targets of jumps
  netfilter: x_tables: don't move to non-existent next rule
  netfilter: x_tables: fix unconditional helper
  netfilter: x_tables: make sure e->next_offset covers remaining blob size
  ...

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
2016-07-14 07:58:03 -03:00
Sasha Levin 5880876e94 Linux 4.1.28
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-13 14:17:46 -04:00
Otavio Salvador 3477bd7c6d Merge tag 'rel_imx_4.1.15_1.2.0_ga' into 4.1-1.0.x-imx
* tag 'rel_imx_4.1.15_1.2.0_ga': (56 commits)
  MLK-12948 ARM: dts: imx7d-sdb: change the hardware reset gpio for mipi dsi
  MLK-12946 media: pxp-v4l2: correct the 32 bpp pixel format passed to pxp
  mmc: mmc: fix switch timeout issue caused by jiffies precision
  mmc: core: fix __mmc_switch timeout caused by preempt
  MLK-12934-2 mmc: sdhci-esdhc-imx: do not touch other bit when config DTOCV
  MLK-12934-1 mmc: sdhci-esdhc-imx: correct the max timeout count
  MLK-12944 fix makefile miss imx7d-12x12-lpddr3-arm2-pcie.dtb
  MLK-12935 ARM: imx: switch system counter clock to 32K in suspend
  MLK-12902: usdhc: Revert "MLK-11685-5 mmc: sdhci-esdhc-imx: no need busfreq for imx6qdl"
  MLK-12899-2 video: mipi_dsi_samsung: add panel 'TFT3P5581' driver.
  MLK-12899-1 ARM: dts: imx7d-sdb: add dts support for panel 'TFT3P5581'.
  MLK-12901-3 video: mipi_dsi_samsung: alwasy use video mode to transfer data and cmds.
  MLK-12901-2 video: mipi_dsi_samsung: add 10msec delay after all the pkt write operation.
  MLK-12901-1 video: mipi_dsi_samsung: correct the hardware reset calling position.
  MLK_12886-2 video: mxsfb: handle the assert gpio in driver to support deferred probe
  MLK-12886-1 ARM: dts: imx7d-sdb: the assert gpio for lcdif should be active low
  MLK-12898: ov5640 mipi: Add more delay to wait sensor stable
  MLK-12880 arm: dts: imx7d: correct the PAD_GPIO1_IO01 pin ctrl setting
  MLK-12876: mipi csi: Remove regulator enable code when driver probe
  MLK-12860-4 usb: chipidea: imx: add HSIC support for imx7d
  ...
2016-07-13 10:17:30 -03:00
Hugh Dickins 116c75f642 tmpfs: fix regression hang in fallocate undo
[ Upstream commit 7f55656703 ]

The well-spotted fallocate undo fix is good in most cases, but not when
fallocate failed on the very first page.  index 0 then passes lend -1
to shmem_undo_range(), and that has two bad effects: (a) that it will
undo every fallocation throughout the file, unrestricted by the current
range; but more importantly (b) it can cause the undo to hang, because
lend -1 is treated as truncation, which makes it keep on retrying until
every page has gone, but those already fully instantiated will never go
away.  Big thank you to xfstests generic/269 which demonstrates this.

Fixes: b9b4bb26af ("tmpfs: don't undo fallocate past its last page")
Cc: stable@vger.kernel.org
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-12 08:41:10 -04:00
Florian Westphal b7aa372fec netfilter: x_tables: introduce and use xt_copy_counters_from_user
[ Upstream commit d7591f0c41 ]

The three variants use same copy&pasted code, condense this into a
helper and use that.

Make sure info.name is 0-terminated.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:37 -04:00
Florian Westphal af815d264b netfilter: x_tables: do compat validation via translate_table
[ Upstream commit 09d9686047 ]

This looks like refactoring, but its also a bug fix.

Problem is that the compat path (32bit iptables, 64bit kernel) lacks a few
sanity tests that are done in the normal path.

For example, we do not check for underflows and the base chain policies.

While its possible to also add such checks to the compat path, its more
copy&pastry, for instance we cannot reuse check_underflow() helper as
e->target_offset differs in the compat case.

Other problem is that it makes auditing for validation errors harder; two
places need to be checked and kept in sync.

At a high level 32 bit compat works like this:
1- initial pass over blob:
   validate match/entry offsets, bounds checking
   lookup all matches and targets
   do bookkeeping wrt. size delta of 32/64bit structures
   assign match/target.u.kernel pointer (points at kernel
   implementation, needed to access ->compatsize etc.)

2- allocate memory according to the total bookkeeping size to
   contain the translated ruleset

3- second pass over original blob:
   for each entry, copy the 32bit representation to the newly allocated
   memory.  This also does any special match translations (e.g.
   adjust 32bit to 64bit longs, etc).

4- check if ruleset is free of loops (chase all jumps)

5-first pass over translated blob:
   call the checkentry function of all matches and targets.

The alternative implemented by this patch is to drop steps 3&4 from the
compat process, the translation is changed into an intermediate step
rather than a full 1:1 translate_table replacement.

In the 2nd pass (step #3), change the 64bit ruleset back to a kernel
representation, i.e. put() the kernel pointer and restore ->u.user.name .

This gets us a 64bit ruleset that is in the format generated by a 64bit
iptables userspace -- we can then use translate_table() to get the
'native' sanity checks.

This has two drawbacks:

1. we re-validate all the match and target entry structure sizes even
though compat translation is supposed to never generate bogus offsets.
2. we put and then re-lookup each match and target.

THe upside is that we get all sanity tests and ruleset validations
provided by the normal path and can remove some duplicated compat code.

iptables-restore time of autogenerated ruleset with 300k chains of form
-A CHAIN0001 -m limit --limit 1/s -j CHAIN0002
-A CHAIN0002 -m limit --limit 1/s -j CHAIN0003

shows no noticeable differences in restore times:
old:   0m30.796s
new:   0m31.521s
64bit: 0m25.674s

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:36 -04:00
Florian Westphal 2756b2a324 netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
[ Upstream commit 0188346f21 ]

Always returned 0.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:36 -04:00
Florian Westphal 05e089b3a2 netfilter: ip6_tables: simplify translate_compat_table args
[ Upstream commit 329a080712 ]

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:36 -04:00
Florian Westphal cd76c8c82c netfilter: ip_tables: simplify translate_compat_table args
[ Upstream commit 7d3f843eed ]

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:36 -04:00
Florian Westphal 7bdf4f4982 netfilter: arp_tables: simplify translate_compat_table args
[ Upstream commit 8dddd32756 ]

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:35 -04:00
Florian Westphal d97246b5d1 netfilter: x_tables: don't reject valid target size on some architectures
[ Upstream commit 7b7eba0f35 ]

Quoting John Stultz:
  In updating a 32bit arm device from 4.6 to Linus' current HEAD, I
  noticed I was having some trouble with networking, and realized that
  /proc/net/ip_tables_names was suddenly empty.
  Digging through the registration process, it seems we're catching on the:

   if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
       target_offset + sizeof(struct xt_standard_target) != next_offset)
         return -EINVAL;

  Where next_offset seems to be 4 bytes larger then the
  offset + standard_target struct size.

next_offset needs to be aligned via XT_ALIGN (so we can access all members
of ip(6)t_entry struct).

This problem didn't show up on i686 as it only needs 4-byte alignment for
u64, but iptables userspace on other 32bit arches does insert extra padding.

Reported-by: John Stultz <john.stultz@linaro.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Fixes: 7ed2abddd2 ("netfilter: x_tables: check standard target size too")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:35 -04:00
Florian Westphal a605e7476c netfilter: x_tables: validate all offsets and sizes in a rule
[ Upstream commit 13631bfc60 ]

Validate that all matches (if any) add up to the beginning of
the target and that each match covers at least the base structure size.

The compat path should be able to safely re-use the function
as the structures only differ in alignment; added a
BUILD_BUG_ON just in case we have an arch that adds padding as well.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:35 -04:00
Florian Westphal 451e4403bc netfilter: x_tables: check for bogus target offset
[ Upstream commit ce683e5f9d ]

We're currently asserting that targetoff + targetsize <= nextoff.

Extend it to also check that targetoff is >= sizeof(xt_entry).
Since this is generic code, add an argument pointing to the start of the
match/target, we can then derive the base structure size from the delta.

We also need the e->elems pointer in a followup change to validate matches.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:34 -04:00
Florian Westphal 73bfda1c49 netfilter: x_tables: check standard target size too
[ Upstream commit 7ed2abddd2 ]

We have targets and standard targets -- the latter carries a verdict.

The ip/ip6tables validation functions will access t->verdict for the
standard targets to fetch the jump offset or verdict for chainloop
detection, but this happens before the targets get checked/validated.

Thus we also need to check for verdict presence here, else t->verdict
can point right after a blob.

Spotted with UBSAN while testing malformed blobs.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:34 -04:00
Florian Westphal acbcf85306 netfilter: x_tables: add compat version of xt_check_entry_offsets
[ Upstream commit fc1221b3a1 ]

32bit rulesets have different layout and alignment requirements, so once
more integrity checks get added to xt_check_entry_offsets it will reject
well-formed 32bit rulesets.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:34 -04:00
Florian Westphal aae91919c9 netfilter: x_tables: assert minimum target size
[ Upstream commit a08e4e190b ]

The target size includes the size of the xt_entry_target struct.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:33 -04:00
Florian Westphal 801cd32774 netfilter: x_tables: kill check_entry helper
[ Upstream commit aa412ba225 ]

Once we add more sanity testing to xt_check_entry_offsets it
becomes relvant if we're expecting a 32bit 'config_compat' blob
or a normal one.

Since we already have a lot of similar-named functions (check_entry,
compat_check_entry, find_and_check_entry, etc.) and the current
incarnation is short just fold its contents into the callers.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:33 -04:00