Documentation/sysctl/fs.txt | 42 42 + 0 - 0 !
fs/namei.c | 124 124 + 0 - 0 !
include/linux/fs.h | 2 2 + 0 - 0 !
kernel/sysctl.c | 18 18 + 0 - 0 !
4 files changed, 186 insertions(+)

 [1/2] fs: add link restrictions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 800179c9b8a1e796e441674776d11cd4c05d61d7 upstream.

This adds symlink and hardlink restrictions to the Linux VFS.

Symlinks:

A long-standing class of security issues is the symlink-based
time-of-check-time-of-use race, most commonly seen in world-writable
directories like /tmp. The common method of exploitation of this flaw
is to cross privilege boundaries when following a given symlink (i.e. a
root process follows a symlink belonging to another user). For a likely
incomplete list of hundreds of examples across the years, please see:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp

The solution is to permit symlinks to only be followed when outside
a sticky world-writable directory, or when the uid of the symlink and
follower match, or when the directory owner matches the symlink's owner.

Some pointers to the history of earlier discussion that I could find:

 1996 Aug, Zygo Blaxell
  http://marc.info/?l=bugtraq&m=87602167419830&w=2
 1996 Oct, Andrew Tridgell
  http://lkml.indiana.edu/hypermail/linux/kernel/9610.2/0086.html
 1997 Dec, Albert D Cahalan
  http://lkml.org/lkml/1997/12/16/4
 2005 Feb, Lorenzo Hernndez Garca-Hierro
  http://lkml.indiana.edu/hypermail/linux/kernel/0502.0/1896.html
 2010 May, Kees Cook
  https://lkml.org/lkml/2010/5/30/144

Past objections and rebuttals could be summarized as:

 - Violates POSIX.
   - POSIX didn't consider this situation and it's not useful to follow
     a broken specification at the cost of security.
 - Might break unknown applications that use this feature.
   - Applications that break because of the change are easy to spot and
     fix. Applications that are vulnerable to symlink ToCToU by not having
     the change aren't. Additionally, no applications have yet been found
     that rely on this behavior.
 - Applications should just use mkstemp() or O_CREATE|O_EXCL.
   - True, but applications are not perfect, and new software is written
     all the time that makes these mistakes; blocking this flaw at the
     kernel is a single solution to the entire class of vulnerability.
 - This should live in the core VFS.
   - This should live in an LSM. (https://lkml.org/lkml/2010/5/31/135)
 - This should live in an LSM.
   - This should live in the core VFS. (https://lkml.org/lkml/2010/8/2/188)

Hardlinks:

On systems that have user-writable directories on the same partition
as system files, a long-standing class of security issues is the
hardlink-based time-of-check-time-of-use race, most commonly seen in
world-writable directories like /tmp. The common method of exploitation
of this flaw is to cross privilege boundaries when following a given
hardlink (i.e. a root process follows a hardlink created by another
user). Additionally, an issue exists where users can "pin" a potentially
vulnerable setuid/setgid file so that an administrator will not actually
upgrade a system fully.

The solution is to permit hardlinks to only be created when the user is
already the existing file's owner, or if they already have read/write
access to the existing file.

Many Linux users are surprised when they learn they can link to files
they have no access to, so this change appears to follow the doctrine
of "least surprise". Additionally, this change does not violate POSIX,
which states "the implementation may require that the calling process
has permission to access the existing file"[1].

This change is known to break some implementations of the "at" daemon,
though the version used by Fedora and Ubuntu has been fixed[2] for
a while. Otherwise, the change has been undisruptive while in use in
Ubuntu for the last 1.5 years.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/linkat.html

fs/namei.c | 2 2 + 0 - 0 !
include/linux/audit.h | 4 4 + 0 - 0 !
kernel/audit.c | 21 21 + 0 - 0 !
3 files changed, 27 insertions(+)

 [2/2] fs: add link restriction audit reporting

commit a51d9eaa41866ab6b4b6ecad7b621f8b66ece0dc upstream.

Adds audit messages for unexpected link restriction violations so that
system owners will have some sort of potentially actionable information
about misbehaving processes.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

kernel/audit.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 fs: handle failed audit_log_start properly

commit d1c7d97ad58836affde6e39980b96527510b572e upstream.

audit_log_start() may return NULL, this is unchecked by the caller in
audit_log_link_denied() and could cause a NULL ptr deref.

Introduced by commit a51d9eaa ("fs: add link restriction audit reporting").

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

fs/namei.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fs: prevent use after free in auditing when symlink following was
 denied

commit ffd8d101a3a7d3f2e79deee1e342801703b6dc70 upstream.

Commit "fs: add link restriction audit reporting" has added auditing of failed
attempts to follow symlinks. Unfortunately, the auditing was being done after
the struct path structure was released earlier.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

drivers/hid/Kconfig | 6 6 + 0 - 0 !
drivers/hid/Makefile | 1 1 + 0 - 0 !
drivers/hid/hid-hyperv.c | 582 582 + 0 - 0 !
3 files changed, 589 insertions(+)

 [patch 02/77] hid: move the hid-hyperv driver out of staging

commit b95f5bcb811e3905b5376f87789da8d097fee682 upstream.

The file  hid-hyperv.c implements a hid compliant mouse driver for use on a
Hyper-V based system. This driver is currently in the staging area and as part
of the effort to move this driver out of staging, I had posted the driver code
for community review a few weeks ago. This current patch addresses all the
review comments I have gotten to date. All the relevant patches have already
been submitted to the staging tree as well.

As per Greg's suggestion, this patch does not get rid of the code from
the staging area. Once the mouse driver lands under the hid directory,
we will cleanup the staging directory.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

drivers/staging/hv/storvsc_drv.c | 30 25 + 5 - 0 !
1 file changed, 25 insertions(+), 5 deletions(-)

 [patch 03/77] staging: hv: storvsc: use mempools to allocate struct
 storvsc_cmd_request

commit 4e03e697c5446146318cdb6344af0060541cbc1c upstream.

We intend to use the storage driver to manage the root device.
To avoid deadlocks, use mempools to allocate struct storvsc_cmd_request.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
[bwh: Adjusted to apply after backported commit 56b26e69c828
 'Drivers: scsi: storvsc: Implement a eh_timed_out handler'

drivers/staging/hv/storvsc_drv.c | 42 24 + 18 - 0 !
1 file changed, 24 insertions(+), 18 deletions(-)

 [patch 04/77] staging: hv: storvsc: cleanup error handling in the
 probe function

commit 225ce6eab741d51d565f67ce9065c596c6535f25 upstream.

Cleanup error handling in the probe function.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch 05/77] staging: hv: storvsc: fixup the error when processing
 SET_WINDOW command

commit 59e00e744d2413430ebaa09a5fdb61e9ad02a492 upstream.

Fixup the error when processing SET_WINDOW command.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 20 6 + 14 - 0 !
1 file changed, 6 insertions(+), 14 deletions(-)

 [patch 06/77] staging: hv: storvsc: fix error handling
 storvsc_host_reset()

commit a00e8224c19fa5ba3007da00d850865cbefcaabd upstream.

Fix error handling storvsc_host_reset(). I would like to thank
Long Li <longli@microsoft.com> for reporting this.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Long Li <longli@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 14 5 + 9 - 0 !
1 file changed, 5 insertions(+), 9 deletions(-)

 [patch 07/77] staging: hv: storvsc: use the accessor function
 shost_priv()

commit 7f33f30a67cebbdaa938e34c5144424d2f0ce9cc upstream.

Use the accessor function shost_priv().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 19 5 + 14 - 0 !
1 file changed, 5 insertions(+), 14 deletions(-)

 [patch 08/77] staging: hv: storvsc: use the unlocked version
 queuecommand

commit bab445e12b45153282fb7d39143516e11987deaa upstream.

Use the unlocked version queuecommand.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch 09/77] staging: hv: storvsc: use the macro kbuild_modname

commit fafb0efc303a916f9902cbadddef3ea125720c1b upstream.

Use the macro KBUILD_MODNAME.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 2 0 + 2 - 0 !
1 file changed, 2 deletions(-)

 [patch 10/77] staging: hv: storvsc: get rid of an unnecessary
 forward declaration

commit a404c1ff5556fe29460c097a34d2abe10ddd6e0a upstream.

Get rid of an unnecessary forward declaration.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 5 3 + 2 - 0 !
1 file changed, 3 insertions(+), 2 deletions(-)

 [patch 11/77] staging: hv: storvsc: upgrade the vmstor protocol
 version

commit 2b9525f511791758b394643b61754a9688e0707d upstream.

In preparation for supporting hot add/remove of scsi devices,
upgrade the vmstor protocol version.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 38 38 + 0 - 0 !
1 file changed, 38 insertions(+)

 [patch 12/77] staging: hv: storvsc: support hot add of scsi disks

commit 126757998a50659f79a3f1ff23fccfc40ff1bf5c upstream.

Support hot add of scsi disks.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 45 45 + 0 - 0 !
1 file changed, 45 insertions(+)

 [patch 13/77] staging: hv: storvsc: support hot-removing of scsi
 devices

commit b401731985bfa7c02e4e5673a151b29ae7180fce upstream.

Support hot-removing of scsi devices.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/hv_mouse.c | 4 1 + 3 - 0 !
drivers/staging/hv/netvsc.c | 11 3 + 8 - 0 !
2 files changed, 4 insertions(+), 11 deletions(-)

 [patch 14/77] staging: hv: use kmemdup rather than duplicating its
 implementation

commit 27b7923035f737a7e6384d0084e34706ea068040 upstream.

Use kmemdup rather than duplicating its implementation

The semantic patch that makes this change is available
in scripts/coccinelle/api/memdup.cocci.

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hv/vmbus_drv.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch 15/77] staging: hv: vmbus: support building the vmbus driver
 as part of the kernel

commit 43d4e119f944a41a7694552353635ad9b2cd8b37 upstream.

Modify the way we initialize the vmbus driver so that all the hyper-v drivers
can be linked with the kernel and still ensure that the vmbus driver
is fully initialized before the drivers that depend upon the vmbus
driver attempt to initialize.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hv/Kconfig | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 [patch 16/77] hv: add kconfig menu entry

commit 124a6b4c4dae0317a0689a42ed0c68fabeb10c8d upstream.

Most of the drivers/*/Kconfig files define a menu entry. Define
a menu item for hv too such that it becomes uniform with e.g.
virtio for at least "make xconfig" and "make menuconfig" users.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: James Bottomley <JBottomley@Parallels.com>
Cc: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/Kconfig | 6 0 + 6 - 0 !
drivers/staging/hv/Makefile | 1 0 + 1 - 0 !
drivers/staging/hv/hv_mouse.c | 597 0 + 597 - 0 !
3 files changed, 604 deletions(-)

 [patch 17/77] staging: hv: mousevsc: remove the mouse driver from
 the staging tree

commit 045b1684bc21575793a099490938d197555eb128 upstream.

The mouse driver for Hyper-V is a HID compliant mouse driver.
Now that all relevant review comments have been addressed,
Jiri has agreed to merge this mouse driver into 3.3 hid.git.
This patch takes care of removing the mouse driver from the
staging area. Greg, if you can ack this patch, Jiri will proceed
with his merge.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>

drivers/net/Kconfig | 2 2 + 0 - 0 !
drivers/net/Makefile | 2 2 + 0 - 0 !
drivers/net/hyperv/Kconfig | 5 5 + 0 - 0 !
drivers/net/hyperv/Makefile | 3 3 + 0 - 0 !
drivers/net/hyperv/hyperv_net.h | 1058 1058 + 0 - 0 !
drivers/net/hyperv/netvsc.c | 939 939 + 0 - 0 !
drivers/net/hyperv/netvsc_drv.c | 456 456 + 0 - 0 !
drivers/net/hyperv/rndis_filter.c | 855 855 + 0 - 0 !
drivers/staging/hv/Kconfig | 6 0 + 6 - 0 !
drivers/staging/hv/Makefile | 2 0 + 2 - 0 !
drivers/staging/hv/TODO | 1 0 + 1 - 0 !
drivers/staging/hv/hyperv_net.h | 1058 0 + 1058 - 0 !
drivers/staging/hv/netvsc.c | 939 0 + 939 - 0 !
drivers/staging/hv/netvsc_drv.c | 456 0 + 456 - 0 !
drivers/staging/hv/rndis_filter.c | 855 0 + 855 - 0 !
15 files changed, 3320 insertions(+), 3317 deletions(-)

 [patch 18/77] staging: hv: move hv_netvsc out of staging area

commit 95fa0405c5991726e06c08ffcd8ff872f7fb4f2d upstream.

hv_netvsc has been reviewed on netdev mailing list on 6/09/2011.
All recommended changes have been made. We are requesting to move
it out of staging area.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: KY Srinivasan <kys@microsoft.com>
Signed-off-by: Mike Sterling <Mike.Sterling@microsoft.com>

drivers/net/hyperv/netvsc.c | 8 5 + 3 - 0 !
1 file changed, 5 insertions(+), 3 deletions(-)

 [patch 19/77] net/hyperv: fix long lines in netvsc.c

commit c18132005e711c07523d8c6602e5b2266ab9a0f2 upstream.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/hyperv_net.h | 24 24 + 0 - 0 !
drivers/net/hyperv/netvsc_drv.c | 46 43 + 3 - 0 !
drivers/net/hyperv/rndis_filter.c | 23 1 + 22 - 0 !
3 files changed, 68 insertions(+), 25 deletions(-)

 [patch 20/77] net/hyperv: add support for promiscuous mode setting

commit d426b2e3d91f8ec3203f8852e7ad0153b5dfdf71 upstream.

Add code to accept promiscuous mode setting, and pass it to
RNDIS filter.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 18 1 + 17 - 0 !
1 file changed, 1 insertion(+), 17 deletions(-)

 [patch 21/77] staging: hv: storvsc: disable clustering

commit 039db52de9c5682ee10a3cd69f2d76db40b1dee0 upstream.

Disable clustering, since the host side on Hyper-V requires that
each I/O element not exceed the page size. As part of this
cleanup, get rid of the function to merge bvecs, as the primary
reason for this function was to avoid having an element exceed
the page size.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 5 0 + 5 - 0 !
1 file changed, 5 deletions(-)

 [patch 22/77] staging: hv: storvsc: cleanup storvsc_device_alloc()

commit 2781866484624fabbe373b95cfd20d44d2c9a69e upstream.

The code in storvsc_device_alloc() is not needed as this would be
done by default. Get rid of it. We still keep the function as we use
this hook to allocate per-LUN memory pools in a later patch.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 5 2 + 3 - 0 !
1 file changed, 2 insertions(+), 3 deletions(-)

 [patch 23/77] staging: hv: storvsc: fix a bug in
 storvsc_command_completion()

commit a768a76d55c2798bbd86b81f50ef740312d69935 upstream.

Fix a bug in storvsc_command_completion() that leaks memory when scatter/gather
lists are used on the "write" side.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 24 22 + 2 - 0 !
1 file changed, 22 insertions(+), 2 deletions(-)

 [patch 24/77] staging: hv: storvsc: fix a bug in
 copy_from_bounce_buffer()

commit 10c43dd4c4403d35fc6477d547aa3a38b466b310 upstream.

Fix a bug in copy_from_bounce_buffer().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/storvsc_drv.c | 106 62 + 44 - 0 !
1 file changed, 62 insertions(+), 44 deletions(-)

 [patch 25/77] staging: hv: storvsc: implement per device memory
 pools

commit ce3e301c442f7beffd049908a007697753766cf7 upstream.

The current code implemented a per-HBA memory pool mechanism. For IDE disks
managed by this driver, there is a one to one correspondance between the
block device and the associated virtual HBA and since currently only IDE devices
can be the boot device, this addressed the deadlock issues that were raised during
the review process. This patch implements a per-lun memory pool mechanism.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/hv/TODO | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 [patch 26/77] staging: hv: update todo file

commit 0c9d19646249e0124f1d82fb939e5ba76cb1af3c upstream.

Hank is no longer at Microsoft, so remove his email address as it
bounces.

Cc: KY Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hid/hid-hyperv.c | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 [patch 27/77] hid: hv_mouse: properly add the hid device

commit 74c4fb058083b47571a4f76dcfce95085f2d8098 upstream.

We need to properly add the hid device to correctly initialize the sysfs state.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Fuzhou Chen <fuzhouch@microsoft.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

drivers/staging/hv/storvsc_drv.c | 9 6 + 3 - 0 !
1 file changed, 6 insertions(+), 3 deletions(-)

 [patch 28/77] staging: hv: storvsc: fix a bug in
 create_bounce_buffer()

commit 6e8087a4fae41ae1518babbf1ef46f105d702bfd upstream.

Set the length field of the scatter gather elements correctly when we create
the bounce buffer. When we use the bounce buffer for a "write" operation,
the act of copying to the bounce buffer, correctly deals with this issue.
However, on the "read" side, the current code was not correctly setting
the buffer length. Fix this bug. Note that when we copy from the bounce
buffer (for the read case), the amount we copy is controlled by the original
scatter gather list given to the driver.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Dadok Milan <dadok@kvados.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/netvsc.c | 14 11 + 3 - 0 !
drivers/net/hyperv/netvsc_drv.c | 24 1 + 23 - 0 !
2 files changed, 12 insertions(+), 26 deletions(-)

 [patch 29/77] net/hyperv: fix the stop/wake queue mechanism

commit 1d06825b0ede541f63b5577435abd2fc649a9b5e upstream.

The ring buffer is only used to pass meta data for outbound packets. The
actual payload is accessed by DMA from the host. So the stop/wake queue
mechanism based on counting and comparing number of pages sent v.s. number
of pages in the ring buffer is wrong. Also, there is a race condition in
the stop/wake queue calls, which can stop xmit queue forever.

The new stop/wake queue mechanism is based on the actual bytes used by
outbound packets in the ring buffer. The check for number of outstanding
sends after stop queue prevents the race condition that can cause wake
queue happening earlier than stop queue.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reported-by: Long Li <longli@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hv/channel_mgmt.c | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 [patch 30/77] drivers: hv: fix a memory leak

commit 8b8ee6753154dd6cfe397e0d29fe7f90a8adb50b upstream.

There was a memory leak in a failure path in vmbus_process_offer().
Fix it.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hv/channel_mgmt.c | 11 11 + 0 - 0 !
drivers/hv/hv.c | 3 3 + 0 - 0 !
drivers/hv/hyperv_vmbus.h | 1 1 + 0 - 0 !
drivers/hv/vmbus_drv.c | 11 11 + 0 - 0 !
4 files changed, 26 insertions(+)

 [patch 31/77] drivers: hv: make the vmbus driver unloadable

commit 93e5bd06a95343c701361fa009cdc5a653d6ec8e upstream.

It turns out that the vmbus driver can be made unloadable. Make it
unloadable.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/hv/hv.c | 5 0 + 5 - 0 !
1 file changed, 5 deletions(-)

 [patch 32/77] drivers: hv: get rid of an unnecessary check in hv.c

commit 175cad266774d09c57a62c65baa6b4e1edafdf3a upstream.

In preparation for eventually supporting kexec in Linux VMs on Hyper-V,
get rid of an unnecessary check in hv_init().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/hyperv_net.h | 6 2 + 4 - 0 !
drivers/net/hyperv/netvsc.c | 53 4 + 49 - 0 !
drivers/net/hyperv/netvsc_drv.c | 22 2 + 20 - 0 !
drivers/net/hyperv/rndis_filter.c | 21 2 + 19 - 0 !
4 files changed, 10 insertions(+), 92 deletions(-)

 [patch 33/77] net/hyperv: remove unnecessary kmap_atomic in netvsc
 driver

commit 453263421f88b4a7e508c2e7b639c97e99c5b118 upstream.

__get_free_pages() doesn't return HI memory, so the memory is always mapped.
kmap_atomic() is not necessary here. This patch removes the kmap_atomic()
calls and related code for locking and page manipulation.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/hyperv_net.h | 101 94 + 7 - 0 !
drivers/net/hyperv/netvsc.c | 82 55 + 27 - 0 !
2 files changed, 149 insertions(+), 34 deletions(-)

 [patch 34/77] net/hyperv: add netvsp protocol version negotiation

commit f157e78de5923dfb209355f3005ce1b5d64f7998 upstream.

Automatically negotiate the highest protocol version mutually recognized by
both host and guest.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/hyperv_net.h | 8 3 + 5 - 0 !
drivers/net/hyperv/netvsc.c | 6 3 + 3 - 0 !
drivers/net/hyperv/netvsc_drv.c | 70 61 + 9 - 0 !
include/linux/hyperv.h | 2 1 + 1 - 0 !
4 files changed, 68 insertions(+), 18 deletions(-)

 [patch 35/77] net/hyperv: add support for jumbo frame up to 64kb

commit 4d447c9a6ebc0142d320f075c5bac6d202a79fd4 upstream.

Allow the user set the MTU up to 65536 for Linux guests running on
Hyper-V 2008 R2 or later.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/netvsc_drv.c | 5 3 + 2 - 0 !
1 file changed, 3 insertions(+), 2 deletions(-)

 [patch 36/77] net/hyperv: fix possible memory leak in
 do_set_multicast()

commit c11bf1c8baff170fa478adc04964da519d160e62 upstream.

do_set_multicast() may not free the memory malloc in
netvsc_set_multicast_list().

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/hv/channel_mgmt.c | 87 0 + 87 - 0 !
1 file changed, 87 deletions(-)

 [patch 37/77] drivers: hv: get rid of some unnecessary code

commit 2897a563a55442379e5e59ec68c229a7f27fb7c6 upstream.

The current code unnecessarily limits the number of offers we handle.
Get rid of this limitation. As part of this cleanup, also get rid of an
unused define - MAX_MSG_TYPES.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/net/hyperv/netvsc_drv.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch 38/77] net/hyperv: rx_bytes should account the ether header
 size

commit 48c3883999cb06246911e29356d194f96f1c75ef upstream.

skb->len after call eth_type_trans() does not include the ether
header size, but rx_bytes should account it.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/hid/hid-hyperv.c | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 [patch 39/77] hid: hyperv: properly disconnect the input device

commit c1c454b8691cc95aa83f19273ed7845914c70e83 upstream.

When we unload the mouse driver, properly disconnect the input device.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Fuzhou Chen <fuzhouch@microsoft.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

drivers/net/hyperv/rndis_filter.c | 19 19 + 0 - 0 !
1 file changed, 19 insertions(+)

 [patch 40/77] net/hyperv: fix the issue that large packets be
 dropped under bridge

commit 4b8a8bc9249f144803d840f2f7608ee9bbf1ea51 upstream.

The packets with size larger than 1452 will be dropped by bridge
which with two hyperv netdevice ports. This cause by hyperv netvsc
driver always copy the trailer padding to the data packet, and then
the skb received from netdevice may include wrong skb->len (20 bytes
larger than the real size normally). The captured packet may like
this:

  Ethernet II, Src: Microsof_00:00:07 (00:15:5d:00:00:07),
               Dst: HewlettP_00:00:4e (00:1f:29:00:00:4e)
    Destination: HewlettP_e6:00:4e (00:1f:29:00:00:4e)
    Source: Microsof_f6:6d:07 (00:15:5d:f6:6d:07)
    Type: IP (0x0800)
    Trailer: 1415161718191A1B1C1D1E1F20212223
    Frame check sequence: 0x24252627 [incorrect, should be 0x7c2e5a5e]

The following command help to reproduction it, and the ping ICMP
packets will be dropped by bridge.
  $ ping ip -s 1453

This patch fixed it by removing the trailer padding from the data
packet.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/hyperv/netvsc_drv.c | 8 4 + 4 - 0 !
1 file changed, 4 insertions(+), 4 deletions(-)

 [patch 41/77] net/hyperv: use netif_tx_disable() instead of
 netif_stop_queue() when necessary

commit 0a282538cc1977655004cdb2eb25dd2b63f20637 upstream.

For code path not on the xmit, use netif_tx_disable() instead of
netif_stop_queue() to ensure other CPUs are not doing xmit.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/hyperv/netvsc_drv.c | 8 4 + 4 - 0 !
drivers/net/hyperv/rndis_filter.c | 13 13 + 0 - 0 !
include/linux/hyperv.h | 2 1 + 1 - 0 !
3 files changed, 18 insertions(+), 5 deletions(-)

 [patch 42/77] net/hyperv: fix the page buffer when an rndis message
 goes beyond page boundary

commit c31c151b1c4a29da4dc92212aa8648fb4f8557b9 upstream.

There is a possible data corruption if an RNDIS message goes beyond page
boundary in the sending code path. This patch fixes the problem.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/hv/hv_kvp.h | 3 0 + 3 - 0 !
include/linux/connector.h | 1 1 + 0 - 0 !
tools/hv/hv_kvp_daemon.c | 4 0 + 4 - 0 !
3 files changed, 1 insertion(+), 7 deletions(-)

 [patch 43/77] drivers: hv: kvp: add/cleanup connector defines

commit 4f03a2c934894f30a64d397df8c7c4de129c5b30 upstream.

The current KVP code carries some private connector related defines.
Update connector.h to have all the KVP defines. As part of this patch
get rid of some unused defines.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/hv/hv_kvp.c | 2 0 + 2 - 0 !
drivers/hv/hv_kvp.h | 181 0 + 181 - 0 !
drivers/hv/hv_util.c | 3 0 + 3 - 0 !
include/linux/hyperv.h | 165 165 + 0 - 0 !
4 files changed, 165 insertions(+), 186 deletions(-)

 [patch 44/77] drivers: hv: kvp: move the contents of hv_kvp.h to
 hyperv.h

commit 2939437ce8f2de07237eb2bcce29b6a699bfe799 upstream.

In preparation for consolidating all KVP related defines into a single header file
that both the kernel and user level components can use, move the contents of
hv_kvp.h into hyperv.h.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/net/hyperv/rndis_filter.c | 60 30 + 30 - 0 !
1 file changed, 30 insertions(+), 30 deletions(-)

 [patch 45/77] net/hyperv: convert camel cased variables in
 rndis_filter.c to lower cases

commit 5fccab3b66d53883a97fc65e0c33f3ebf74e8ff9 upstream.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>

drivers/net/hyperv/netvsc_drv.c | 7 2 + 5 - 0 !
1 file changed, 2 insertions(+), 5 deletions(-)

 [patch 46/77] net/hyperv: correct the assignment in
 netvsc_recv_callback()

commit 6f4c44460750dd4eb9926a58ab1ad0ceacef8284 upstream.

The first assignment to variable "net" is wrong, but overridden by the
latter assignments. So the bug isn't manifested.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/hyperv/rndis_filter.c | 2 0 + 2 - 0 !
1 file changed, 2 deletions(-)

 [patch 47/77] net/hyperv: remove the unnecessary memset in
 rndis_filter_send()

commit bce60806de882cf15ad3a80a51e9878863a8fced upstream.

The memory has been allocated by kzalloc, so it's unnecessary to memset
again.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/staging/hv/storvsc_drv.c | 57 26 + 31 - 0 !
1 file changed, 26 insertions(+), 31 deletions(-)

 [patch 48/77] staging: hv: storvsc: cleanup some comments

commit 09f0355f0612520820ae4b2c342a26e048bef6e7 upstream.

Use consistent format for comments and get rid of some unnecessary
comments.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/hv/storvsc_drv.c | 30 8 + 22 - 0 !
1 file changed, 8 insertions(+), 22 deletions(-)

 [patch 49/77] staging: hv: storvsc: cleanup storvsc_probe()

commit 59d22950b274182b006e4071d6690bfbc94d7267 upstream.

Cleanup storvsc_probe(). As part of this cleanup, get rid of
storvsc_get_ide_info() by inlining the necessary code.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/hv/storvsc_drv.c | 48 22 + 26 - 0 !
1 file changed, 22 insertions(+), 26 deletions(-)

 [patch 50/77] staging: hv: storvsc: cleanup storvsc_queuecommand()

commit c77b63b639f52b2e92d0bbaa94f33a78939f3e7c upstream.

Cleanup storvsc_queuecommand(). As part of this cleanup, rename the function to
check if the scsi command can be sent to the host, consolidate error recovery
and get rid of some dead code.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/hv/storvsc_drv.c | 21 16 + 5 - 0 !
1 file changed, 16 insertions(+), 5 deletions(-)

 [patch 51/77] staging: hv: storvsc: introduce defines for srb status
 codes

commit 160463204f541cea112fd4d68422f297bd98ec51 upstream.

Introduce defines for srb status codes.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/hv/storvsc_drv.c | 14 4 + 10 - 0 !
1 file changed, 4 insertions(+), 10 deletions(-)

 [patch 52/77] staging: hv: storvsc: cleanup
 storvsc_host_reset_handler()

commit 4b270c8b23722128adedb5694097aea367284ce1 upstream.

Cleanup storvsc_host_reset_handler() by getting rid of storvsc_host_reset().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/hv/storvsc_drv.c | 28 12 + 16 - 0 !
1 file changed, 12 insertions(+), 16 deletions(-)

 [patch 53/77] staging: hv: storvsc: move and cleanup
 storvsc_remove()

commit ddcbf65e484c3473d3e808718ddb6c8166822c4c upstream.