Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1489390 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2016-09-22 20:50 +0200 |
| Last post | 2016-09-23 12:20 +0200 |
| Articles | 7 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 4.7 000/184] 4.7.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-22 20:50 +0200
[PATCH 4.7 015/184] net/mlx5: Added missing check of msg length in verifying its signature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-22 21:00 +0200
[PATCH 4.7 012/184] tipc: fix NULL pointer dereference in shutdown() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-22 21:00 +0200
[PATCH 4.7 010/184] net/sctp: always initialise sctp_ht_iter::start_fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-22 21:00 +0200
Re: [PATCH 4.7 000/184] 4.7.5-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-23 01:50 +0200
Re: [PATCH 4.7 000/184] 4.7.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-23 10:20 +0200
[PATCH 4.7 141/184] powerpc/32: Fix again csum_partial_copy_generic() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-23 12:20 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-22 20:50 +0200 |
| Subject | [PATCH 4.7 000/184] 4.7.5-stable review |
| Message-ID | <skgid-VW-5@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.7.5 release.
There are 184 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Sep 24 17:40:23 UTC 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.7.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.7.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.7.5-rc1
Linus Torvalds <torvalds@linux-foundation.org>
Add braces to avoid "ambiguous ‘else’" compiler warnings
Thomas Gleixner <tglx@linutronix.de>
genirq/msi: Fix broken debug output
Arnd Bergmann <arnd@arndb.de>
iwlegacy: avoid warning about missing braces
Al Viro <viro@zeniv.linux.org.uk>
ia64: copy_from_user() should zero the destination on access_ok() failure
Al Viro <viro@zeniv.linux.org.uk>
ppc32: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
sparc32: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
mn10300: copy_from_user() should zero on access_ok() failure...
Al Viro <viro@zeniv.linux.org.uk>
nios2: copy_from_user() should zero the tail of destination
Al Viro <viro@zeniv.linux.org.uk>
openrisc: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
parisc: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
metag: copy_from_user() should zero the destination on access_ok() failure
Al Viro <viro@zeniv.linux.org.uk>
alpha: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
asm-generic: make copy_from_user() zero the destination properly
Al Viro <viro@zeniv.linux.org.uk>
mips: copy_from_user() must zero the destination on access_ok() failure
Al Viro <viro@zeniv.linux.org.uk>
hexagon: fix strncpy_from_user() error return
Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
sh: cmpxchg: fix a bit shift bug in big_endian os
Al Viro <viro@zeniv.linux.org.uk>
sh: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
score: fix copy_from_user() and friends
Al Viro <viro@zeniv.linux.org.uk>
blackfin: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
cris: buggered copy_from_user/copy_to_user/clear_user
Al Viro <viro@zeniv.linux.org.uk>
frv: fix clear_user()
Al Viro <viro@zeniv.linux.org.uk>
asm-generic: make get_user() clear the destination on errors
Vineet Gupta <Vineet.Gupta1@synopsys.com>
ARC: uaccess: get_user to zero out dest in cause of fault
Al Viro <viro@zeniv.linux.org.uk>
s390: get_user() should zero on failure
Al Viro <viro@zeniv.linux.org.uk>
score: fix __get_user/get_user
Al Viro <viro@zeniv.linux.org.uk>
nios2: fix __get_user()
Al Viro <viro@zeniv.linux.org.uk>
sh64: failing __get_user() should zero
Al Viro <viro@zeniv.linux.org.uk>
m32r: fix __get_user()
Al Viro <viro@zeniv.linux.org.uk>
mn10300: failing __get_user() and get_user() should zero
Al Viro <viro@ZenIV.linux.org.uk>
fix minor infoleak in get_user_ex()
Al Viro <viro@zeniv.linux.org.uk>
microblaze: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
avr32: fix copy_from_user()
Al Viro <viro@zeniv.linux.org.uk>
microblaze: fix __get_user()
Al Viro <viro@ZenIV.linux.org.uk>
fix iov_iter_fault_in_readable()
Boris Brezillon <boris.brezillon@free-electrons.com>
irqchip/atmel-aic: Fix potential deadlock in ->xlate()
Boris Brezillon <boris.brezillon@free-electrons.com>
genirq: Provide irq_gc_{lock_irqsave,unlock_irqrestore}() helpers
Lee Jones <lee.jones@linaro.org>
mmc: sdhci-st: Handle interconnect clock
Chuck Lever <chuck.lever@oracle.com>
svcauth_gss: Revert 64c59a3726f2 ("Remove unnecessary allocation")
Kristian H. Kristensen <hoegsberg@gmail.com>
drm: Only use compat ioctl for addfb2 on X86/IA64
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Ignore OpRegion panel type except on select machines
Jan Leupold <leupold@rsi-elektrotechnik.de>
drm: atmel-hlcdc: Fix vertical scaling
Arnd Bergmann <arnd@arndb.de>
kconfig: tinyconfig: provide whole choice blocks to avoid warnings
Mike Danese <mikedanese@google.com>
mpssd: fix buffer overflow warning
Christophe Leroy <christophe.leroy@c-s.fr>
powerpc/32: Fix again csum_partial_copy_generic()
Christophe Leroy <christophe.leroy@c-s.fr>
powerpc/32: Fix csum_partial_copy_generic()
Jeffrey Hugo <jhugo@codeaurora.org>
x86/efi: Use efi_exit_boot_services()
Jeffrey Hugo <jhugo@codeaurora.org>
efi/libstub: Use efi_exit_boot_services() in FDT
Jeffrey Hugo <jhugo@codeaurora.org>
efi/libstub: Introduce ExitBootServices helper
Jeffrey Hugo <jhugo@codeaurora.org>
efi/libstub: Allocate headspace in efi_get_memory_map()
Jan Beulich <JBeulich@suse.com>
efi: Make for_each_efi_memory_desc_in_map() cope with running on Xen
Eli Cooper <elicooper@gmx.com>
ipv6: Don't unset flowi6_proto in ipxip6_tnl_xmit()
Balbir Singh <bsingharora@gmail.com>
sched/core: Fix a race between try_to_wake_up() and a woken up task
Johannes Berg <johannes.berg@intel.com>
Revert "wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel"
Alexander Shishkin <alexander.shishkin@linux.intel.com>
perf/x86/intel/pt: Do validate the size of a kernel address filter
Alexander Shishkin <alexander.shishkin@linux.intel.com>
perf/x86/intel/pt: Fix kernel address filter's offset validation
Alexander Shishkin <alexander.shishkin@linux.intel.com>
perf/x86/intel/pt: Fix an off-by-one in address filter configuration
Matt Fleming <matt@codeblueprint.co.uk>
perf/x86/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2
Jiri Olsa <jolsa@kernel.org>
perf/x86/intel/cqm: Check cqm/mbm enabled state in event init
Peter Zijlstra <peterz@infradead.org>
perf/x86/intel: Fix PEBSv3 record drain
Giedrius Statkevičius <giedrius.statkevicius@gmail.com>
ath9k: bring back direction setting in ath9k_{start_stop}
Felix Fietkau <nbd@nbd.name>
ath9k: fix using sta->drv_priv before initializing it
Guoqing Jiang <gqjiang@suse.com>
md-cluster: make md-cluster also can work when compiled into kernel
Arend Van Spriel <arend.vanspriel@broadcom.com>
brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: fix null pointer dereference in stop command timeout function
Miklos Szeredi <mszeredi@redhat.com>
fuse: direct-io: don't dirty ITER_BVEC pages
Chris Mason <clm@fb.com>
Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns
Ard Biesheuvel <ard.biesheuvel@linaro.org>
crypto: cryptd - initialize child shash_desc on import
Will Deacon <will.deacon@arm.com>
arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb()
Johan Hovold <johan@kernel.org>
memory: omap-gpmc: allow probe of child nodes to fail
Icenowy Zheng <icenowy@aosc.xyz>
pinctrl: sunxi: fix uart1 CTS/RTS pins at PG on A23/A33
James Hartley <james.hartley@imgtec.com>
pinctrl: pistachio: fix mfio pll_lock pinmux
Mikulas Patocka <mpatocka@redhat.com>
dm crypt: fix error with too large bios
Mikulas Patocka <mpatocka@redhat.com>
dm log writes: move IO accounting earlier to fix error path
Eric Biggers <ebiggers@google.com>
dm crypt: fix free of bad values after tfm allocation failure
Vladimir Zapolskiy <vz@mleia.com>
dm log writes: fix check of kthread_run() return value
Pawel Moll <pawel.moll@arm.com>
bus: arm-ccn: Fix XP watchpoint settings bitmask
Pawel Moll <pawel.moll@arm.com>
bus: arm-ccn: Do not attempt to configure XPs for cycle counter
Pawel Moll <pawel.moll@arm.com>
bus: arm-ccn: Fix PMU handling of MN
Lee Jones <lee.jones@linaro.org>
ARM: dts: STiH407-family: Provide interconnect clock for consumption in ST SDHCI
Johan Hovold <johan@kernel.org>
ARM: dts: overo: fix gpmc nand on boards with ethernet
Johan Hovold <johan@kernel.org>
ARM: dts: overo: fix gpmc nand cs0 range
Russell King <rmk+kernel@armlinux.org.uk>
ARM: dts: armada-388-clearfog: number LAN ports properly
Fabio Estevam <fabio.estevam@nxp.com>
ARM: dts: imx6qdl: Fix SPDIF regression
Gregory CLEMENT <gregory.clement@free-electrons.com>
ARM: dts: kirkwood: Fix PCIe label on OpenRD
Sebastian Reichel <sre@kernel.org>
ARM: OMAP3: hwmod data: Add sysc information for DSI
Simon Baatz <gmbnomis@gmail.com>
ARM: kirkwood: ib62x0: fix size of u-boot environment partition
Anson Huang <Anson.Huang@nxp.com>
ARM: imx6: add missing BM_CLPCR_BYPASS_PMIC_READY setting for imx6sx
Peter Chen <peter.chen@nxp.com>
ARM: imx6: add missing BM_CLPCR_BYP_MMDC_CH0_LPM_HS setting for imx6ul
Keerthy <j-keerthy@ti.com>
ARM: AM43XX: hwmod: Fix RSTST register offset for pruss
Caesar Wang <wxt@rock-chips.com>
arm: dts: rockchip: add reset node for the exist saradc SoCs
Zefan Li <lizefan@huawei.com>
cpuset: make sure new tasks conform to the current config of the cpuset
Harini Katakam <harini.katakam@xilinx.com>
net: macb: Correct CAPS mask
David Daney <david.daney@cavium.com>
net: thunderx: Fix OOPs with ethtool --register-dump
Andrew Donnellan <andrew.donnellan@au1.ibm.com>
cxl: use pcibios_free_controller_deferred() when removing vPHBs
Linus Torvalds <torvalds@linux-foundation.org>
devpts: return NULL pts 'priv' entry for non-devpts nodes
Alan Stern <stern@rowland.harvard.edu>
USB: change bInterval default to 10 ms
Lee Jones <lee.jones@linaro.org>
ARM: dts: STiH410: Handle interconnect clock required by EHCI/OHCI (USB)
Clemens Gruber <clemens.gruber@pqgruber.com>
usb: chipidea: udc: fix NULL ptr dereference in isr_setup_status_phase
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
usb: gadget: udc: renesas-usb3: clear VBOUT bit in DRD_CON
Daniele Palmas <dnlplm@gmail.com>
USB: serial: simple: add support for another Infineon flashloader
Jimi Damon <jdamon@accesio.com>
serial: 8250: added acces i/o products quad and octal serial cards
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
serial: 8250_mid: fix divide error bug if baud rate is 0
Colin Ian King <colin.king@canonical.com>
iio: ensure ret is initialized to zero before entering do loop
Gregor Boirie <gregor.boirie@parrot.com>
iio:core: fix IIO_VAL_FRACTIONAL sign handling
Linus Walleij <linus.walleij@linaro.org>
iio: accel: kxsd9: Fix scaling bug
Kweh, Hock Leong <hock.leong.kweh@intel.com>
iio: fix pressure data output unit in hid-sensor-attributes
Olof Johansson <olof@lixom.net>
iio: accel: bmc150: reset chip at init time
Alison Schofield <amsfield22@gmail.com>
iio: humidity: hdc100x: fix sensor data reads of temp and humidity
Anders Darander <anders@chargestorm.se>
iio: adc: at91: unbreak channel adc channel 3
Alison Schofield <amsfield22@gmail.com>
iio: humidity: am2315: set up buffer timestamps for non-zero values
Lars-Peter Clausen <lars@metafoo.de>
iio: ad799x: Fix buffered capture for ad7991/ad7995/ad7999
Giorgio Dal Molin <giorgio.nicole@arcor.de>
iio:ti-ads1015: fix a wrong pointer definition.
Vignesh R <vigneshr@ti.com>
iio: adc: ti_am335x_adc: Increase timeout value waiting for ADC sample
Vignesh R <vigneshr@ti.com>
iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access
Caesar Wang <wxt@rock-chips.com>
iio: adc: rockchip_saradc: reset saradc controller before programming it
Alison Schofield <amsfield22@gmail.com>
iio: proximity: as3935: set up buffer timestamps for non-zero values
Lars-Peter Clausen <lars@metafoo.de>
iio: sw-trigger: Fix config group initialization
Linus Walleij <linus.walleij@linaro.org>
iio: accel: kxsd9: Fix raw read return
Paolo Bonzini <pbonzini@redhat.com>
kvm: x86: correctly reset dest_map->vector when restoring LAPIC state
Suzuki K Poulose <suzuki.poulose@arm.com>
kvm-arm: Unmap shadow pagetables properly
David Hildenbrand <dahi@linux.vnet.ibm.com>
KVM: s390: don't use current->thread.fpu.* when accessing registers
Emanuel Czirai <icanrealizeum@gmail.com>
x86/AMD: Apply erratum 665 on machines without a BIOS fix
Steven Rostedt <rostedt@goodmis.org>
x86/paravirt: Do not trace _paravirt_ident_*() functions
Dan Williams <dan.j.williams@intel.com>
mm: fix cache mode of dax pmd mappings
Easwar Hariharan <easwar.hariharan@intel.com>
IB/hfi1: Reset QSFP on every run through channel tuning
Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
IB/uverbs: Fix race between uverbs_close and remove_one
Mike Marciniszyn <mike.marciniszyn@intel.com>
IB/hfi1,IB/qib: Fix qp_stats sleep with rcu read lock held
Mike Snitzer <snitzer@redhat.com>
dm flakey: fix reads to be issued if drop_writes configured
Mateusz Guzik <mguzik@redhat.com>
audit: fix exe_file access in audit_exe_compare
Mateusz Guzik <mguzik@redhat.com>
mm: introduce get_task_exe_file
Alexandre Bounine <alexandre.bounine@idt.com>
rapidio/tsi721: fix incorrect detection of address translation condition
Christoph Hellwig <hch@lst.de>
ahci: disable correct irq for dummy ports
David Rientjes <rientjes@google.com>
mm, mempolicy: task->mempolicy must be NULL before dropping final reference
Michal Hocko <mhocko@suse.com>
mm, oom: prevent premature OOM killer invocation for high order request
Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
kexec: fix double-free when failing to relocate the purgatory
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4.1: Fix the CREATE_SESSION slot number accounting
Trond Myklebust <trond.myklebust@primarydata.com>
pNFS: Ensure LAYOUTGET and LAYOUTRETURN are properly serialised
Chuck Lever <chuck.lever@oracle.com>
nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4.x: Fix a refcount leak in nfs_callback_up_net
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4.1: Fix Oopsable condition in server callback races
Trond Myklebust <trond.myklebust@primarydata.com>
pNFS: The client must not do I/O to the DS if it's lease has expired
Trond Myklebust <trond.myklebust@primarydata.com>
pNFS/flexfiles: Fix an Oopsable condition when connection to the DS fails
Tejun Heo <tj@kernel.org>
kernfs: don't depend on d_find_any_alias() when generating notifications
Gavin Shan <gwshan@linux.vnet.ibm.com>
powerpc/powernv: Fix corrupted PE allocation bitmap on releasing PE
Paul Mackerras <paulus@ozlabs.org>
powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET
Christophe Leroy <christophe.leroy@c-s.fr>
powerpc: sysdev: cpm: fix gpio save_regs functions
Mukesh Ojha <mukesh02@linux.vnet.ibm.com>
powerpc/powernv : Drop reference added by kset_find_obj()
Nicholas Piggin <npiggin@gmail.com>
powerpc/tm: do not use r13 for tabort_syscall
Artem Germanov <agermanov@anchorfree.com>
tcp: cwnd does not increase in TCP YeAH
Gal Pressman <galp@mellanox.com>
net/mlx5e: Fix parsing of vlan packets when updating lro header
Eric Dumazet <edumazet@google.com>
tcp: fastopen: avoid negative sk_forward_alloc
Wei Yongjun <weiyongjun1@huawei.com>
ipv6: addrconf: fix dev refcont leak when DAD failed
Michael Chan <michael.chan@broadcom.com>
bnxt_en: Fix TX push operation on ARM64.
Dave Jones <davej@codemonkey.org.uk>
ipv6: release dst in ping_v6_sendmsg
Linus Torvalds <torvalds@linux-foundation.org>
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
Linus Torvalds <torvalds@linux-foundation.org>
Revert "af_unix: Fix splice-bind deadlock"
Mahesh Bandewar <maheshb@google.com>
bonding: Fix bonding crash
WANG Cong <xiyou.wangcong@gmail.com>
kcm: fix a socket double free
Davide Caratti <dcaratti@redhat.com>
bridge: re-introduce 'fix parsing of MLDv2 reports'
Russell King <rmk+kernel@armlinux.org.uk>
net: smc91x: fix SMC accesses
Xander Huff <xander.huff@ni.com>
Revert "phy: IRQ cannot be shared"
Florian Fainelli <f.fainelli@gmail.com>
net: dsa: bcm_sf2: Fix race condition while unmasking interrupts
Soheil Hassas Yeganeh <soheil@google.com>
tun: fix transmit timestamp support
Lance Richardson <lrichard@redhat.com>
sctp: fix overrun in sctp_diag_dump_one()
Eric Dumazet <edumazet@google.com>
tcp: properly scale window in tcp_v[46]_reqsk_send_ack()
Eric Dumazet <edumazet@google.com>
udp: fix poll() issue with zero sized packets
Jamal Hadi Salim <jhs@mojatatu.com>
net sched: fix encoding to use real length
Hadar Hen Zion <hadarh@mellanox.com>
net/mlx5e: Use correct flow dissector key on flower offloading
Paul Blakey <paulb@mellanox.com>
net/mlx5: Added missing check of msg length in verifying its signature
Mohamad Haj Yahia <mohamad@mellanox.com>
net/mlx5: Fix pci error recovery flow
Eric Dumazet <edumazet@google.com>
tcp: fix use after free in tcp_xmit_retransmit_queue()
Vegard Nossum <vegard.nossum@oracle.com>
tipc: fix NULL pointer dereference in shutdown()
Mike Manning <mmanning@brocade.com>
net: ipv6: Do not keep IPv6 addresses when IPv6 is disabled
Vegard Nossum <vegard.nossum@oracle.com>
net/sctp: always initialise sctp_ht_iter::start_fail
Vegard Nossum <vegard.nossum@oracle.com>
net/irda: handle iriap_register_lsap() allocation failure
Daniel Borkmann <daniel@iogearbox.net>
bpf: fix write helpers with regards to non-linear parts
Lance Richardson <lrichard@redhat.com>
vti: flush x-netns xfrm cache when vti interface is removed
David Forster <dforster@brocade.com>
ipv4: panic in leaf_walk_rcu due to stale node pointer
Jakub Kicinski <jakub.kicinski@netronome.com>
bpf: fix method of PTR_TO_PACKET reg id generation
Rob Clark <robdclark@gmail.com>
drm/msm: protect against faults from copy_from_user() in submit ioctl
Eric Biggers <ebiggers@google.com>
fscrypto: require write access to mount to set encryption policy
James Hogan <james.hogan@imgtec.com>
MIPS: KVM: Check for pfn noslot case
Chen-Yu Tsai <wens@csie.org>
clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function
-------------
Diffstat:
.../bindings/iio/adc/rockchip-saradc.txt | 7 +
Documentation/mic/mpssd/mpssd.c | 4 +-
Makefile | 4 +-
arch/alpha/include/asm/uaccess.h | 19 +--
arch/arc/include/asm/uaccess.h | 11 +-
arch/arm/boot/dts/armada-388-clearfog.dts | 8 +-
arch/arm/boot/dts/imx6qdl.dtsi | 2 +-
arch/arm/boot/dts/kirkwood-ib62x0.dts | 2 +-
arch/arm/boot/dts/kirkwood-openrd.dtsi | 4 +
arch/arm/boot/dts/omap3-overo-base.dtsi | 4 +-
.../boot/dts/omap3-overo-chestnut43-common.dtsi | 2 -
arch/arm/boot/dts/omap3-overo-tobi-common.dtsi | 2 -
arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 3 -
arch/arm/boot/dts/rk3066a.dtsi | 2 +
arch/arm/boot/dts/rk3288.dtsi | 2 +
arch/arm/boot/dts/rk3xxx.dtsi | 2 +
arch/arm/boot/dts/stih407-family.dtsi | 10 +-
arch/arm/boot/dts/stih410.dtsi | 12 +-
arch/arm/kvm/arm.c | 2 -
arch/arm/kvm/mmu.c | 1 +
arch/arm/mach-imx/pm-imx6.c | 4 +-
.../mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c | 1 +
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 12 ++
arch/arm/mach-omap2/prcm43xx.h | 1 +
arch/arm/mach-pxa/idp.c | 3 +-
arch/arm/mach-pxa/xcep.c | 3 +-
arch/arm/mach-realview/core.c | 3 +-
arch/arm/mach-sa1100/pleb.c | 2 +-
arch/arm64/include/asm/spinlock.h | 10 ++
arch/avr32/include/asm/uaccess.h | 11 +-
arch/avr32/kernel/avr32_ksyms.c | 2 +-
arch/avr32/lib/copy_user.S | 4 +-
arch/blackfin/include/asm/uaccess.h | 9 +-
arch/blackfin/mach-bf561/boards/cm_bf561.c | 3 +-
arch/blackfin/mach-bf561/boards/ezkit.c | 3 +-
arch/cris/include/asm/uaccess.h | 71 ++++-----
arch/frv/include/asm/uaccess.h | 12 +-
arch/hexagon/include/asm/uaccess.h | 3 +-
arch/ia64/include/asm/uaccess.h | 20 ++-
arch/m32r/include/asm/uaccess.h | 2 +-
arch/metag/include/asm/uaccess.h | 3 +-
arch/microblaze/include/asm/uaccess.h | 11 +-
arch/mips/include/asm/uaccess.h | 3 +
arch/mips/kvm/tlb.c | 2 +-
arch/mn10300/include/asm/uaccess.h | 1 +
arch/mn10300/lib/usercopy.c | 4 +-
arch/nios2/include/asm/uaccess.h | 13 +-
arch/openrisc/include/asm/uaccess.h | 35 ++---
arch/parisc/include/asm/uaccess.h | 6 +-
arch/powerpc/include/asm/uaccess.h | 21 +--
arch/powerpc/kernel/entry_64.S | 12 +-
arch/powerpc/lib/checksum_32.S | 8 +-
arch/powerpc/mm/slb_low.S | 7 +-
arch/powerpc/platforms/powernv/opal-dump.c | 7 +-
arch/powerpc/platforms/powernv/opal-elog.c | 7 +-
arch/powerpc/platforms/powernv/pci-ioda.c | 3 +-
arch/powerpc/sysdev/cpm1.c | 6 +-
arch/powerpc/sysdev/cpm_common.c | 3 +-
arch/s390/include/asm/uaccess.h | 8 +-
arch/s390/kvm/kvm-s390.c | 10 +-
arch/score/include/asm/uaccess.h | 46 +++---
arch/sh/include/asm/cmpxchg-xchg.h | 2 +-
arch/sh/include/asm/uaccess.h | 5 +-
arch/sh/include/asm/uaccess_64.h | 1 +
arch/sparc/include/asm/uaccess_32.h | 4 +-
arch/x86/boot/compressed/eboot.c | 134 ++++++++--------
arch/x86/configs/tiny.config | 2 +
arch/x86/events/amd/core.c | 4 +-
arch/x86/events/intel/cqm.c | 9 ++
arch/x86/events/intel/ds.c | 19 ++-
arch/x86/events/intel/pt.c | 18 ++-
arch/x86/include/asm/uaccess.h | 6 +-
arch/x86/kernel/cpu/amd.c | 12 ++
arch/x86/kernel/paravirt.c | 4 +-
arch/x86/kvm/ioapic.c | 8 +-
arch/x86/kvm/pmu_amd.c | 4 +-
arch/x86/mm/pat.c | 17 ++-
crypto/cryptd.c | 9 +-
drivers/ata/libahci.c | 2 +-
drivers/bus/arm-ccn.c | 27 +++-
drivers/clocksource/sun4i_timer.c | 9 +-
drivers/firmware/efi/libstub/efi-stub-helper.c | 169 +++++++++++++++++----
drivers/firmware/efi/libstub/fdt.c | 54 +++++--
drivers/firmware/efi/libstub/random.c | 12 +-
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 10 +-
drivers/gpu/drm/drm_ioc32.c | 4 +
drivers/gpu/drm/i915/i915_debugfs.c | 3 +-
drivers/gpu/drm/i915/intel_opregion.c | 27 ++++
drivers/gpu/drm/msm/msm_drv.h | 6 +
drivers/gpu/drm/msm/msm_gem.c | 9 ++
drivers/gpu/drm/msm/msm_gem_submit.c | 2 +
drivers/iio/accel/bmc150-accel-core.c | 11 ++
drivers/iio/accel/kxsd9.c | 2 +
drivers/iio/adc/Kconfig | 1 +
drivers/iio/adc/ad799x.c | 1 +
drivers/iio/adc/at91_adc.c | 4 +-
drivers/iio/adc/rockchip_saradc.c | 30 ++++
drivers/iio/adc/ti-ads1015.c | 3 +-
drivers/iio/adc/ti_am335x_adc.c | 16 +-
.../iio/common/hid-sensors/hid-sensor-attributes.c | 4 +-
drivers/iio/humidity/am2315.c | 2 +-
drivers/iio/humidity/hdc100x.c | 27 +---
drivers/iio/industrialio-buffer.c | 4 +-
drivers/iio/industrialio-core.c | 5 +-
drivers/iio/proximity/as3935.c | 2 +-
drivers/infiniband/core/uverbs.h | 1 +
drivers/infiniband/core/uverbs_main.c | 37 +++--
drivers/infiniband/hw/hfi1/debugfs.c | 14 +-
drivers/infiniband/hw/hfi1/platform.c | 6 +-
drivers/infiniband/hw/hfi1/qp.c | 4 -
drivers/infiniband/hw/qib/qib_debugfs.c | 12 +-
drivers/infiniband/hw/qib/qib_qp.c | 4 -
drivers/iommu/dmar.c | 3 +-
drivers/iommu/intel-iommu.c | 3 +-
drivers/irqchip/irq-atmel-aic.c | 5 +-
drivers/irqchip/irq-atmel-aic5.c | 5 +-
drivers/md/dm-crypt.c | 9 +-
drivers/md/dm-flakey.c | 27 ++--
drivers/md/dm-log-writes.c | 6 +-
drivers/md/md.c | 12 +-
drivers/memory/omap-gpmc.c | 21 +--
drivers/misc/cxl/vphb.c | 10 +-
drivers/mmc/host/sdhci-st.c | 15 +-
drivers/net/bonding/bond_main.c | 7 +-
drivers/net/dsa/bcm_sf2.h | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +-
drivers/net/ethernet/cadence/macb.h | 2 +-
drivers/net/ethernet/cavium/thunder/nic_reg.h | 1 -
.../net/ethernet/cavium/thunder/nicvf_ethtool.c | 5 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 85 +++++++----
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 22 ++-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 59 ++++---
drivers/net/ethernet/smsc/smc91x.c | 7 +
drivers/net/ethernet/smsc/smc91x.h | 65 +++++---
drivers/net/phy/phy.c | 6 +-
drivers/net/tun.c | 6 +-
drivers/net/wireless/ath/ath9k/main.c | 17 ++-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
drivers/net/wireless/intel/iwlegacy/3945.c | 3 +-
drivers/pci/host-bridge.c | 1 +
drivers/pinctrl/pinctrl-pistachio.c | 12 +-
drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c | 4 +-
drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c | 4 +-
drivers/rapidio/devices/tsi721.c | 2 +-
drivers/tty/serial/8250/8250_mid.c | 3 +
drivers/tty/serial/8250/8250_pci.c | 139 +++++++++++++++++
drivers/usb/chipidea/udc.c | 9 ++
drivers/usb/core/config.c | 28 ++--
drivers/usb/gadget/udc/renesas_usb3.c | 2 +
drivers/usb/host/xhci-ring.c | 6 +-
drivers/usb/renesas_usbhs/mod.c | 11 +-
drivers/usb/serial/usb-serial-simple.c | 3 +-
fs/btrfs/tree-log.c | 1 +
fs/devpts/inode.c | 3 +-
fs/ext4/ioctl.c | 6 +
fs/fuse/file.c | 7 +-
fs/kernfs/file.c | 28 +++-
fs/nfs/callback.c | 1 +
fs/nfs/callback_proc.c | 5 +-
fs/nfs/flexfilelayout/flexfilelayout.c | 37 +++--
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 19 +--
fs/nfs/nfs4proc.c | 12 +-
fs/nfs/nfs4session.c | 33 ++++
fs/nfs/nfs4session.h | 1 +
fs/nfs/pnfs.c | 4 +
fs/nfsd/nfs4state.c | 40 +++--
fs/proc/base.c | 7 +-
include/asm-generic/uaccess.h | 20 ++-
include/linux/efi.h | 28 +++-
include/linux/iio/sw_trigger.h | 2 +-
include/linux/irq.h | 10 ++
include/linux/mempolicy.h | 4 +
include/linux/mfd/ti_am335x_tscadc.h | 8 +-
include/linux/mm.h | 1 +
include/linux/netdevice.h | 1 +
include/linux/smc91x.h | 10 ++
include/linux/uio.h | 2 +-
include/net/af_unix.h | 2 +-
include/net/tcp.h | 2 +
kernel/audit_watch.c | 8 +-
kernel/bpf/verifier.c | 3 +-
kernel/configs/tiny.config | 8 +
kernel/cpuset.c | 15 ++
kernel/exit.c | 7 +-
kernel/fork.c | 23 +++
kernel/irq/msi.c | 1 +
kernel/kexec_file.c | 3 +
kernel/memremap.c | 9 ++
kernel/sched/core.c | 22 +++
lib/iov_iter.c | 24 +--
mm/mempolicy.c | 17 +++
mm/page_alloc.c | 50 +-----
net/bridge/br_multicast.c | 2 +-
net/core/dev.c | 16 ++
net/core/filter.c | 70 +++------
net/ipv4/fib_trie.c | 8 +-
net/ipv4/ip_vti.c | 31 ++++
net/ipv4/tcp_fastopen.c | 1 +
net/ipv4/tcp_ipv4.c | 8 +-
net/ipv4/tcp_yeah.c | 2 +-
net/ipv4/udp.c | 12 +-
net/ipv6/addrconf.c | 6 +-
net/ipv6/ip6_tunnel.c | 2 +
net/ipv6/ping.c | 9 +-
net/ipv6/tcp_ipv6.c | 8 +-
net/irda/iriap.c | 8 +-
net/kcm/kcmsock.c | 3 +-
net/sched/act_ife.c | 18 ++-
net/sctp/proc.c | 1 +
net/sctp/sctp_diag.c | 6 +-
net/sunrpc/auth_gss/svcauth_gss.c | 5 +-
net/tipc/socket.c | 3 +-
net/unix/af_unix.c | 111 ++++++--------
net/wireless/wext-core.c | 25 +--
215 files changed, 1783 insertions(+), 971 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-22 21:00 +0200 |
| Subject | [PATCH 4.7 015/184] net/mlx5: Added missing check of msg length in verifying its signature |
| Message-ID | <skhnY-1Bu-3@gated-at.bofh.it> |
| In reply to | #1489390 |
4.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Blakey <paulb@mellanox.com>
[ Upstream commit 2c0f8ce1b584a4d7b8ff53140d21dfed99834940 ]
Set and verify signature calculates the signature for each of the
mailbox nodes, even for those that are unused (from cache). Added
a missing length check to set and verify only those which are used.
While here, also moved the setting of msg's nodes token to where we
already go over them. This saves a pass because checksum is disabled,
and the only useful thing remaining that set signature does is setting
the token.
Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB
adapters')
Signed-off-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 83 ++++++++++++++++----------
1 file changed, 53 insertions(+), 30 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(
return cmd->cmd_buf + (idx << cmd->log_stride);
}
-static u8 xor8_buf(void *buf, int len)
+static u8 xor8_buf(void *buf, size_t offset, int len)
{
u8 *ptr = buf;
u8 sum = 0;
int i;
+ int end = len + offset;
- for (i = 0; i < len; i++)
+ for (i = offset; i < end; i++)
sum ^= ptr[i];
return sum;
@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
static int verify_block_sig(struct mlx5_cmd_prot_block *block)
{
- if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
+ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+ int xor_len = sizeof(*block) - sizeof(block->data) - 1;
+
+ if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
return -EINVAL;
- if (xor8_buf(block, sizeof(*block)) != 0xff)
+ if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
return -EINVAL;
return 0;
}
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
- int csum)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block)
{
- block->token = token;
- if (csum) {
- block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
- sizeof(block->data) - 2);
- block->sig = ~xor8_buf(block, sizeof(*block) - 1);
- }
+ int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
+ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+
+ block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
+ block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
}
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg)
{
struct mlx5_cmd_mailbox *next = msg->next;
+ int size = msg->len;
+ int blen = size - min_t(int, sizeof(msg->first.data), size);
+ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+ / MLX5_CMD_DATA_BLOCK_SIZE;
+ int i = 0;
- while (next) {
- calc_block_sig(next->buf, token, csum);
+ for (i = 0; i < n && next; i++) {
+ calc_block_sig(next->buf);
next = next->next;
}
}
static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
{
- ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
- calc_chain_sig(ent->in, ent->token, csum);
- calc_chain_sig(ent->out, ent->token, csum);
+ ent->lay->sig = ~xor8_buf(ent->lay, 0, sizeof(*ent->lay));
+ if (csum) {
+ calc_chain_sig(ent->in);
+ calc_chain_sig(ent->out);
+ }
}
static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_
struct mlx5_cmd_mailbox *next = ent->out->next;
int err;
u8 sig;
+ int size = ent->out->len;
+ int blen = size - min_t(int, sizeof(ent->out->first.data), size);
+ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+ / MLX5_CMD_DATA_BLOCK_SIZE;
+ int i = 0;
- sig = xor8_buf(ent->lay, sizeof(*ent->lay));
+ sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
if (sig != 0xff)
return -EINVAL;
- while (next) {
+ for (i = 0; i < n && next; i++) {
err = verify_block_sig(next->buf);
if (err)
return err;
@@ -656,7 +670,6 @@ static void cmd_work_handler(struct work
spin_unlock_irqrestore(&cmd->alloc_lock, flags);
}
- ent->token = alloc_token(cmd);
cmd->ent_arr[ent->idx] = ent;
lay = get_inst(cmd, ent->idx);
ent->lay = lay;
@@ -766,7 +779,8 @@ static u8 *get_status_ptr(struct mlx5_ou
static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
struct mlx5_cmd_msg *out, void *uout, int uout_size,
mlx5_cmd_cbk_t callback,
- void *context, int page_queue, u8 *status)
+ void *context, int page_queue, u8 *status,
+ u8 token)
{
struct mlx5_cmd *cmd = &dev->cmd;
struct mlx5_cmd_work_ent *ent;
@@ -783,6 +797,8 @@ static int mlx5_cmd_invoke(struct mlx5_c
if (IS_ERR(ent))
return PTR_ERR(ent);
+ ent->token = token;
+
if (!callback)
init_completion(&ent->done);
@@ -854,7 +870,8 @@ static const struct file_operations fops
.write = dbg_write,
};
-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
+static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
+ u8 token)
{
struct mlx5_cmd_prot_block *block;
struct mlx5_cmd_mailbox *next;
@@ -880,6 +897,7 @@ static int mlx5_copy_to_msg(struct mlx5_
memcpy(block->data, from, copy);
from += copy;
size -= copy;
+ block->token = token;
next = next->next;
}
@@ -949,7 +967,8 @@ static void free_cmd_box(struct mlx5_cor
}
static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
- gfp_t flags, int size)
+ gfp_t flags, int size,
+ u8 token)
{
struct mlx5_cmd_mailbox *tmp, *head = NULL;
struct mlx5_cmd_prot_block *block;
@@ -978,6 +997,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_c
tmp->next = head;
block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
block->block_num = cpu_to_be32(n - i - 1);
+ block->token = token;
head = tmp;
}
msg->next = head;
@@ -1352,7 +1372,7 @@ static struct mlx5_cmd_msg *alloc_msg(st
}
if (IS_ERR(msg))
- msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
+ msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
return msg;
}
@@ -1377,6 +1397,7 @@ static int cmd_exec(struct mlx5_core_dev
int err;
u8 status = 0;
u32 drv_synd;
+ u8 token;
if (pci_channel_offline(dev->pdev) ||
dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -1395,20 +1416,22 @@ static int cmd_exec(struct mlx5_core_dev
return err;
}
- err = mlx5_copy_to_msg(inb, in, in_size);
+ token = alloc_token(&dev->cmd);
+
+ err = mlx5_copy_to_msg(inb, in, in_size, token);
if (err) {
mlx5_core_warn(dev, "err %d\n", err);
goto out_in;
}
- outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
+ outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
if (IS_ERR(outb)) {
err = PTR_ERR(outb);
goto out_in;
}
err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
- pages_queue, &status);
+ pages_queue, &status, token);
if (err)
goto out_out;
@@ -1476,7 +1499,7 @@ static int create_msg_cache(struct mlx5_
INIT_LIST_HEAD(&cmd->cache.med.head);
for (i = 0; i < NUM_LONG_LISTS; i++) {
- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
+ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
if (IS_ERR(msg)) {
err = PTR_ERR(msg);
goto ex_err;
@@ -1486,7 +1509,7 @@ static int create_msg_cache(struct mlx5_
}
for (i = 0; i < NUM_MED_LISTS; i++) {
- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
+ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
if (IS_ERR(msg)) {
err = PTR_ERR(msg);
goto ex_err;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-22 21:00 +0200 |
| Subject | [PATCH 4.7 012/184] tipc: fix NULL pointer dereference in shutdown() |
| Message-ID | <skhnY-1Bu-21@gated-at.bofh.it> |
| In reply to | #1489390 |
4.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
[ Upstream commit d2fbdf76b85bcdfe57b8ef2ba09d20e8ada79abd ]
tipc_msg_create() can return a NULL skb and if so, we shouldn't try to
call tipc_node_xmit_skb() on it.
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 3 PID: 30298 Comm: trinity-c0 Not tainted 4.7.0-rc7+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff8800baf09980 ti: ffff8800595b8000 task.ti: ffff8800595b8000
RIP: 0010:[<ffffffff830bb46b>] [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
RSP: 0018:ffff8800595bfce8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003023b0e0
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffffffff83d12580
RBP: ffff8800595bfd78 R08: ffffed000b2b7f32 R09: 0000000000000000
R10: fffffbfff0759725 R11: 0000000000000000 R12: 1ffff1000b2b7f9f
R13: ffff8800595bfd58 R14: ffffffff83d12580 R15: dffffc0000000000
FS: 00007fcdde242700(0000) GS:ffff88011af80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcddde1db10 CR3: 000000006874b000 CR4: 00000000000006e0
DR0: 00007fcdde248000 DR1: 00007fcddd73d000 DR2: 00007fcdde248000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000090602
Stack:
0000000000000018 0000000000000018 0000000041b58ab3 ffffffff83954208
ffffffff830bb400 ffff8800595bfd30 ffffffff8309d767 0000000000000018
0000000000000018 ffff8800595bfd78 ffffffff8309da1a 00000000810ee611
Call Trace:
[<ffffffff830c84a3>] tipc_shutdown+0x553/0x880
[<ffffffff825b4a3b>] SyS_shutdown+0x14b/0x170
[<ffffffff8100334c>] do_syscall_64+0x19c/0x410
[<ffffffff83295ca5>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 90 00 b4 0b 83 c7 00 f1 f1 f1 f1 4c 8d 6d e0 c7 40 04 00 00 00 f4 c7 40 08 f3 f3 f3 f3 48 89 d8 48 c1 e8 03 c7 45 b4 00 00 00 00 <80> 3c 30 00 75 78 48 8d 7b 08 49 8d 75 c0 48 b8 00 00 00 00 00
RIP [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
RSP <ffff8800595bfce8>
---[ end trace 57b0484e351e71f1 ]---
I feel like we should maybe return -ENOMEM or -ENOBUFS, but I'm not sure
userspace is equipped to handle that. Anyway, this is better than a GPF
and looks somewhat consistent with other tipc_msg_create() callers.
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/socket.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2180,7 +2180,8 @@ restart:
TIPC_CONN_MSG, SHORT_H_SIZE,
0, dnode, onode, dport, oport,
TIPC_CONN_SHUTDOWN);
- tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
+ if (skb)
+ tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
}
tsk->connected = 0;
sock->state = SS_DISCONNECTING;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-22 21:00 +0200 |
| Subject | [PATCH 4.7 010/184] net/sctp: always initialise sctp_ht_iter::start_fail |
| Message-ID | <skhnZ-1Bu-69@gated-at.bofh.it> |
| In reply to | #1489390 |
4.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
[ Upstream commit 54236ab09e9696a27baaae693c288920a26e8588 ]
sctp_transport_seq_start() does not currently clear iter->start_fail on
success, but relies on it being zero when it is allocated (by
seq_open_net()).
This can be a problem in the following sequence:
open() // allocates iter (and implicitly sets iter->start_fail = 0)
read()
- iter->start() // fails and sets iter->start_fail = 1
- iter->stop() // doesn't call sctp_transport_walk_stop() (correct)
read() again
- iter->start() // succeeds, but doesn't change iter->start_fail
- iter->stop() // doesn't call sctp_transport_walk_stop() (wrong)
We should initialize sctp_ht_iter::start_fail to zero if ->start()
succeeds, otherwise it's possible that we leave an old value of 1 there,
which will cause ->stop() to not call sctp_transport_walk_stop(), which
causes all sorts of problems like not calling rcu_read_unlock() (and
preempt_enable()), eventually leading to more warnings like this:
BUG: sleeping function called from invalid context at mm/slab.h:388
in_atomic(): 0, irqs_disabled(): 0, pid: 16551, name: trinity-c2
Preemption disabled at:[<ffffffff819bceb6>] rhashtable_walk_start+0x46/0x150
[<ffffffff81149abb>] preempt_count_add+0x1fb/0x280
[<ffffffff83295892>] _raw_spin_lock+0x12/0x40
[<ffffffff819bceb6>] rhashtable_walk_start+0x46/0x150
[<ffffffff82ec665f>] sctp_transport_walk_start+0x2f/0x60
[<ffffffff82edda1d>] sctp_transport_seq_start+0x4d/0x150
[<ffffffff81439e50>] traverse+0x170/0x850
[<ffffffff8143aeec>] seq_read+0x7cc/0x1180
[<ffffffff814f996c>] proc_reg_read+0xbc/0x180
[<ffffffff813d0384>] do_loop_readv_writev+0x134/0x210
[<ffffffff813d2a95>] do_readv_writev+0x565/0x660
[<ffffffff813d6857>] vfs_readv+0x67/0xa0
[<ffffffff813d6c16>] do_preadv+0x126/0x170
[<ffffffff813d710c>] SyS_preadv+0xc/0x10
[<ffffffff8100334c>] do_syscall_64+0x19c/0x410
[<ffffffff83296225>] return_from_SYSCALL_64+0x0/0x6a
[<ffffffffffffffff>] 0xffffffffffffffff
Notice that this is a subtly different stacktrace from the one in commit
5fc382d875 ("net/sctp: terminate rhashtable walk correctly").
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-By: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/proc.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -293,6 +293,7 @@ static void *sctp_transport_seq_start(st
return ERR_PTR(err);
}
+ iter->start_fail = 0;
return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos);
}
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2016-09-23 01:50 +0200 |
| Message-ID | <sklUC-4sl-9@gated-at.bofh.it> |
| In reply to | #1489390 |
On Thu, Sep 22, 2016 at 07:38:54PM +0200, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.7.5 release. > There are 184 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Sat Sep 24 17:40:23 UTC 2016. > Anything received after that time might be too late. > Build results: total: 149 pass: 137 fail: 12 Failed builds: avr32:defconfig avr32:allnoconfig avr32:merisc_defconfig avr32:atngw100mkii_evklcd101_defconfig powerpc:defconfig powerpc:allmodconfig powerpc:allnoconfig powerpc:ppc6xx_defconfig powerpc:mpc83xx_defconfig powerpc:tqm8xx_defconfig powerpc:85xx/sbc8548_defconfig powerpc:83xx/mpc834x_mds_defconfig Qemu test results: total: 108 pass: 97 fail: 11 Failed tests: openrisc:or1ksim_defconfig powerpc:mac99:nosmp:ppc_book3s_defconfig powerpc:g3beige:nosmp:ppc_book3s_defconfig powerpc:mac99:smp:ppc_book3s_defconfig powerpc:virtex-ml507:44x/virtex5_defconfig powerpc:mpc8548cds:85xx/mpc85xx_cds_defconfig powerpc:mpc8548cds:smpdev:85xx/mpc85xx_cds_defconfig powerpc:bamboo:44x/bamboo_defconfig powerpc:mac99:ppc64_book3s_defconfig:nosmp powerpc:mac99:ppc64_book3s_defconfig:smp4 powerpc:pseries:pseries_defconfig Failures pretty much match 4.4, so I won't go into specifics here. Details are available at http://kerneltests.org/builders. Guenter
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-23 10:20 +0200 |
| Message-ID | <sktSa-1fi-15@gated-at.bofh.it> |
| In reply to | #1489656 |
On Thu, Sep 22, 2016 at 04:44:55PM -0700, Guenter Roeck wrote: > On Thu, Sep 22, 2016 at 07:38:54PM +0200, Greg Kroah-Hartman wrote: > > This is the start of the stable review cycle for the 4.7.5 release. > > There are 184 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Sat Sep 24 17:40:23 UTC 2016. > > Anything received after that time might be too late. > > > Build results: > total: 149 pass: 137 fail: 12 > Failed builds: > avr32:defconfig > avr32:allnoconfig > avr32:merisc_defconfig > avr32:atngw100mkii_evklcd101_defconfig > powerpc:defconfig > powerpc:allmodconfig > powerpc:allnoconfig > powerpc:ppc6xx_defconfig > powerpc:mpc83xx_defconfig > powerpc:tqm8xx_defconfig > powerpc:85xx/sbc8548_defconfig > powerpc:83xx/mpc834x_mds_defconfig > > Qemu test results: > total: 108 pass: 97 fail: 11 > Failed tests: > openrisc:or1ksim_defconfig > powerpc:mac99:nosmp:ppc_book3s_defconfig > powerpc:g3beige:nosmp:ppc_book3s_defconfig > powerpc:mac99:smp:ppc_book3s_defconfig > powerpc:virtex-ml507:44x/virtex5_defconfig > powerpc:mpc8548cds:85xx/mpc85xx_cds_defconfig > powerpc:mpc8548cds:smpdev:85xx/mpc85xx_cds_defconfig > powerpc:bamboo:44x/bamboo_defconfig > powerpc:mac99:ppc64_book3s_defconfig:nosmp > powerpc:mac99:ppc64_book3s_defconfig:smp4 > powerpc:pseries:pseries_defconfig > > Failures pretty much match 4.4, so I won't go into specifics here. Should all now be fixed up, sorry for the mess, it's on arches that I don't do local test builds for :( greg k-h
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-23 12:20 +0200 |
| Subject | [PATCH 4.7 141/184] powerpc/32: Fix again csum_partial_copy_generic() |
| Message-ID | <skvKh-2mq-11@gated-at.bofh.it> |
| In reply to | #1489390 |
4.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@c-s.fr>
commit 8540571e01f973d321b0821f4f32ed6e9ae8263c upstream.
Commit 7aef4136566b0 ("powerpc32: rewrite csum_partial_copy_generic()
based on copy_tofrom_user()") introduced a bug when destination address
is odd and len is lower than cacheline size.
In that case the resulting csum value doesn't have to be rotated one
byte because the cache-aligned copy part is skipped so no alignment
is performed.
Fixes: 7aef4136566b0 ("powerpc32: rewrite csum_partial_copy_generic() based on copy_tofrom_user()")
Cc: stable@vger.kernel.org # v4.6+
Reported-by: Alessio Igor Bogani <alessio.bogani@elettra.eu>
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Tested-by: Alessio Igor Bogani <alessio.bogani@elettra.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/lib/checksum_32.S | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/arch/powerpc/lib/checksum_32.S
+++ b/arch/powerpc/lib/checksum_32.S
@@ -127,18 +127,19 @@ _GLOBAL(csum_partial_copy_generic)
stw r7,12(r1)
stw r8,8(r1)
- rlwinm r0,r4,3,0x8
- rlwnm r6,r6,r0,0,31 /* odd destination address: rotate one byte */
- cmplwi cr7,r0,0 /* is destination address even ? */
addic r12,r6,0
addi r6,r4,-4
neg r0,r4
addi r4,r3,-4
andi. r0,r0,CACHELINE_MASK /* # bytes to start of cache line */
+ crset 4*cr7+eq
beq 58f
cmplw 0,r5,r0 /* is this more than total to do? */
blt 63f /* if not much to do */
+ rlwinm r7,r6,3,0x8
+ rlwnm r12,r12,r7,0,31 /* odd destination address: rotate one byte */
+ cmplwi cr7,r7,0 /* is destination address even ? */
andi. r8,r0,3 /* get it word-aligned first */
mtctr r8
beq+ 61f
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web