Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1496251 > unrolled thread

[PATCH 4.7 000/141] 4.7.7-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.7 000/141] 4.7.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 024/141] hwmon: (adt7411) set bit 3 in CFG1 register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 061/141] regulator: pwm: Fix regulator ramp delay for continuous mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 003/141] scripts/recordmcount.c: account for .softirqentry.text Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 045/141] i40iw: Send last streaming mode message for loopback connections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 023/141] nvmem: Declare nvmem_cell_read() consistently Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 029/141] iwlwifi: mvm: write the correct internal TXF index Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 032/141] iwlwifi: mvm: free RX reorder buffer on restart Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 008/141] x86/boot: Initialize FPU and X86_FEATURE_ALWAYS even if we dont have CPUID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 046/141] i40iw: Update hw_iwarp_state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 064/141] regulator: qcom_spmi: Update mvs1/mvs2 switches on pm8941 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 006/141] can: dev: fix deadlock reported after bus-off Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 028/141] iwlwifi: mvm: fix txq aggregation bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 011/141] drm/radeon/si/dpm: add workaround for for Jet parts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 013/141] ARM: 8617/1: dma: fix dma_max_pfn() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 039/141] i40iw: Add missing check for interface already open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 018/141] i2c: mux: demux-pinctrl: run properly with multiple instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 007/141] x86/init: Fix cr4_init_shadow() on CR4-less machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 054/141] MIPS: fix uretprobe implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 002/141] cgroup: fix invalid controller enable rejections with cgroup namespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 010/141] drm/nouveau/fifo/nv04: avoid ramht race against cookie insertion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 141/141] ALSA: hda - Add the top speaker pin config for HP Spectre x360 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 107/141] powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 101/141] xprtrdma: Remove FMRs from the unmap list after unmapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 050/141] irqchip/gicv3: Silence noisy DEBUG_PER_CPU_MAPS warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 089/141] fnic: pci_dma_mapping_error() doesnt return an error code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 093/141] dmaengine: at_xdmac: fix debug string Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 080/141] iwlmvm: mvm: set correct state in smart-fifo configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
      Re: [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of  is_sas_attached James Bottomley <jejb@linux.vnet.ibm.com> - 2016-10-06 15:30 +0200
        Re: [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of  is_sas_attached Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-07 06:10 +0200
    [PATCH 4.7 137/141] USB: serial: cp210x: Add ID for a Juniper console Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 078/141] tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 071/141] ARM: sa1100: clear reset status prior to reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 076/141] blk-mq: actually hook up defer list when running requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 096/141] NFS: Dont drop CB requests with invalid principals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 099/141] watchdog: core: Clear WDOG_HW_RUNNING before calling the stop function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 138/141] Revert "usbtmc: convert to devm_kzalloc" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 073/141] ARM: sa1111: fix pcmcia suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 072/141] ARM: shmobile: fix regulator quirk for Gen2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 090/141] mm, kasan: account for object redzone in SLUBs nearest_obj() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 126/141] IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 074/141] pcmcia: ds: fix suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 077/141] pstore: drop file opened reference count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 127/141] IB/mlx5: Enable MAD_IFC commands for IB ports only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 110/141] IB/core: Fix possible memory leak in cma_resolve_iboe_route() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 053/141] MIPS: uprobes: remove incorrect set_orig_insn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 139/141] ALSA: hda - Adding one more ALC255 pin definition for headset problem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 106/141] staging: comedi: adv_pci1760: Do not return EINVAL for CMDF_ROUND_DOWN. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 083/141] [media] v4l: vsp1: Fix crash when resetting pipeline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 088/141] qla2xxx: Fix BBCR offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 136/141] usb: usbip: vudc: fix left shift overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 125/141] IB/mlx4: Fix code indentation in QP1 MAD flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 094/141] NFS/pnfs: Do not clobber existing pgio_done_cb in nfs4_proc_read_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 134/141] usb: misc: legousbtower: Fix NULL pointer deference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 102/141] ASoC: Intel: Skylake: Fix error return code in skl_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 100/141] cxl: fix potential NULL dereference in free_adapter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 051/141] ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 069/141] ARM: sa1100: register clocks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 135/141] Staging: fbtft: Fix bug in fbtft-core Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 048/141] batman-adv: Add missing refcnt for last_candidate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 121/141] regmap: rbtree: Avoid overlapping nodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 115/141] dmaengine: at_xdmac: fix to pass correct device identity to free_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 103/141] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 070/141] ARM: sa1100: fix 3.6864MHz clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 087/141] avr32: off by one in at32_init_pio() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 085/141] ath9k: Fix programming of minCCA power threshold Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 047/141] i40iw: Receive notification events correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 079/141] fm10k: fix incorrect index calculation in fm10k_write_reta Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 075/141] hwrng: omap - Fix assumption that runtime_get_sync will always succeed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 095/141] svc: Avoid garbage replies when pc_func() returns rpc_drop_reply Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 109/141] ASoC: omap-mcpdm: Fix irq resource handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 098/141] pNFS/flexfiles: Fix layoutcommit after a commit to DS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 092/141] dmaengine: bcm2835: fix 64-bit warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 052/141] arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 111/141] kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 112/141] SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 097/141] pNFS/files: Fix layoutcommit after a commit to DS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 104/141] brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 082/141] [media] em28xx-i2c: rt_mutex_trylock() returns zero on failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 123/141] IB/ipoib: Dont allow MC joins during light MC flush Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 084/141] [media] gspca: avoid unused variable warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 131/141] tpm_crb: fix mapping of the buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 132/141] aio: mark AIO pseudo-fs noexec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 124/141] IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 130/141] tpm_crb: drop struct resource res from struct crb_priv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 128/141] IB/mlx5: Set source mac address in FTE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 133/141] dm log writes: fix bug with too large bios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 091/141] tracing: Have HIST_TRIGGERS select TRACING Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 140/141] ALSA: hda - Fix headset mic detection problem for several Dell laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 129/141] batman-adv: remove unused callback from batadv_algo_ops struct Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 118/141] IB/ipoib: Fix memory corruption in ipoib cm mode connect flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 086/141] mailbox: mailbox-test: set tdev->signal to NULL after freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 120/141] IB/core: Fix use after free in send_leave function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 119/141] ath10k: fix get rx_status from htt context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 113/141] pNFS/flexfiles: Fix layoutstat periodic reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 117/141] ceph: do not modify fi->frag in need_reset_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 114/141] lib/test_hash.c: fix warning in preprocessor symbol evaluation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 105/141] brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 108/141] sysctl: handle error writing UINT_MAX to u32 fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 044/141] i40iw: Add missing NULL check for MPA private data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 038/141] i40iw: Protect req_resource_num update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 056/141] MIPS: uprobes: fix use of uninitialised variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 058/141] Bluetooth: split sk_filter in l2cap_sock_recv_cb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 005/141] mm,ksm: fix endless looping in allocating memory when ksm enable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 014/141] mwifiex: illegal assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 036/141] gpio: sa1100: fix irq probing for ucb1x00 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 055/141] MIPS: Malta: Fix IOCU disable switch read for MIPS64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    Re: [PATCH 4.7 000/141] 4.7.7-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-06 21:00 +0200
      Re: [PATCH 4.7 000/141] 4.7.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-07 06:10 +0200
    Re: [PATCH 4.7 000/141] 4.7.7-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-06 22:00 +0200

Page 6 of 6 — ← Prev page 1 2 3 4 5 [6]

#1496532 — [PATCH 4.7 044/141] i40iw: Add missing NULL check for MPA private data

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shiraz Saleem <shiraz.saleem@intel.com>

commit 5dfd5e5e3bc68ab3912acc712c8180942094fc69 upstream.

Add NULL check for pdata and pdata->addr before the memcpy in
i40iw_form_cm_frame(). This fixes a NULL pointer de-reference
which occurs when the MPA private data pointer is NULL. Also
only copy pdata->size bytes in the memcpy to prevent reading
past the length of the private data buffer provided by upper layer.

Fixes: f27b4746f378 ("i40iw: add connection management code")

Reported-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/i40iw/i40iw_cm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form
 		buf += hdr_len;
 	}
 
-	if (pd_len)
-		memcpy(buf, pdata->addr, pd_len);
+	if (pdata && pdata->addr)
+		memcpy(buf, pdata->addr, pdata->size);
 
 	atomic_set(&sqbuf->refcount, 1);
 

[toc] | [prev] | [next] | [standalone]

#1496539 — [PATCH 4.7 038/141] i40iw: Protect req_resource_num update

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mustafa Ismail <mustafa.ismail@intel.com>

commit 44856be3e95c87f03e850ef4fdf8c0503c2dde18 upstream.

In i40iw_alloc_resource(), ensure that the update to
req_resource_num is protected by the lock.

Fixes: 8e06af711bf2 ("i40iw: add main, hdr, status")

Reported-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/i40iw/i40iw.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(s
 	*next = resource_num + 1;
 	if (*next == max_resources)
 		*next = 0;
-	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 	*req_resource_num = resource_num;
+	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1496545 — [PATCH 4.7 056/141] MIPS: uprobes: fix use of uninitialised variable

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>

commit ca86c9ef2b322ebf24772009fdea037688cbdac1 upstream.

arch_uprobe_pre_xol needs to emulate a branch if a branch instruction
has been replaced with a breakpoint, but in fact an uninitialised local
variable was passed to the emulator routine instead of the original
instruction

Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Fixes: 40e084a506eb ('MIPS: Add uprobes support.')
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14300/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/uprobes.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/arch/mips/kernel/uprobes.c
+++ b/arch/mips/kernel/uprobes.c
@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
 int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
 {
 	struct uprobe_task *utask = current->utask;
-	union mips_instruction insn;
 
 	/*
 	 * Now find the EPC where to resume after the breakpoint has been
@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_upro
 		unsigned long epc;
 
 		epc = regs->cp0_epc;
-		__compute_return_epc_for_insn(regs, insn);
+		__compute_return_epc_for_insn(regs,
+			(union mips_instruction) aup->insn[0]);
 		aup->resume_epc = regs->cp0_epc;
 	}
-
 	utask->autask.saved_trap_nr = current->thread.trap_nr;
 	current->thread.trap_nr = UPROBE_TRAP_NR;
 	regs->cp0_epc = current->utask->xol_vaddr;

[toc] | [prev] | [next] | [standalone]

#1496546 — [PATCH 4.7 058/141] Bluetooth: split sk_filter in l2cap_sock_recv_cb

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

commit dbb50887c8f619fc5c3489783ebc3122bc134a31 upstream.

During an audit for sk_filter(), we found that rx_busy_skb handling
in l2cap_sock_recv_cb() and l2cap_sock_recvmsg() looks not quite as
intended.

The assumption from commit e328140fdacb ("Bluetooth: Use event-driven
approach for handling ERTM receive buffer") is that errors returned
from sock_queue_rcv_skb() are due to receive buffer shortage. However,
nothing should prevent doing a setsockopt() with SO_ATTACH_FILTER on
the socket, that could drop some of the incoming skbs when handled in
sock_queue_rcv_skb().

In that case sock_queue_rcv_skb() will return with -EPERM, propagated
from sk_filter() and if in L2CAP_MODE_ERTM mode, wrong assumption was
that we failed due to receive buffer being full. From that point onwards,
due to the to-be-dropped skb being held in rx_busy_skb, we cannot make
any forward progress as rx_busy_skb is never cleared from l2cap_sock_recvmsg(),
due to the filter drop verdict over and over coming from sk_filter().
Meanwhile, in l2cap_sock_recv_cb() all new incoming skbs are being
dropped due to rx_busy_skb being occupied.

Instead, just use __sock_queue_rcv_skb() where an error really tells that
there's a receive buffer issue. Split the sk_filter() and enable it for
non-segmented modes at queuing time since at this point in time the skb has
already been through the ERTM state machine and it has been acked, so dropping
is not allowed. Instead, for ERTM and streaming mode, call sk_filter() in
l2cap_data_rcv() so the packet can be dropped before the state machine sees it.

Fixes: e328140fdacb ("Bluetooth: Use event-driven approach for handling ERTM receive buffer")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/l2cap_core.c |    8 ++++++++
 net/bluetooth/l2cap_sock.c |   14 ++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -32,6 +32,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l
 		if (chan->sdu)
 			break;
 
+		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+			break;
+
 		chan->sdu_len = get_unaligned_le16(skb->data);
 		skb_pull(skb, L2CAP_SDULEN_SIZE);
 
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_c
 		goto drop;
 	}
 
+	if ((chan->mode == L2CAP_MODE_ERTM ||
+	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+		goto drop;
+
 	if (!control->sframe) {
 		int err;
 
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct soc
 		goto done;
 
 	if (pi->rx_busy_skb) {
-		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
 			pi->rx_busy_skb = NULL;
 		else
 			goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2c
 		goto done;
 	}
 
-	err = sock_queue_rcv_skb(sk, skb);
+	if (chan->mode != L2CAP_MODE_ERTM &&
+	    chan->mode != L2CAP_MODE_STREAMING) {
+		/* Even if no filter is attached, we could potentially
+		 * get errors from security modules, etc.
+		 */
+		err = sk_filter(sk, skb);
+		if (err)
+			goto done;
+	}
+
+	err = __sock_queue_rcv_skb(sk, skb);
 
 	/* For ERTM, handle one skb that doesn't fit into the recv
 	 * buffer.  This is important to do because the data frames

[toc] | [prev] | [next] | [standalone]

#1496547 — [PATCH 4.7 005/141] mm,ksm: fix endless looping in allocating memory when ksm enable

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: zhong jiang <zhongjiang@huawei.com>

commit 5b398e416e880159fe55eefd93c6588fa072cd66 upstream.

I hit the following hung task when runing a OOM LTP test case with 4.1
kernel.

Call trace:
[<ffffffc000086a88>] __switch_to+0x74/0x8c
[<ffffffc000a1bae0>] __schedule+0x23c/0x7bc
[<ffffffc000a1c09c>] schedule+0x3c/0x94
[<ffffffc000a1eb84>] rwsem_down_write_failed+0x214/0x350
[<ffffffc000a1e32c>] down_write+0x64/0x80
[<ffffffc00021f794>] __ksm_exit+0x90/0x19c
[<ffffffc0000be650>] mmput+0x118/0x11c
[<ffffffc0000c3ec4>] do_exit+0x2dc/0xa74
[<ffffffc0000c46f8>] do_group_exit+0x4c/0xe4
[<ffffffc0000d0f34>] get_signal+0x444/0x5e0
[<ffffffc000089fcc>] do_signal+0x1d8/0x450
[<ffffffc00008a35c>] do_notify_resume+0x70/0x78

The oom victim cannot terminate because it needs to take mmap_sem for
write while the lock is held by ksmd for read which loops in the page
allocator

ksm_do_scan
	scan_get_next_rmap_item
		down_read
		get_next_rmap_item
			alloc_rmap_item   #ksmd will loop permanently.

There is no way forward because the oom victim cannot release any memory
in 4.1 based kernel.  Since 4.6 we have the oom reaper which would solve
this problem because it would release the memory asynchronously.
Nevertheless we can relax alloc_rmap_item requirements and use
__GFP_NORETRY because the allocation failure is acceptable as ksm_do_scan
would just retry later after the lock got dropped.

Such a patch would be also easy to backport to older stable kernels which
do not have oom_reaper.

While we are at it add GFP_NOWARN so the admin doesn't have to be alarmed
by the allocation failure.

Link: http://lkml.kernel.org/r/1474165570-44398-1-git-send-email-zhongjiang@huawei.com
Signed-off-by: zhong jiang <zhongjiang@huawei.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Suggested-by: Michal Hocko <mhocko@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/ksm.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rm
 {
 	struct rmap_item *rmap_item;
 
-	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
+	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
+						__GFP_NORETRY | __GFP_NOWARN);
 	if (rmap_item)
 		ksm_rmap_items++;
 	return rmap_item;

[toc] | [prev] | [next] | [standalone]

#1496548 — [PATCH 4.7 014/141] mwifiex: illegal assignment

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Heinrich Schuchardt <xypron.glpk@gmx.de>

commit 3fdbda446fbcd7fb750179c01338e81cf04e46c7 upstream.

Variable adapter is incorrectly initialized.

Fixes: bf00dc22bc7a ("mwifiex: AMSDU Rx frame handling in AP mode")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/marvell/mwifiex/uap_txrx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct
 int mwifiex_uap_recv_packet(struct mwifiex_private *priv,
 			    struct sk_buff *skb)
 {
-	struct mwifiex_adapter *adapter = adapter;
+	struct mwifiex_adapter *adapter = priv->adapter;
 	struct mwifiex_sta_node *src_node;
 	struct ethhdr *p_ethhdr;
 	struct sk_buff *skb_uap;

[toc] | [prev] | [next] | [standalone]

#1496550 — [PATCH 4.7 036/141] gpio: sa1100: fix irq probing for ucb1x00

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@armlinux.org.uk>

commit 56beac95cb88c188d2a885825a5da131edb41fe3 upstream.

ucb1x00 has used IRQ probing since it's dawn to find the GPIO interrupt
that it's connected to.  However, commit 23393d49fb75 ("gpio: kill off
set_irq_flags usage") broke this by disabling IRQ probing on GPIO
interrupts.  Fix this.

Fixes: 23393d49fb75 ("gpio: kill off set_irq_flags usage")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpio/gpio-sa1100.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(str
 {
 	irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
 				 handle_edge_irq);
-	irq_set_noprobe(irq);
+	irq_set_probe(irq);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1496552 — [PATCH 4.7 055/141] MIPS: Malta: Fix IOCU disable switch read for MIPS64

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Burton <paul.burton@imgtec.com>

commit 305723ab439e14debc1d339aa04e835d488b8253 upstream.

Malta boards used with CPU emulators feature a switch to disable use of
an IOCU. Software has to check this switch & ignore any present IOCU if
the switch is closed. The read used to do this was unsafe for 64 bit
kernels, as it simply casted the address 0xbf403000 to a pointer &
dereferenced it. Whilst in a 32 bit kernel this would access kseg1, in a
64 bit kernel this attempts to access xuseg & results in an address
error exception.

Fix by accessing a correctly formed ckseg1 address generated using the
CKSEG1ADDR macro.

Whilst modifying this code, define the name of the register and the bit
we care about within it, which indicates whether PCI DMA is routed to
the IOCU or straight to DRAM. The code previously checked that bit 0 was
also set, but the least significant 7 bits of the CONFIG_GEN0 register
contain the value of the MReqInfo signal provided to the IOCU OCP bus,
so singling out bit 0 makes little sense & that part of the check is
dropped.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: b6d92b4a6bdb ("MIPS: Add option to disable software I/O coherency.")
Cc: Matt Redfearn <matt.redfearn@imgtec.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/14187/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mti-malta/malta-setup.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/arch/mips/mti-malta/malta-setup.c
+++ b/arch/mips/mti-malta/malta-setup.c
@@ -39,6 +39,9 @@
 #include <linux/console.h>
 #endif
 
+#define ROCIT_CONFIG_GEN0		0x1f403000
+#define  ROCIT_CONFIG_GEN0_PCI_IOCU	BIT(7)
+
 extern void malta_be_init(void);
 extern int malta_be_handler(struct pt_regs *regs, int is_fixup);
 
@@ -107,6 +110,8 @@ static void __init fd_activate(void)
 static int __init plat_enable_iocoherency(void)
 {
 	int supported = 0;
+	u32 cfg;
+
 	if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
 		if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
 			BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;
@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherenc
 	} else if (mips_cm_numiocu() != 0) {
 		/* Nothing special needs to be done to enable coherency */
 		pr_info("CMP IOCU detected\n");
-		if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
+		cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
+		if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
 			pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n");
 			return 0;
 		}

[toc] | [prev] | [next] | [standalone]

#1496814

On Thu, Oct 06, 2016 at 10:27:16AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.7.7 release.
> There are 141 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat Oct  8 07:44:08 UTC 2016.
> Anything received after that time might be too late.
> 

Build results:
	total: 149 pass: 148 fail: 1
Failed builds:
	powerpc:ppc6xx_defconfig

Qemu test results:
	total: 108 pass: 108 fail: 0

Adding upstream commit c1a23f6d6455 ("scsi: sas: provide stub implementation
for scsi_is_sas_rphy") fixes the build problem.

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1496982

On Thu, Oct 06, 2016 at 11:54:02AM -0700, Guenter Roeck wrote:
> On Thu, Oct 06, 2016 at 10:27:16AM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.7.7 release.
> > There are 141 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sat Oct  8 07:44:08 UTC 2016.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 149 pass: 148 fail: 1
> Failed builds:
> 	powerpc:ppc6xx_defconfig
> 
> Qemu test results:
> 	total: 108 pass: 108 fail: 0
> 
> Adding upstream commit c1a23f6d6455 ("scsi: sas: provide stub implementation
> for scsi_is_sas_rphy") fixes the build problem.

Thanks, this should now be fixed.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1496833

On 10/06/2016 02:27 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.7.7 release.
> There are 141 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat Oct  8 07:44:08 UTC 2016.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.7.7-rc1.gz
> or in the git tree and branch at:
>   git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.7.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

-- 
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com

[toc] | [prev] | [standalone]

Page 6 of 6 — ← Prev page 1 2 3 4 5 [6]

Back to top | Article view | linux.kernel

csiph-web