Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1587391 > unrolled thread

[PATCH 4.10 00/21] 4.10.1-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 13/21] USB: serial: ark3116: fix register-accessor error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 06/21] USB: serial: cp210x: add new IDs for GE Bx50v3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 10/21] USB: serial: digi_acceleport: fix OOB data sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 16/21] goldfish: Sanitize the broken interrupt handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 20/21] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 14/21] USB: serial: console: fix uninitialised spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 04/21] tty: serial: msm: Fix module autoload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 15/21] x86/platform/goldfish: Prevent unconditional loading Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 02/21] ip: fix IP_CHECKSUM handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 17/21] netfilter: nf_ct_helper: warn when not applying default helper assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 12/21] USB: serial: opticon: fix CTS retrieval at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 05/21] USB: serial: mos7840: fix another NULL-deref at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    [PATCH 4.10 19/21] block: fix double-free in the failure path of cgwb_bdi_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-24 09:50 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-24 19:40 +0100
      Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-25 05:30 +0100
      Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
    Re: [PATCH 4.10 00/21] 4.10.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-26 17:10 +0100
      Re: [PATCH 4.10 00/21] 4.10.1-stable review Kevin Hilman <khilman@baylibre.com> - 2017-02-27 21:30 +0100

#1587391 — [PATCH 4.10 00/21] 4.10.1-stable review

This is the start of the stable review cycle for the 4.10.1 release.
There are 21 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun Feb 26 08:38:42 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.1-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.10.1-rc1

Brian Foster <bfoster@redhat.com>
    xfs: clear delalloc and cache on buffered write failure

Michael Schenk <michael.schenk@albis-elcon.com>
    rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down

Tejun Heo <tj@kernel.org>
    block: fix double-free in the failure path of cgwb_bdi_init()

Lv Zheng <lv.zheng@intel.com>
    ACPICA: Linuxize: Restore and fix Intel compiler build

Jiri Kosina <jkosina@suse.cz>
    netfilter: nf_ct_helper: warn when not applying default helper assignment

Thomas Gleixner <tglx@linutronix.de>
    goldfish: Sanitize the broken interrupt handler

Thomas Gleixner <tglx@linutronix.de>
    x86/platform/goldfish: Prevent unconditional loading

Johan Hovold <johan@kernel.org>
    USB: serial: console: fix uninitialised spinlock

Johan Hovold <johan@kernel.org>
    USB: serial: ark3116: fix register-accessor error handling

Johan Hovold <johan@kernel.org>
    USB: serial: opticon: fix CTS retrieval at open

Johan Hovold <johan@kernel.org>
    USB: serial: spcp8x5: fix modem-status handling

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix OOB data sanity check

Johan Hovold <johan@kernel.org>
    USB: serial: ftdi_sio: fix line-status over-reporting

Johan Hovold <johan@kernel.org>
    USB: serial: ftdi_sio: fix extreme low-latency setting

Johan Hovold <johan@kernel.org>
    USB: serial: ftdi_sio: fix modem-status error handling

Ken Lin <yungching0725@gmail.com>
    USB: serial: cp210x: add new IDs for GE Bx50v3 boards

Johan Hovold <johan@kernel.org>
    USB: serial: mos7840: fix another NULL-deref at open

Javier Martinez Canillas <javier@osg.samsung.com>
    tty: serial: msm: Fix module autoload

Maxime Jayat <maxime.jayat@mobile-devices.fr>
    net: socket: fix recvmmsg not returning error from sock_error

Paolo Abeni <pabeni@redhat.com>
    ip: fix IP_CHECKSUM handling

Michael S. Tsirkin <mst@redhat.com>
    ptr_ring: fix race conditions when resizing


-------------

Diffstat:

 Documentation/admin-guide/kernel-parameters.txt |  4 ++
 Makefile                                        |  4 +-
 arch/x86/platform/goldfish/goldfish.c           | 14 +++-
 drivers/net/wireless/realtek/rtlwifi/usb.c      | 18 +++++
 drivers/platform/goldfish/pdev_bus.c            | 13 ++--
 drivers/tty/serial/msm_serial.c                 |  1 +
 drivers/usb/serial/ark3116.c                    | 13 +++-
 drivers/usb/serial/console.c                    |  1 +
 drivers/usb/serial/cp210x.c                     |  2 +
 drivers/usb/serial/digi_acceleport.c            | 14 ++--
 drivers/usb/serial/ftdi_sio.c                   | 31 +++++----
 drivers/usb/serial/mos7840.c                    |  4 +-
 drivers/usb/serial/opticon.c                    |  2 +-
 drivers/usb/serial/spcp8x5.c                    |  8 ++-
 fs/xfs/xfs_iomap.c                              | 13 +++-
 include/acpi/platform/acenv.h                   |  2 +-
 include/acpi/platform/acintel.h                 | 87 +++++++++++++++++++++++++
 include/linux/ptr_ring.h                        | 36 ++++++++--
 mm/backing-dev.c                                |  9 ++-
 net/ipv4/ip_sockglue.c                          |  8 +--
 net/netfilter/nf_conntrack_helper.c             | 39 +++++++----
 net/socket.c                                    |  4 +-
 22 files changed, 269 insertions(+), 58 deletions(-)

[toc] | [next] | [standalone]

#1587393 — [PATCH 4.10 13/21] USB: serial: ark3116: fix register-accessor error handling

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 9fef37d7cf170522fb354d6d0ea6de09b9b16678 upstream.

The current implementation failed to detect short transfers, something
which could lead to bits of the uninitialised heap transfer buffer
leaking to user space.

Fixes: 149fc791a452 ("USB: ark3116: Setup some basic infrastructure for new ark3116 driver.")
Fixes: f4c1e8d597d1 ("USB: ark3116: Make existing functions 16450-aware and add close and release functions.")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ark3116.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -99,10 +99,17 @@ static int ark3116_read_reg(struct usb_s
 				 usb_rcvctrlpipe(serial->dev, 0),
 				 0xfe, 0xc0, 0, reg,
 				 buf, 1, ARK_TIMEOUT);
-	if (result < 0)
+	if (result < 1) {
+		dev_err(&serial->interface->dev,
+				"failed to read register %u: %d\n",
+				reg, result);
+		if (result >= 0)
+			result = -EIO;
+
 		return result;
-	else
-		return buf[0];
+	}
+
+	return buf[0];
 }
 
 static inline int calc_divisor(int bps)

[toc] | [prev] | [next] | [standalone]

#1587395 — [PATCH 4.10 06/21] USB: serial: cp210x: add new IDs for GE Bx50v3 boards

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ken Lin <yungching0725@gmail.com>

commit 9a593656def0dc2f6c227851e8e602077267a5f1 upstream.

Add new USB IDs for cp2104/5 devices on Bx50v3 boards due to the design
change.

Signed-off-by: Ken Lin <yungching0725@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/cp210x.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -178,6 +178,8 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
 	{ USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
+	{ USB_DEVICE(0x1901, 0x0195) },	/* GE B850/B650/B450 CP2104 DP UART interface */
+	{ USB_DEVICE(0x1901, 0x0196) },	/* GE B850 CP2105 DP UART interface */
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
 	{ USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */

[toc] | [prev] | [next] | [standalone]

#1587396 — [PATCH 4.10 10/21] USB: serial: digi_acceleport: fix OOB data sanity check

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 2d380889215fe20b8523345649dee0579821800c upstream.

Make sure to check for short transfers to avoid underflow in a loop
condition when parsing the receive buffer.

Also fix an off-by-one error in the incomplete sanity check which could
lead to invalid data being parsed.

Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/digi_acceleport.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1482,16 +1482,20 @@ static int digi_read_oob_callback(struct
 	struct usb_serial *serial = port->serial;
 	struct tty_struct *tty;
 	struct digi_port *priv = usb_get_serial_port_data(port);
+	unsigned char *buf = urb->transfer_buffer;
 	int opcode, line, status, val;
 	int i;
 	unsigned int rts;
 
+	if (urb->actual_length < 4)
+		return -1;
+
 	/* handle each oob command */
-	for (i = 0; i < urb->actual_length - 3;) {
-		opcode = ((unsigned char *)urb->transfer_buffer)[i++];
-		line = ((unsigned char *)urb->transfer_buffer)[i++];
-		status = ((unsigned char *)urb->transfer_buffer)[i++];
-		val = ((unsigned char *)urb->transfer_buffer)[i++];
+	for (i = 0; i < urb->actual_length - 4; i += 4) {
+		opcode = buf[i];
+		line = buf[i + 1];
+		status = buf[i + 2];
+		val = buf[i + 3];
 
 		dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n",
 			opcode, line, status, val);

[toc] | [prev] | [next] | [standalone]

#1587397 — [PATCH 4.10 16/21] goldfish: Sanitize the broken interrupt handler

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 6cf18e6927c0b224f972e3042fb85770d63cb9f8 upstream.

This interrupt handler is broken in several ways:

  - It loops forever when the op code is not decodeable

  - It never returns IRQ_HANDLED because the only way to exit the loop
    returns IRQ_NONE unconditionally.

The whole concept of this is broken. Creating devices in an interrupt
handler is beyond any point of sanity.

Make it at least behave halfways sane so accidental users do not have to
deal with a hard to debug lockup.

Fixes: e809c22b8fb028 ("goldfish: add the goldfish virtual bus")
Reported-by: Gabriel C <nix.or.die@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/goldfish/pdev_bus.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/platform/goldfish/pdev_bus.c
+++ b/drivers/platform/goldfish/pdev_bus.c
@@ -157,23 +157,26 @@ static int goldfish_new_pdev(void)
 static irqreturn_t goldfish_pdev_bus_interrupt(int irq, void *dev_id)
 {
 	irqreturn_t ret = IRQ_NONE;
+
 	while (1) {
 		u32 op = readl(pdev_bus_base + PDEV_BUS_OP);
-		switch (op) {
-		case PDEV_BUS_OP_DONE:
-			return IRQ_NONE;
 
+		switch (op) {
 		case PDEV_BUS_OP_REMOVE_DEV:
 			goldfish_pdev_remove();
+			ret = IRQ_HANDLED;
 			break;
 
 		case PDEV_BUS_OP_ADD_DEV:
 			goldfish_new_pdev();
+			ret = IRQ_HANDLED;
 			break;
+
+		case PDEV_BUS_OP_DONE:
+		default:
+			return ret;
 		}
-		ret = IRQ_HANDLED;
 	}
-	return ret;
 }
 
 static int goldfish_pdev_bus_probe(struct platform_device *pdev)

[toc] | [prev] | [next] | [standalone]

#1587399 — [PATCH 4.10 20/21] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Schenk <michael.schenk@albis-elcon.com>

commit 575ddce0507789bf9830d089557d2199d2f91865 upstream.

In the function rtl_usb_start we pre-allocate a certain number of urbs
for RX path but they will not be freed when calling rtl_usb_stop. This
results in leaking urbs when doing ifconfig up and down. Eventually,
the system has no available urbs.

Signed-off-by: Michael Schenk <michael.schenk@albis-elcon.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/realtek/rtlwifi/usb.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -827,12 +827,30 @@ static void rtl_usb_stop(struct ieee8021
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+	struct urb *urb;
 
 	/* should after adapter start and interrupt enable. */
 	set_hal_stop(rtlhal);
 	cancel_work_sync(&rtlpriv->works.fill_h2c_cmd);
 	/* Enable software */
 	SET_USB_STOP(rtlusb);
+
+	/* free pre-allocated URBs from rtl_usb_start() */
+	usb_kill_anchored_urbs(&rtlusb->rx_submitted);
+
+	tasklet_kill(&rtlusb->rx_work_tasklet);
+	cancel_work_sync(&rtlpriv->works.lps_change_work);
+
+	flush_workqueue(rtlpriv->works.rtl_wq);
+
+	skb_queue_purge(&rtlusb->rx_queue);
+
+	while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) {
+		usb_free_coherent(urb->dev, urb->transfer_buffer_length,
+				urb->transfer_buffer, urb->transfer_dma);
+		usb_free_urb(urb);
+	}
+
 	rtlpriv->cfg->ops->hw_disable(hw);
 }
 

[toc] | [prev] | [next] | [standalone]

#1587400 — [PATCH 4.10 14/21] USB: serial: console: fix uninitialised spinlock

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 14816b16fa0adac24f82492f18fa62c55acabbbe upstream.

Since commit 4a510969374a ("tty: Make tty_files_lock per-tty") a new
tty_struct spin lock is taken in the tty release path, but the
USB-serial-console hack was never updated hence leaving the lock of its
"fake" tty uninitialised. This was eventually detected by lockdep.

Make sure to initialise the new lock also for the fake tty to address
this regression.

Yes, this code is a mess, but cleaning it up is left for another day.

Fixes: 4a510969374a ("tty: Make tty_files_lock per-tty")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/console.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -143,6 +143,7 @@ static int usb_console_setup(struct cons
 			tty->driver = usb_serial_tty_driver;
 			tty->index = co->index;
 			init_ldsem(&tty->ldisc_sem);
+			spin_lock_init(&tty->files_lock);
 			INIT_LIST_HEAD(&tty->tty_files);
 			kref_get(&tty->driver->kref);
 			__module_get(tty->driver->owner);

[toc] | [prev] | [next] | [standalone]

#1587401 — [PATCH 4.10 04/21] tty: serial: msm: Fix module autoload

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Javier Martinez Canillas <javier@osg.samsung.com>

commit abe81f3b8ed2996e1712d26d38ff6b73f582c616 upstream.

If the driver is built as a module, autoload won't work because the module
alias information is not filled. So user-space can't match the registered
device with the corresponding module.

Export the module alias information using the MODULE_DEVICE_TABLE() macro.

Before this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
$

After this patch:

$ modinfo drivers/tty/serial/msm_serial.ko | grep alias
alias:          of:N*T*Cqcom,msm-uartdmC*
alias:          of:N*T*Cqcom,msm-uartdm
alias:          of:N*T*Cqcom,msm-uartC*
alias:          of:N*T*Cqcom,msm-uart

Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/msm_serial.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -1809,6 +1809,7 @@ static const struct of_device_id msm_mat
 	{ .compatible = "qcom,msm-uartdm" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, msm_match_table);
 
 static struct platform_driver msm_platform_driver = {
 	.remove = msm_serial_remove,

[toc] | [prev] | [next] | [standalone]

#1587402 — [PATCH 4.10 15/21] x86/platform/goldfish: Prevent unconditional loading

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb upstream.

The goldfish platform code registers the platform device unconditionally
which causes havoc in several ways if the goldfish_pdev_bus driver is
enabled:

 - Access to the hardcoded physical memory region, which is either not
   available or contains stuff which is completely unrelated.

 - Prevents that the interrupt of the serial port can be requested

 - In case of a spurious interrupt it goes into a infinite loop in the
   interrupt handler of the pdev_bus driver (which needs to be fixed
   seperately).

Add a 'goldfish' command line option to make the registration opt-in when
the platform is compiled in.

I'm seriously grumpy about this engineering trainwreck, which has seven
SOBs from Intel developers for 50 lines of code. And none of them figured
out that this is broken. Impressive fail!

Fixes: ddd70cf93d78 ("goldfish: platform device for x86")
Reported-by: Gabriel C <nix.or.die@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/admin-guide/kernel-parameters.txt |    4 ++++
 arch/x86/platform/goldfish/goldfish.c           |   14 +++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1201,6 +1201,10 @@
 			When zero, profiling data is discarded and associated
 			debugfs files are removed at module unload time.
 
+	goldfish	[X86] Enable the goldfish android emulator platform.
+			Don't use this when you are not running on the
+			android emulator
+
 	gpt		[EFI] Forces disk with valid GPT signature but
 			invalid Protective MBR to be treated as GPT. If the
 			primary GPT is corrupted, it enables the backup/alternate
--- a/arch/x86/platform/goldfish/goldfish.c
+++ b/arch/x86/platform/goldfish/goldfish.c
@@ -42,10 +42,22 @@ static struct resource goldfish_pdev_bus
 	}
 };
 
+static bool goldfish_enable __initdata;
+
+static int __init goldfish_setup(char *str)
+{
+	goldfish_enable = true;
+	return 0;
+}
+__setup("goldfish", goldfish_setup);
+
 static int __init goldfish_init(void)
 {
+	if (!goldfish_enable)
+		return -ENODEV;
+
 	platform_device_register_simple("goldfish_pdev_bus", -1,
-						goldfish_pdev_bus_resources, 2);
+					goldfish_pdev_bus_resources, 2);
 	return 0;
 }
 device_initcall(goldfish_init);

[toc] | [prev] | [next] | [standalone]

#1587404 — [PATCH 4.10 02/21] ip: fix IP_CHECKSUM handling

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <pabeni@redhat.com>


[ Upstream commit ca4ef4574f1ee5252e2cd365f8f5d5bafd048f32 ]

The skbs processed by ip_cmsg_recv() are not guaranteed to
be linear e.g. when sending UDP packets over loopback with
MSGMORE.
Using csum_partial() on [potentially] the whole skb len
is dangerous; instead be on the safe side and use skb_checksum().

Thanks to syzkaller team to detect the issue and provide the
reproducer.

v1 -> v2:
 - move the variable declaration in a tighter scope

Fixes: ad6f939ab193 ("ip: Add offset parameter to ip_cmsg_recv")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_sockglue.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -116,10 +116,10 @@ static void ip_cmsg_recv_checksum(struct
 	if (skb->ip_summed != CHECKSUM_COMPLETE)
 		return;
 
-	if (offset != 0)
-		csum = csum_sub(csum,
-				csum_partial(skb_transport_header(skb) + tlen,
-					     offset, 0));
+	if (offset != 0) {
+		int tend_off = skb_transport_offset(skb) + tlen;
+		csum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0));
+	}
 
 	put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum);
 }

[toc] | [prev] | [next] | [standalone]

#1587406 — [PATCH 4.10 17/21] netfilter: nf_ct_helper: warn when not applying default helper assignment

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Kosina <jkosina@suse.cz>

commit dfe75ff8ca74f54b0fa5a326a1aa9afa485ed802 upstream.

Commit 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper
assignment") is causing behavior regressions in firewalls, as traffic
handled by conntrack helpers is now by default not passed through even
though it was before due to missing CT targets (which were not necessary
before this commit).

The default had to be switched off due to security reasons [1] [2] and
therefore should stay the way it is, but let's be friendly to firewall
admins and issue a warning the first time we're in situation where packet
would be likely passed through with the old default but we're likely going
to drop it on the floor now.

Rewrite the code a little bit as suggested by Linus, so that we avoid
spaghettiing the code even more -- namely the whole decision making
process regarding helper selection (either automatic or not) is being
separated, so that the whole logic can be simplified and code (condition)
duplication reduced.

[1] https://cansecwest.com/csw12/conntrack-attack.pdf
[2] https://home.regit.org/netfilter-en/secure-use-of-helpers/

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nf_conntrack_helper.c |   39 ++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 13 deletions(-)

--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -188,6 +188,26 @@ nf_ct_helper_ext_add(struct nf_conn *ct,
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 
+static struct nf_conntrack_helper *
+nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
+{
+	if (!net->ct.sysctl_auto_assign_helper) {
+		if (net->ct.auto_assign_helper_warned)
+			return NULL;
+		if (!__nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))
+			return NULL;
+		pr_info("nf_conntrack: default automatic helper assignment "
+			"has been turned off for security reasons and CT-based "
+			" firewall rule not found. Use the iptables CT target "
+			"to attach helpers instead.\n");
+		net->ct.auto_assign_helper_warned = 1;
+		return NULL;
+	}
+
+	return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+}
+
+
 int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 			      gfp_t flags)
 {
@@ -213,21 +233,14 @@ int __nf_ct_try_assign_helper(struct nf_
 	}
 
 	help = nfct_help(ct);
-	if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
-		helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-		if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
-			pr_info("nf_conntrack: automatic helper "
-				"assignment is deprecated and it will "
-				"be removed soon. Use the iptables CT target "
-				"to attach helpers instead.\n");
-			net->ct.auto_assign_helper_warned = true;
-		}
-	}
 
 	if (helper == NULL) {
-		if (help)
-			RCU_INIT_POINTER(help->helper, NULL);
-		return 0;
+		helper = nf_ct_lookup_helper(ct, net);
+		if (helper == NULL) {
+			if (help)
+				RCU_INIT_POINTER(help->helper, NULL);
+			return 0;
+		}
 	}
 
 	if (help == NULL) {

[toc] | [prev] | [next] | [standalone]

#1587408 — [PATCH 4.10 12/21] USB: serial: opticon: fix CTS retrieval at open

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 2eee05020a0e7ee7c04422cbacdb07859e45dce6 upstream.

The opticon driver used a control request at open to trigger a CTS
status notification to be sent over the bulk-in pipe. When the driver
was converted to using the generic read implementation, an inverted test
prevented this request from being sent, something which could lead to
TIOCMGET reporting an incorrect CTS state.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 7a6ee2b02751 ("USB: opticon: switch to generic read implementation")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/opticon.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -142,7 +142,7 @@ static int opticon_open(struct tty_struc
 	usb_clear_halt(port->serial->dev, port->read_urb->pipe);
 
 	res = usb_serial_generic_open(tty, port);
-	if (!res)
+	if (res)
 		return res;
 
 	/* Request CTS line state, sometimes during opening the current

[toc] | [prev] | [next] | [standalone]

#1587411 — [PATCH 4.10 05/21] USB: serial: mos7840: fix another NULL-deref at open

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.

Fix another NULL-pointer dereference at open should a malicious device
lack an interrupt-in endpoint.

Note that the driver has a broken check for an interrupt-in endpoint
which means that an interrupt URB has never even been submitted.

Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7840.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1023,6 +1023,7 @@ static int mos7840_open(struct tty_struc
 	 * (can't set it up in mos7840_startup as the structures *
 	 * were not set up at that time.)                        */
 	if (port0->open_ports == 1) {
+		/* FIXME: Buffer never NULL, so URB is not submitted. */
 		if (serial->port[0]->interrupt_in_buffer == NULL) {
 			/* set up interrupt urb */
 			usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -2106,7 +2107,8 @@ static int mos7840_calc_num_ports(struct
 static int mos7840_attach(struct usb_serial *serial)
 {
 	if (serial->num_bulk_in < serial->num_ports ||
-			serial->num_bulk_out < serial->num_ports) {
+			serial->num_bulk_out < serial->num_ports ||
+			serial->num_interrupt_in < 1) {
 		dev_err(&serial->interface->dev, "missing endpoints\n");
 		return -ENODEV;
 	}

[toc] | [prev] | [next] | [standalone]

#1587412 — [PATCH 4.10 19/21] block: fix double-free in the failure path of cgwb_bdi_init()

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 5f478e4ea5c5560b4e40eb136991a09f9389f331 upstream.

When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested
at bdi->wb_congested.  cgwb_bdi_init() allocates it with kzalloc() and
doesn't do further initialization.  This usually works fine as the
reference count gets bumped to 1 by wb_init() and the put from
wb_exit() releases it.

However, when wb_init() fails, it puts the wb base ref automatically
freeing the wb and the explicit kfree() in cgwb_bdi_init() error path
ends up trying to free the same pointer the second time causing a
double-free.

Fix it by explicitly initilizing the refcnt to 1 and putting the base
ref from cgwb_bdi_destroy().

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in bdi_writeback")
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/backing-dev.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -758,15 +758,20 @@ static int cgwb_bdi_init(struct backing_
 	if (!bdi->wb_congested)
 		return -ENOMEM;
 
+	atomic_set(&bdi->wb_congested->refcnt, 1);
+
 	err = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
 	if (err) {
-		kfree(bdi->wb_congested);
+		wb_congested_put(bdi->wb_congested);
 		return err;
 	}
 	return 0;
 }
 
-static void cgwb_bdi_destroy(struct backing_dev_info *bdi) { }
+static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
+{
+	wb_congested_put(bdi->wb_congested);
+}
 
 #endif	/* CONFIG_CGROUP_WRITEBACK */
 

[toc] | [prev] | [next] | [standalone]

#1587853

On 02/24/2017 01:39 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.10.1 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun Feb 26 08:38:42 UTC 2017.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.1-rc1.gz
> or in the git tree and branch at:
>   git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions. When
I did a reboot, shutdown sequence took longer than usual. I will
look into this further later on this afternoon.

I don't think this is a show stopper though.

thanks,
-- Shuah

[toc] | [prev] | [next] | [standalone]

#1588347

On Fri, Feb 24, 2017 at 11:20:10AM -0700, Shuah Khan wrote:
> On 02/24/2017 01:39 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.10.1 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun Feb 26 08:38:42 UTC 2017.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.1-rc1.gz
> > or in the git tree and branch at:
> >   git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> 
> Compiled and booted on my test system. No dmesg regressions. When
> I did a reboot, shutdown sequence took longer than usual. I will
> look into this further later on this afternoon.
> 
> I don't think this is a show stopper though.

Let me know if you find anything, and thanks for testing all 3 of these.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1588060

On 02/24/2017 12:39 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.10.1 release.
> There are 21 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Feb 26 08:38:42 UTC 2017.
> Anything received after that time might be too late.
>

Build results:
	total: 149 pass: 149 fail: 0
Qemu test results:
	total: 122 pass: 122 fail: 0

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1588349

On Fri, Feb 24, 2017 at 08:24:17PM -0800, Guenter Roeck wrote:
> On 02/24/2017 12:39 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.10.1 release.
> > There are 21 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun Feb 26 08:38:42 UTC 2017.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 149 pass: 149 fail: 0
> Qemu test results:
> 	total: 122 pass: 122 fail: 0
> 
> Details are available at http://kerneltests.org/builders.

Thanks for testing all of these and letting me know.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1588345

On Fri, Feb 24, 2017 at 10:09:22AM -0800, kernelci.org bot wrote:
> stable-rc boot: 191 boots: 2 failed, 181 passed with 8 offline (v4.10-22-g0b3f6c4ba776)
> 
> Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/kernel/v4.10-22-g0b3f6c4ba776/
> Full Build Summary: https://kernelci.org/build/stable-rc/kernel/v4.10-22-g0b3f6c4ba776/
> 
> Tree: stable-rc
> Branch: local/linux-4.10.y
> Git Describe: v4.10-22-g0b3f6c4ba776
> Git Commit: 0b3f6c4ba776c7c49564681a3b0be953cce243e3
> Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> Tested: 47 unique boards, 16 SoC families, 24 builds out of 206
> 
> Boot Failures Detected:
> 
> arm64:
> 
>     defconfig+CONFIG_RANDOMIZE_BASE=y
>         apm-mustang: 1 failed lab
>         juno: 1 failed lab

Is this failure new?

thanks,

greg k-h

[toc] | [prev] | [next] | [standalone]

#1588915

Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:

> On Fri, Feb 24, 2017 at 10:09:22AM -0800, kernelci.org bot wrote:
>> stable-rc boot: 191 boots: 2 failed, 181 passed with 8 offline (v4.10-22-g0b3f6c4ba776)
>> 
>> Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/kernel/v4.10-22-g0b3f6c4ba776/
>> Full Build Summary: https://kernelci.org/build/stable-rc/kernel/v4.10-22-g0b3f6c4ba776/
>> 
>> Tree: stable-rc
>> Branch: local/linux-4.10.y
>> Git Describe: v4.10-22-g0b3f6c4ba776
>> Git Commit: 0b3f6c4ba776c7c49564681a3b0be953cce243e3
>> Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
>> Tested: 47 unique boards, 16 SoC families, 24 builds out of 206
>> 
>> Boot Failures Detected:
>> 
>> arm64:
>> 
>>     defconfig+CONFIG_RANDOMIZE_BASE=y
>>         apm-mustang: 1 failed lab
>>         juno: 1 failed lab
>
> Is this failure new?

It's new, but not unique to stable, also been happening in mainline for awhile:

    https://kernelci.org/boot/id/58b381fd59b51450d65e8e4f/

Not sure if anyone is looking into it though, as I'm just getting back
from some time off.

Kevin

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web