Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1610686 > unrolled thread

[PATCH 4.10 000/111] 4.10.7-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2017-03-28 14:40 +0200
Last post2017-03-29 07:50 +0200
Articles 20 on this page of 97 — 4 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 4.10 000/111] 4.10.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:40 +0200
    [PATCH 4.10 046/111] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 065/111] parport: fix attempt to write duplicate procfiles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 023/111] amd-xgbe: Fix the ECC-related bit position definitions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 053/111] USB: usbtmc: fix probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 100/111] intel_th: Dont leak module refcount on failure to activate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 103/111] mmc: block: Fix is_waiting_last_req set incorrectly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 022/111] tcp: initialize icsk_ack.lrcvtime at session start time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 095/111] cpsw/netcp: cpts depends on posix_timers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 034/111] Input: cm109 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 014/111] net/mlx5: Increase number of max QPs in default profile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 050/111] usb: musb: cppi41: dont check early-TX-interrupt for Isoch transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 049/111] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 058/111] mmc: core: Fix access to HS400-ES devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 111/111] crypto: algif_hash - avoid zero-sized array Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 093/111] blk-mq: dont complete un-started request in timeout handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 082/111] fscrypt: remove broken support for detecting keyring key revocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 102/111] Drivers: hv: vmbus: Dont leak memory when a channel is rescinded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 048/111] USB: idmouse: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 104/111] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 025/111] HID: sony: Fix input device leak when connecting a DS4 twice using USB/BT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 110/111] fbcon: Fix vc attr at deinit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 005/111] openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 037/111] ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 106/111] scsi: sd: Check for unaligned partial completion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 089/111] ARM: at91: pm: cpu_idle: switch DDR to power-down mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 14:50 +0200
    [PATCH 4.10 043/111] usb: gadget: f_uvc: Fix SuperSpeed companion descriptors wBytesPerInterval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 051/111] usb: hub: Fix crash after failure to read BOS descriptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 019/111] ipv4: provide stronger user input validation in nl_fib_input() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 021/111] genetlink: fix counting regression on ctrl_dumpfamily() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 054/111] uwb: i1480-dfu: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 020/111] socket, bpf: fix sk_filter use after free in sk_clone_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 057/111] nl80211: fix dumpit error path RTNL deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 045/111] usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 109/111] drm: reference count event->completion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 038/111] ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 052/111] USB: usbtmc: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 056/111] mmc: ushc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 039/111] ALSA: hda - Adding a group of pin definition to fix headset problem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 033/111] Input: yealink - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 047/111] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 055/111] uwb: hwa-rc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 040/111] USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:00 +0200
    [PATCH 4.10 101/111] Drivers: hv: vmbus: Dont leak channel ids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.10 097/111] drm/amd/amdgpu: add POLARIS12 PCI ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.10 105/111] device-dax: fix pmd/pte fault fallback handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.10 098/111] auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.10 107/111] cpuidle: Validate cpu_dev in cpuidle_add_sysfs() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:20 +0200
    [PATCH 4.10 086/111] iommu/exynos: Block SYSMMU while invalidating FLPD cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 067/111] ext4: mark inode dirty after converting inline directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 062/111] iio: magnetometer: ak8974: remove incorrect __exit markups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 090/111] arm64: kaslr: Fix up the kernel image alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 079/111] mwifiex: pcie: dont leak DMA buffers when removing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 099/111] jbd2: dont leak memory if setting up journal fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 017/111] ipv6: make sure to initialize sockc.tsflags before first use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 091/111] cpufreq: Restore policy min/max limits on CPU online Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 096/111] drm/amdgpu: reinstate oland workaround for sclk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 061/111] iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 085/111] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 088/111] Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 064/111] mei: dont wait for os version message reply Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 108/111] xen: do not re-use pirq number cached in pci device msi msg data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 092/111] cgroup, net_cls: iterate the fds of only the tasks which are being migrated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 081/111] crypto: ccp - Assign DMA commands to the channels CCP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 066/111] ppdev: fix registering same device name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 084/111] xen/acpi: upload PM state from init-domain to Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 063/111] mei: fix deadlock on mei reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 083/111] vfio: Rework group release notifier warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 087/111] iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
    [PATCH 4.10 094/111] libceph: force GFP_NOIO for socket allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:30 +0200
      Re: [PATCH 4.10 094/111] libceph: force GFP_NOIO for socket  allocations Michal Hocko <mhocko@kernel.org> - 2017-03-29 10:20 +0200
        Re: [PATCH 4.10 094/111] libceph: force GFP_NOIO for socket  allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 09:40 +0200
    [PATCH 4.10 059/111] iio: adc: ti_am335x_adc: fix fifo overrun recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 024/111] net: solve a NAPI race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 060/111] iio: sw-device: Fix config group initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 069/111] powerpc/64s: Fix idle wakeup potential to clobber registers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 077/111] clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 073/111] mmc: sdhci: Do not disable interrupts while waiting for clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 026/111] Input: ALPS - fix V8+ protocol handling (73 03 28) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 016/111] net/mlx5e: Count LRO packets correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 074/111] mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 080/111] ath10k: fix incorrect wlan_mac_base in qca6174_regs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 072/111] mmc: sdhci-of-arasan: fix incorrect timeout clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 068/111] ext4: lock the xattr block before checksuming it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 071/111] mmc: sdhci-of-at91: Support external regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 078/111] clk: sunxi-ng: mp: Adjust parent rate for pre-dividers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 075/111] hwrng: amd - Revert managed API changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 070/111] audit: fix auditd/kernel connection state tracking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 076/111] hwrng: geode - Revert managed API changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:40 +0200
    [PATCH 4.10 010/111] net/mlx5e: Change the TC offload rule add/del code path to be per NIC or E-Switch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:50 +0200
    [PATCH 4.10 013/111] net/mlx5e: Avoid supporting udp tunnel port ndo for VF reps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:50 +0200
    [PATCH 4.10 011/111] net/mlx5: E-Switch, Dont allow changing inline mode when flows are configured Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:50 +0200
    [PATCH 4.10 012/111] net/mlx5e: Use the proper UAPI values when offloading TC vlan actions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-28 15:50 +0200
    Re: [PATCH 4.10 000/111] 4.10.7-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-28 21:40 +0200
      Re: [PATCH 4.10 000/111] 4.10.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-29 07:50 +0200
    Re: [PATCH 4.10 000/111] 4.10.7-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-29 05:10 +0200
      Re: [PATCH 4.10 000/111] 4.10.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-29 07:50 +0200

Page 1 of 5  [1] 2 3 4 5  Next page →


#1610686 — [PATCH 4.10 000/111] 4.10.7-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:40 +0200
Subject[PATCH 4.10 000/111] 4.10.7-stable review
Message-ID<tpYzM-7we-9@gated-at.bofh.it>
This is the start of the stable review cycle for the 4.10.7 release.
There are 111 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Mar 30 12:28:57 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.7-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.10.7-rc1

Jiri Slaby <jslaby@suse.cz>
    crypto: algif_hash - avoid zero-sized array

Takashi Iwai <tiwai@suse.de>
    fbcon: Fix vc attr at deinit

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm: reference count event->completion

Dan Streetman <ddstreet@ieee.org>
    xen: do not re-use pirq number cached in pci device msi msg data

Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
    cpuidle: Validate cpu_dev in cpuidle_add_sysfs()

Damien Le Moal <damien.lemoal@wdc.com>
    scsi: sd: Check for unaligned partial completion

Dave Jiang <dave.jiang@intel.com>
    device-dax: fix pmd/pte fault fallback handling

Ilya Dryomov <idryomov@gmail.com>
    libceph: don't set weight to IN when OSD is destroyed

Adrian Hunter <adrian.hunter@intel.com>
    mmc: block: Fix is_waiting_last_req set incorrectly

K. Y. Srinivasan <kys@microsoft.com>
    Drivers: hv: vmbus: Don't leak memory when a channel is rescinded

K. Y. Srinivasan <kys@microsoft.com>
    Drivers: hv: vmbus: Don't leak channel ids

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: Don't leak module refcount on failure to activate

Eric Biggers <ebiggers@google.com>
    jbd2: don't leak memory if setting up journal fails

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches

Evan Quan <evan.quan@amd.com>
    drm/amd/amdgpu: add POLARIS12 PCI ID

Alex Deucher <alexander.deucher@amd.com>
    drm/amdgpu: reinstate oland workaround for sclk

Arnd Bergmann <arnd@arndb.de>
    cpsw/netcp: cpts depends on posix_timers

Ilya Dryomov <idryomov@gmail.com>
    libceph: force GFP_NOIO for socket allocations

Ming Lei <tom.leiming@gmail.com>
    blk-mq: don't complete un-started request in timeout handler

Tejun Heo <tj@kernel.org>
    cgroup, net_cls: iterate the fds of only the tasks which are being migrated

Viresh Kumar <viresh.kumar@linaro.org>
    cpufreq: Restore policy min/max limits on CPU online

Neeraj Upadhyay <neeraju@codeaurora.org>
    arm64: kaslr: Fix up the kernel image alignment

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: at91: pm: cpu_idle: switch DDR to power-down mode

Romain Izard <romain.izard.pro@gmail.com>
    Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node"

Marek Szyprowski <m.szyprowski@samsung.com>
    iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5

Marek Szyprowski <m.szyprowski@samsung.com>
    iommu/exynos: Block SYSMMU while invalidating FLPD cache

Koos Vriezen <koos.vriezen@gmail.com>
    iommu/vt-d: Fix NULL pointer dereference in device_to_iommu

Ankur Arora <ankur.a.arora@oracle.com>
    xen/acpi: upload PM state from init-domain to Xen

Alex Williamson <alex.williamson@redhat.com>
    vfio: Rework group release notifier warning

Eric Biggers <ebiggers@google.com>
    fscrypt: remove broken support for detecting keyring key revocation

Gary R Hook <ghook@amd.com>
    crypto: ccp - Assign DMA commands to the channel's CCP

Ryan Hsu <ryanhsu@qca.qualcomm.com>
    ath10k: fix incorrect wlan_mac_base in qca6174_regs

Brian Norris <briannorris@chromium.org>
    mwifiex: pcie: don't leak DMA buffers when removing

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: mp: Adjust parent rate for pre-dividers

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock

Prarit Bhargava <prarit@redhat.com>
    hwrng: geode - Revert managed API changes

Prarit Bhargava <prarit@redhat.com>
    hwrng: amd - Revert managed API changes

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci: Do not disable interrupts while waiting for clock

Anssi Hannula <anssi.hannula@bitwise.fi>
    mmc: sdhci-of-arasan: fix incorrect timeout clock

Romain Izard <romain.izard.pro@gmail.com>
    mmc: sdhci-of-at91: Support external regulators

Paul Moore <paul@paul-moore.com>
    audit: fix auditd/kernel connection state tracking

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s: Fix idle wakeup potential to clobber registers

Theodore Ts'o <tytso@mit.edu>
    ext4: lock the xattr block before checksuming it

Eric Biggers <ebiggers@google.com>
    ext4: mark inode dirty after converting inline directory

Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    ppdev: fix registering same device name

Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    parport: fix attempt to write duplicate procfiles

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: don't wait for os version message reply

Tomas Winkler <tomas.winkler@intel.com>
    mei: fix deadlock on mei reset

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    iio: magnetometer: ak8974: remove incorrect __exit markups

Song Hongyan <hongyan.song@intel.com>
    iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3

Lars-Peter Clausen <lars@metafoo.de>
    iio: sw-device: Fix config group initialization

Michael Engl <michael.engl@wjw-solutions.com>
    iio: adc: ti_am335x_adc: fix fifo overrun recovery

Guenter Roeck <linux@roeck-us.net>
    mmc: core: Fix access to HS400-ES devices

Johannes Berg <johannes.berg@intel.com>
    nl80211: fix dumpit error path RTNL deadlocks

Johan Hovold <johan@kernel.org>
    mmc: ushc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: hwa-rc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: i1480-dfu: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: usbtmc: fix probe error path

Johan Hovold <johan@kernel.org>
    USB: usbtmc: add missing endpoint sanity check

Guenter Roeck <linux@roeck-us.net>
    usb: hub: Fix crash after failure to read BOS descriptor

Bin Liu <b-liu@ti.com>
    usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer

Johan Hovold <johan@kernel.org>
    USB: wusbcore: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: idmouse: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: lvtest: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: uss720: fix NULL-deref at probe

Samuel Thibault <samuel.thibault@ens-lyon.org>
    usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk

Stefan Brüns <stefan.bruens@rwth-aachen.de>
    dvb-usb-firmware: don't do DMA on stack

Roger Quadros <rogerq@ti.com>
    usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval

Oliver Neukum <oneukum@suse.com>
    ACM gadget: fix endianness in notifications

Bjørn Mork <bjorn@mork.no>
    USB: serial: qcserial: add Dell DW5811e

Dan Williams <dcbw@redhat.com>
    USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Adding a group of pin definition to fix headset problem

Takashi Iwai <tiwai@suse.de>
    ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()

Johan Hovold <johan@kernel.org>
    Input: sur40 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: kbtab - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: cm109 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: yealink - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: hanwang - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: ims-pcu - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: iforce - validate number of endpoints before using them

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000

Matjaz Hegedic <matjaz.hegedic@gmail.com>
    Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw

Masaki Ota <masaki.ota@jp.alps.com>
    Input: ALPS - fix trackstick button handling on V8 devices

Masaki Ota <masaki.ota@jp.alps.com>
    Input: ALPS - fix V8+ protocol handling (73 03 28)

Roderick Colenbrander <roderick.colenbrander@sony.com>
    HID: sony: Fix input device leak when connecting a DS4 twice using USB/BT

Eric Dumazet <edumazet@google.com>
    net: solve a NAPI race

Lendacky, Thomas <Thomas.Lendacky@amd.com>
    amd-xgbe: Fix the ECC-related bit position definitions

Eric Dumazet <edumazet@google.com>
    tcp: initialize icsk_ack.lrcvtime at session start time

Stanislaw Gruszka <sgruszka@redhat.com>
    genetlink: fix counting regression on ctrl_dumpfamily()

Daniel Borkmann <daniel@iogearbox.net>
    socket, bpf: fix sk_filter use after free in sk_clone_lock

Eric Dumazet <edumazet@google.com>
    ipv4: provide stronger user input validation in nl_fib_input()

Doug Berger <opendmb@gmail.com>
    net: bcmgenet: remove bcmgenet_internal_phy_setup()

Alexander Potapenko <glider@google.com>
    ipv6: make sure to initialize sockc.tsflags before first use

Gal Pressman <galp@mellanox.com>
    net/mlx5e: Count LRO packets correctly

Gal Pressman <galp@mellanox.com>
    net/mlx5e: Count GSO packets correctly

Maor Gottlieb <maorg@mellanox.com>
    net/mlx5: Increase number of max QPs in default profile

Paul Blakey <paulb@mellanox.com>
    net/mlx5e: Avoid supporting udp tunnel port ndo for VF reps

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5e: Use the proper UAPI values when offloading TC vlan actions

Roi Dayan <roid@mellanox.com>
    net/mlx5: E-Switch, Don't allow changing inline mode when flows are configured

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5e: Change the TC offload rule add/del code path to be per NIC or E-Switch

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5: Add missing entries for set/query rate limit commands

David Ahern <dsa@cumulusnetworks.com>
    net: vrf: Reset rt6i_idev in local dst after put

Bjørn Mork <bjorn@mork.no>
    qmi_wwan: add Dell DW5811e

Andrey Ulanov <andreyu@google.com>
    net: unix: properly re-increment inflight counter of GC discarded candidates

Kris Murphy <kriskend@linux.vnet.ibm.com>
    openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD

Lendacky, Thomas <Thomas.Lendacky@amd.com>
    amd-xgbe: Fix jumbo MTU processing on newer hardware

Eric Dumazet <edumazet@google.com>
    net: properly release sk_frag.page

Florian Fainelli <f.fainelli@gmail.com>
    net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled

Or Gerlitz <ogerlitz@mellanox.com>
    net/openvswitch: Set the ipv6 source tunnel key address attribute correctly


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/boot/dts/sama5d2.dtsi                     |   2 +-
 arch/arm/mach-at91/pm.c                            |  18 +-
 arch/arm64/kernel/kaslr.c                          |  10 +-
 arch/powerpc/kernel/idle_book3s.S                  |  20 +-
 arch/x86/pci/xen.c                                 |  23 +-
 block/blk-mq.c                                     |  11 +-
 crypto/algif_hash.c                                |   2 +-
 drivers/auxdisplay/img-ascii-lcd.c                 |   1 +
 drivers/char/hw_random/amd-rng.c                   |  42 +-
 drivers/char/hw_random/geode-rng.c                 |  50 +-
 drivers/char/ppdev.c                               |  11 +-
 drivers/clk/sunxi-ng/ccu-sun6i-a31.c               |   2 +-
 drivers/clk/sunxi-ng/ccu_mp.c                      |   8 +
 drivers/cpufreq/cpufreq.c                          |   3 +
 drivers/cpuidle/sysfs.c                            |  12 +
 drivers/crypto/ccp/ccp-dev.c                       |   5 +-
 drivers/crypto/ccp/ccp-dmaengine.c                 |   1 +
 drivers/dax/dax.c                                  |  15 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   1 +
 drivers/gpu/drm/amd/amdgpu/si_dpm.c                |  10 +-
 drivers/gpu/drm/drm_atomic_helper.c                |  11 +
 drivers/gpu/drm/drm_fops.c                         |   2 +-
 drivers/hid/hid-sony.c                             |   2 +
 drivers/hv/channel.c                               |  13 +-
 drivers/hv/channel_mgmt.c                          |   1 +
 drivers/hwtracing/intel_th/core.c                  |   4 +-
 drivers/iio/adc/ti_am335x_adc.c                    |  13 +-
 .../iio/common/hid-sensors/hid-sensor-trigger.c    |   6 +-
 drivers/iio/magnetometer/ak8974.c                  |   4 +-
 drivers/input/joystick/iforce/iforce-usb.c         |   3 +
 drivers/input/misc/cm109.c                         |   4 +
 drivers/input/misc/ims-pcu.c                       |   4 +
 drivers/input/misc/yealink.c                       |   4 +
 drivers/input/mouse/alps.c                         |  72 ++-
 drivers/input/mouse/alps.h                         |  11 +
 drivers/input/mouse/elan_i2c_core.c                |  20 +-
 drivers/input/serio/i8042-x86ia64io.h              |   7 +
 drivers/input/tablet/hanwang.c                     |   3 +
 drivers/input/tablet/kbtab.c                       |   3 +
 drivers/input/touchscreen/sur40.c                  |   3 +
 drivers/iommu/exynos-iommu.c                       |   8 +-
 drivers/iommu/intel-iommu.c                        |   2 +-
 drivers/media/usb/dvb-usb/dvb-usb-firmware.c       |  22 +-
 drivers/misc/mei/bus-fixup.c                       |  14 +-
 drivers/misc/mei/init.c                            |   8 +-
 drivers/mmc/core/block.c                           |   1 +
 drivers/mmc/core/mmc.c                             |   2 +-
 drivers/mmc/host/sdhci-of-arasan.c                 |  14 +-
 drivers/mmc/host/sdhci-of-at91.c                   |  19 +
 drivers/mmc/host/sdhci-pci-core.c                  |   4 +
 drivers/mmc/host/sdhci.c                           |   4 +-
 drivers/mmc/host/ushc.c                            |   3 +
 drivers/net/ethernet/amd/xgbe/xgbe-common.h        |  30 +-
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c           |  20 +-
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c           | 102 ++--
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   6 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c       |  15 -
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   4 -
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   8 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c   |   2 -
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |  72 ++-
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c    |   5 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h  |   6 +
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |  22 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   2 +-
 drivers/net/ethernet/ti/Kconfig                    |   2 +-
 drivers/net/usb/qmi_wwan.c                         |   2 +
 drivers/net/vrf.c                                  |   4 +-
 drivers/net/wireless/ath/ath10k/hw.c               |   2 +-
 drivers/net/wireless/marvell/mwifiex/pcie.c        |  38 +-
 drivers/parport/share.c                            |   6 +-
 drivers/scsi/mpt3sas/mpt3sas_scsih.c               |  15 -
 drivers/scsi/sd.c                                  |  17 +
 drivers/usb/class/usbtmc.c                         |  18 +-
 drivers/usb/core/config.c                          |  10 +
 drivers/usb/core/hub.c                             |   2 +-
 drivers/usb/core/quirks.c                          |   8 +
 drivers/usb/gadget/function/f_acm.c                |   4 +-
 drivers/usb/gadget/function/f_uvc.c                |   2 +-
 drivers/usb/misc/idmouse.c                         |   3 +
 drivers/usb/misc/lvstest.c                         |   4 +
 drivers/usb/misc/uss720.c                          |   5 +
 drivers/usb/musb/musb_cppi41.c                     |  23 +-
 drivers/usb/serial/option.c                        |  17 +-
 drivers/usb/serial/qcserial.c                      |   2 +
 drivers/usb/wusbcore/wa-hc.c                       |   3 +
 drivers/uwb/hwa-rc.c                               |   3 +
 drivers/uwb/i1480/dfu/usb.c                        |   3 +
 drivers/vfio/vfio.c                                |   8 +-
 drivers/video/console/fbcon.c                      |  67 ++-
 drivers/xen/xen-acpi-processor.c                   |  34 +-
 fs/crypto/crypto.c                                 |  10 +-
 fs/crypto/fname.c                                  |   2 +-
 fs/crypto/fscrypt_private.h                        |   4 -
 fs/crypto/keyinfo.c                                |  52 +-
 fs/ext4/inline.c                                   |   5 +-
 fs/ext4/xattr.c                                    |  65 +--
 fs/jbd2/journal.c                                  |  22 +-
 fs/jbd2/revoke.c                                   |   1 +
 include/drm/drmP.h                                 |   1 +
 include/linux/ccp.h                                |   2 +-
 include/linux/iio/sw_device.h                      |   2 +-
 include/linux/netdevice.h                          |  29 +-
 include/linux/usb/quirks.h                         |   6 +
 kernel/audit.c                                     | 639 +++++++++++++--------
 kernel/audit.h                                     |   9 +-
 kernel/auditsc.c                                   |   6 +-
 net/ceph/messenger.c                               |   6 +
 net/ceph/osdmap.c                                  |   1 -
 net/core/dev.c                                     |  81 ++-
 net/core/netclassid_cgroup.c                       |  32 +-
 net/core/sock.c                                    |  16 +-
 net/ipv4/fib_frontend.c                            |   3 +-
 net/ipv4/tcp_input.c                               |   2 +-
 net/ipv4/tcp_minisocks.c                           |   1 +
 net/ipv6/udp.c                                     |   2 +-
 net/netlink/genetlink.c                            |   4 +-
 net/openvswitch/flow_netlink.c                     |   4 +-
 net/unix/garbage.c                                 |  17 +-
 net/wireless/nl80211.c                             | 127 ++--
 sound/core/seq/seq_clientmgr.c                     |   1 +
 sound/core/seq/seq_fifo.c                          |   3 +
 sound/core/seq/seq_memory.c                        |  17 +-
 sound/core/seq/seq_memory.h                        |   1 +
 sound/pci/ctxfi/cthw20k1.c                         |   2 +-
 sound/pci/hda/patch_realtek.c                      |   2 +
 129 files changed, 1477 insertions(+), 846 deletions(-)

[toc] | [next] | [standalone]


#1610701 — [PATCH 4.10 046/111] USB: uss720: fix NULL-deref at probe

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 046/111] USB: uss720: fix NULL-deref at probe
Message-ID<tpYJs-7Cs-7@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit f259ca3eed6e4b79ac3d5c5c9fb259fb46e86217 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/uss720.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -708,6 +708,11 @@ static int uss720_probe(struct usb_inter
 
 	interface = intf->cur_altsetting;
 
+	if (interface->desc.bNumEndpoints < 3) {
+		usb_put_dev(usbdev);
+		return -ENODEV;
+	}
+
 	/*
 	 * Allocate parport interface 
 	 */

[toc] | [prev] | [next] | [standalone]


#1610702 — [PATCH 4.10 065/111] parport: fix attempt to write duplicate procfiles

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 065/111] parport: fix attempt to write duplicate procfiles
Message-ID<tpYJs-7Cs-11@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>

commit 03270c6ac6207fc55bbf9d20d195029dca210c79 upstream.

Usually every parallel port will have a single pardev registered with
it. But ppdev driver is an exception. This userspace parallel port
driver allows to create multiple parrallel port devices for a single
parallel port. And as a result we were having a nice warning like:
"sysctl table check failed:
/dev/parport/parport0/devices/ppdev0/timeslice Sysctl already exists"

Use the same logic as used in parport_register_device() and register
the proc files only once for each parallel port.

Fixes: 6fa45a226897 ("parport: add device-model to parport subsystem")
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1414656
Bugzilla: https://bugs.archlinux.org/task/52322
Tested-by: James Feeney <james@nurealm.net>
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/parport/share.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -939,8 +939,10 @@ parport_register_dev_model(struct parpor
 	 * pardevice fields. -arca
 	 */
 	port->ops->init_state(par_dev, par_dev->state);
-	port->proc_device = par_dev;
-	parport_device_proc_register(par_dev);
+	if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
+		port->proc_device = par_dev;
+		parport_device_proc_register(par_dev);
+	}
 
 	return par_dev;
 

[toc] | [prev] | [next] | [standalone]


#1610704 — [PATCH 4.10 023/111] amd-xgbe: Fix the ECC-related bit position definitions

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 023/111] amd-xgbe: Fix the ECC-related bit position definitions
Message-ID<tpYJs-7Cs-9@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>


[ Upstream commit f43feef4e6acde10857fcbfdede790d6b3f2c71d ]

The ECC bit positions that describe whether the ECC interrupt is for
Tx, Rx or descriptor memory and whether the it is a single correctable
or double detected error were defined in incorrectly (reversed order).
Fix the bit position definitions for these settings so that the proper
ECC handling is performed.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-common.h |   24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -984,29 +984,29 @@
 #define XP_ECC_CNT1_DESC_DED_WIDTH		8
 #define XP_ECC_CNT1_DESC_SEC_INDEX		0
 #define XP_ECC_CNT1_DESC_SEC_WIDTH		8
-#define XP_ECC_IER_DESC_DED_INDEX		0
+#define XP_ECC_IER_DESC_DED_INDEX		5
 #define XP_ECC_IER_DESC_DED_WIDTH		1
-#define XP_ECC_IER_DESC_SEC_INDEX		1
+#define XP_ECC_IER_DESC_SEC_INDEX		4
 #define XP_ECC_IER_DESC_SEC_WIDTH		1
-#define XP_ECC_IER_RX_DED_INDEX			2
+#define XP_ECC_IER_RX_DED_INDEX			3
 #define XP_ECC_IER_RX_DED_WIDTH			1
-#define XP_ECC_IER_RX_SEC_INDEX			3
+#define XP_ECC_IER_RX_SEC_INDEX			2
 #define XP_ECC_IER_RX_SEC_WIDTH			1
-#define XP_ECC_IER_TX_DED_INDEX			4
+#define XP_ECC_IER_TX_DED_INDEX			1
 #define XP_ECC_IER_TX_DED_WIDTH			1
-#define XP_ECC_IER_TX_SEC_INDEX			5
+#define XP_ECC_IER_TX_SEC_INDEX			0
 #define XP_ECC_IER_TX_SEC_WIDTH			1
-#define XP_ECC_ISR_DESC_DED_INDEX		0
+#define XP_ECC_ISR_DESC_DED_INDEX		5
 #define XP_ECC_ISR_DESC_DED_WIDTH		1
-#define XP_ECC_ISR_DESC_SEC_INDEX		1
+#define XP_ECC_ISR_DESC_SEC_INDEX		4
 #define XP_ECC_ISR_DESC_SEC_WIDTH		1
-#define XP_ECC_ISR_RX_DED_INDEX			2
+#define XP_ECC_ISR_RX_DED_INDEX			3
 #define XP_ECC_ISR_RX_DED_WIDTH			1
-#define XP_ECC_ISR_RX_SEC_INDEX			3
+#define XP_ECC_ISR_RX_SEC_INDEX			2
 #define XP_ECC_ISR_RX_SEC_WIDTH			1
-#define XP_ECC_ISR_TX_DED_INDEX			4
+#define XP_ECC_ISR_TX_DED_INDEX			1
 #define XP_ECC_ISR_TX_DED_WIDTH			1
-#define XP_ECC_ISR_TX_SEC_INDEX			5
+#define XP_ECC_ISR_TX_SEC_INDEX			0
 #define XP_ECC_ISR_TX_SEC_WIDTH			1
 #define XP_I2C_MUTEX_BUSY_INDEX			31
 #define XP_I2C_MUTEX_BUSY_WIDTH			1

[toc] | [prev] | [next] | [standalone]


#1610708 — [PATCH 4.10 053/111] USB: usbtmc: fix probe error path

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 053/111] USB: usbtmc: fix probe error path
Message-ID<tpYJt-7Cs-25@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 2e47c53503eb9faff42b3cfa144a833344dd1f89 upstream.

Make sure to initialise the return value to avoid having allocation
failures going unnoticed when allocating interrupt-endpoint resources.

This prevents use-after-free or worse when the device is later unbound.

Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.")
Cc: Dave Penkler <dpenkler@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/class/usbtmc.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1476,8 +1476,10 @@ static int usbtmc_probe(struct usb_inter
 	if (data->iin_ep_present) {
 		/* allocate int urb */
 		data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
-		if (!data->iin_urb)
+		if (!data->iin_urb) {
+			retcode = -ENOMEM;
 			goto error_register;
+		}
 
 		/* Protect interrupt in endpoint data until iin_urb is freed */
 		kref_get(&data->kref);
@@ -1485,8 +1487,10 @@ static int usbtmc_probe(struct usb_inter
 		/* allocate buffer for interrupt in */
 		data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
 					GFP_KERNEL);
-		if (!data->iin_buffer)
+		if (!data->iin_buffer) {
+			retcode = -ENOMEM;
 			goto error_register;
+		}
 
 		/* fill interrupt urb */
 		usb_fill_int_urb(data->iin_urb, data->usb_dev,

[toc] | [prev] | [next] | [standalone]


#1610717 — [PATCH 4.10 100/111] intel_th: Dont leak module refcount on failure to activate

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 100/111] intel_th: Dont leak module refcount on failure to activate
Message-ID<tpYJu-7Cs-43@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

commit e609ccef5222c73b46b322be7d3796d60bff353d upstream.

Output 'activation' may fail for the reasons of the output driver,
for example, if msc's buffer is not allocated. We forget, however,
to drop the module reference in this case. So each attempt at
activation in this case leaks a reference, preventing the module
from ever unloading.

This patch adds the missing module_put() in the activation error
path.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/intel_th/core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -221,8 +221,10 @@ static int intel_th_output_activate(stru
 	else
 		intel_th_trace_enable(thdev);
 
-	if (ret)
+	if (ret) {
 		pm_runtime_put(&thdev->dev);
+		module_put(thdrv->driver.owner);
+	}
 
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]


#1610719 — [PATCH 4.10 103/111] mmc: block: Fix is_waiting_last_req set incorrectly

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 103/111] mmc: block: Fix is_waiting_last_req set incorrectly
Message-ID<tpYJu-7Cs-57@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <adrian.hunter@intel.com>

commit 2602b740e45cc64feb55d5a9ee8db744ab3becbb upstream.

Commit 15520111500c ("mmc: core: Further fix thread wake-up") allowed a
queue to release the host with is_waiting_last_req set to true. A queue
waiting to claim the host will not reset it, which can result in the
queue getting stuck in a loop.

Fixes: 15520111500c ("mmc: core: Further fix thread wake-up")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/block.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1791,6 +1791,7 @@ int mmc_blk_issue_rq(struct mmc_queue *m
 		ret = mmc_blk_issue_flush(mq, req);
 	} else {
 		ret = mmc_blk_issue_rw_rq(mq, req);
+		card->host->context_info.is_waiting_last_req = false;
 	}
 
 out:

[toc] | [prev] | [next] | [standalone]


#1610723 — [PATCH 4.10 022/111] tcp: initialize icsk_ack.lrcvtime at session start time

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 022/111] tcp: initialize icsk_ack.lrcvtime at session start time
Message-ID<tpYJu-7Cs-55@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 15bb7745e94a665caf42bfaabf0ce062845b533b ]

icsk_ack.lrcvtime has a 0 value at socket creation time.

tcpi_last_data_recv can have bogus value if no payload is ever received.

This patch initializes icsk_ack.lrcvtime for active sessions
in tcp_finish_connect(), and for passive sessions in
tcp_create_openreq_child()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c     |    2 +-
 net/ipv4/tcp_minisocks.c |    1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5571,6 +5571,7 @@ void tcp_finish_connect(struct sock *sk,
 	struct inet_connection_sock *icsk = inet_csk(sk);
 
 	tcp_set_state(sk, TCP_ESTABLISHED);
+	icsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
 	if (skb) {
 		icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
@@ -5789,7 +5790,6 @@ static int tcp_rcv_synsent_state_process
 			 * to stand against the temptation 8)     --ANK
 			 */
 			inet_csk_schedule_ack(sk);
-			icsk->icsk_ack.lrcvtime = tcp_time_stamp;
 			tcp_enter_quickack_mode(sk);
 			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
 						  TCP_DELACK_MAX, TCP_RTO_MAX);
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -466,6 +466,7 @@ struct sock *tcp_create_openreq_child(co
 		newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
 		minmax_reset(&newtp->rtt_min, tcp_time_stamp, ~0U);
 		newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+		newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
 		newtp->packets_out = 0;
 		newtp->retrans_out = 0;

[toc] | [prev] | [next] | [standalone]


#1610728 — [PATCH 4.10 095/111] cpsw/netcp: cpts depends on posix_timers

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 095/111] cpsw/netcp: cpts depends on posix_timers
Message-ID<tpYJu-7Cs-67@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 07fef3623407444e51c12ea57cd91df38c1069e0 upstream.

With posix timers having become optional, we get a build error with
the cpts time sync option of the CPSW driver:

drivers/net/ethernet/ti/cpts.c: In function 'cpts_find_ts':
drivers/net/ethernet/ti/cpts.c:291:23: error: implicit declaration of function 'ptp_classify_raw';did you mean 'ptp_classifier_init'? [-Werror=implicit-function-declaration]

This adds a hard dependency on PTP_CLOCK to avoid the problem, as
building it without PTP support makes no sense anyway.

Fixes: baa73d9e478f ("posix-timers: Make them configurable")
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -76,7 +76,7 @@ config TI_CPSW
 config TI_CPTS
 	tristate "TI Common Platform Time Sync (CPTS) Support"
 	depends on TI_CPSW || TI_KEYSTONE_NETCP
-	imply PTP_1588_CLOCK
+	depends on PTP_1588_CLOCK
 	---help---
 	  This driver supports the Common Platform Time Sync unit of
 	  the CPSW Ethernet Switch and Keystone 2 1g/10g Switch Subsystem.

[toc] | [prev] | [next] | [standalone]


#1610730 — [PATCH 4.10 034/111] Input: cm109 - validate number of endpoints before using them

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 034/111] Input: cm109 - validate number of endpoints before using them
Message-ID<tpYJv-7Cs-77@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/cm109.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -700,6 +700,10 @@ static int cm109_usb_probe(struct usb_in
 	int error = -ENOMEM;
 
 	interface = intf->cur_altsetting;
+
+	if (interface->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	endpoint = &interface->endpoint[0].desc;
 
 	if (!usb_endpoint_is_int_in(endpoint))

[toc] | [prev] | [next] | [standalone]


#1610731 — [PATCH 4.10 014/111] net/mlx5: Increase number of max QPs in default profile

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 014/111] net/mlx5: Increase number of max QPs in default profile
Message-ID<tpYJv-7Cs-73@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maor Gottlieb <maorg@mellanox.com>


[ Upstream commit 5f40b4ed975c26016cf41953b7510fe90718e21c ]

With ConnectX-4 sharing SRQs from the same space as QPs, we hit a
limit preventing some applications to allocate needed QPs amount.
Double the size to 256K.

Fixes: e126ba97dba9e ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -87,7 +87,7 @@ static struct mlx5_profile profile[] = {
 	[2] = {
 		.mask		= MLX5_PROF_MASK_QP_SIZE |
 				  MLX5_PROF_MASK_MR_CACHE,
-		.log_max_qp	= 17,
+		.log_max_qp	= 18,
 		.mr_cache[0]	= {
 			.size	= 500,
 			.limit	= 250

[toc] | [prev] | [next] | [standalone]


#1610732 — [PATCH 4.10 050/111] usb: musb: cppi41: dont check early-TX-interrupt for Isoch transfer

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 050/111] usb: musb: cppi41: dont check early-TX-interrupt for Isoch transfer
Message-ID<tpYJv-7Cs-75@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bin Liu <b-liu@ti.com>

commit 0090114d336a9604aa2d90bc83f20f7cd121b76c upstream.

The CPPI 4.1 driver polls register to workaround the premature TX
interrupt issue, but it causes audio playback underrun when triggered in
Isoch transfers.

Isoch doesn't do back-to-back transfers, the TX should be done by the
time the next transfer is scheduled. So skip this polling workaround for
Isoch transfer.

Fixes: a655f481d83d6 ("usb: musb: musb_cppi41: handle pre-mature TX complete interrupt")
Reported-by: Alexandre Bailon <abailon@baylibre.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Alexandre Bailon <abailon@baylibre.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/musb/musb_cppi41.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -231,8 +231,27 @@ static void cppi41_dma_callback(void *pr
 			transferred < cppi41_channel->packet_sz)
 		cppi41_channel->prog_len = 0;
 
-	if (cppi41_channel->is_tx)
-		empty = musb_is_tx_fifo_empty(hw_ep);
+	if (cppi41_channel->is_tx) {
+		u8 type;
+
+		if (is_host_active(musb))
+			type = hw_ep->out_qh->type;
+		else
+			type = hw_ep->ep_in.type;
+
+		if (type == USB_ENDPOINT_XFER_ISOC)
+			/*
+			 * Don't use the early-TX-interrupt workaround below
+			 * for Isoch transfter. Since Isoch are periodic
+			 * transfer, by the time the next transfer is
+			 * scheduled, the current one should be done already.
+			 *
+			 * This avoids audio playback underrun issue.
+			 */
+			empty = true;
+		else
+			empty = musb_is_tx_fifo_empty(hw_ep);
+	}
 
 	if (!cppi41_channel->is_tx || empty) {
 		cppi41_trans_done(cppi41_channel);

[toc] | [prev] | [next] | [standalone]


#1610733 — [PATCH 4.10 049/111] USB: wusbcore: fix NULL-deref at probe

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 049/111] USB: wusbcore: fix NULL-deref at probe
Message-ID<tpYJv-7Cs-81@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

This specifically fixes the NULL-pointer dereference when probing HWA HC
devices.

Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core")
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/wusbcore/wa-hc.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct us
 	int result;
 	struct device *dev = &iface->dev;
 
+	if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+		return -ENODEV;
+
 	result = wa_rpipes_create(wa);
 	if (result < 0)
 		goto error_rpipes_create;

[toc] | [prev] | [next] | [standalone]


#1610737 — [PATCH 4.10 058/111] mmc: core: Fix access to HS400-ES devices

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 058/111] mmc: core: Fix access to HS400-ES devices
Message-ID<tpYJv-7Cs-93@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 773dc118756b1f38766063e90e582016be868f09 upstream.

HS400-ES devices fail to initialize with the following error messages.

mmc1: power class selection to bus width 8 ddr 0 failed
mmc1: error -110 whilst initialising MMC card

This was seen on Samsung Chromebook Plus. Code analysis points to
commit 3d4ef329757c ("mmc: core: fix multi-bit bus width without
high-speed mode"), which attempts to set the bus width for all but
HS200 devices unconditionally. However, for HS400-ES, the bus width
is already selected.

Cc: Anssi Hannula <anssi.hannula@bitwise.fi>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Fixes: 3d4ef329757c ("mmc: core: fix multi-bit bus width ...")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chip.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/core/mmc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1706,7 +1706,7 @@ static int mmc_init_card(struct mmc_host
 		err = mmc_select_hs400(card);
 		if (err)
 			goto free_card;
-	} else {
+	} else if (!mmc_card_hs400es(card)) {
 		/* Select the desired bus width optionally */
 		err = mmc_select_bus_width(card);
 		if (err > 0 && mmc_card_hs(card)) {

[toc] | [prev] | [next] | [standalone]


#1610738 — [PATCH 4.10 111/111] crypto: algif_hash - avoid zero-sized array

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 111/111] crypto: algif_hash - avoid zero-sized array
Message-ID<tpYJv-7Cs-83@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jiri Slaby <jslaby@suse.cz>

commit 6207119444595d287b1e9e83a2066c17209698f3 upstream.

With this reproducer:
  struct sockaddr_alg alg = {
          .salg_family = 0x26,
          .salg_type = "hash",
          .salg_feat = 0xf,
          .salg_mask = 0x5,
          .salg_name = "digest_null",
  };
  int sock, sock2;

  sock = socket(AF_ALG, SOCK_SEQPACKET, 0);
  bind(sock, (struct sockaddr *)&alg, sizeof(alg));
  sock2 = accept(sock, NULL, NULL);
  setsockopt(sock, SOL_ALG, ALG_SET_KEY, "\x9b\xca", 2);
  accept(sock2, NULL, NULL);

==== 8< ======== 8< ======== 8< ======== 8< ====

one can immediatelly see an UBSAN warning:
UBSAN: Undefined behaviour in crypto/algif_hash.c:187:7
variable length array bound value 0 <= 0
CPU: 0 PID: 15949 Comm: syz-executor Tainted: G            E      4.4.30-0-default #1
...
Call Trace:
...
 [<ffffffff81d598fd>] ? __ubsan_handle_vla_bound_not_positive+0x13d/0x188
 [<ffffffff81d597c0>] ? __ubsan_handle_out_of_bounds+0x1bc/0x1bc
 [<ffffffffa0e2204d>] ? hash_accept+0x5bd/0x7d0 [algif_hash]
 [<ffffffffa0e2293f>] ? hash_accept_nokey+0x3f/0x51 [algif_hash]
 [<ffffffffa0e206b0>] ? hash_accept_parent_nokey+0x4a0/0x4a0 [algif_hash]
 [<ffffffff8235c42b>] ? SyS_accept+0x2b/0x40

It is a correct warning, as hash state is propagated to accept as zero,
but creating a zero-length variable array is not allowed in C.

Fix this as proposed by Herbert -- do "?: 1" on that site. No sizeof or
similar happens in the code there, so we just allocate one byte even
though we do not use the array.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net> (maintainer:CRYPTO API)
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/algif_hash.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -245,7 +245,7 @@ static int hash_accept(struct socket *so
 	struct alg_sock *ask = alg_sk(sk);
 	struct hash_ctx *ctx = ask->private;
 	struct ahash_request *req = &ctx->req;
-	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];
+	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1];
 	struct sock *sk2;
 	struct alg_sock *ask2;
 	struct hash_ctx *ctx2;

[toc] | [prev] | [next] | [standalone]


#1610739 — [PATCH 4.10 093/111] blk-mq: dont complete un-started request in timeout handler

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 093/111] blk-mq: dont complete un-started request in timeout handler
Message-ID<tpYJv-7Cs-85@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ming Lei <tom.leiming@gmail.com>

commit 95a49603707d982b25d17c5b70e220a05556a2f9 upstream.

When iterating busy requests in timeout handler,
if the STARTED flag of one request isn't set, that means
the request is being processed in block layer or driver, and
isn't submitted to hardware yet.

In current implementation of blk_mq_check_expired(),
if the request queue becomes dying, un-started requests are
handled as being completed/freed immediately. This way is
wrong, and can cause rq corruption or double allocation[1][2],
when doing I/O and removing&resetting NVMe device at the sametime.

This patch fixes several issues reported by Yi Zhang.

[1]. oops log 1
[  581.789754] ------------[ cut here ]------------
[  581.789758] kernel BUG at block/blk-mq.c:374!
[  581.789760] invalid opcode: 0000 [#1] SMP
[  581.789761] Modules linked in: vfat fat ipmi_ssif intel_rapl sb_edac
edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm nvme
irqbypass crct10dif_pclmul nvme_core crc32_pclmul ghash_clmulni_intel
intel_cstate ipmi_si mei_me ipmi_devintf intel_uncore sg ipmi_msghandler
intel_rapl_perf iTCO_wdt mei iTCO_vendor_support mxm_wmi lpc_ich dcdbas shpchp
pcspkr acpi_power_meter wmi nfsd auth_rpcgss nfs_acl lockd dm_multipath grace
sunrpc ip_tables xfs libcrc32c sd_mod mgag200 i2c_algo_bit drm_kms_helper
syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm ahci libahci
crc32c_intel tg3 libata megaraid_sas i2c_core ptp fjes pps_core dm_mirror
dm_region_hash dm_log dm_mod
[  581.789796] CPU: 1 PID: 1617 Comm: kworker/1:1H Not tainted 4.10.0.bz1420297+ #4
[  581.789797] Hardware name: Dell Inc. PowerEdge R730xd/072T6D, BIOS 2.2.5 09/06/2016
[  581.789804] Workqueue: kblockd blk_mq_timeout_work
[  581.789806] task: ffff8804721c8000 task.stack: ffffc90006ee4000
[  581.789809] RIP: 0010:blk_mq_end_request+0x58/0x70
[  581.789810] RSP: 0018:ffffc90006ee7d50 EFLAGS: 00010202
[  581.789811] RAX: 0000000000000001 RBX: ffff8802e4195340 RCX: ffff88028e2f4b88
[  581.789812] RDX: 0000000000001000 RSI: 0000000000001000 RDI: 0000000000000000
[  581.789813] RBP: ffffc90006ee7d60 R08: 0000000000000003 R09: ffff88028e2f4b00
[  581.789814] R10: 0000000000001000 R11: 0000000000000001 R12: 00000000fffffffb
[  581.789815] R13: ffff88042abe5780 R14: 000000000000002d R15: ffff88046fbdff80
[  581.789817] FS:  0000000000000000(0000) GS:ffff88047fc00000(0000) knlGS:0000000000000000
[  581.789818] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  581.789819] CR2: 00007f64f403a008 CR3: 000000014d078000 CR4: 00000000001406e0
[  581.789820] Call Trace:
[  581.789825]  blk_mq_check_expired+0x76/0x80
[  581.789828]  bt_iter+0x45/0x50
[  581.789830]  blk_mq_queue_tag_busy_iter+0xdd/0x1f0
[  581.789832]  ? blk_mq_rq_timed_out+0x70/0x70
[  581.789833]  ? blk_mq_rq_timed_out+0x70/0x70
[  581.789840]  ? __switch_to+0x140/0x450
[  581.789841]  blk_mq_timeout_work+0x88/0x170
[  581.789845]  process_one_work+0x165/0x410
[  581.789847]  worker_thread+0x137/0x4c0
[  581.789851]  kthread+0x101/0x140
[  581.789853]  ? rescuer_thread+0x3b0/0x3b0
[  581.789855]  ? kthread_park+0x90/0x90
[  581.789860]  ret_from_fork+0x2c/0x40
[  581.789861] Code: 48 85 c0 74 0d 44 89 e6 48 89 df ff d0 5b 41 5c 5d c3 48
8b bb 70 01 00 00 48 85 ff 75 0f 48 89 df e8 7d f0 ff ff 5b 41 5c 5d c3 <0f>
0b e8 71 f0 ff ff 90 eb e9 0f 1f 40 00 66 2e 0f 1f 84 00 00
[  581.789882] RIP: blk_mq_end_request+0x58/0x70 RSP: ffffc90006ee7d50
[  581.789889] ---[ end trace bcaf03d9a14a0a70 ]---

[2]. oops log2
[ 6984.857362] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 6984.857372] IP: nvme_queue_rq+0x6e6/0x8cd [nvme]
[ 6984.857373] PGD 0
[ 6984.857374]
[ 6984.857376] Oops: 0000 [#1] SMP
[ 6984.857379] Modules linked in: ipmi_ssif vfat fat intel_rapl sb_edac
edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_si iTCO_wdt
iTCO_vendor_support mxm_wmi ipmi_devintf intel_cstate sg dcdbas intel_uncore
mei_me intel_rapl_perf mei pcspkr lpc_ich ipmi_msghandler shpchp
acpi_power_meter wmi nfsd auth_rpcgss dm_multipath nfs_acl lockd grace sunrpc
ip_tables xfs libcrc32c sd_mod mgag200 i2c_algo_bit drm_kms_helper syscopyarea
sysfillrect crc32c_intel sysimgblt fb_sys_fops ttm nvme drm nvme_core ahci
libahci i2c_core tg3 libata ptp megaraid_sas pps_core fjes dm_mirror
dm_region_hash dm_log dm_mod
[ 6984.857416] CPU: 7 PID: 1635 Comm: kworker/7:1H Not tainted
4.10.0-2.el7.bz1420297.x86_64 #1
[ 6984.857417] Hardware name: Dell Inc. PowerEdge R730xd/072T6D, BIOS 2.2.5 09/06/2016
[ 6984.857427] Workqueue: kblockd blk_mq_run_work_fn
[ 6984.857429] task: ffff880476e3da00 task.stack: ffffc90002e90000
[ 6984.857432] RIP: 0010:nvme_queue_rq+0x6e6/0x8cd [nvme]
[ 6984.857433] RSP: 0018:ffffc90002e93c50 EFLAGS: 00010246
[ 6984.857434] RAX: 0000000000000000 RBX: ffff880275646600 RCX: 0000000000001000
[ 6984.857435] RDX: 0000000000000fff RSI: 00000002fba2a000 RDI: ffff8804734e6950
[ 6984.857436] RBP: ffffc90002e93d30 R08: 0000000000002000 R09: 0000000000001000
[ 6984.857437] R10: 0000000000001000 R11: 0000000000000000 R12: ffff8804741d8000
[ 6984.857438] R13: 0000000000000040 R14: ffff880475649f80 R15: ffff8804734e6780
[ 6984.857439] FS:  0000000000000000(0000) GS:ffff88047fcc0000(0000) knlGS:0000000000000000
[ 6984.857440] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6984.857442] CR2: 0000000000000010 CR3: 0000000001c09000 CR4: 00000000001406e0
[ 6984.857443] Call Trace:
[ 6984.857451]  ? mempool_free+0x2b/0x80
[ 6984.857455]  ? bio_free+0x4e/0x60
[ 6984.857459]  blk_mq_dispatch_rq_list+0xf5/0x230
[ 6984.857462]  blk_mq_process_rq_list+0x133/0x170
[ 6984.857465]  __blk_mq_run_hw_queue+0x8c/0xa0
[ 6984.857467]  blk_mq_run_work_fn+0x12/0x20
[ 6984.857473]  process_one_work+0x165/0x410
[ 6984.857475]  worker_thread+0x137/0x4c0
[ 6984.857478]  kthread+0x101/0x140
[ 6984.857480]  ? rescuer_thread+0x3b0/0x3b0
[ 6984.857481]  ? kthread_park+0x90/0x90
[ 6984.857489]  ret_from_fork+0x2c/0x40
[ 6984.857490] Code: 8b bd 70 ff ff ff 89 95 50 ff ff ff 89 8d 58 ff ff ff 44
89 95 60 ff ff ff e8 b7 dd 12 e1 8b 95 50 ff ff ff 48 89 85 68 ff ff ff <4c>
8b 48 10 44 8b 58 18 8b 8d 58 ff ff ff 44 8b 95 60 ff ff ff
[ 6984.857511] RIP: nvme_queue_rq+0x6e6/0x8cd [nvme] RSP: ffffc90002e93c50
[ 6984.857512] CR2: 0000000000000010
[ 6984.895359] ---[ end trace 2d7ceb528432bf83 ]---

Reported-by: Yi Zhang <yizhan@redhat.com>
Tested-by: Yi Zhang <yizhan@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/blk-mq.c |   11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -678,17 +678,8 @@ static void blk_mq_check_expired(struct
 {
 	struct blk_mq_timeout_data *data = priv;
 
-	if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) {
-		/*
-		 * If a request wasn't started before the queue was
-		 * marked dying, kill it here or it'll go unnoticed.
-		 */
-		if (unlikely(blk_queue_dying(rq->q))) {
-			rq->errors = -EIO;
-			blk_mq_end_request(rq, rq->errors);
-		}
+	if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags))
 		return;
-	}
 
 	if (time_after_eq(jiffies, rq->deadline)) {
 		if (!blk_mark_rq_complete(rq))

[toc] | [prev] | [next] | [standalone]


#1610741 — [PATCH 4.10 082/111] fscrypt: remove broken support for detecting keyring key revocation

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 082/111] fscrypt: remove broken support for detecting keyring key revocation
Message-ID<tpYJv-7Cs-91@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Biggers <ebiggers@google.com>

commit 1b53cf9815bb4744958d41f3795d5d5a1d365e2d upstream.

Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again.  This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.

This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired.  Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory.  Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem.  In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.

In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches.  But this is a hard problem, and for now this bug must be fixed.

This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y).  Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.

Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/crypto/crypto.c          |   10 --------
 fs/crypto/fname.c           |    2 -
 fs/crypto/fscrypt_private.h |    4 ---
 fs/crypto/keyinfo.c         |   52 +++++++-------------------------------------
 4 files changed, 11 insertions(+), 57 deletions(-)

--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -394,7 +394,6 @@ EXPORT_SYMBOL(fscrypt_zeroout_range);
 static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
 	struct dentry *dir;
-	struct fscrypt_info *ci;
 	int dir_has_key, cached_with_key;
 
 	if (flags & LOOKUP_RCU)
@@ -406,18 +405,11 @@ static int fscrypt_d_revalidate(struct d
 		return 0;
 	}
 
-	ci = d_inode(dir)->i_crypt_info;
-	if (ci && ci->ci_keyring_key &&
-	    (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-					  (1 << KEY_FLAG_REVOKED) |
-					  (1 << KEY_FLAG_DEAD))))
-		ci = NULL;
-
 	/* this should eventually be an flag in d_flags */
 	spin_lock(&dentry->d_lock);
 	cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
 	spin_unlock(&dentry->d_lock);
-	dir_has_key = (ci != NULL);
+	dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
 	dput(dir);
 
 	/*
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -350,7 +350,7 @@ int fscrypt_setup_filename(struct inode
 		fname->disk_name.len = iname->len;
 		return 0;
 	}
-	ret = fscrypt_get_crypt_info(dir);
+	ret = fscrypt_get_encryption_info(dir);
 	if (ret && ret != -EOPNOTSUPP)
 		return ret;
 
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -67,7 +67,6 @@ struct fscrypt_info {
 	u8 ci_filename_mode;
 	u8 ci_flags;
 	struct crypto_skcipher *ci_ctfm;
-	struct key *ci_keyring_key;
 	u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE];
 };
 
@@ -87,7 +86,4 @@ struct fscrypt_completion_result {
 /* crypto.c */
 int fscrypt_initialize(unsigned int cop_flags);
 
-/* keyinfo.c */
-extern int fscrypt_get_crypt_info(struct inode *);
-
 #endif /* _FSCRYPT_PRIVATE_H */
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -99,6 +99,7 @@ static int validate_user_key(struct fscr
 	kfree(full_key_descriptor);
 	if (IS_ERR(keyring_key))
 		return PTR_ERR(keyring_key);
+	down_read(&keyring_key->sem);
 
 	if (keyring_key->type != &key_type_logon) {
 		printk_once(KERN_WARNING
@@ -106,11 +107,9 @@ static int validate_user_key(struct fscr
 		res = -ENOKEY;
 		goto out;
 	}
-	down_read(&keyring_key->sem);
 	ukp = user_key_payload(keyring_key);
 	if (ukp->datalen != sizeof(struct fscrypt_key)) {
 		res = -EINVAL;
-		up_read(&keyring_key->sem);
 		goto out;
 	}
 	master_key = (struct fscrypt_key *)ukp->data;
@@ -121,17 +120,11 @@ static int validate_user_key(struct fscr
 				"%s: key size incorrect: %d\n",
 				__func__, master_key->size);
 		res = -ENOKEY;
-		up_read(&keyring_key->sem);
 		goto out;
 	}
 	res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
-	up_read(&keyring_key->sem);
-	if (res)
-		goto out;
-
-	crypt_info->ci_keyring_key = keyring_key;
-	return 0;
 out:
+	up_read(&keyring_key->sem);
 	key_put(keyring_key);
 	return res;
 }
@@ -173,12 +166,11 @@ static void put_crypt_info(struct fscryp
 	if (!ci)
 		return;
 
-	key_put(ci->ci_keyring_key);
 	crypto_free_skcipher(ci->ci_ctfm);
 	kmem_cache_free(fscrypt_info_cachep, ci);
 }
 
-int fscrypt_get_crypt_info(struct inode *inode)
+int fscrypt_get_encryption_info(struct inode *inode)
 {
 	struct fscrypt_info *crypt_info;
 	struct fscrypt_context ctx;
@@ -188,21 +180,15 @@ int fscrypt_get_crypt_info(struct inode
 	u8 *raw_key = NULL;
 	int res;
 
+	if (inode->i_crypt_info)
+		return 0;
+
 	res = fscrypt_initialize(inode->i_sb->s_cop->flags);
 	if (res)
 		return res;
 
 	if (!inode->i_sb->s_cop->get_context)
 		return -EOPNOTSUPP;
-retry:
-	crypt_info = ACCESS_ONCE(inode->i_crypt_info);
-	if (crypt_info) {
-		if (!crypt_info->ci_keyring_key ||
-				key_validate(crypt_info->ci_keyring_key) == 0)
-			return 0;
-		fscrypt_put_encryption_info(inode, crypt_info);
-		goto retry;
-	}
 
 	res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
 	if (res < 0) {
@@ -230,7 +216,6 @@ retry:
 	crypt_info->ci_data_mode = ctx.contents_encryption_mode;
 	crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
 	crypt_info->ci_ctfm = NULL;
-	crypt_info->ci_keyring_key = NULL;
 	memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
 				sizeof(crypt_info->ci_master_key));
 
@@ -286,14 +271,8 @@ got_key:
 	if (res)
 		goto out;
 
-	kzfree(raw_key);
-	raw_key = NULL;
-	if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
-		put_crypt_info(crypt_info);
-		goto retry;
-	}
-	return 0;
-
+	if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
+		crypt_info = NULL;
 out:
 	if (res == -ENOKEY)
 		res = 0;
@@ -301,6 +280,7 @@ out:
 	kzfree(raw_key);
 	return res;
 }
+EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
 void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
 {
@@ -318,17 +298,3 @@ void fscrypt_put_encryption_info(struct
 	put_crypt_info(ci);
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
-
-int fscrypt_get_encryption_info(struct inode *inode)
-{
-	struct fscrypt_info *ci = inode->i_crypt_info;
-
-	if (!ci ||
-		(ci->ci_keyring_key &&
-		 (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-					       (1 << KEY_FLAG_REVOKED) |
-					       (1 << KEY_FLAG_DEAD)))))
-		return fscrypt_get_crypt_info(inode);
-	return 0;
-}
-EXPORT_SYMBOL(fscrypt_get_encryption_info);

[toc] | [prev] | [next] | [standalone]


#1610743 — [PATCH 4.10 102/111] Drivers: hv: vmbus: Dont leak memory when a channel is rescinded

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 102/111] Drivers: hv: vmbus: Dont leak memory when a channel is rescinded
Message-ID<tpYJw-7Cs-107@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: K. Y. Srinivasan <kys@microsoft.com>

commit 5e030d5ce9d99a899b648413139ff65bab12b038 upstream.

When we close a channel that has been rescinded, we will leak memory since
vmbus_teardown_gpadl() returns an error. Fix this so that we can properly
cleanup the memory allocated to the ring buffers.

Fixes: ccb61f8a99e6 ("Drivers: hv: vmbus: Fix a rescind handling bug")

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hv/channel.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -506,12 +506,15 @@ int vmbus_teardown_gpadl(struct vmbus_ch
 
 	wait_for_completion(&info->waitevent);
 
-	if (channel->rescind) {
-		ret = -ENODEV;
-		goto post_msg_err;
-	}
-
 post_msg_err:
+	/*
+	 * If the channel has been rescinded;
+	 * we will be awakened by the rescind
+	 * handler; set the error code to zero so we don't leak memory.
+	 */
+	if (channel->rescind)
+		ret = 0;
+
 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
 	list_del(&info->msglistentry);
 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);

[toc] | [prev] | [next] | [standalone]


#1610745 — [PATCH 4.10 048/111] USB: idmouse: fix NULL-deref at probe

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 048/111] USB: idmouse: fix NULL-deref at probe
Message-ID<tpYJw-7Cs-101@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit b0addd3fa6bcd119be9428996d5d4522479ab240 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/idmouse.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -346,6 +346,9 @@ static int idmouse_probe(struct usb_inte
 	if (iface_desc->desc.bInterfaceClass != 0x0A)
 		return -ENODEV;
 
+	if (iface_desc->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* allocate memory for our device state and initialize it */
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 	if (dev == NULL)

[toc] | [prev] | [next] | [standalone]


#1610746 — [PATCH 4.10 104/111] libceph: dont set weight to IN when OSD is destroyed

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-03-28 14:50 +0200
Subject[PATCH 4.10 104/111] libceph: dont set weight to IN when OSD is destroyed
Message-ID<tpYJw-7Cs-99@gated-at.bofh.it>
In reply to#1610686
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit b581a5854eee4b7851dedb0f8c2ceb54fb902c06 upstream.

Since ceph.git commit 4e28f9e63644 ("osd/OSDMap: clear osd_info,
osd_xinfo on osd deletion"), weight is set to IN when OSD is deleted.
This changes the result of applying an incremental for clients, not
just OSDs.  Because CRUSH computations are obviously affected,
pre-4e28f9e63644 servers disagree with post-4e28f9e63644 clients on
object placement, resulting in misdirected requests.

Mirrors ceph.git commit a6009d1039a55e2c77f431662b3d6cc5a8e8e63f.

Fixes: 930c53286977 ("libceph: apply new_state before new_up_client on incrementals")
Link: http://tracker.ceph.com/issues/19122
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ceph/osdmap.c |    1 -
 1 file changed, 1 deletion(-)

--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1334,7 +1334,6 @@ static int decode_new_up_state_weight(vo
 		if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
 		    (xorstate & CEPH_OSD_EXISTS)) {
 			pr_info("osd%d does not exist\n", osd);
-			map->osd_weight[osd] = CEPH_OSD_IN;
 			ret = set_primary_affinity(map, osd,
 						   CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
 			if (ret)

[toc] | [prev] | [next] | [standalone]


Page 1 of 5  [1] 2 3 4 5  Next page →

Back to top | Article view | linux.kernel


csiph-web