Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1624299 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-04-16 13:00 +0200 |
| Last post | 2017-04-18 07:00 +0200 |
| Articles | 20 on this page of 86 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 099/145] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 032/145] selinux: fix off-by-one in setprocattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 140/145] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 041/145] [PATCH 087/760] net: pktgen: remove rcu locking in pktgen_change_name() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 084/145] usb: dwc3: gadget: make Set Endpoint Configuration macros safe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 143/145] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 125/145] KVM: s390: Fix guest migration for huge guests resulting in panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 104/145] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 095/145] padata: avoid race in reordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 083/145] usb: gadget: dummy_hcd: clear usb_gadget region before registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 132/145] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 141/145] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 101/145] cpmac: remove hopeless #warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 110/145] net/packet: fix overflow in check for priv area size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 117/145] crypto: cryptd - Assign statesize properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 098/145] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 078/145] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 123/145] s390: make setup_randomness work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 075/145] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 130/145] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 137/145] MIPS: DEC: Avoid la pseudo-instruction in delay slots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 139/145] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 111/145] usb: hub: Wait for connection to be reestablished after port reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 094/145] dm: flush queued bios when process blocks to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 082/145] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 135/145] MIPS: ip27: Disable qlge driver in defconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 091/145] USB: serial: io_ti: fix NULL-deref in interrupt callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 118/145] crypto: mcryptd - Fix load failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 122/145] s390: TASK_SIZE for kernel threads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 115/145] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 106/145] ipv4: mask tos for input route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 134/145] USB: fix linked-list corruption in rh_call_control() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 102/145] tracing: Add #undef to fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 136/145] MIPS: ip22: Fix ip28 build for modern gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 052/145] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 042/145] [PATCH 091/760] ipv4: disable BH in set_ping_group_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 090/145] USB: iowarrior: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 035/145] [PATCH 074/760] tcp: fix a compile error in DBGUNDO() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 060/145] lib/vsprintf.c: improve sanity check in vsnprintf() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 030/145] pwm: Unexport children before chip removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 068/145] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 071/145] Bluetooth: Add another AR3012 04ca:3018 device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 057/145] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 087/145] USB: serial: safe_serial: fix information leak in completion handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 070/145] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 089/145] USB: iowarrior: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 046/145] [PATCH 083/760] netlink: do not enter direct reclaim from netlink_dump() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 065/145] xfrm: policy: init locks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 074/145] USB: serial: digi_acceleport: fix OOB-event processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 076/145] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 007/145] ipv4: keep skb->dst around in presence of IP options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 050/145] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 043/145] [PATCH 093/760] net: sctp, forbid negative length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 072/145] IB/ipoib: Fix deadlock between rmmod and set_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 069/145] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 047/145] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 054/145] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 036/145] [PATCH 075/760] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 005/145] tcp: fix 0 divide in __tcp_select_window() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 085/145] usb: gadget: function: f_fs: pass companion descriptor along Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 063/145] cancel the setfilesize transation when io error happen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 051/145] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 064/145] raid10: increment write counter after bio is split Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 059/145] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 037/145] [PATCH 076/760] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 049/145] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 062/145] tty: n_hdlc: get rid of racy n_hdlc.tbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 028/145] smc91x: avoid self-comparison warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 015/145] [PATCH 084/760] ipv6: tcp: restore IP6CB for pktoptions skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 012/145] ping: fix a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 020/145] tcp: fix overflow in __tcp_retransmit_skb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 019/145] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 002/145] can: Fix kernel panic at security_sock_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 031/145] HID: usbhid: add ATEN CS962 to list of quirky devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 027/145] drm/exynos: fix error handling in exynos_drm_subdrv_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 033/145] fbdev: color map copying bounds checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 023/145] ALSA: usb-audio: Add quirk for Syntek STK1160 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-17 01:40 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Amit Pundir <amit.pundir@linaro.org> - 2017-04-17 10:10 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 10:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-17 20:20 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-18 07:00 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 000/145] 3.18.49-stable review |
| Message-ID | <twQ4p-2E7-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 3.18.49 release.
There are 145 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
---------
Wait, what? 3.18? Wasn't that kernel dead and forgotten and left to
rot on the side of the road? Yes, it was, but unfortunately, there's a
few million or so devices out there in the wild that still rely on this
kernel. Now, some of their manufacturers and SoC vendors might not be
keeping their kernels up to date very well, but some do actually care
about security and their users, so this release is for them. If you
happen to have a vendor that does not care about their users, go
complain, as odds are, your device is very insecure right now...
Because of this strange situation, and thanks to some vendors backing
the effort[1], I'll keep 3.18-stable alive in a semi-active mode, doing
releases every once in a while to keep it up to date and working well
based on what is happening in other more well-maintained stable kernels
(hint, use 4.4 or 4.9 or newer PLEASE, if your vendor refuses to do so,
switch vendors, it's the only way they will learn...) I don't know how
long I'll keep doing this, so if you care about 3.18, please contact me
to let me know the expected lifespan of your device.
And finally, due to the delay from the last 3.18-stable kernel release,
there is a large backlog of patches, this is about 1/2 of the pending
ones so far. I'll be working on catching up to the rest of them over
the next few weeks, and then the updates should be smaller than this
one.
ok, back to your normal form-letter stable -rc release notice:
---------
Responses should be made by Tue Apr 18 08:01:19 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.49-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
[1] Google's android-common-3.18 will be tracking these releases for
those of you caring about a working android kernel based on 3.18, I
recommend using this tree:
https://android.googlesource.com/kernel/common/+/android-3.18
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.18.49-rc1
Hannes Frederic Sowa <hannes@stressinduktion.org>
dccp: fix memory leak during tear-down of unsuccessful connection request
Jon Maxwell <jmaxwell37@gmail.com>
dccp/tcp: fix routing redirect race
Dmitry V. Levin <ldv@altlinux.org>
uapi: fix linux/packet_diag.h userspace compilation error
Eric Dumazet <edumazet@google.com>
net: fix socket refcounting in skb_complete_tx_timestamp()
Eric Dumazet <edumazet@google.com>
net: fix socket refcounting in skb_complete_wifi_ack()
Eric Dumazet <edumazet@google.com>
tcp: fix various issues for sockets morphing to listen state
Ilya Dryomov <idryomov@gmail.com>
libceph: don't set weight to IN when OSD is destroyed
Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
powerpc: Emulation support for load/store instructions on LE
Ralf Baechle <ralf@linux-mips.org>
MIPS: DEC: Avoid la pseudo-instruction in delay slots
Arnd Bergmann <arnd@arndb.de>
MIPS: ip22: Fix ip28 build for modern gcc
Arnd Bergmann <arnd@arndb.de>
MIPS: ip27: Disable qlge driver in defconfig
Alan Stern <stern@rowland.harvard.edu>
USB: fix linked-list corruption in rh_call_control()
Guenter Roeck <linux@roeck-us.net>
usb: hub: Fix crash after failure to read BOS descriptor
Johan Hovold <johan@kernel.org>
USB: wusbcore: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
USB: idmouse: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
USB: lvtest: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
USB: uss720: fix NULL-deref at probe
Samuel Thibault <samuel.thibault@ens-lyon.org>
usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
Roger Quadros <rogerq@ti.com>
usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
Bjørn Mork <bjorn@mork.no>
USB: serial: qcserial: add Dell DW5811e
Janosch Frank <frankja@linux.vnet.ibm.com>
KVM: s390: Fix guest migration for huge guests resulting in panic
Heiko Carstens <heiko.carstens@de.ibm.com>
s390: use correct input data address for setup_randomness
Heiko Carstens <heiko.carstens@de.ibm.com>
s390: make setup_randomness work
Martin Schwidefsky <schwidefsky@de.ibm.com>
s390: TASK_SIZE for kernel threads
Julian Wiedmann <jwi@linux.vnet.ibm.com>
s390/qdio: clear DSCI prior to scanning multiple input queues
Wang, Rui Y <rui.y.wang@intel.com>
crypto: ghash-clmulni - Fix load failure
Jiri Slaby <jslaby@suse.cz>
crypto: algif_hash - avoid zero-sized array
Wang, Rui Y <rui.y.wang@intel.com>
crypto: mcryptd - Fix load failure
Wang, Rui Y <rui.y.wang@intel.com>
crypto: cryptd - Assign statesize properly
Peter Zijlstra <peterz@infradead.org>
futex: Add missing error handling to FUTEX_REQUEUE_PI
Peter Zijlstra <peterz@infradead.org>
futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Jack Morgenstein <jackm@dev.mellanox.co.il>
net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions
Jack Morgenstein <jackm@dev.mellanox.co.il>
net/mlx4_core: Fix racy CQ (Completion Queue) free
Eugenia Emantayev <eugenia@mellanox.com>
net/mlx4_en: Fix bad WQE issue
Guenter Roeck <linux@roeck-us.net>
usb: hub: Wait for connection to be reestablished after port reset
Andrey Konovalov <andreyknvl@google.com>
net/packet: fix overflow in check for priv area size
Arnaldo Carvalho de Melo <acme@redhat.com>
dccp: Unlock sock before calling sk_free()
Alexander Potapenko <glider@google.com>
net: don't call strlen() on the user buffer in packet_bind_spkt()
Paul Hüber <phueber@kernsp.in>
l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
Julian Anastasov <ja@ssi.bg>
ipv4: mask tos for input route
David Forster <dforster@brocade.com>
vti6: return GRE_KEY for vti6
Matthias Schiffer <mschiffer@universe-factory.net>
vxlan: correctly validate VXLAN ID against VXLAN_N_VID
Florian Westphal <fw@strlen.de>
netlink: remove mmapped netlink support
Rik van Riel <riel@redhat.com>
tracing: Add #undef to fix compile error
Arnd Bergmann <arnd@arndb.de>
cpmac: remove hopeless #warning
Michel Dänzer <michel.daenzer@amd.com>
drm/ttm: Make sure BOs being swapped out are cacheable
Y.C. Chen <yc_chen@aspeedtech.com>
drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS
Y.C. Chen <yc_chen@aspeedtech.com>
drm/ast: Call open_key before enable_mmio in POST code
Y.C. Chen <yc_chen@aspeedtech.com>
drm/ast: Fix test for VGA enabled
Shuah Khan <shuahkh@osg.samsung.com>
samples: move mic/mpssd example code from Documentation
Jason A. Donenfeld <Jason@zx2c4.com>
padata: avoid race in reordering
Mikulas Patocka <mpatocka@redhat.com>
dm: flush queued bios when process blocks to avoid deadlock
Luis de Bethencourt <luisbg@osg.samsung.com>
mvsas: fix misleading indentation
Johan Hovold <johan@kernel.org>
USB: serial: io_ti: fix information leak in completion handler
Johan Hovold <johan@kernel.org>
USB: serial: io_ti: fix NULL-deref in interrupt callback
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix NULL-deref in write
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
USB: serial: omninet: fix reference leaks at open
Johan Hovold <johan@kernel.org>
USB: serial: safe_serial: fix information leak in completion handler
Guenter Roeck <linux@roeck-us.net>
usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers
Felipe Balbi <felipe.balbi@linux.intel.com>
usb: gadget: function: f_fs: pass companion descriptor along
Felipe Balbi <felipe.balbi@linux.intel.com>
usb: dwc3: gadget: make Set Endpoint Configuration macros safe
Peter Chen <peter.chen@nxp.com>
usb: gadget: dummy_hcd: clear usb_gadget region before registration
Arnd Bergmann <arnd@arndb.de>
mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy
Arnd Bergmann <arnd@arndb.de>
crypto: improve gcc optimization flags for serpent and wp512
Steven Rostedt (VMware) <rostedt@goodmis.org>
ktest: Fix child exit code processing
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
Arnd Bergmann <arnd@arndb.de>
libceph: use BUG() instead of BUG_ON(1)
Matt Chen <matt.chen@intel.com>
mac80211: flush delayed work when entering suspend
Max Filippov <jcmvbkbc@gmail.com>
xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
Trond Myklebust <trond.myklebust@primarydata.com>
nlm: Ensure callback code also checks that the files match
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix OOB-event processing
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix OOB data sanity check
Feras Daoud <ferasda@mellanox.com>
IB/ipoib: Fix deadlock between rmmod and set_mode
Dmitry Tunin <hanipouspilot@gmail.com>
Bluetooth: Add another AR3012 04ca:3018 device
Janosch Frank <frankja@linux.vnet.ibm.com>
KVM: s390: Disable dirty log retrieval for UCONTROL guests
Ian Abbott <abbotti@mev.co.uk>
serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards
Shuxiao Zhang <zhangshuxiao@xiaomi.com>
staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
Andy Whitcroft <apw@canonical.com>
xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
Andy Whitcroft <apw@canonical.com>
xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
Florian Westphal <fw@strlen.de>
xfrm: policy: init locks early
Tomasz Majchrzak <tomasz.majchrzak@intel.com>
raid10: increment write counter after bio is split
Zhaohongjiang <zhaohongjiang@huawei.com>
cancel the setfilesize transation when io error happen
Alexander Popov <alex.popov@linux.com>
tty: n_hdlc: get rid of racy n_hdlc.tbuf
Jiri Slaby <jslaby@suse.cz>
TTY: n_hdlc, fix lockdep false positive
Rasmus Villemoes <linux@rasmusvillemoes.dk>
lib/vsprintf.c: improve sanity check in vsnprintf()
Maxime Jayat <maxime.jayat@mobile-devices.fr>
net: socket: fix recvmmsg not returning error from sock_error
Andrey Konovalov <andreyknvl@google.com>
dccp: fix freeing skb too early for IPV6_RECVPKTINFO
Eric Dumazet <edumazet@google.com>
net/llc: avoid BUG_ON() in skb_orphan()
Richard Weinberger <richard@nod.at>
drbd: Fix kernel_sendmsg() usage - potential NULL deref
Felipe Balbi <felipe.balbi@linux.intel.com>
usb: gadget: u_ether: remove interrupt throttling
Johan Hovold <johan@kernel.org>
USB: cdc-acm: fix TIOCMIWAIT
Paul Fertser <fercerpav@gmail.com>
Revert "staging: nvec: ps2: change serio type to passthrough"
Paul Fertser <fercerpav@gmail.com>
drivers: staging: nvec: remove bogus reset command for PS/2 interface
Arnd Bergmann <arnd@arndb.de>
staging: iio: ad5933: avoid uninitialized variable in error case
Andrey Ryabinin <aryabinin@virtuozzo.com>
coredump: fix unfreezable coredumping task
Jann Horn <jann@thejh.net>
swapfile: fix memory corruption via malformed swapfile
Sean Young <sean@mess.org>
dib0700: fix nec repeat handling
murray foster <mrafoster@gmail.com>
ASoC: cs4270: fix DAPM stream name mismatch
Eric Dumazet <edumazet@google.com>
netlink: do not enter direct reclaim from netlink_dump()
Willem de Bruijn <willemb@google.com>
packet: on direct_xmit, limit tso and csum to supported devices
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
sctp: validate chunk len before actually using it
Jiri Slaby <jslaby@suse.cz>
net: sctp, forbid negative length
Eric Dumazet <edumazet@google.com>
ipv4: disable BH in set_ping_group_range()
Eric Dumazet <edumazet@google.com>
net: pktgen: remove rcu locking in pktgen_change_name()
Nicolas Dichtel <nicolas.dichtel@6wind.com>
ipv6: correctly add local routes when lo goes up
Anoob Soman <anoob.soman@citrix.com>
packet: call fanout_release, while UNREGISTERING a netdev
Andrew Collins <acollins@cradlepoint.com>
net: Add netdev all_adj_list refcnt propagation to fix panic
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
Lance Richardson <lrichard@redhat.com>
ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
Eric Dumazet <edumazet@google.com>
tcp: fix a compile error in DBGUNDO()
Douglas Caetano dos Santos <douglascs@taghos.com.br>
tcp: fix wrong checksum calculation on MTU probing
Kees Cook <keescook@chromium.org>
fbdev: color map copying bounds checking
Stephen Smalley <sds@tycho.nsa.gov>
selinux: fix off-by-one in setprocattr
Oliver Neukum <oneukum@suse.com>
HID: usbhid: add ATEN CS962 to list of quirky devices
David Hsu <davidhsu@google.com>
pwm: Unexport children before chip removal
Boris Brezillon <boris.brezillon@free-electrons.com>
UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header
Arnd Bergmann <arnd@arndb.de>
smc91x: avoid self-comparison warning
Arnd Bergmann <arnd@arndb.de>
drm/exynos: fix error handling in exynos_drm_subdrv_open
Arnd Bergmann <arnd@arndb.de>
ARM: 8584/1: floppy: avoid gcc-6 warning
Jiri Slaby <jslaby@suse.cz>
tty: vt, fix bogus division in csi_J
Linus Torvalds <torvalds@linux-foundation.org>
Fix potential infoleak in older kernels
Marcel Hasler <mahasler@gmail.com>
ALSA: usb-audio: Add quirk for Syntek STK1160
Arve Hjønnevåg <arve@android.com>
ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
Arve Hjønnevåg <arve@android.com>
ANDROID: binder: Add strong ref checks
Eric Dumazet <edumazet@google.com>
tcp: fix overflow in __tcp_retransmit_skb()
Peter Chen <peter.chen@nxp.com>
usb: chipidea: move the lock initialization to core file
Ashok Raj <ashok.raj@intel.com>
iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions
Eric Dumazet <edumazet@google.com>
tcp: avoid infinite loop in tcp_splice_read()
Eric Dumazet <edumazet@google.com>
ipv6: tcp: add a missing tcp_v6_restore_cb()
Eric Dumazet <edumazet@google.com>
ipv6: tcp: restore IP6CB for pktoptions skbs
Eric Dumazet <edumazet@google.com>
ip6_gre: fix ip6gre_err() invalid reads
Eric Dumazet <edumazet@google.com>
l2tp: do not use udp_ioctl()
WANG Cong <xiyou.wangcong@gmail.com>
ping: fix a null pointer dereference
WANG Cong <xiyou.wangcong@gmail.com>
sit: fix a double free on error path
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
sctp: avoid BUG_ON on sctp_wait_for_sndbuf
Benjamin Poirier <bpoirier@suse.com>
mlx4: Invoke softirqs after napi_reschedule
Eric Dumazet <edumazet@google.com>
netlabel: out of bound access in cipso_v4_validate()
Eric Dumazet <edumazet@google.com>
ipv4: keep skb->dst around in presence of IP options
Eric Dumazet <edumazet@google.com>
net: use a work queue to defer net_disable_timestamp() work
Eric Dumazet <edumazet@google.com>
tcp: fix 0 divide in __tcp_select_window()
Dan Carpenter <dan.carpenter@oracle.com>
ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
Eric Dumazet <edumazet@google.com>
ipv6: fix ip6_tnl_parse_tlv_enc_lim()
Eric Dumazet <edumazet@google.com>
can: Fix kernel panic at security_sock_rcv_skb
Linus Torvalds <torvalds@linux-foundation.org>
Revert "af_unix: Fix splice-bind deadlock"
-------------
Diffstat:
Documentation/Makefile | 2 +-
Documentation/mic/Makefile | 1 -
Documentation/mic/mpssd/Makefile | 19 -
Documentation/networking/netlink_mmap.txt | 339 ----------
Makefile | 4 +-
arch/arm/include/asm/floppy.h | 2 +-
arch/mips/configs/ip27_defconfig | 1 -
arch/mips/dec/int-handler.S | 40 +-
arch/mips/sgi-ip22/Platform | 2 +-
arch/powerpc/lib/sstep.c | 20 -
arch/s390/include/asm/processor.h | 3 +-
arch/s390/kernel/setup.c | 8 +-
arch/s390/kvm/kvm-s390.c | 3 +
arch/s390/mm/pgtable.c | 19 +-
arch/x86/crypto/ghash-clmulni-intel_glue.c | 26 +
arch/x86/include/asm/uaccess.h | 10 +-
arch/xtensa/kernel/setup.c | 4 +-
crypto/Makefile | 2 +
crypto/algif_hash.c | 2 +-
crypto/cryptd.c | 1 +
crypto/mcryptd.c | 1 +
drivers/block/drbd/drbd_main.c | 2 +-
drivers/bluetooth/ath3k.c | 2 +
drivers/bluetooth/btusb.c | 1 +
drivers/gpu/drm/ast/ast_post.c | 48 +-
drivers/gpu/drm/exynos/exynos_drm_core.c | 2 +-
drivers/gpu/drm/ttm/ttm_bo.c | 4 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 12 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 6 +-
drivers/iommu/dmar.c | 4 +-
drivers/iommu/intel-iommu.c | 13 +
drivers/md/dm.c | 55 ++
drivers/md/raid10.c | 4 +-
drivers/media/usb/dvb-usb/dib0700_core.c | 5 +-
drivers/mtd/maps/pmcmsp-flash.c | 4 +-
drivers/mtd/ubi/fastmap.c | 7 +-
drivers/net/ethernet/mellanox/mlx4/cq.c | 38 +-
drivers/net/ethernet/mellanox/mlx4/en_rx.c | 13 +-
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 5 +-
drivers/net/ethernet/smsc/smc91x.c | 2 +-
drivers/net/ethernet/ti/cpmac.c | 2 +-
drivers/net/vxlan.c | 2 +-
drivers/pwm/core.c | 2 +
drivers/pwm/sysfs.c | 18 +
drivers/s390/cio/qdio_thinint.c | 8 +-
drivers/scsi/mvsas/mv_sas.c | 4 +-
drivers/staging/android/ashmem.c | 1 +
drivers/staging/android/binder.c | 35 +-
drivers/staging/iio/impedance-analyzer/ad5933.c | 17 +-
drivers/staging/nvec/nvec_ps2.c | 6 +-
drivers/tty/n_hdlc.c | 143 ++--
drivers/tty/serial/8250/8250_pci.c | 13 +
drivers/tty/vt/vt.c | 2 +-
drivers/usb/chipidea/core.c | 1 +
drivers/usb/chipidea/udc.c | 2 -
drivers/usb/class/cdc-acm.c | 2 -
drivers/usb/core/config.c | 10 +
drivers/usb/core/hcd.c | 7 +-
drivers/usb/core/hub.c | 13 +-
drivers/usb/core/quirks.c | 8 +
drivers/usb/dwc3/gadget.h | 14 +-
drivers/usb/gadget/function/f_fs.c | 15 +-
drivers/usb/gadget/function/f_uvc.c | 2 +-
drivers/usb/gadget/function/u_ether.c | 8 -
drivers/usb/gadget/udc/dummy_hcd.c | 2 +
drivers/usb/host/xhci-plat.c | 2 +
drivers/usb/misc/idmouse.c | 3 +
drivers/usb/misc/iowarrior.c | 21 +-
drivers/usb/misc/lvstest.c | 4 +
drivers/usb/misc/uss720.c | 5 +
drivers/usb/serial/digi_acceleport.c | 14 +-
drivers/usb/serial/io_ti.c | 8 +-
drivers/usb/serial/omninet.c | 6 -
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/serial/safe_serial.c | 5 +
drivers/usb/wusbcore/wa-hc.c | 3 +
drivers/video/fbdev/core/fbcmap.c | 26 +-
fs/coredump.c | 3 +
fs/fat/inode.c | 13 +-
fs/xfs/xfs_aops.c | 13 +-
include/linux/can/core.h | 7 +-
include/linux/ceph/osdmap.h | 2 +-
include/linux/lockd/lockd.h | 3 +-
include/linux/mroute.h | 2 +-
include/linux/mroute6.h | 2 +-
include/linux/pwm.h | 5 +
include/linux/usb/quirks.h | 6 +
include/net/cipso_ipv4.h | 4 +
include/trace/events/syscalls.h | 1 +
include/uapi/linux/netlink.h | 4 +
include/uapi/linux/netlink_diag.h | 2 +
include/uapi/linux/packet_diag.h | 2 +-
kernel/futex.c | 22 +-
kernel/padata.c | 5 +-
lib/vsprintf.c | 2 +-
mm/swapfile.c | 2 +
net/can/af_can.c | 12 +-
net/can/af_can.h | 3 +-
net/can/bcm.c | 4 +-
net/can/gw.c | 2 +-
net/can/raw.c | 4 +-
net/ceph/osdmap.c | 1 -
net/core/dev.c | 100 +--
net/core/pktgen.c | 17 +-
net/core/skbuff.c | 30 +-
net/dccp/ccids/ccid2.c | 1 +
net/dccp/input.c | 3 +-
net/dccp/ipv4.c | 3 +-
net/dccp/ipv6.c | 8 +-
net/dccp/minisocks.c | 1 +
net/ipv4/cipso_ipv4.c | 4 +
net/ipv4/ip_sockglue.c | 9 +-
net/ipv4/ipmr.c | 3 +-
net/ipv4/ping.c | 2 +
net/ipv4/route.c | 4 +-
net/ipv4/sysctl_net_ipv4.c | 4 +-
net/ipv4/tcp.c | 6 +
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_ipv4.c | 10 +-
net/ipv4/tcp_output.c | 21 +-
net/ipv4/tcp_timer.c | 6 +-
net/ipv6/addrconf.c | 2 +-
net/ipv6/ip6_gre.c | 42 +-
net/ipv6/ip6_tunnel.c | 34 +-
net/ipv6/ip6_vti.c | 4 +
net/ipv6/ip6mr.c | 5 +-
net/ipv6/route.c | 4 +-
net/ipv6/sit.c | 1 +
net/ipv6/tcp_ipv6.c | 32 +-
net/l2tp/l2tp_core.h | 1 +
net/l2tp/l2tp_ip.c | 29 +-
net/l2tp/l2tp_ip6.c | 2 +-
net/llc/llc_conn.c | 3 +
net/llc/llc_sap.c | 3 +
net/mac80211/pm.c | 1 +
net/netlink/Kconfig | 9 -
net/netlink/af_netlink.c | 741 +--------------------
net/netlink/af_netlink.h | 15 -
net/netlink/diag.c | 39 --
net/packet/af_packet.c | 22 +-
net/sctp/sm_statefuns.c | 12 +-
net/sctp/socket.c | 8 +-
net/socket.c | 4 +-
net/unix/af_unix.c | 66 +-
net/xfrm/xfrm_policy.c | 10 +-
net/xfrm/xfrm_user.c | 9 +-
{Documentation => samples}/mic/mpssd/.gitignore | 0
samples/mic/mpssd/Makefile | 27 +
{Documentation => samples}/mic/mpssd/micctrl | 0
{Documentation => samples}/mic/mpssd/mpss | 0
{Documentation => samples}/mic/mpssd/mpssd.c | 0
{Documentation => samples}/mic/mpssd/mpssd.h | 0
{Documentation => samples}/mic/mpssd/sysfs.c | 0
security/selinux/hooks.c | 2 +-
sound/soc/codecs/cs4270.c | 8 +-
sound/usb/quirks-table.h | 17 +
tools/testing/ktest/ktest.pl | 2 +-
159 files changed, 1029 insertions(+), 1660 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 099/145] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS |
| Message-ID | <twQ4t-2E7-113@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Y.C. Chen <yc_chen@aspeedtech.com>
commit 3856081eede297b617560b85e948cfb00bb395ec upstream.
The current POST code for the AST2300/2400 family doesn't work properly
if the chip hasn't been initialized previously by either the BMC own FW
or the VBIOS. This fixes it.
Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Tested-by: Y.C. Chen <yc_chen@aspeedtech.com>
Acked-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_post.c | 38 +++++++++++++++++++++++++++++++++++---
1 file changed, 35 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -1626,12 +1626,44 @@ static void ast_init_dram_2300(struct dr
temp |= 0x73;
ast_write32(ast, 0x12008, temp);
+ param.dram_freq = 396;
param.dram_type = AST_DDR3;
+ temp = ast_mindwm(ast, 0x1e6e2070);
if (temp & 0x01000000)
param.dram_type = AST_DDR2;
- param.dram_chipid = ast->dram_type;
- param.dram_freq = ast->mclk;
- param.vram_size = ast->vram_size;
+ switch (temp & 0x18000000) {
+ case 0:
+ param.dram_chipid = AST_DRAM_512Mx16;
+ break;
+ default:
+ case 0x08000000:
+ param.dram_chipid = AST_DRAM_1Gx16;
+ break;
+ case 0x10000000:
+ param.dram_chipid = AST_DRAM_2Gx16;
+ break;
+ case 0x18000000:
+ param.dram_chipid = AST_DRAM_4Gx16;
+ break;
+ }
+ switch (temp & 0x0c) {
+ default:
+ case 0x00:
+ param.vram_size = AST_VIDMEM_SIZE_8M;
+ break;
+
+ case 0x04:
+ param.vram_size = AST_VIDMEM_SIZE_16M;
+ break;
+
+ case 0x08:
+ param.vram_size = AST_VIDMEM_SIZE_32M;
+ break;
+
+ case 0x0c:
+ param.vram_size = AST_VIDMEM_SIZE_64M;
+ break;
+ }
if (param.dram_type == AST_DDR3) {
get_ddr3_info(ast, ¶m);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 032/145] selinux: fix off-by-one in setprocattr |
| Message-ID | <twQ4t-2E7-115@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <sds@tycho.nsa.gov>
commit 0c461cb727d146c9ef2d3e86214f498b78b7d125 upstream.
SELinux tries to support setting/clearing of /proc/pid/attr attributes
from the shell by ignoring terminating newlines and treating an
attribute value that begins with a NUL or newline as an attempt to
clear the attribute. However, the test for clearing attributes has
always been wrong; it has an off-by-one error, and this could further
lead to reading past the end of the allocated buffer since commit
bb646cdb12e75d82258c2f2e7746d5952d3e321a ("proc_pid_attr_write():
switch to memdup_user()"). Fix the off-by-one error.
Even with this fix, setting and clearing /proc/pid/attr attributes
from the shell is not straightforward since the interface does not
support multiple write() calls (so shells that write the value and
newline separately will set and then immediately clear the attribute,
requiring use of echo -n to set the attribute), whereas trying to use
echo -n "" to clear the attribute causes the shell to skip the
write() call altogether since POSIX says that a zero-length write
causes no side effects. Thus, one must use echo -n to set and echo
without -n to clear, as in the following example:
$ echo -n unconfined_u:object_r:user_home_t:s0 > /proc/$$/attr/fscreate
$ cat /proc/$$/attr/fscreate
unconfined_u:object_r:user_home_t:s0
$ echo "" > /proc/$$/attr/fscreate
$ cat /proc/$$/attr/fscreate
Note the use of /proc/$$ rather than /proc/self, as otherwise
the cat command will read its own attribute value, not that of the shell.
There are no users of this facility to my knowledge; possibly we
should just get rid of it.
UPDATE: Upon further investigation it appears that a local process
with the process:setfscreate permission can cause a kernel panic as a
result of this bug. This patch fixes CVE-2017-2618.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: added the update about CVE-2017-2618 to the commit description]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/selinux/hooks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5594,7 +5594,7 @@ static int selinux_setprocattr(struct ta
return error;
/* Obtain a SID for the context, if one was specified. */
- if (size && str[1] && str[1] != '\n') {
+ if (size && str[0] && str[0] != '\n') {
if (str[size-1] == '\n') {
str[size-1] = 0;
size--;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 140/145] tcp: fix various issues for sockets morphing to listen state |
| Message-ID | <twQ4u-2E7-119@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 02b2faaf0af1d85585f6d6980e286d53612acfc2 upstream.
Dmitry Vyukov reported a divide by 0 triggered by syzkaller, exploiting
tcp_disconnect() path that was never really considered and/or used
before syzkaller ;)
I was not able to reproduce the bug, but it seems issues here are the
three possible actions that assumed they would never trigger on a
listener.
1) tcp_write_timer_handler
2) tcp_delack_timer_handler
3) MTU reduction
Only IPv6 MTU reduction was properly testing TCP_CLOSE and TCP_LISTEN
states from tcp_v6_mtu_reduced()
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_ipv4.c | 7 +++++--
net/ipv4/tcp_timer.c | 6 ++++--
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
*/
void tcp_v4_mtu_reduced(struct sock *sk)
{
- struct dst_entry *dst;
struct inet_sock *inet = inet_sk(sk);
- u32 mtu = tcp_sk(sk)->mtu_info;
+ struct dst_entry *dst;
+ u32 mtu;
+ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+ return;
+ mtu = tcp_sk(sk)->mtu_info;
dst = inet_csk_update_pmtu(sk, mtu);
if (!dst)
return;
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -207,7 +207,8 @@ void tcp_delack_timer_handler(struct soc
sk_mem_reclaim_partial(sk);
- if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+ !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
goto out;
if (time_after(icsk->icsk_ack.timeout, jiffies)) {
@@ -486,7 +487,8 @@ void tcp_write_timer_handler(struct sock
struct inet_connection_sock *icsk = inet_csk(sk);
int event;
- if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
+ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+ !icsk->icsk_pending)
goto out;
if (time_after(icsk->icsk_timeout, jiffies)) {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 041/145] [PATCH 087/760] net: pktgen: remove rcu locking in pktgen_change_name() |
| Message-ID | <twQ4u-2E7-117@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9a0b1e8ba4061778897b544afc898de2163382f7 ]
After Jesper commit back in linux-3.18, we trigger a lockdep
splat in proc_create_data() while allocating memory from
pktgen_change_name().
This patch converts t->if_lock to a mutex, since it is now only
used from control path, and adds proper locking to pktgen_change_name()
1) pktgen_thread_lock to protect the outer loop (iterating threads)
2) t->if_lock to protect the inner loop (iterating devices)
Note that before Jesper patch, pktgen_change_name() was lacking proper
protection, but lockdep was not able to detect the problem.
Fixes: 8788370a1d4b ("pktgen: RCU-ify "if_list" to remove lock in next_to_run()")
Reported-by: John Sperbeck <jsperbeck@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/pktgen.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -211,8 +211,8 @@
#define T_REMDEV (1<<3) /* Remove one dev */
/* If lock -- protects updating of if_list */
-#define if_lock(t) spin_lock(&(t->if_lock));
-#define if_unlock(t) spin_unlock(&(t->if_lock));
+#define if_lock(t) mutex_lock(&(t->if_lock));
+#define if_unlock(t) mutex_unlock(&(t->if_lock));
/* Used to help with determining the pkts on receive */
#define PKTGEN_MAGIC 0xbe9be955
@@ -418,7 +418,7 @@ struct pktgen_net {
};
struct pktgen_thread {
- spinlock_t if_lock; /* for list of devices */
+ struct mutex if_lock; /* for list of devices */
struct list_head if_list; /* All device here */
struct list_head th_list;
struct task_struct *tsk;
@@ -1952,11 +1952,13 @@ static void pktgen_change_name(const str
{
struct pktgen_thread *t;
+ mutex_lock(&pktgen_thread_lock);
+
list_for_each_entry(t, &pn->pktgen_threads, th_list) {
struct pktgen_dev *pkt_dev;
- rcu_read_lock();
- list_for_each_entry_rcu(pkt_dev, &t->if_list, list) {
+ if_lock(t);
+ list_for_each_entry(pkt_dev, &t->if_list, list) {
if (pkt_dev->odev != dev)
continue;
@@ -1971,8 +1973,9 @@ static void pktgen_change_name(const str
dev->name);
break;
}
- rcu_read_unlock();
+ if_unlock(t);
}
+ mutex_unlock(&pktgen_thread_lock);
}
static int pktgen_device_event(struct notifier_block *unused,
@@ -3656,7 +3659,7 @@ static int __net_init pktgen_create_thre
return -ENOMEM;
}
- spin_lock_init(&t->if_lock);
+ mutex_init(&t->if_lock);
t->cpu = cpu;
INIT_LIST_HEAD(&t->if_list);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 084/145] usb: dwc3: gadget: make Set Endpoint Configuration macros safe |
| Message-ID | <twQ4u-2E7-123@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Felipe Balbi <felipe.balbi@linux.intel.com> commit 7369090a9fb57c3fc705ce355d2e4523a5a24716 upstream. Some gadget drivers are bad, bad boys. We notice that ADB was passing bad Burst Size which caused top bits of param0 to be overwritten which confused DWC3 when running this command. In order to avoid future issues, we're going to make sure values passed by macros are always safe for the controller. Note that ADB still needs a fix to *not* pass bad values. Reported-by: Mohamed Abbas <mohamed.abbas@intel.com> Sugested-by: Adam Andruszak <adam.andruszak@intel.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/usb/dwc3/gadget.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/drivers/usb/dwc3/gadget.h +++ b/drivers/usb/dwc3/gadget.h @@ -28,23 +28,23 @@ struct dwc3; #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget)) /* DEPCFG parameter 1 */ -#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0) +#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0) #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8) #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9) #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10) #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11) #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13) -#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16) +#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24) -#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25) +#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) #define DWC3_DEPCFG_BULK_BASED (1 << 30) #define DWC3_DEPCFG_FIFO_BASED (1 << 31) /* DEPCFG parameter 0 */ -#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1) -#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3) -#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17) -#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22) +#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1) +#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3) +#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17) +#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22) #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26) /* This applies for core versions earlier than 1.94a */ #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:00 +0200 |
| Subject | [PATCH 3.18 143/145] uapi: fix linux/packet_diag.h userspace compilation error |
| Message-ID | <twQ4u-2E7-121@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry V. Levin <ldv@altlinux.org>
commit 745cb7f8a5de0805cade3de3991b7a95317c7c73 upstream.
Replace MAX_ADDR_LEN with its numeric value to fix the following
linux/packet_diag.h userspace compilation error:
/usr/include/linux/packet_diag.h:67:17: error: 'MAX_ADDR_LEN' undeclared here (not in a function)
__u8 pdmc_addr[MAX_ADDR_LEN];
This is not the first case in the UAPI where the numeric value
of MAX_ADDR_LEN is used instead of symbolic one, uapi/linux/if_link.h
already does the same:
$ grep MAX_ADDR_LEN include/uapi/linux/if_link.h
__u8 mac[32]; /* MAX_ADDR_LEN */
There are no UAPI headers besides these two that use MAX_ADDR_LEN.
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Pavel Emelyanov <xemul@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/packet_diag.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -64,7 +64,7 @@ struct packet_diag_mclist {
__u32 pdmc_count;
__u16 pdmc_type;
__u16 pdmc_alen;
- __u8 pdmc_addr[MAX_ADDR_LEN];
+ __u8 pdmc_addr[32]; /* MAX_ADDR_LEN */
};
struct packet_diag_ring {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 125/145] KVM: s390: Fix guest migration for huge guests resulting in panic |
| Message-ID | <twQe5-2WB-5@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janosch Frank <frankja@linux.vnet.ibm.com>
commit 2e4d88009f57057df7672fa69a32b5224af54d37 upstream.
While we can technically not run huge page guests right now, we can
setup a guest with huge pages. Trying to migrate it will trigger a
VM_BUG_ON and, if the kernel is not configured to panic on a BUG, it
will happily try to work on non-existing page table entries.
With this patch, we always return "dirty" if we encounter a large page
when migrating. This at least fixes the immediate problem until we
have proper handling for both kind of pages.
Fixes: 15f36eb ("KVM: s390: Add proper dirty bitmap support to S390 kvm.")
Signed-off-by: Janosch Frank <frankja@linux.vnet.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/mm/pgtable.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -1358,11 +1358,28 @@ EXPORT_SYMBOL_GPL(s390_enable_skey);
*/
bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap)
{
+ pgd_t *pgd;
+ pud_t *pud;
+ pmd_t *pmd;
pte_t *pte;
spinlock_t *ptl;
bool dirty = false;
- pte = get_locked_pte(gmap->mm, address, &ptl);
+ pgd = pgd_offset(gmap->mm, address);
+ pud = pud_alloc(gmap->mm, pgd, address);
+ if (!pud)
+ return false;
+ pmd = pmd_alloc(gmap->mm, pud, address);
+ if (!pmd)
+ return false;
+ /* We can't run guests backed by huge pages, but userspace can
+ * still set them up and then try to migrate them without any
+ * migration support.
+ */
+ if (pmd_large(*pmd))
+ return true;
+
+ pte = pte_alloc_map_lock(gmap->mm, pmd, address, &ptl);
if (unlikely(!pte))
return false;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 104/145] vxlan: correctly validate VXLAN ID against VXLAN_N_VID |
| Message-ID | <twQe5-2WB-9@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <mschiffer@universe-factory.net>
commit 4e37d6911f36545b286d15073f6f2222f840e81c upstream.
The incorrect check caused an off-by-one error: the maximum VID 0xffffff
was unusable.
Fixes: d342894c5d2f ("vxlan: virtual extensible lan")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vxlan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2260,7 +2260,7 @@ static int vxlan_validate(struct nlattr
if (data[IFLA_VXLAN_ID]) {
__u32 id = nla_get_u32(data[IFLA_VXLAN_ID]);
- if (id >= VXLAN_VID_MASK)
+ if (id >= VXLAN_N_VID)
return -ERANGE;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 095/145] padata: avoid race in reordering |
| Message-ID | <twQe5-2WB-3@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <Jason@zx2c4.com>
commit de5540d088fe97ad583cc7d396586437b32149a5 upstream.
Under extremely heavy uses of padata, crashes occur, and with list
debugging turned on, this happens instead:
[87487.298728] WARNING: CPU: 1 PID: 882 at lib/list_debug.c:33
__list_add+0xae/0x130
[87487.301868] list_add corruption. prev->next should be next
(ffffb17abfc043d0), but was ffff8dba70872c80. (prev=ffff8dba70872b00).
[87487.339011] [<ffffffff9a53d075>] dump_stack+0x68/0xa3
[87487.342198] [<ffffffff99e119a1>] ? console_unlock+0x281/0x6d0
[87487.345364] [<ffffffff99d6b91f>] __warn+0xff/0x140
[87487.348513] [<ffffffff99d6b9aa>] warn_slowpath_fmt+0x4a/0x50
[87487.351659] [<ffffffff9a58b5de>] __list_add+0xae/0x130
[87487.354772] [<ffffffff9add5094>] ? _raw_spin_lock+0x64/0x70
[87487.357915] [<ffffffff99eefd66>] padata_reorder+0x1e6/0x420
[87487.361084] [<ffffffff99ef0055>] padata_do_serial+0xa5/0x120
padata_reorder calls list_add_tail with the list to which its adding
locked, which seems correct:
spin_lock(&squeue->serial.lock);
list_add_tail(&padata->list, &squeue->serial.list);
spin_unlock(&squeue->serial.lock);
This therefore leaves only place where such inconsistency could occur:
if padata->list is added at the same time on two different threads.
This pdata pointer comes from the function call to
padata_get_next(pd), which has in it the following block:
next_queue = per_cpu_ptr(pd->pqueue, cpu);
padata = NULL;
reorder = &next_queue->reorder;
if (!list_empty(&reorder->list)) {
padata = list_entry(reorder->list.next,
struct padata_priv, list);
spin_lock(&reorder->lock);
list_del_init(&padata->list);
atomic_dec(&pd->reorder_objects);
spin_unlock(&reorder->lock);
pd->processed++;
goto out;
}
out:
return padata;
I strongly suspect that the problem here is that two threads can race
on reorder list. Even though the deletion is locked, call to
list_entry is not locked, which means it's feasible that two threads
pick up the same padata object and subsequently call list_add_tail on
them at the same time. The fix is thus be hoist that lock outside of
that block.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/padata.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_ne
reorder = &next_queue->reorder;
+ spin_lock(&reorder->lock);
if (!list_empty(&reorder->list)) {
padata = list_entry(reorder->list.next,
struct padata_priv, list);
- spin_lock(&reorder->lock);
list_del_init(&padata->list);
atomic_dec(&pd->reorder_objects);
- spin_unlock(&reorder->lock);
pd->processed++;
+ spin_unlock(&reorder->lock);
goto out;
}
+ spin_unlock(&reorder->lock);
if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
padata = ERR_PTR(-ENODATA);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 083/145] usb: gadget: dummy_hcd: clear usb_gadget region before registration |
| Message-ID | <twQe5-2WB-1@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <peter.chen@nxp.com>
commit 5bbc852676ae08e818241cf66a3ffe4be44225c4 upstream.
When the user does device unbind and rebind test, the kernel will
show below dump due to usb_gadget memory region is dirty after unbind.
Clear usb_gadget region for every new probe.
root@imx6qdlsolo:/sys/bus/platform/drivers/dummy_udc# echo dummy_udc.0 > bind
[ 102.523312] kobject (eddd78b0): tried to init an initialized object, something is seriously wrong.
[ 102.532447] CPU: 0 PID: 734 Comm: sh Not tainted 4.10.0-rc7-00872-g1b2b8e9 #1298
[ 102.539866] Hardware name: Freescale i.MX6 SoloX (Device Tree)
[ 102.545717] Backtrace:
[ 102.548225] [<c010d090>] (dump_backtrace) from [<c010d338>] (show_stack+0x18/0x1c)
[ 102.555822] r7:ede34000 r6:60010013 r5:00000000 r4:c0f29418
[ 102.561512] [<c010d320>] (show_stack) from [<c040c2a4>] (dump_stack+0xb4/0xe8)
[ 102.568764] [<c040c1f0>] (dump_stack) from [<c040e6d4>] (kobject_init+0x80/0x9c)
[ 102.576187] r10:0000001f r9:eddd7000 r8:eeaf8c10 r7:eddd78a8 r6:c177891c r5:c0f3b060
[ 102.584036] r4:eddd78b0 r3:00000000
[ 102.587641] [<c040e654>] (kobject_init) from [<c05359a4>] (device_initialize+0x28/0xf8)
[ 102.595665] r5:eebc4800 r4:eddd78a8
[ 102.599268] [<c053597c>] (device_initialize) from [<c05382ac>] (device_register+0x14/0x20)
[ 102.607556] r7:eddd78a8 r6:00000000 r5:eebc4800 r4:eddd78a8
[ 102.613256] [<c0538298>] (device_register) from [<c0668ef4>] (usb_add_gadget_udc_release+0x8c/0x1ec)
[ 102.622410] r5:eebc4800 r4:eddd7860
[ 102.626015] [<c0668e68>] (usb_add_gadget_udc_release) from [<c0669068>] (usb_add_gadget_udc+0x14/0x18)
[ 102.635351] r10:0000001f r9:eddd7000 r8:eddd788c r7:bf003770 r6:eddd77f8 r5:eddd7818
[ 102.643198] r4:eddd785c r3:eddd7b24
[ 102.646834] [<c0669054>] (usb_add_gadget_udc) from [<bf003428>] (dummy_udc_probe+0x170/0x1c4 [dummy_hcd])
[ 102.656458] [<bf0032b8>] (dummy_udc_probe [dummy_hcd]) from [<c053d114>] (platform_drv_probe+0x54/0xb8)
[ 102.665881] r10:00000008 r9:c1778960 r8:bf004128 r7:fffffdfb r6:bf004128 r5:eeaf8c10
[ 102.673727] r4:eeaf8c10
[ 102.676293] [<c053d0c0>] (platform_drv_probe) from [<c053b160>] (driver_probe_device+0x264/0x474)
[ 102.685186] r7:00000000 r6:00000000 r5:c1778960 r4:eeaf8c10
[ 102.690876] [<c053aefc>] (driver_probe_device) from [<c05397c4>] (bind_store+0xb8/0x14c)
[ 102.698994] r10:eeb3bb4c r9:ede34000 r8:0000000c r7:eeaf8c44 r6:bf004128 r5:c0f3b668
[ 102.706840] r4:eeaf8c10
[ 102.709402] [<c053970c>] (bind_store) from [<c0538ca8>] (drv_attr_store+0x28/0x34)
[ 102.716998] r9:ede34000 r8:00000000 r7:ee3863c0 r6:ee3863c0 r5:c0538c80 r4:c053970c
[ 102.724776] [<c0538c80>] (drv_attr_store) from [<c029c930>] (sysfs_kf_write+0x50/0x54)
[ 102.732711] r5:c0538c80 r4:0000000c
[ 102.736313] [<c029c8e0>] (sysfs_kf_write) from [<c029be84>] (kernfs_fop_write+0x100/0x214)
[ 102.744599] r7:ee3863c0 r6:eeb3bb40 r5:00000000 r4:00000000
[ 102.750287] [<c029bd84>] (kernfs_fop_write) from [<c0222dd8>] (__vfs_write+0x34/0x120)
[ 102.758231] r10:00000000 r9:ede34000 r8:c0108bc4 r7:0000000c r6:ede35f80 r5:c029bd84
[ 102.766077] r4:ee223780
[ 102.768638] [<c0222da4>] (__vfs_write) from [<c0224678>] (vfs_write+0xa8/0x170)
[ 102.775974] r9:ede34000 r8:c0108bc4 r7:ede35f80 r6:01861cb0 r5:ee223780 r4:0000000c
[ 102.783743] [<c02245d0>] (vfs_write) from [<c0225498>] (SyS_write+0x4c/0xa8)
[ 102.790818] r9:ede34000 r8:c0108bc4 r7:0000000c r6:01861cb0 r5:ee223780 r4:ee223780
[ 102.798595] [<c022544c>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
[ 102.806188] r7:00000004 r6:b6e83d58 r5:01861cb0 r4:0000000c
Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Tested-by: Xiaolong Ye <xiaolong.ye@intel.com>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/dummy_hcd.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -972,6 +972,8 @@ static int dummy_udc_probe(struct platfo
int rc;
dum = *((void **)dev_get_platdata(&pdev->dev));
+ /* Clear usb_gadget region for new registration to udc-core */
+ memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
dum->gadget.name = gadget_name;
dum->gadget.ops = &dummy_ops;
dum->gadget.max_speed = USB_SPEED_SUPER;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe |
| Message-ID | <twQe5-2WB-7@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit f259ca3eed6e4b79ac3d5c5c9fb259fb46e86217 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/uss720.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -715,6 +715,11 @@ static int uss720_probe(struct usb_inter
interface = intf->cur_altsetting;
+ if (interface->desc.bNumEndpoints < 3) {
+ usb_put_dev(usbdev);
+ return -ENODEV;
+ }
+
/*
* Allocate parport interface
*/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 132/145] USB: wusbcore: fix NULL-deref at probe |
| Message-ID | <twQe5-2WB-11@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
This specifically fixes the NULL-pointer dereference when probing HWA HC
devices.
Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core")
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/wusbcore/wa-hc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct us
int result;
struct device *dev = &iface->dev;
+ if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+ return -ENODEV;
+
result = wa_rpipes_create(wa);
if (result < 0)
goto error_rpipes_create;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() |
| Message-ID | <twQe5-2WB-17@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit d5afb6f9b6bb2c57bd0c05e76e12489dc0d037d9 upstream.
The code where sk_clone() came from created a new socket and locked it,
but then, on the error path didn't unlock it.
This problem stayed there for a long while, till b0691c8ee7c2 ("net:
Unlock sock before calling sk_free()") fixed it, but unfortunately the
callers of sk_clone() (now sk_clone_locked()) were not audited and the
one in dccp_create_openreq_child() remained.
Now in the age of the syskaller fuzzer, this was finally uncovered, as
reported by Dmitry:
---- 8< ----
I've got the following report while running syzkaller fuzzer on
86292b33d4b7 ("Merge branch 'akpm' (patches from Andrew)")
[ BUG: held lock freed! ]
4.10.0+ #234 Not tainted
-------------------------
syz-executor6/6898 is freeing memory
ffff88006286cac0-ffff88006286d3b7, with a lock still held there!
(slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
include/linux/spinlock.h:299 [inline]
(slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504
5 locks held by syz-executor6/6898:
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>] lock_sock
include/net/sock.h:1460 [inline]
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>]
inet_stream_connect+0x44/0xa0 net/ipv4/af_inet.c:681
#1: (rcu_read_lock){......}, at: [<ffffffff83bc1c2a>]
inet6_csk_xmit+0x12a/0x5d0 net/ipv6/inet6_connection_sock.c:126
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_unlink
include/linux/skbuff.h:1767 [inline]
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_dequeue
include/linux/skbuff.h:1783 [inline]
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>]
process_backlog+0x264/0x730 net/core/dev.c:4835
#3: (rcu_read_lock){......}, at: [<ffffffff83aeb5c0>]
ip6_input_finish+0x0/0x1700 net/ipv6/ip6_input.c:59
#4: (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
include/linux/spinlock.h:299 [inline]
#4: (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504
Fix it just like was done by b0691c8ee7c2 ("net: Unlock sock before calling
sk_free()").
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170301153510.GE15145@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/minisocks.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -135,6 +135,7 @@ struct sock *dccp_create_openreq_child(s
/* It is still raw copy of parent, so invalidate
* destructor and make plain sk_free() */
newsk->sk_destruct = NULL;
+ bh_unlock_sock(newsk);
sk_free(newsk);
return NULL;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 141/145] net: fix socket refcounting in skb_complete_wifi_ack() |
| Message-ID | <twQe5-2WB-15@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit dd4f10722aeb10f4f582948839f066bebe44e5fb upstream.
TX skbs do not necessarily hold a reference on skb->sk->sk_refcnt
By the time TX completion happens, sk_refcnt might be already 0.
sock_hold()/sock_put() would then corrupt critical state, like
sk_wmem_alloc.
Fixes: bf7fa551e0ce ("mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3661,7 +3661,7 @@ void skb_complete_wifi_ack(struct sk_buf
{
struct sock *sk = skb->sk;
struct sock_exterr_skb *serr;
- int err;
+ int err = 1;
skb->wifi_acked_valid = 1;
skb->wifi_acked = acked;
@@ -3671,14 +3671,15 @@ void skb_complete_wifi_ack(struct sk_buf
serr->ee.ee_errno = ENOMSG;
serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
- /* take a reference to prevent skb_orphan() from freeing the socket */
- sock_hold(sk);
-
- err = sock_queue_err_skb(sk, skb);
+ /* Take a reference to prevent skb_orphan() from freeing the socket,
+ * but only if the socket refcount is not zero.
+ */
+ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+ err = sock_queue_err_skb(sk, skb);
+ sock_put(sk);
+ }
if (err)
kfree_skb(skb);
-
- sock_put(sk);
}
EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 101/145] cpmac: remove hopeless #warning |
| Message-ID | <twQe6-2WB-19@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnd Bergmann <arnd@arndb.de> commit d43e6fb4ac4abfe4ef7c102833ed02330ad701e0 upstream. The #warning was present 10 years ago when the driver first got merged. As the platform is rather obsolete by now, it seems very unlikely that the warning will cause anyone to fix the code properly. kernelci.org reports the warning for every build in the meantime, so I think it's better to just turn it into a code comment to reduce noise. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/ethernet/ti/cpmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/ti/cpmac.c +++ b/drivers/net/ethernet/ti/cpmac.c @@ -1235,7 +1235,7 @@ int cpmac_init(void) goto fail_alloc; } -#warning FIXME: unhardcode gpio&reset bits + /* FIXME: unhardcode gpio&reset bits */ ar7_gpio_disable(26); ar7_gpio_disable(27); ar7_device_reset(AR7_RESET_BIT_CPMAC_LO);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 110/145] net/packet: fix overflow in check for priv area size |
| Message-ID | <twQe6-2WB-23@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrey Konovalov <andreyknvl@google.com> commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream. Subtracting tp_sizeof_priv from tp_block_size and casting to int to check whether one is less then the other doesn't always work (both of them are unsigned ints). Compare them as is instead. Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as it can overflow inside BLK_PLUS_PRIV otherwise. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3808,8 +3808,8 @@ static int packet_set_ring(struct sock * if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) goto out; if (po->tp_version >= TPACKET_V3 && - (int)(req->tp_block_size - - BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) + req->tp_block_size <= + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) goto out; if (unlikely(req->tp_frame_size < po->tp_hdrlen + po->tp_reserve))
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 117/145] crypto: cryptd - Assign statesize properly |
| Message-ID | <twQe6-2WB-21@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang, Rui Y <rui.y.wang@intel.com>
commit 1a07834024dfca5c4bed5de8f8714306e0a11836 upstream.
cryptd_create_hash() fails by returning -EINVAL. It is because after
8996eafdc ("crypto: ahash - ensure statesize is non-zero") all ahash
drivers must have a non-zero statesize.
This patch fixes the problem by properly assigning the statesize.
Signed-off-by: Rui Wang <rui.y.wang@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/cryptd.c | 1 +
1 file changed, 1 insertion(+)
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -606,6 +606,7 @@ static int cryptd_create_hash(struct cry
inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC;
inst->alg.halg.digestsize = salg->digestsize;
+ inst->alg.halg.statesize = salg->statesize;
inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx);
inst->alg.halg.base.cra_init = cryptd_hash_init_tfm;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 098/145] drm/ast: Call open_key before enable_mmio in POST code |
| Message-ID | <twQe6-2WB-25@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Y.C. Chen <yc_chen@aspeedtech.com> commit 9bb92f51558f2ef5f56c257bdcea0588f31d857e upstream. open_key enables access the registers used by enable_mmio Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Joel Stanley <joel@jms.id.au> Tested-by: Y.C. Chen <yc_chen@aspeedtech.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/gpu/drm/ast/ast_post.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/ast/ast_post.c +++ b/drivers/gpu/drm/ast/ast_post.c @@ -371,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev pci_write_config_dword(ast->dev->pdev, 0x04, reg); ast_enable_vga(dev); - ast_enable_mmio(dev); ast_open_key(ast); + ast_enable_mmio(dev); ast_set_def_ext_reg(dev); if (ast->chip == AST2300 || ast->chip == AST2400)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-16 13:10 +0200 |
| Subject | [PATCH 3.18 078/145] libceph: use BUG() instead of BUG_ON(1) |
| Message-ID | <twQe6-2WB-29@gated-at.bofh.it> |
| In reply to | #1624299 |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit d24cdcd3e40a6825135498e11c20c7976b9bf545 upstream.
I ran into this compile warning, which is the result of BUG_ON(1)
not always leading to the compiler treating the code path as
unreachable:
include/linux/ceph/osdmap.h: In function 'ceph_can_shift_osds':
include/linux/ceph/osdmap.h:62:1: error: control reaches end of non-void function [-Werror=return-type]
Using BUG() here avoids the warning.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ceph/osdmap.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/ceph/osdmap.h
+++ b/include/linux/ceph/osdmap.h
@@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(s
case CEPH_POOL_TYPE_EC:
return false;
default:
- BUG_ON(1);
+ BUG();
}
}
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.kernel
csiph-web