This is the start of the stable review cycle for the 4.14.124 release.
There are 69 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun 09 Jun 2019 03:37:08 PM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.124-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.124-rc1
Nadav Amit <namit(a)vmware.com>
media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
Todd Kjos <tkjos(a)android.com>
binder: fix race between munmap() and direct reclaim
Todd Kjos <tkjos(a)android.com>
Revert "binder: fix handling of misaligned binder object"
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "x86/build: Move _etext to actual end of .text"
Miguel Ojeda <miguel.ojeda.sandonis(a)gmail.com>
include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
Miguel Ojeda <miguel.ojeda.sandonis(a)gmail.com>
Compiler Attributes: add support for __copy (gcc >= 9)
Vicente Bergas <vicencb(a)gmail.com>
drm/rockchip: shutdown drm subsystem on shutdown
Thomas Hellstrom <thellstrom(a)vmware.com>
drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
Kees Cook <keescook(a)chromium.org>
gcc-plugins: Fix build failures under Darwin host
Benjamin Coddington <bcodding(a)redhat.com>
Revert "lockd: Show pid of lockd for remote locks"
Roberto Bergantinos Corpas <rbergant(a)redhat.com>
CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
Tim Collier <osdevtc(a)gmail.com>
staging: wlan-ng: fix adapter initialization failure
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: vc04_services: prevent integer overflow in create_pagelist()
George G. Davis <george_davis(a)mentor.com>
serial: sh-sci: disable DMA for uart_console
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: show rules with IMA_INMASK correctly
Jonathan Corbet <corbet(a)lwn.net>
doc: Cope with Sphinx logging deprecations
Jonathan Corbet <corbet(a)lwn.net>
doc: Cope with the deprecation of AutoReporter
Jonathan Corbet <corbet(a)lwn.net>
docs: Fix conf.py for Sphinx 2.0
Zhenliang Wei <weizhenliang(a)huawei.com>
kernel/signal.c: trace_signal_deliver when signal_group_exit
Jiri Slaby <jslaby(a)suse.cz>
memcg: make it work on sparse non-0-node systems
Joe Burmeister <joe.burmeister(a)devtank.co.uk>
tty: max310x: Fix external crystal register setup
Jorge Ramirez-Ortiz <jorge.ramirez-ortiz(a)linaro.org>
tty: serial: msm_serial: Fix XON/XOFF
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/i2c: Disable i2c bus access after ->fini()
Thomas Huth <thuth(a)redhat.com>
KVM: s390: Do not report unusabled IDs via KVM_CAP_MAX_VCPU_ID
Kailang Yang <kailang(a)realtek.com>
ALSA: hda/realtek - Set default power save node to 0
Ravi Bangoria <ravi.bangoria(a)linux.ibm.com>
powerpc/perf: Fix MMCRA corruption by bhrb_filter
Cédric Le Goater <clg(a)kaod.org>
KVM: PPC: Book3S HV: XIVE: Do not clear IRQ data of passthrough interrupts
Filipe Manana <fdmanana(a)suse.com>
Btrfs: incremental send, fix file corruption when no-holes feature is enabled
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix fsync not persisting changed attributes of a directory
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix race updating log root item during fsync
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix wrong ctime and mtime of a directory after log replay
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
Steffen Maier <maier(a)linux.ibm.com>
scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
media: smsusb: better handle optional alignment
Alan Stern <stern(a)rowland.harvard.edu>
media: usb: siano: Fix false-positive "uninitialized variable" warning
Alan Stern <stern(a)rowland.harvard.edu>
media: usb: siano: Fix general protection fault in smsusb
Oliver Neukum <oneukum(a)suse.com>
USB: rio500: fix memory leak in close after disconnect
Oliver Neukum <oneukum(a)suse.com>
USB: rio500: refuse more than one device at a time
Maximilian Luz <luzmaximilian(a)gmail.com>
USB: Add LPM quirk for Surface Dock GigE adapter
Oliver Neukum <oneukum(a)suse.com>
USB: sisusbvga: fix oops in error path of sisusb_probe
Alan Stern <stern(a)rowland.harvard.edu>
USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: usbip_host: fix stub_dev lock context imbalance regression
Shuah Khan <skhan(a)linuxfoundation.org>
usbip: usbip_host: fix BUG: sleeping function called from invalid context
Carsten Schmid <carsten_schmid(a)mentor.com>
usb: xhci: avoid null pointer deref when bos field is NULL
Andrey Smirnov <andrew.smirnov(a)gmail.com>
xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
Fabio Estevam <festevam(a)gmail.com>
xhci: Use %zu for printing size_t type
Henry Lin <henryl(a)nvidia.com>
xhci: update bounce buffer with correct sg num
Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
include/linux/bitops.h: sanitize rotate primitives
James Clarke <jrtc27(a)jrtc27.com>
sparc64: Fix regression in non-hypervisor TLB flush xcall
Junwei Hu <hujunwei4(a)huawei.com>
tipc: fix modprobe tipc failed after switch order of device registration
David S. Miller <davem(a)davemloft.net>
Revert "tipc: fix modprobe tipc failed after switch order of device registration"
Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com>
xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
Daniel Axtens <dja(a)axtens.net>
crypto: vmx - ghash: do nosimd fallback manually
Russell King <rmk+kernel(a)armlinux.org.uk>
net: phy: marvell10g: report if the PHY fails to boot firmware
Antoine Tenart <antoine.tenart(a)bootlin.com>
net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
net: mvneta: Fix err code path of probe
Rasmus Villemoes <rasmus.villemoes(a)prevas.dk>
net: dsa: mv88e6xxx: fix handling of upper half of STATS_TYPE_PORT
Eric Dumazet <edumazet(a)google.com>
ipv4/igmp: fix build error if !CONFIG_IP_MULTICAST
Eric Dumazet <edumazet(a)google.com>
ipv4/igmp: fix another memory leak in igmpv3_del_delrec()
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Fix aggregation buffer leak under OOM condition.
Parav Pandit <parav(a)mellanox.com>
net/mlx5: Allocate root ns memory using kzalloc to match kfree
Chris Packham <chris.packham(a)alliedtelesis.co.nz>
tipc: Avoid copying bytes beyond the supplied data
Kloetzke Jan <Jan.Kloetzke(a)preh.de>
usbnet: fix kernel crash after disconnect
Jisheng Zhang <Jisheng.Zhang(a)synaptics.com>
net: stmmac: fix reset gpio free missing
Eric Dumazet <edumazet(a)google.com>
net-gro: fix use-after-free read in napi_gro_frags()
Andy Duan <fugang.duan(a)nxp.com>
net: fec: fix the clk mismatch in failed_reset path
Eric Dumazet <edumazet(a)google.com>
llc: fix skb leak in llc_build_and_send_ui_pkt()
Mike Manning <mmanning(a)vyatta.att-mail.com>
ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
Eric Dumazet <edumazet(a)google.com>
inet: switch IP ID generator to siphash
-------------
Diffstat:
Documentation/conf.py | 2 +-
Documentation/sphinx/kerneldoc.py | 44 +++--
Documentation/sphinx/kernellog.py | 28 +++
Documentation/sphinx/kfigure.py | 40 ++--
Makefile | 4 +-
arch/mips/kvm/mips.c | 3 +
arch/powerpc/kvm/book3s_xive.c | 4 +-
arch/powerpc/kvm/powerpc.c | 3 +
arch/powerpc/perf/core-book3s.c | 6 +-
arch/powerpc/perf/power8-pmu.c | 3 +
arch/powerpc/perf/power9-pmu.c | 3 +
arch/s390/kvm/kvm-s390.c | 1 +
arch/sparc/mm/ultra.S | 4 +-
arch/x86/kernel/vmlinux.lds.S | 6 +-
arch/x86/kvm/x86.c | 3 +
drivers/crypto/vmx/ghash.c | 213 +++++++++------------
drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h | 2 +
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c | 26 ++-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h | 2 +
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 15 ++
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c | 21 +-
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h | 1 +
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 9 +
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 8 +-
drivers/media/usb/siano/smsusb.c | 33 ++--
drivers/media/usb/uvc/uvc_driver.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +
drivers/net/ethernet/freescale/fec_main.c | 2 +-
drivers/net/ethernet/marvell/mvneta.c | 4 +-
drivers/net/ethernet/marvell/mvpp2.c | 10 +-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 3 +-
drivers/net/phy/marvell10g.c | 14 ++
drivers/net/usb/usbnet.c | 6 +
drivers/s390/scsi/zfcp_ext.h | 1 +
drivers/s390/scsi/zfcp_scsi.c | 9 +
drivers/s390/scsi/zfcp_sysfs.c | 55 +++++-
drivers/s390/scsi/zfcp_unit.c | 8 +-
.../interface/vchiq_arm/vchiq_2835_arm.c | 9 +
drivers/staging/wlan-ng/hfa384x_usb.c | 3 +-
drivers/tty/serial/max310x.c | 2 +-
drivers/tty/serial/msm_serial.c | 5 +-
drivers/tty/serial/sh-sci.c | 7 +
drivers/usb/core/config.c | 4 +-
drivers/usb/core/quirks.c | 3 +
drivers/usb/host/xhci-ring.c | 17 +-
drivers/usb/host/xhci.c | 24 ++-
drivers/usb/misc/rio500.c | 41 +++-
drivers/usb/misc/sisusbvga/sisusb.c | 15 +-
drivers/usb/usbip/stub_dev.c | 75 +++++---
drivers/xen/xen-pciback/pciback_ops.c | 2 -
fs/btrfs/inode.c | 14 +-
fs/btrfs/send.c | 6 +
fs/btrfs/tree-log.c | 20 +-
fs/cifs/file.c | 4 +-
fs/lockd/xdr.c | 4 +-
fs/lockd/xdr4.c | 4 +-
include/linux/bitops.h | 16 +-
include/linux/compiler-gcc.h | 4 +
include/linux/compiler_types.h | 4 +
include/linux/list_lru.h | 1 +
include/linux/module.h | 4 +-
include/linux/siphash.h | 5 +
include/net/netns/ipv4.h | 2 +
include/uapi/linux/tipc_config.h | 10 +-
kernel/signal.c | 2 +
mm/list_lru.c | 8 +-
net/core/dev.c | 2 +-
net/ipv4/igmp.c | 47 +++--
net/ipv4/route.c | 12 +-
net/ipv6/output_core.c | 30 +--
net/ipv6/raw.c | 2 +
net/llc/llc_output.c | 2 +
net/tipc/core.c | 32 ++--
net/tipc/subscr.c | 14 +-
net/tipc/subscr.h | 5 +-
scripts/gcc-plugins/gcc-common.h | 4 +
security/integrity/ima/ima_policy.c | 21 +-
sound/pci/hda/patch_realtek.c | 2 +-
virt/kvm/arm/arm.c | 3 +
virt/kvm/kvm_main.c | 2 -
82 files changed, 728 insertions(+), 369 deletions(-)
Hello,
CVE-2019-12381 was fixed in the upstream linux kernel with the commit :-
* 425aa0e1d015 ("ip_sockglue: Fix missing-check bug in ip_ra_control()")
Could the patch be applied in order to v4.19.y, v4.14.y, v4.9.y and v4.4.y ?
Tests run:
* Chrome OS tryjobs
Thanks,
- Zubin
Commit-ID: f3c74b38a55aefe1004200d15a83f109b510068c
Gitweb: https://git.kernel.org/tip/f3c74b38a55aefe1004200d15a83f109b510068c
Author: Borislav Petkov <bp(a)suse.de>
AuthorDate: Sat, 20 Apr 2019 13:27:51 +0200
Committer: Borislav Petkov <bp(a)suse.de>
CommitDate: Fri, 7 Jun 2019 23:18:26 +0200
RAS/CEC: Fix binary search function
Switch to using Donald Knuth's binary search algorithm (The Art of
Computer Programming, vol. 3, section 6.2.1). This should've been done
from the very beginning but the author must've been smoking something
very potent at the time.
The problem with the current one was that it would return the wrong
element index in certain situations:
https://lkml.kernel.org/r/CAM_iQpVd02zkVJ846cj-Fg1yUNuz6tY5q1Vpj4LrXmE06dPY…
and the noodling code after the loop was fishy at best.
So switch to using Knuth's binary search. The final result is much
cleaner and straightforward.
Fixes: 011d82611172 ("RAS: Add a Corrected Errors Collector")
Reported-by: Cong Wang <xiyou.wangcong(a)gmail.com>
Signed-off-by: Borislav Petkov <bp(a)suse.de>
Cc: Tony Luck <tony.luck(a)intel.com>
Cc: linux-edac <linux-edac(a)vger.kernel.org>
Cc: <stable(a)vger.kernel.org>
---
drivers/ras/cec.c | 34 ++++++++++++++++++++--------------
1 file changed, 20 insertions(+), 14 deletions(-)
diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index 88e4f3ff0cb8..dbfe3e61d2c2 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -183,32 +183,38 @@ static void cec_timer_fn(struct timer_list *unused)
*/
static int __find_elem(struct ce_array *ca, u64 pfn, unsigned int *to)
{
+ int min = 0, max = ca->n - 1;
u64 this_pfn;
- int min = 0, max = ca->n;
- while (min < max) {
- int tmp = (max + min) >> 1;
+ while (min <= max) {
+ int i = (min + max) >> 1;
- this_pfn = PFN(ca->array[tmp]);
+ this_pfn = PFN(ca->array[i]);
if (this_pfn < pfn)
- min = tmp + 1;
+ min = i + 1;
else if (this_pfn > pfn)
- max = tmp;
- else {
- min = tmp;
- break;
+ max = i - 1;
+ else if (this_pfn == pfn) {
+ if (to)
+ *to = i;
+
+ return i;
}
}
+ /*
+ * When the loop terminates without finding @pfn, min has the index of
+ * the element slot where the new @pfn should be inserted. The loop
+ * terminates when min > max, which means the min index points to the
+ * bigger element while the max index to the smaller element, in-between
+ * which the new @pfn belongs to.
+ *
+ * For more details, see exercise 1, Section 6.2.1 in TAOCP, vol. 3.
+ */
if (to)
*to = min;
- this_pfn = PFN(ca->array[min]);
-
- if (this_pfn == pfn)
- return min;
-
return -ENOKEY;
}
From: Dan Carpenter <dan.carpenter(a)oracle.com>
[ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ]
The user can change the device_name with the IMSETDEVNAME ioctl, but we
need to ensure that the user's name is NUL terminated. Otherwise it
could result in a buffer overflow when we copy the name back to the user
with IMGETDEVINFO ioctl.
I also changed two strcpy() calls which handle the name to strscpy().
Hopefully, there aren't any other ways to create a too long name, but
it's nice to do this as a kernel hardening measure.
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/isdn/mISDN/socket.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 0d29b5a6356d..8cbb75d09a1d 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
memcpy(di.channelmap, dev->channelmap,
sizeof(di.channelmap));
di.nrbchan = dev->nrbchan;
- strcpy(di.name, dev_name(&dev->dev));
+ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
if (copy_to_user((void __user *)arg, &di, sizeof(di)))
err = -EFAULT;
} else
@@ -678,7 +678,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
memcpy(di.channelmap, dev->channelmap,
sizeof(di.channelmap));
di.nrbchan = dev->nrbchan;
- strcpy(di.name, dev_name(&dev->dev));
+ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
if (copy_to_user((void __user *)arg, &di, sizeof(di)))
err = -EFAULT;
} else
@@ -692,6 +692,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
err = -EFAULT;
break;
}
+ dn.name[sizeof(dn.name) - 1] = '\0';
dev = get_mdevice(dn.id);
if (dev)
err = device_rename(&dev->dev, dn.name);
--
2.20.1