This is the start of the stable review cycle for the 4.14.145 release.
There are 45 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 20 Sep 2019 06:09:47 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.145-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.145-rc1
Linus Torvalds <torvalds(a)linux-foundation.org>
x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
Jean Delvare <jdelvare(a)suse.de>
nvmem: Use the same permissions for eeprom as for nvmem
Steffen Dirkwinkel <s.dirkwinkel(a)beckhoff.com>
platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table
Mario Limonciello <mario.limonciello(a)dell.com>
Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
Nishka Dasgupta <nishkadg.linux(a)gmail.com>
drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
Andrew F. Davis <afd(a)ti.com>
firmware: ti_sci: Always request response from firmware
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - Do not modify req->cryptlen on decryption.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix ECB algs ivsize
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - check data blocksize in ablkcipher.
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - fix CTR alg blocksize
Christophe Leroy <christophe.leroy(a)c-s.fr>
crypto: talitos - check AES key size
Muchun Song <smuchun(a)gmail.com>
driver core: Fix use-after-free and double free on glue directory
Richard Weinberger <richard(a)nod.at>
ubifs: Correctly use tnc_next() in search_dh_cookie()
Alex Williamson <alex.williamson(a)redhat.com>
PCI: Always allow probing with driver_override
Xiaolei Li <xiaolei.li(a)mediatek.com>
mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
Douglas Anderson <dianders(a)chromium.org>
clk: rockchip: Don't yell about bad mmc phases when getting
Neil Armstrong <narmstrong(a)baylibre.com>
drm/meson: Add support for XBGR8888 & ABGR8888 formats
Suraj Jitindar Singh <sjitindarsingh(a)gmail.com>
powerpc: Add barrier_nospec to raw_copy_in_user()
Paul Burton <paul.burton(a)mips.com>
MIPS: VDSO: Use same -m%-float cflag as the kernel proper
Paul Burton <paul.burton(a)mips.com>
MIPS: VDSO: Prevent use of smp_processor_id()
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: nVMX: handle page fault in vmread
Fuqian Huang <huangfq.daxian(a)gmail.com>
KVM: x86: work around leak of uninitialized stack contents
Thomas Huth <thuth(a)redhat.com>
KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
Yunfeng Ye <yeyunfeng(a)huawei.com>
genirq: Prevent NULL pointer dereference in resend_irqs()
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix assertion failure during fsync and use of stale transaction
Kent Gibson <warthog618(a)gmail.com>
gpio: fix line flag validation in lineevent_create
Kent Gibson <warthog618(a)gmail.com>
gpio: fix line flag validation in linehandle_create
Hans de Goede <hdegoede(a)redhat.com>
gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
Johannes Thumshirn <jthumshirn(a)suse.de>
btrfs: correctly validate compression type
David Sterba <dsterba(a)suse.com>
btrfs: compression: add helper for type to string conversion
Yang Yingliang <yangyingliang(a)huawei.com>
tun: fix use-after-free when register netdev failed
Xin Long <lucien.xin(a)gmail.com>
tipc: add NULL pointer check before calling kfree_rcu
Neal Cardwell <ncardwell(a)google.com>
tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
Xin Long <lucien.xin(a)gmail.com>
sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
Cong Wang <xiyou.wangcong(a)gmail.com>
sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
Stefan Chulski <stefanc(a)marvell.com>
net: phylink: Fix flow control resolution
Shmulik Ladkani <shmulik(a)metanetworks.com>
net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
Subash Abhinov Kasiviswanathan <subashab(a)codeaurora.org>
net: Fix null de-reference of device refcount
Eric Biggers <ebiggers(a)google.com>
isdn/capi: check message length in capi_write()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
Bjørn Mork <bjorn(a)mork.no>
cdc_ether: fix rndis support for Mediatek based smartphones
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
bridge/mdb: remove wrong use of NLM_F_MULTI
-------------
Diffstat:
Makefile | 4 +-
arch/mips/Kconfig | 3 --
arch/mips/include/asm/smp.h | 12 +++++-
arch/mips/sibyte/common/Makefile | 1 -
arch/mips/sibyte/common/dma.c | 14 -------
arch/mips/vdso/Makefile | 4 +-
arch/powerpc/include/asm/uaccess.h | 1 +
arch/s390/kvm/interrupt.c | 10 +++++
arch/s390/kvm/kvm-s390.c | 2 +-
arch/x86/Makefile | 1 +
arch/x86/kvm/vmx.c | 7 +++-
arch/x86/kvm/x86.c | 7 ++++
drivers/base/core.c | 53 ++++++++++++++++++++++++++-
drivers/bluetooth/btusb.c | 5 ---
drivers/clk/rockchip/clk-mmc-phase.c | 4 +-
drivers/crypto/talitos.c | 67 +++++++++++++++++++++++++---------
drivers/firmware/ti_sci.c | 8 ++--
drivers/gpio/gpiolib-acpi.c | 42 +++++++++++++++++++--
drivers/gpio/gpiolib.c | 20 +++++++---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++-
drivers/gpu/drm/meson/meson_plane.c | 16 ++++++++
drivers/isdn/capi/capi.c | 10 ++++-
drivers/mtd/nand/mtk_nand.c | 21 +++++------
drivers/net/phy/phylink.c | 6 +--
drivers/net/tun.c | 16 +++++---
drivers/net/usb/cdc_ether.c | 13 +++++--
drivers/nvmem/core.c | 15 ++++++--
drivers/pci/pci-driver.c | 3 +-
drivers/platform/x86/pmc_atom.c | 8 ++++
fs/btrfs/compression.c | 31 ++++++++++++++++
fs/btrfs/compression.h | 3 ++
fs/btrfs/props.c | 6 +--
fs/btrfs/tree-log.c | 8 ++--
fs/ubifs/tnc.c | 16 +++++---
include/uapi/linux/isdn/capicmd.h | 1 +
kernel/irq/resend.c | 2 +
net/bridge/br_mdb.c | 2 +-
net/core/dev.c | 2 +
net/core/skbuff.c | 19 ++++++++++
net/ipv4/tcp_input.c | 2 +-
net/ipv6/ping.c | 2 +-
net/sched/sch_hhf.c | 2 +-
net/sctp/protocol.c | 2 +-
net/sctp/sm_sideeffect.c | 2 +-
net/tipc/name_distr.c | 3 +-
45 files changed, 366 insertions(+), 115 deletions(-)
From: Chris Lew <clew(a)codeaurora.org>
The device release function is set before registering with rpmsg. If
rpmsg registration fails, the framework will call device_put(), which
invokes the release function. The channel create logic does not need to
free rpdev if rpmsg_register_device() fails and release is called.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Chris Lew <clew(a)codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
---
drivers/rpmsg/qcom_glink_native.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 21fd2ae5f7f1..89e02baea2d0 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1423,15 +1423,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,
ret = rpmsg_register_device(rpdev);
if (ret)
- goto free_rpdev;
+ goto rcid_remove;
channel->rpdev = rpdev;
}
return 0;
-free_rpdev:
- kfree(rpdev);
rcid_remove:
spin_lock_irqsave(&glink->idr_lock, flags);
idr_remove(&glink->rcids, channel->rcid);
--
2.18.0
From: Chris Lew <clew(a)codeaurora.org>
In a remote processor crash scenario, there is no guarantee the remote
processor sent close requests before it went into a bad state. Remove
the reference that is normally handled by the close command in the
so channel resources can be released.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Chris Lew <clew(a)codeaurora.org>
Reported-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
---
drivers/rpmsg/qcom_glink_native.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 72ed671f5dcd..21fd2ae5f7f1 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1641,6 +1641,10 @@ void qcom_glink_native_remove(struct qcom_glink *glink)
idr_for_each_entry(&glink->lcids, channel, cid)
kref_put(&channel->refcount, qcom_glink_channel_release);
+ /* Release any defunct local channels, waiting for close-req */
+ idr_for_each_entry(&glink->rcids, channel, cid)
+ kref_put(&channel->refcount, qcom_glink_channel_release);
+
idr_destroy(&glink->lcids);
idr_destroy(&glink->rcids);
spin_unlock_irqrestore(&glink->idr_lock, flags);
--
2.18.0
From: Arun Kumar Neelakantam <aneela(a)codeaurora.org>
Extra channel reference put when remote sending OPEN_ACK after timeout
causes use-after-free while handling next remote CLOSE command.
Remove extra reference put in timeout case to avoid use-after-free.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Cc: stable(a)vger.kernel.org
Signed-off-by: Arun Kumar Neelakantam <aneela(a)codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson(a)linaro.org>
---
drivers/rpmsg/qcom_glink_native.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 9355ce26fd98..72ed671f5dcd 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1103,13 +1103,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink,
close_link:
/*
* Send a close request to "undo" our open-ack. The close-ack will
- * release the last reference.
+ * release qcom_glink_send_open_req() reference and the last reference
+ * will be relesed after receiving remote_close or transport unregister
+ * by calling qcom_glink_native_remove().
*/
qcom_glink_send_close_req(glink, channel);
- /* Release qcom_glink_send_open_req() reference */
- kref_put(&channel->refcount, qcom_glink_channel_release);
-
return ret;
}
--
2.18.0