September 2019 - Linux-stable-mirror

Re: [PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

by Greg Kroah-Hartman

On Fri, Aug 30, 2019 at 05:49:59PM -0400, Hui Peng wrote: > This is the backported patch of the following bug to v4.4.x and v4.14.x: > daac07156b33 ("ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit") Thanks, also now queued up to 4.9.y, you forgot that one :) greg k-h

5 years, 1 month

1
0
0 0

[PATCH AUTOSEL 4.19 01/29] hv_sock: Fix hang when a connection is closed

by Sasha Levin

From: Dexuan Cui <decui(a)microsoft.com> [ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ] There is a race condition for an established connection that is being closed by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the 'remove_sock' is false): 1 for the initial value; 1 for the sk being in the bound list; 1 for the sk being in the connected list; 1 for the delayed close_work. After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may* decrease the refcnt to 3. Concurrently, hvs_close_connection() runs in another thread: calls vsock_remove_sock() to decrease the refcnt by 2; call sock_put() to decrease the refcnt to 0, and free the sk; next, the "release_sock(sk)" may hang due to use-after-free. In the above, after hvs_release() finishes, if hvs_close_connection() runs faster than "__vsock_release() -> sock_put(sk)", then there is not any issue, because at the beginning of hvs_close_connection(), the refcnt is still 4. The issue can be resolved if an extra reference is taken when the connection is established. Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close") Signed-off-by: Dexuan Cui <decui(a)microsoft.com> Reviewed-by: Sunil Muthuswamy <sunilmut(a)microsoft.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/vmw_vsock/hyperv_transport.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c index 9c7da811d130f..98f193fd5315e 100644 --- a/net/vmw_vsock/hyperv_transport.c +++ b/net/vmw_vsock/hyperv_transport.c @@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan) lock_sock(sk); hvs_do_close_lock_held(vsock_sk(sk), true); release_sock(sk); + + /* Release the refcnt for the channel that's opened in + * hvs_open_connection(). + */ + sock_put(sk); } static void hvs_open_connection(struct vmbus_channel *chan) @@ -388,6 +393,9 @@ static void hvs_open_connection(struct vmbus_channel *chan) } set_per_channel_state(chan, conn_from_host ? new : sk); + + /* This reference will be dropped by hvs_close_connection(). */ + sock_hold(conn_from_host ? new : sk); vmbus_set_chn_rescind_callback(chan, hvs_close_connection); /* Set the pending send size to max packet size to always get -- 2.20.1

5 years, 1 month

3
32
0 0

[PATCH] spi: ep93xx: Repair SPI CS lookup tables

by Alexander Sverdlin

The actual device name of the SPI controller being registered on EP93xx is "spi0" (as seen by gpiod_find_lookup_table()). This patch fixes all relevant lookup tables and the following failure (seen on EDB9302): ep93xx-spi ep93xx-spi.0: failed to register SPI master ep93xx-spi: probe of ep93xx-spi.0 failed with error -22 Fixes: 1dfbf334f1236 ("spi: ep93xx: Convert to use CS GPIO descriptors") Cc: stable(a)vger.kernel.org Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)gmail.com> --- arch/arm/mach-ep93xx/edb93xx.c | 2 +- arch/arm/mach-ep93xx/simone.c | 2 +- arch/arm/mach-ep93xx/ts72xx.c | 4 ++-- arch/arm/mach-ep93xx/vision_ep9307.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/arm/mach-ep93xx/edb93xx.c b/arch/arm/mach-ep93xx/edb93xx.c index 1f0da76a39de..7b7280c21ee0 100644 --- a/arch/arm/mach-ep93xx/edb93xx.c +++ b/arch/arm/mach-ep93xx/edb93xx.c @@ -103,7 +103,7 @@ static struct spi_board_info edb93xx_spi_board_info[] __initdata = { }; static struct gpiod_lookup_table edb93xx_spi_cs_gpio_table = { - .dev_id = "ep93xx-spi.0", + .dev_id = "spi0", .table = { GPIO_LOOKUP("A", 6, "cs", GPIO_ACTIVE_LOW), { }, diff --git a/arch/arm/mach-ep93xx/simone.c b/arch/arm/mach-ep93xx/simone.c index e2658e22bba1..8a53b74dc4b2 100644 --- a/arch/arm/mach-ep93xx/simone.c +++ b/arch/arm/mach-ep93xx/simone.c @@ -73,7 +73,7 @@ static struct spi_board_info simone_spi_devices[] __initdata = { * v1.3 parts will still work, since the signal on SFRMOUT is automatic. */ static struct gpiod_lookup_table simone_spi_cs_gpio_table = { - .dev_id = "ep93xx-spi.0", + .dev_id = "spi0", .table = { GPIO_LOOKUP("A", 1, "cs", GPIO_ACTIVE_LOW), { }, diff --git a/arch/arm/mach-ep93xx/ts72xx.c b/arch/arm/mach-ep93xx/ts72xx.c index 582e06e104fd..e0e1b11032f1 100644 --- a/arch/arm/mach-ep93xx/ts72xx.c +++ b/arch/arm/mach-ep93xx/ts72xx.c @@ -267,7 +267,7 @@ static struct spi_board_info bk3_spi_board_info[] __initdata = { * goes through CPLD */ static struct gpiod_lookup_table bk3_spi_cs_gpio_table = { - .dev_id = "ep93xx-spi.0", + .dev_id = "spi0", .table = { GPIO_LOOKUP("F", 3, "cs", GPIO_ACTIVE_LOW), { }, @@ -316,7 +316,7 @@ static struct spi_board_info ts72xx_spi_devices[] __initdata = { }; static struct gpiod_lookup_table ts72xx_spi_cs_gpio_table = { - .dev_id = "ep93xx-spi.0", + .dev_id = "spi0", .table = { /* DIO_17 */ GPIO_LOOKUP("F", 2, "cs", GPIO_ACTIVE_LOW), diff --git a/arch/arm/mach-ep93xx/vision_ep9307.c b/arch/arm/mach-ep93xx/vision_ep9307.c index a88a1d807b32..cbcba3136d74 100644 --- a/arch/arm/mach-ep93xx/vision_ep9307.c +++ b/arch/arm/mach-ep93xx/vision_ep9307.c @@ -242,7 +242,7 @@ static struct spi_board_info vision_spi_board_info[] __initdata = { }; static struct gpiod_lookup_table vision_spi_cs_gpio_table = { - .dev_id = "ep93xx-spi.0", + .dev_id = "spi0", .table = { GPIO_LOOKUP_IDX("A", 6, "cs", 0, GPIO_ACTIVE_LOW), GPIO_LOOKUP_IDX("A", 7, "cs", 1, GPIO_ACTIVE_LOW), -- 2.21.0

5 years, 1 month

4
3
0 0

[PATCH V2] x86/boot: Fix regression--secure boot info loss from bootparam sanitizing

by John S Gruber

From: "John S. Gruber" <JohnSGruber(a)gmail.com> commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") now zeros the secure boot information passed by the boot loader or by the kernel's efi handover mechanism. Include boot-params.secure_boot in the preserve field list. I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6 with signed kernels using the efi handoff protocol with grub. The kernel log message "Secure boot enabled" becomes "Secure boot could not be determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets this field early but it is subsequently zeroed by the above referenced commit in the file arch/x86/include/asm/bootparam_utils.h Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com> --- Adjusted the patch for John Hubbard's comments. arch/x86/include/asm/bootparam_utils.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h index 9e5f3c7..981fe92 100644 --- a/arch/x86/include/asm/bootparam_utils.h +++ b/arch/x86/include/asm/bootparam_utils.h @@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params *boot_params) BOOT_PARAM_PRESERVE(eddbuf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), + BOOT_PARAM_PRESERVE(secure_boot), BOOT_PARAM_PRESERVE(hdr), BOOT_PARAM_PRESERVE(e820_table), BOOT_PARAM_PRESERVE(eddbuf), -- 2.7.4

5 years, 1 month

3
2
0 0

[PATCH v2] power: supply: sbs-battery: use correct flags field

by Michael Nosthoff

the type flag is stored in the chip->flags field not in the client->flags field. This currently leads to never using the ti specific health function as client->flags doesn't use that bit. So it's always falling back to the general one. Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume MANUFACTURER_DATA formats") Signed-off-by: Michael Nosthoff <committed(a)heine.so> Reviewed-by: Brian Norris <briannorris(a)chromium.org> Cc: <stable(a)vger.kernel.org> --- Changes since v1: * Changed comment according to Brian's suggestions * Added Fixes tag * Added reviewed and cc stable drivers/power/supply/sbs-battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c index 048d205d7074..2e86cc1e0e35 100644 --- a/drivers/power/supply/sbs-battery.c +++ b/drivers/power/supply/sbs-battery.c @@ -620,7 +620,7 @@ static int sbs_get_property(struct power_supply *psy, switch (psp) { case POWER_SUPPLY_PROP_PRESENT: case POWER_SUPPLY_PROP_HEALTH: - if (client->flags & SBS_FLAGS_TI_BQ20Z75) + if (chip->flags & SBS_FLAGS_TI_BQ20Z75) ret = sbs_get_ti_battery_presence_and_health(client, psp, val); else -- 2.20.1

5 years, 1 month

3
2
0 0

[PATCH] power: supply: sbs-battery: only return health when battery present

by Michael Nosthoff

when the battery is set to sbs-mode and no gpio detection is enabled "health" is always returning a value even when the battery is not present. All other fields return "not present". This leads to a scenario where the driver is constantly switching between "present" and "not present" state. This generates a lot of constant traffic on the i2c. This commit changes the response of "health" to an error when the battery is not responding leading to a consistent "not present" state. Fixes: 76b16f4cdfb8 ("power: supply: sbs-battery: don't assume MANUFACTURER_DATA formats") Signed-off-by: Michael Nosthoff <committed(a)heine.so> Cc: Brian Norris <briannorris(a)chromium.org> Cc: <stable(a)vger.kernel.org> --- drivers/power/supply/sbs-battery.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c index 2e86cc1e0e35..f8d74e9f7931 100644 --- a/drivers/power/supply/sbs-battery.c +++ b/drivers/power/supply/sbs-battery.c @@ -314,17 +314,22 @@ static int sbs_get_battery_presence_and_health( { int ret; - if (psp == POWER_SUPPLY_PROP_PRESENT) { - /* Dummy command; if it succeeds, battery is present. */ - ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr); - if (ret < 0) - val->intval = 0; /* battery disconnected */ - else - val->intval = 1; /* battery present */ - } else { /* POWER_SUPPLY_PROP_HEALTH */ + /* Dummy command; if it succeeds, battery is present. */ + ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr); + + if (ret < 0) { /* battery not present*/ + if (psp == POWER_SUPPLY_PROP_PRESENT) { + val->intval = 0; + return 0; + } + return ret; + } + + if (psp == POWER_SUPPLY_PROP_PRESENT) + val->intval = 1; /* battery present */ + else /* POWER_SUPPLY_PROP_HEALTH */ /* SBS spec doesn't have a general health command. */ val->intval = POWER_SUPPLY_HEALTH_UNKNOWN; - } return 0; } @@ -626,6 +631,8 @@ static int sbs_get_property(struct power_supply *psy, else ret = sbs_get_battery_presence_and_health(client, psp, val); + + /* this can only be true if no gpio is used */ if (psp == POWER_SUPPLY_PROP_PRESENT) return 0; break; -- 2.20.1

5 years, 1 month

3
5
0 0

[PATCH 2/2] Fix a stack buffer overflow bug in check_input_term

by Hui Peng

`check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). CVE: CVE-2018-15118 Reported-by: Hui Peng <benquike(a)gmail.com> Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Signed-off-by: Hui Peng <benquike(a)gmail.com> --- sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 10ddec76f906..e24572fd6e30 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -81,6 +81,7 @@ struct mixer_build { unsigned char *buffer; unsigned int buflen; DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); struct usb_audio_term oterm; const struct usbmix_name_map *map; const struct usbmix_selector_map *selector_map; @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm * parse the source unit recursively until it reaches to a terminal * or a branched unit. */ -static int check_input_term(struct mixer_build *state, int id, +static int __check_input_term(struct mixer_build *state, int id, struct usb_audio_term *term) { int err; void *p1; + unsigned char *hdr; memset(term, 0, sizeof(*term)); - while ((p1 = find_audio_control_unit(state, id)) != NULL) { - unsigned char *hdr = p1; + for (;;) { + /* a loop in the terminal chain? */ + if (test_and_set_bit(id, state->termbitmap)) + return -EINVAL; + + p1 = find_audio_control_unit(state, id); + if (!p1) + break; + + hdr = p1; term->id = id; switch (hdr[2]) { case UAC_INPUT_TERMINAL: @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, /* call recursively to verify that the * referenced clock entity is valid */ - err = check_input_term(state, d->bCSourceID, term); + err = __check_input_term(state, d->bCSourceID, term); if (err < 0) return err; @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, case UAC2_CLOCK_SELECTOR: { struct uac_selector_unit_descriptor *d = p1; /* call recursively to retrieve the channel info */ - err = check_input_term(state, d->baSourceID[0], term); + err = __check_input_term(state, d->baSourceID[0], term); if (err < 0) return err; term->type = d->bDescriptorSubtype << 16; /* virtual type */ @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, return -ENODEV; } + +static int check_input_term(struct mixer_build *state, int id, + struct usb_audio_term *term) +{ + memset(term, 0, sizeof(*term)); + memset(state->termbitmap, 0, sizeof(state->termbitmap)); + return __check_input_term(state, id, term); +} + /* * Feature Unit */ -- 2.17.1

5 years, 1 month

2
2
0 0

[PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit

by Hui Peng

The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`). If a descriptor read from the device side is invalid, it may trigger out-of-bound memory access. ``` struct uac_mixer_unit_descriptor { __u8 bLength; __u8 bDescriptorType; __u8 bDescriptorSubtype; __u8 bUnitID; __u8 bNrInPins; __u8 baSourceID[]; } ``` This patch fixes the bug by add a sanity check on the length of the descriptor. CVE: CVE-2018-15117 Reported-by: Hui Peng <benquike(a)gmail.com> Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Signed-off-by: Hui Peng <benquike(a)gmail.com> --- sound/usb/mixer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 1f7eb3816cd7..10ddec76f906 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1628,6 +1628,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, int pin, ich, err; if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) || + desc->bLength < sizeof(*desc) + desc->bNrInPins || !(num_outs = uac_mixer_unit_bNrChannels(desc))) { usb_audio_err(state->chip, "invalid MIXER UNIT descriptor %d\n", -- 2.17.1

5 years, 1 month

2
2
0 0

Re: [PATCH] x86/boot: Fix regression--secure boot info loss from bootparam sanitizing

by John Hubbard

On 9/1/19 8:38 AM, John S Gruber wrote: > From: "John S. Gruber" <JohnSGruber(a)gmail.com> > > commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything > else") now zeros the secure boot information passed by the boot loader or > by the kernel's efi handover mechanism. > > Include boot-params.secure_boot in the preserve field list. > > Signed-off-by: John S. Gruber <JohnSGruber(a)gmail.com> > --- > > I noted a change in my computers between running signed 5.3-rc4 and 5.3-rc6 > with signed kernels using the efi handoff protocol with grub. The kernel > log message "Secure boot enabled" becomes "Secure boot could not be > determined". The efi_main function in arch/x86/boot/compressed/eboot.c sets > this field early but it is subsequently zeroed by the above referenced commit > in the file arch/x86/include/asm/bootparam_utils.h > > Applies to 5.3-rc6. > Hi, The fix itself looks good, so you can add: Reviewed-by: John Hubbard <jhubbard(a)nvidia.com> ...but note that the commit description should get a few tweaks: 1. Your description above is actually well-suited for the commit log, so please add that in. Especially the symptoms are desirable to have on record. 2. This should Cc: stable(a)vger.kernel.org, because the whole thing made it into -stable and those kernels need this fix. 3. Also need a Fixes tag: Fixes: commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else") thanks, -- John Hubbard NVIDIA > arch/x86/include/asm/bootparam_utils.h | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/arch/x86/include/asm/bootparam_utils.h > b/arch/x86/include/asm/bootparam_utils.h > index 9e5f3c7..981fe92 100644 > --- a/arch/x86/include/asm/bootparam_utils.h > +++ b/arch/x86/include/asm/bootparam_utils.h > @@ -70,6 +70,7 @@ static void sanitize_boot_params(struct boot_params > *boot_params) > BOOT_PARAM_PRESERVE(eddbuf_entries), > BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), > BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), > + BOOT_PARAM_PRESERVE(secure_boot), > BOOT_PARAM_PRESERVE(hdr), > BOOT_PARAM_PRESERVE(e820_table), > BOOT_PARAM_PRESERVE(eddbuf), >

5 years, 1 month

1
0
0 0

[PATCH 4.14 00/33] 4.14.138-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.138 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat 10 Aug 2019 07:03:19 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.138-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.138-rc1 Lukas Wunner <lukas(a)wunner.de> spi: bcm2835: Fix 3-wire mode if DMA is enabled Tejun Heo <tj(a)kernel.org> cgroup: Fix css_task_iter_advance_css_set() cset skip condition Tejun Heo <tj(a)kernel.org> cgroup: css_task_iter_skip()'d iterators must be advanced before accessed Tejun Heo <tj(a)kernel.org> cgroup: Include dying leaders with live threads in PROCS iterations Tejun Heo <tj(a)kernel.org> cgroup: Implement css_task_iter_skip() Tejun Heo <tj(a)kernel.org> cgroup: Call cgroup_release() before __exit_signal() Sudarsana Reddy Kalluru <skalluru(a)marvell.com> bnx2x: Disable multi-cos feature. Matteo Croce <mcroce(a)redhat.com> mvpp2: refactor MTU change code Alexis Bauvin <abauvin(a)scaleway.com> tun: mark small packets as owned by the tap sock Ariel Levkovich <lariel(a)mellanox.com> net/mlx5e: Prevent encap flow counter update async to user query Arnd Bergmann <arnd(a)arndb.de> compat_ioctl: pppoe: fix PPPOEIOCSFWD handling Taras Kondratiuk <takondra(a)cisco.com> tipc: compat: allow tipc commands without arguments Johan Hovold <johan(a)kernel.org> NFC: nfcmrvl: fix gpio-handling regression Jia-Ju Bai <baijiaju1990(a)gmail.com> net: sched: Fix a possible null-pointer dereference in dequeue_func() René van Dorst <opensource(a)vdorst.com> net: phylink: Fix flow control for fixed-link Mark Zhang <markz(a)mellanox.com> net/mlx5: Use reversed order when unregister devices Jiri Pirko <jiri(a)mellanox.com> net: fix ifindex collision during namespace removal Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: mcast: don't delete permanent entries when fast leave is enabled Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: delete local fdb on device init failure Haishuang Yan <yanhaishuang(a)cmss.chinamobile.com> ip6_tunnel: fix possible use-after-free on xmit Cong Wang <xiyou.wangcong(a)gmail.com> ife: error out when nla attributes are empty Gustavo A. R. Silva <gustavo(a)embeddedor.com> atm: iphase: Fix Spectre v1 vulnerability Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Add rewind_stack_do_exit() to the noreturn list Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Add machine_real_restart() to the noreturn list Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> IB: directly cast the sockaddr union to aockaddr Jason Gunthorpe <jgg(a)mellanox.com> RDMA: Directly cast the sockaddr union to sockaddr Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for HP X1200 PIXART OEM mouse Aaron Armstrong Skomra <skomra(a)gmail.com> HID: wacom: fix bit shift for Cintiq Companion 2 Will Deacon <will(a)kernel.org> arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} Eric Dumazet <edumazet(a)google.com> tcp: be more careful in tcp_fragment() Adam Ford <aford173(a)gmail.com> ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo Adam Ford <aford173(a)gmail.com> ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV Hannes Reinecke <hare(a)suse.de> scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/logicpd-som-lv.dtsi | 16 ++++ arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 16 ++++ arch/arm64/include/asm/cpufeature.h | 7 +- arch/arm64/kernel/cpufeature.c | 8 +- drivers/atm/iphase.c | 8 +- drivers/hid/hid-ids.h | 1 + drivers/hid/usbhid/hid-quirks.c | 1 + drivers/hid/wacom_wac.c | 12 +-- drivers/infiniband/core/addr.c | 15 ++- drivers/infiniband/core/sa_query.c | 10 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 5 +- drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 5 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 2 +- drivers/net/ethernet/marvell/mvpp2.c | 41 +++----- drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- .../net/ethernet/mellanox/mlx5/core/fs_counters.c | 5 + drivers/net/phy/phylink.c | 2 + drivers/net/ppp/pppoe.c | 3 + drivers/net/ppp/pppox.c | 13 +++ drivers/net/ppp/pptp.c | 3 + drivers/net/tun.c | 1 + drivers/nfc/nfcmrvl/main.c | 4 +- drivers/nfc/nfcmrvl/uart.c | 4 +- drivers/nfc/nfcmrvl/usb.c | 1 + drivers/scsi/fcoe/fcoe_ctlr.c | 51 ++++------ drivers/scsi/libfc/fc_rport.c | 5 +- drivers/spi/spi-bcm2835.c | 3 +- fs/compat_ioctl.c | 3 - include/linux/cgroup-defs.h | 1 + include/linux/cgroup.h | 4 + include/linux/if_pppox.h | 3 + include/linux/mlx5/fs.h | 1 + include/net/tcp.h | 17 ++++ include/scsi/libfcoe.h | 1 + kernel/cgroup/cgroup.c | 106 +++++++++++++++------ kernel/exit.c | 2 +- net/bridge/br_multicast.c | 3 + net/bridge/br_vlan.c | 5 + net/core/dev.c | 2 + net/ipv4/tcp_output.c | 11 ++- net/ipv6/ip6_tunnel.c | 6 +- net/l2tp/l2tp_ppp.c | 3 + net/sched/act_ife.c | 3 + net/sched/sch_codel.c | 6 +- net/tipc/netlink_compat.c | 11 ++- tools/objtool/check.c | 2 + 48 files changed, 293 insertions(+), 149 deletions(-)

5 years, 1 month

11
49
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2019