This is the start of the stable review cycle for the 5.10.3 release.
There are 40 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 25 Dec 2020 15:05:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.3-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.3-rc1
Dae R. Jeong <dae.r.jeong(a)kaist.ac.kr>
md: fix a warning caused by a race between concurrent md_ioctl()s
Anant Thazhemadam <anant.thazhemadam(a)gmail.com>
nl80211: validate key indexes for cfg80211_registered_device
Eric Biggers <ebiggers(a)google.com>
crypto: af_alg - avoid undefined behavior accessing salg_name
Antti Palosaari <crope(a)iki.fi>
media: msi2500: assign SPI bus number dynamically
Anant Thazhemadam <anant.thazhemadam(a)gmail.com>
fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode()
Jan Kara <jack(a)suse.cz>
quota: Sanity-check quota file headers on load
Peilin Ye <yepeilin.cs(a)gmail.com>
Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
Eric Biggers <ebiggers(a)google.com>
f2fs: prevent creating duplicate encrypted filenames
Eric Biggers <ebiggers(a)google.com>
ext4: prevent creating duplicate encrypted filenames
Eric Biggers <ebiggers(a)google.com>
ubifs: prevent creating duplicate encrypted filenames
Eric Biggers <ebiggers(a)google.com>
fscrypt: add fscrypt_is_nokey_name()
Eric Biggers <ebiggers(a)google.com>
fscrypt: remove kernel-internal constants from UAPI header
Alexey Kardashevskiy <aik(a)ozlabs.ru>
serial_core: Check for port state when tty is in error state
Julian Sax <jsbc(a)gmx.de>
HID: i2c-hid: add Vero K147 to descriptor override
Arnd Bergmann <arnd(a)arndb.de>
scsi: megaraid_sas: Check user-provided offsets
Jack Qiu <jack.qiu(a)huawei.com>
f2fs: init dirty_secmap incorrectly
Chao Yu <chao(a)kernel.org>
f2fs: fix to seek incorrect data offset in inline data file
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: etm4x: Handle TRCVIPCSSCTLR accesses
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: etm4x: Fix accesses to TRCPROCSELR
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: etm4x: Fix accesses to TRCCIDCTLR1
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: etm4x: Fix accesses to TRCVMIDCTLR1
Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org>
coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up
Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org>
coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()
Suzuki K Poulose <suzuki.poulose(a)arm.com>
coresight: tmc-etr: Fix barrier packet insertion for perf buffer
Mao Jinlong <jinlmao(a)codeaurora.org>
coresight: tmc-etr: Check if page is valid before dma_map_page()
Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org>
coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
Krzysztof Kozlowski <krzk(a)kernel.org>
ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
Fabio Estevam <festevam(a)gmail.com>
usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
Will McVicker <willmcvicker(a)google.com>
USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
Jack Pham <jackp(a)codeaurora.org>
usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
Will McVicker <willmcvicker(a)google.com>
USB: gadget: f_midi: setup SuperSpeed Plus descriptors
taehyun.cho <taehyun.cho(a)samsung.com>
USB: gadget: f_acm: add support for SuperSpeed Plus
Johan Hovold <johan(a)kernel.org>
USB: serial: option: add interface-number sanity check to flag handling
Dan Carpenter <dan.carpenter(a)oracle.com>
usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
Nicolin Chen <nicoleotsuka(a)gmail.com>
soc/tegra: fuse: Fix index bug in get_process_id
Artem Labazov <123321artyom(a)gmail.com>
exfat: Avoid allocating upcase table using kcalloc()
Andi Kleen <ak(a)linux.intel.com>
x86/split-lock: Avoid returning with interrupts enabled
Thierry Reding <treding(a)nvidia.com>
net: ipconfig: Avoid spurious blank lines in boot log
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/exynos5410-odroidxu.dts | 6 ++-
arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++
arch/arm/boot/dts/exynos5410.dtsi | 4 ++
arch/x86/kernel/traps.c | 3 +-
crypto/af_alg.c | 10 +++--
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++
drivers/hwtracing/coresight/coresight-etb10.c | 4 +-
drivers/hwtracing/coresight/coresight-etm4x-core.c | 41 ++++++++++-------
drivers/hwtracing/coresight/coresight-priv.h | 2 +
drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 4 +-
drivers/md/md.c | 7 ++-
drivers/media/usb/msi2500/msi2500.c | 2 +-
drivers/scsi/megaraid/megaraid_sas_base.c | 16 ++++---
drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
drivers/tty/serial/serial_core.c | 4 ++
drivers/usb/chipidea/ci_hdrc_imx.c | 3 +-
drivers/usb/gadget/function/f_acm.c | 2 +-
drivers/usb/gadget/function/f_fs.c | 5 ++-
drivers/usb/gadget/function/f_midi.c | 6 +++
drivers/usb/gadget/function/f_rndis.c | 4 +-
drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
drivers/usb/serial/option.c | 23 +++++++++-
fs/crypto/fscrypt_private.h | 9 ++--
fs/crypto/hooks.c | 5 ++-
fs/crypto/keyring.c | 2 +-
fs/crypto/keysetup.c | 4 +-
fs/crypto/policy.c | 5 ++-
fs/exfat/nls.c | 6 +--
fs/ext4/namei.c | 3 ++
fs/f2fs/f2fs.h | 2 +
fs/f2fs/file.c | 11 +++--
fs/f2fs/segment.c | 2 +-
fs/quota/dquot.c | 2 +-
fs/quota/quota_v2.c | 19 ++++++++
fs/ubifs/dir.c | 17 ++++++--
include/linux/fscrypt.h | 34 +++++++++++++++
include/uapi/linux/fscrypt.h | 5 +--
include/uapi/linux/if_alg.h | 16 +++++++
net/bluetooth/hci_event.c | 12 +++--
net/ipv4/ipconfig.c | 14 +++---
net/wireless/core.h | 2 +
net/wireless/nl80211.c | 7 +--
net/wireless/util.c | 51 ++++++++++++++++++----
45 files changed, 334 insertions(+), 88 deletions(-)
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 89deb1334252ea4a8491d47654811e28b0790364 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Sun, 20 Sep 2020 12:27:37 +0100
Subject: [PATCH] iio:magnetometer:mag3110: Fix alignment and data leak issues.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.
The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.
Fixes: 39631b5f9584 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean(a)analog.com>
Cc: <Stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 838b13c8bb3d..c96415a1aead 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -56,6 +56,12 @@ struct mag3110_data {
int sleep_val;
struct regulator *vdd_reg;
struct regulator *vddio_reg;
+ /* Ensure natural alignment of timestamp */
+ struct {
+ __be16 channels[3];
+ u8 temperature;
+ s64 ts __aligned(8);
+ } scan;
};
static int mag3110_request(struct mag3110_data *data)
@@ -387,10 +393,9 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct mag3110_data *data = iio_priv(indio_dev);
- u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */
int ret;
- ret = mag3110_read(data, (__be16 *) buffer);
+ ret = mag3110_read(data, data->scan.channels);
if (ret < 0)
goto done;
@@ -399,10 +404,10 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
MAG3110_DIE_TEMP);
if (ret < 0)
goto done;
- buffer[6] = ret;
+ data->scan.temperature = ret;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
iio_get_time_ns(indio_dev));
done:
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 7b6b51234df6cd8b04fe736b0b89c25612d896b8 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Date: Sun, 20 Sep 2020 12:27:39 +0100
Subject: [PATCH] iio:imu:bmi160: Fix alignment and data leak issues
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable array in the iio_priv() data with alignment
explicitly requested. This data is allocated with kzalloc() so no
data can leak apart from previous readings.
In this driver, depending on which channels are enabled, the timestamp
can be in a number of locations. Hence we cannot use a structure
to specify the data layout without it being misleading.
Fixes: 77c4ad2d6a9b ("iio: imu: Add initial support for Bosch BMI160")
Reported-by: Lars-Peter Clausen <lars(a)metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean(a)analog.com>
Cc: Daniel Baluta <daniel.baluta(a)gmail.com>
Cc: Daniel Baluta <daniel.baluta(a)oss.nxp.com>
Cc: <Stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-6-jic23@kernel.org
diff --git a/drivers/iio/imu/bmi160/bmi160.h b/drivers/iio/imu/bmi160/bmi160.h
index a82e040bd109..32c2ea2d7112 100644
--- a/drivers/iio/imu/bmi160/bmi160.h
+++ b/drivers/iio/imu/bmi160/bmi160.h
@@ -10,6 +10,13 @@ struct bmi160_data {
struct iio_trigger *trig;
struct regulator_bulk_data supplies[2];
struct iio_mount_matrix orientation;
+ /*
+ * Ensure natural alignment for timestamp if present.
+ * Max length needed: 2 * 3 channels + 4 bytes padding + 8 byte ts.
+ * If fewer channels are enabled, less space may be needed, as
+ * long as the timestamp is still aligned to 8 bytes.
+ */
+ __le16 buf[12] __aligned(8);
};
extern const struct regmap_config bmi160_regmap_config;
diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
index c8e131c29043..290b5ef83f77 100644
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -427,8 +427,6 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p)
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct bmi160_data *data = iio_priv(indio_dev);
- __le16 buf[12];
- /* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
__le16 sample;
@@ -438,10 +436,10 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p)
&sample, sizeof(sample));
if (ret)
goto done;
- buf[j++] = sample;
+ data->buf[j++] = sample;
}
- iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp);
+ iio_push_to_buffers_with_timestamp(indio_dev, data->buf, pf->timestamp);
done:
iio_trigger_notify_done(indio_dev->trig);
return IRQ_HANDLED;