This is the start of the stable review cycle for the 4.14.253 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.253-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.253-rc1
Nick Desaulniers <ndesaulniers(a)google.com>
ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Have all levels of checks prevent recursion
Yanfei Xu <yanfei.xu(a)windriver.com>
net: mdiobus: Fix memory leak in __mdiobus_register
Oliver Neukum <oneukum(a)suse.com>
usbnet: sanity check for maxpacket
Dexuan Cui <decui(a)microsoft.com>
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: avoid write to STATESTS if controller is in reset
Prashant Malani <pmalani(a)chromium.org>
platform/x86: intel_scu_ipc: Update timeout value in comment
Zheyu Ma <zheyuma97(a)gmail.com>
isdn: mISDN: Fix sleeping function called from invalid context
Herve Codina <herve.codina(a)bootlin.com>
ARM: dts: spear3xx: Fix gmac node
Herve Codina <herve.codina(a)bootlin.com>
net: stmmac: add support for dwmac 3.40a
Filipe Manana <fdmanana(a)suse.com>
btrfs: deal with errors when checking if a dir entry exists during log replay
Vegard Nossum <vegard.nossum(a)gmail.com>
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
Xiaolong Huang <butterflyhuangxx(a)gmail.com>
isdn: cpai: check ctr->cnr to avoid array index out of bound
Lin Ma <linma(a)zju.edu.cn>
nfc: nci: fix the UAF of rf_conn_info object
Takashi Iwai <tiwai(a)suse.de>
ASoC: DAPM: Fix missing kctl change notifications
Brendan Grieve <brendan(a)grieve.com.au>
ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
Matthew Wilcox (Oracle) <willy(a)infradead.org>
vfs: check fd has read access in kernel_read_file_from_fd()
Lukas Bulwahn <lukas.bulwahn(a)gmail.com>
elfcore: correct reference to CONFIG_UML
Valentin Vidic <vvidic(a)valentin-vidic.from.hr>
ocfs2: mount fails with buffer overflow in strlen
Jan Kara <jack(a)suse.cz>
ocfs2: fix data corruption after conversion from inline format
Zheyu Ma <zheyuma97(a)gmail.com>
can: peak_pci: peak_pci_remove(): fix UAF
Stephane Grosjean <s.grosjean(a)peak-system.com>
can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
can: rcar_can: fix suspend/resume
Randy Dunlap <rdunlap(a)infradead.org>
NIOS2: irqflags: rename a redefined register name
Antoine Tenart <atenart(a)kernel.org>
netfilter: ipvs: make global sysctl readonly in non-init netns
Benjamin Coddington <bcodding(a)redhat.com>
NFSD: Keep existing listeners on portlist error
Guenter Roeck <linux(a)roeck-us.net>
xtensa: xtfpga: Try software restart before simulating CPU reset
Max Filippov <jcmvbkbc(a)gmail.com>
xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
Eugen Hristev <eugen.hristev(a)microchip.com>
ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
Josef Bacik <jbacik(a)fb.com>
btrfs: always wait on ordered extents at fsync time
-------------
Diffstat:
Makefile | 4 +-
arch/arm/Kconfig | 1 +
arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 1 -
arch/arm/boot/dts/spear3xx.dtsi | 2 +-
arch/nios2/include/asm/irqflags.h | 4 +-
arch/nios2/include/asm/registers.h | 2 +-
arch/xtensa/platforms/xtfpga/setup.c | 12 ++--
drivers/isdn/capi/kcapi.c | 5 ++
drivers/isdn/hardware/mISDN/netjet.c | 2 +-
drivers/net/can/rcar/rcar_can.c | 20 ++++---
drivers/net/can/sja1000/peak_pci.c | 9 ++-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 5 +-
.../net/ethernet/stmicro/stmmac/dwmac-generic.c | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 +++
drivers/net/phy/mdio_bus.c | 1 +
drivers/net/usb/usbnet.c | 4 ++
drivers/platform/x86/intel_scu_ipc.c | 2 +-
drivers/scsi/hosts.c | 3 +-
fs/btrfs/file.c | 56 ++-----------------
fs/btrfs/tree-log.c | 47 ++++++++++------
fs/exec.c | 2 +-
fs/nfsd/nfsctl.c | 5 +-
fs/ocfs2/alloc.c | 46 ++++------------
fs/ocfs2/super.c | 14 +++--
include/linux/elfcore.h | 2 +-
kernel/trace/ftrace.c | 4 +-
kernel/trace/trace.h | 64 +++++++---------------
kernel/trace/trace_functions.c | 2 +-
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ctl.c | 5 ++
net/nfc/nci/rsp.c | 2 +
sound/hda/hdac_controller.c | 5 +-
sound/soc/soc-dapm.c | 13 +++--
sound/usb/quirks-table.h | 32 +++++++++++
34 files changed, 191 insertions(+), 196 deletions(-)
This is the start of the stable review cycle for the 4.9.288 release.
There are 50 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.288-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.288-rc1
Nick Desaulniers <ndesaulniers(a)google.com>
ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Have all levels of checks prevent recursion
Yanfei Xu <yanfei.xu(a)windriver.com>
net: mdiobus: Fix memory leak in __mdiobus_register
Oliver Neukum <oneukum(a)suse.com>
usbnet: sanity check for maxpacket
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: avoid write to STATESTS if controller is in reset
Prashant Malani <pmalani(a)chromium.org>
platform/x86: intel_scu_ipc: Update timeout value in comment
Zheyu Ma <zheyuma97(a)gmail.com>
isdn: mISDN: Fix sleeping function called from invalid context
Herve Codina <herve.codina(a)bootlin.com>
ARM: dts: spear3xx: Fix gmac node
Vegard Nossum <vegard.nossum(a)gmail.com>
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
Xiaolong Huang <butterflyhuangxx(a)gmail.com>
isdn: cpai: check ctr->cnr to avoid array index out of bound
Lin Ma <linma(a)zju.edu.cn>
nfc: nci: fix the UAF of rf_conn_info object
Takashi Iwai <tiwai(a)suse.de>
ASoC: DAPM: Fix missing kctl change notifications
Brendan Grieve <brendan(a)grieve.com.au>
ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
Matthew Wilcox (Oracle) <willy(a)infradead.org>
vfs: check fd has read access in kernel_read_file_from_fd()
Lukas Bulwahn <lukas.bulwahn(a)gmail.com>
elfcore: correct reference to CONFIG_UML
Valentin Vidic <vvidic(a)valentin-vidic.from.hr>
ocfs2: mount fails with buffer overflow in strlen
Jan Kara <jack(a)suse.cz>
ocfs2: fix data corruption after conversion from inline format
Zheyu Ma <zheyuma97(a)gmail.com>
can: peak_pci: peak_pci_remove(): fix UAF
Stephane Grosjean <s.grosjean(a)peak-system.com>
can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com>
can: rcar_can: fix suspend/resume
Randy Dunlap <rdunlap(a)infradead.org>
NIOS2: irqflags: rename a redefined register name
Antoine Tenart <atenart(a)kernel.org>
netfilter: ipvs: make global sysctl readonly in non-init netns
Benjamin Coddington <bcodding(a)redhat.com>
NFSD: Keep existing listeners on portlist error
Guenter Roeck <linux(a)roeck-us.net>
xtensa: xtfpga: Try software restart before simulating CPU reset
Max Filippov <jcmvbkbc(a)gmail.com>
xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
Vegard Nossum <vegard.nossum(a)oracle.com>
r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
Dan Carpenter <dan.carpenter(a)oracle.com>
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
Colin Ian King <colin.king(a)canonical.com>
drm/msm: Fix null pointer dereference on pointer edp
Dan Carpenter <dan.carpenter(a)oracle.com>
pata_legacy: fix a couple uninitialized variable bugs
Ziyang Xuan <william.xuanziyang(a)huawei.com>
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
Ziyang Xuan <william.xuanziyang(a)huawei.com>
NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
Ziyang Xuan <william.xuanziyang(a)huawei.com>
nfc: fix error handling of nfc_proto_register()
Arnd Bergmann <arnd(a)arndb.de>
ethernet: s2io: fix setting mac address during resume
Nanyong Sun <sunnanyong(a)huawei.com>
net: encx24j600: check error in devm_regmap_init_encx24j600
Vegard Nossum <vegard.nossum(a)oracle.com>
net: korina: select CRC32
Vegard Nossum <vegard.nossum(a)oracle.com>
net: arc: select CRC32
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
Jiri Valek - 2N <valek(a)2n.cz>
iio: light: opt3001: Fixed timeout error when 0 lux
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
iio: adc128s052: Fix the error handling path of 'adc128_probe()'
Stephen Boyd <swboyd(a)chromium.org>
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
Daniele Palmas <dnlplm(a)gmail.com>
USB: serial: option: add Telit LE910Cx composition 0x1204
Aleksander Morgado <aleksander(a)aleksander.es>
USB: serial: qcserial: add EM9191 QDL support
Michael Cullen <michael(a)michaelcullen.name>
Input: xpad - add support for another USB ID of Nacon GC-100
Zhang Jianhua <chris.zjh(a)huawei.com>
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
Ard Biesheuvel <ardb(a)kernel.org>
efi/cper: use stack buffer for error record decoding
Arnd Bergmann <arnd(a)arndb.de>
cb710: avoid NULL pointer subtraction
Nikolay Martynov <mar.kolya(a)gmail.com>
xhci: Enable trust tx length quirk for Fresco FL11 USB controller
Roberto Sassu <roberto.sassu(a)huawei.com>
s390: fix strrchr() implementation
Takashi Iwai <tiwai(a)suse.de>
ALSA: seq: Fix a potential UAF by wrong private_free call order
-------------
Diffstat:
Makefile | 4 +-
arch/arm/Kconfig | 1 +
arch/arm/boot/dts/spear3xx.dtsi | 2 +-
arch/nios2/include/asm/irqflags.h | 4 +-
arch/nios2/include/asm/registers.h | 2 +-
arch/s390/lib/string.c | 15 +++--
arch/xtensa/platforms/xtfpga/setup.c | 12 ++--
drivers/ata/pata_legacy.c | 6 +-
drivers/firmware/efi/cper.c | 4 +-
drivers/firmware/efi/runtime-wrappers.c | 2 +-
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 +-
drivers/iio/adc/ti-adc128s052.c | 6 ++
drivers/iio/common/ssp_sensors/ssp_spi.c | 11 +++-
drivers/iio/light/opt3001.c | 6 +-
drivers/input/joystick/xpad.c | 2 +
drivers/isdn/capi/kcapi.c | 5 ++
drivers/isdn/hardware/mISDN/netjet.c | 2 +-
drivers/misc/cb710/sgbuf2.c | 2 +-
drivers/net/can/rcar/rcar_can.c | 20 ++++---
drivers/net/can/sja1000/peak_pci.c | 9 ++-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 5 +-
drivers/net/ethernet/Kconfig | 1 +
drivers/net/ethernet/arc/Kconfig | 1 +
drivers/net/ethernet/microchip/encx24j600-regmap.c | 10 +++-
drivers/net/ethernet/microchip/encx24j600.c | 5 +-
drivers/net/ethernet/microchip/encx24j600_hw.h | 4 +-
drivers/net/ethernet/neterion/s2io.c | 2 +-
drivers/net/phy/mdio_bus.c | 1 +
drivers/net/usb/Kconfig | 4 ++
drivers/net/usb/usbnet.c | 4 ++
drivers/nvmem/core.c | 3 +-
drivers/platform/x86/intel_scu_ipc.c | 2 +-
drivers/usb/host/xhci-pci.c | 2 +
drivers/usb/serial/option.c | 2 +
drivers/usb/serial/qcserial.c | 1 +
fs/exec.c | 2 +-
fs/nfsd/nfsctl.c | 5 +-
fs/ocfs2/alloc.c | 46 ++++------------
fs/ocfs2/super.c | 14 +++--
include/linux/elfcore.h | 2 +-
kernel/trace/ftrace.c | 4 +-
kernel/trace/trace.h | 64 +++++++---------------
kernel/trace/trace_functions.c | 2 +-
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ctl.c | 5 ++
net/nfc/af_nfc.c | 3 +
net/nfc/digital_core.c | 9 ++-
net/nfc/digital_technology.c | 8 ++-
net/nfc/nci/rsp.c | 2 +
sound/core/seq/seq_device.c | 8 +--
sound/hda/hdac_controller.c | 5 +-
sound/soc/soc-dapm.c | 13 +++--
sound/usb/quirks-table.h | 32 +++++++++++
54 files changed, 232 insertions(+), 161 deletions(-)
From: Paolo Bonzini <pbonzini(a)redhat.com>
[ Upstream commit fa13843d1565d4c5b3aeb9be3343b313416bef46 ]
If allocation of rmaps fails, but some of the pointers have already been written,
those pointers can be cleaned up when the memslot is freed, or even reused later
for another attempt at allocating the rmaps. Therefore there is no need to
WARN, as done for example in memslot_rmap_alloc, but the allocation *must* be
skipped lest KVM will overwrite the previous pointer and will indeed leak memory.
Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
arch/x86/kvm/x86.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 4b0e866e9f08..60d9aa0ab389 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11341,7 +11341,8 @@ static int memslot_rmap_alloc(struct kvm_memory_slot *slot,
int lpages = gfn_to_index(slot->base_gfn + npages - 1,
slot->base_gfn, level) + 1;
- WARN_ON(slot->arch.rmap[i]);
+ if (slot->arch.rmap[i])
+ continue;
slot->arch.rmap[i] = kvcalloc(lpages, sz, GFP_KERNEL_ACCOUNT);
if (!slot->arch.rmap[i]) {
--
2.33.0
While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush
cache) and disable cqe, for resume back, we enable CQE and not clear HALT
state.
In this case MediaTek mmc host controller will keep the value for HALT
state after CQE disable/enable flow, so the next CQE transfer after resume
will be timeout due to CQE is in HALT state, the log as below:
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP ===========
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps: 0x100020b6 | Version: 0x00000510
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config: 0x00001103 | Control: 0x00000001
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat: 0x00000000 | Int enab: 0x00000006
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig: 0x00000006 | Int Coal: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base: 0xfd05f000 | TDL up32: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell: 0x8000203c | TCN: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr: 0x00000000 | SSC1: 0x00001000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2: 0x00000001 | DCMD rsp: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask: 0xfdf9a080 | TERRI: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx: 0x00000000 | Resp arg: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP: 0x00000000 | CRNQDUN: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS: 0x00000000 | CRNQIE: 0x00000000
This change check HALT state after CQE enable, if CQE is in HALT state, we
will clear it.
Signed-off-by: Wenbin Mei <wenbin.mei(a)mediatek.com>
Cc: stable(a)vger.kernel.org
---
drivers/mmc/host/cqhci-core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mmc/host/cqhci-core.c b/drivers/mmc/host/cqhci-core.c
index ca8329d55f43..b0d30c35c390 100644
--- a/drivers/mmc/host/cqhci-core.c
+++ b/drivers/mmc/host/cqhci-core.c
@@ -282,6 +282,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
+ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
+ cqhci_writel(cq_host, 0, CQHCI_CTL);
+
mmc->cqe_on = true;
if (cq_host->ops->enable)
--
2.25.1