November 2021 - Linux-stable-mirror

[PATCH] ceph: fix up non-directory creation in SGID directories

by Christian Brauner

From: Christian Brauner <christian.brauner(a)ubuntu.com> Ceph always inherits the SGID bit if it is set on the parent inode, while the generic inode_init_owner does not do this in a few cases where it can create a possible security problem (cf. [1]). Update ceph to strip the SGID bit just as inode_init_owner would. This bug was detected by the mapped mount testsuite in [3]. The testsuite tests all core VFS functionality and semantics with and without mapped mounts. That is to say it functions as a generic VFS testsuite in addition to a mapped mount testsuite. While working on mapped mount support for ceph, SIGD inheritance was the only failing test for ceph after the port. The same bug was detected by the mapped mount testsuite in XFS in January 2021 (cf. [2]). [1]: commit 0fa3ecd87848 ("Fix up non-directory creation in SGID directories") [2]: commit 01ea173e103e ("xfs: fix up non-directory creation in SGID directories") [3]: https://git.kernel.org/fs/xfs/xfstests-dev.git Cc: Ilya Dryomov <idryomov(a)gmail.com> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Jeff Layton <jlayton(a)kernel.org> Cc: ceph-devel(a)vger.kernel.org CC: linux-fsdevel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner <christian.brauner(a)ubuntu.com> --- The test used for this is [3]: /* The following tests are concerned with setgid inheritance. These can be * filesystem type specific. For xfs, if a new file or directory is created * within a setgid directory and irix_sgid_inhiert is set then inherit the * setgid bit if the caller is in the group of the directory. */ static int setgid_create(void) { int fret = -1; int file1_fd = -EBADF; pid_t pid; if (!caps_supported()) return 0; if (fchmod(t_dir1_fd, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH | S_IXUSR | S_IXGRP | S_IXOTH | S_ISGID), 0) { log_stderr("failure: fchmod"); goto out; } /* Verify that the setgid bit got raised. */ if (!is_setgid(t_dir1_fd, "", AT_EMPTY_PATH)) { log_stderr("failure: is_setgid"); goto out; } pid = fork(); if (pid < 0) { log_stderr("failure: fork"); goto out; } if (pid == 0) { /* create regular file via open() */ file1_fd = openat(t_dir1_fd, FILE1, O_CREAT | O_EXCL | O_CLOEXEC, S_IXGRP | S_ISGID); if (file1_fd < 0) die("failure: create"); /* We're capable_wrt_inode_uidgid() and also our fsgid matches * the directories gid. */ if (!is_setgid(t_dir1_fd, FILE1, 0)) die("failure: is_setgid"); /* create directory */ if (mkdirat(t_dir1_fd, DIR1, 0000)) die("failure: create"); /* Directories always inherit the setgid bit. */ if (!is_setgid(t_dir1_fd, DIR1, 0)) die("failure: is_setgid"); if (unlinkat(t_dir1_fd, FILE1, 0)) die("failure: delete"); if (unlinkat(t_dir1_fd, DIR1, AT_REMOVEDIR)) die("failure: delete"); exit(EXIT_SUCCESS); } if (wait_for_pid(pid)) goto out; pid = fork(); if (pid < 0) { log_stderr("failure: fork"); goto out; } if (pid == 0) { if (!switch_ids(0, 10000)) die("failure: switch_ids"); if (!caps_down()) die("failure: caps_down"); /* create regular file via open() */ file1_fd = openat(t_dir1_fd, FILE1, O_CREAT | O_EXCL | O_CLOEXEC, S_IXGRP | S_ISGID); if (file1_fd < 0) die("failure: create"); /* Neither in_group_p() nor capable_wrt_inode_uidgid() so setgid * bit needs to be stripped. */ if (is_setgid(t_dir1_fd, FILE1, 0)) die("failure: is_setgid"); /* create directory */ if (mkdirat(t_dir1_fd, DIR1, 0000)) die("failure: create"); if (xfs_irix_sgid_inherit_enabled()) { /* We're not in_group_p(). */ if (is_setgid(t_dir1_fd, DIR1, 0)) die("failure: is_setgid"); } else { /* Directories always inherit the setgid bit. */ if (!is_setgid(t_dir1_fd, DIR1, 0)) die("failure: is_setgid"); } exit(EXIT_SUCCESS); } if (wait_for_pid(pid)) goto out; fret = 0; log_debug("Ran test"); out: safe_close(file1_fd); return fret; } --- fs/ceph/file.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 02a0a0fd9ccd..d9236b2c7a43 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -605,13 +605,25 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry, in.cap.realm = cpu_to_le64(ci->i_snap_realm->ino); in.cap.flags = CEPH_CAP_FLAG_AUTH; in.ctime = in.mtime = in.atime = iinfo.btime; - in.mode = cpu_to_le32((u32)mode); in.truncate_seq = cpu_to_le32(1); in.truncate_size = cpu_to_le64(-1ULL); in.xattr_version = cpu_to_le64(1); in.uid = cpu_to_le32(from_kuid(&init_user_ns, current_fsuid())); - in.gid = cpu_to_le32(from_kgid(&init_user_ns, dir->i_mode & S_ISGID ? - dir->i_gid : current_fsgid())); + if (dir->i_mode & S_ISGID) { + in.gid = from_kgid(&init_user_ns, dir->i_gid); + + /* Directories always inherit the setgid bit. */ + if (S_ISDIR(mode)) + mode |= S_ISGID; + else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && + !in_group_p(dir->i_gid) && + !capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID)) + mode &= ~S_ISGID; + } else { + in.gid = from_kgid(&init_user_ns, current_fsgid()); + } + in.mode = cpu_to_le32((u32)mode); + in.nlink = cpu_to_le32(1); in.max_size = cpu_to_le64(lo->stripe_unit); base-commit: 136057256686de39cc3a07c2e39ef6bc43003ff6 -- 2.30.2

3 years, 1 month

1
0
0 0

[PATCH] net: dsa: realtek-smi: fix indirect reg access for ports>4

by luizluca＠gmail.com

From: Luiz Angelo Daros de Luca <luizluca(a)gmail.com> This switch family can have up to 8 ports {0..7}. However, INDIRECT_ACCESS_ADDRESS_PHYNUM_MASK was using 2 bits instead of 3, dropping the most significant bit during indirect register reads and writes. Reading or writing ports 5, 6, and 7 registers was actually manipulating, respectively, ports 0, 1, and 2 registers. rtl8365mb_phy_{read,write} will now returns -EINVAL if phy is greater than 7. Fixes: 4af2950c50c8 ("net: dsa: realtek-smi: add rtl8365mb subdriver for RTL8365MB-VC") Signed-off-by: Luiz Angelo Daros de Luca <luizluca(a)gmail.com> --- drivers/net/dsa/rtl8365mb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/rtl8365mb.c b/drivers/net/dsa/rtl8365mb.c index baaae97283c5..f4414ac74b61 100644 --- a/drivers/net/dsa/rtl8365mb.c +++ b/drivers/net/dsa/rtl8365mb.c @@ -107,6 +107,7 @@ #define RTL8365MB_LEARN_LIMIT_MAX_8365MB_VC 2112 /* Family-specific data and limits */ +#define RTL8365MB_PHYADDRMAX 7 #define RTL8365MB_NUM_PHYREGS 32 #define RTL8365MB_PHYREGMAX (RTL8365MB_NUM_PHYREGS - 1) #define RTL8365MB_MAX_NUM_PORTS (RTL8365MB_CPU_PORT_NUM_8365MB_VC + 1) @@ -176,7 +177,7 @@ #define RTL8365MB_INDIRECT_ACCESS_STATUS_REG 0x1F01 #define RTL8365MB_INDIRECT_ACCESS_ADDRESS_REG 0x1F02 #define RTL8365MB_INDIRECT_ACCESS_ADDRESS_OCPADR_5_1_MASK GENMASK(4, 0) -#define RTL8365MB_INDIRECT_ACCESS_ADDRESS_PHYNUM_MASK GENMASK(6, 5) +#define RTL8365MB_INDIRECT_ACCESS_ADDRESS_PHYNUM_MASK GENMASK(7, 5) #define RTL8365MB_INDIRECT_ACCESS_ADDRESS_OCPADR_9_6_MASK GENMASK(11, 8) #define RTL8365MB_PHY_BASE 0x2000 #define RTL8365MB_INDIRECT_ACCESS_WRITE_DATA_REG 0x1F03 @@ -679,6 +680,8 @@ static int rtl8365mb_phy_read(struct realtek_smi *smi, int phy, int regnum) u16 val; int ret; + if (phy > RTL8365MB_PHYADDRMAX) + return -EINVAL; if (regnum > RTL8365MB_PHYREGMAX) return -EINVAL; @@ -704,6 +707,8 @@ static int rtl8365mb_phy_write(struct realtek_smi *smi, int phy, int regnum, u32 ocp_addr; int ret; + if (phy > RTL8365MB_PHYADDRMAX) + return -EINVAL; if (regnum > RTL8365MB_PHYREGMAX) return -EINVAL; -- 2.33.1

3 years, 1 month

3
3
0 0

[PATCH 1/1] staging: ion: Prevent incorrect reference counting behavour

by Lee Jones

Supply additional checks in order to prevent unexpected results. Fixes: b892bf75b2034 ("ion: Switch ion to use dma-buf") Signed-off-by: Lee Jones <lee.jones(a)linaro.org> --- Should be back-ported from v4.9 and earlier. drivers/staging/android/ion/ion.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index 806e9b30b9dc8..402b74f5d7e69 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -29,6 +29,7 @@ #include <linux/export.h> #include <linux/mm.h> #include <linux/mm_types.h> +#include <linux/overflow.h> #include <linux/rbtree.h> #include <linux/slab.h> #include <linux/seq_file.h> @@ -509,6 +510,10 @@ static void *ion_handle_kmap_get(struct ion_handle *handle) void *vaddr; if (handle->kmap_cnt) { + if (check_add_overflow(handle->kmap_cnt, + (unsigned int) 1, &handle->kmap_cnt)) + return ERR_PTR(-EOVERFLOW); + handle->kmap_cnt++; return buffer->vaddr; } -- 2.34.0.rc2.393.gf8c9666880-goog

3 years, 1 month

3
10
0 0

[PATCH AUTOSEL 5.10 1/4] f2fs: set SBI_NEED_FSCK flag when inconsistent node block found

by Sasha Levin

From: Weichao Guo <guoweichao(a)oppo.com> [ Upstream commit 6663b138ded1a59e630c9e605e42aa7fde490cdc ] Inconsistent node block will cause a file fail to open or read, which could make the user process crashes or stucks. Let's mark SBI_NEED_FSCK flag to trigger a fix at next fsck time. After unlinking the corrupted file, the user process could regenerate a new one and work correctly. Signed-off-by: Weichao Guo <guoweichao(a)oppo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/f2fs/node.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 597a145c08ef5..7e625806bd4a2 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -1389,6 +1389,7 @@ static struct page *__get_node_page(struct f2fs_sb_info *sbi, pgoff_t nid, nid, nid_of_node(page), ino_of_node(page), ofs_of_node(page), cpver_of_node(page), next_blkaddr_of_node(page)); + set_sbi_flag(sbi, SBI_NEED_FSCK); err = -EINVAL; out_err: ClearPageUptodate(page); -- 2.33.0

3 years, 1 month

2
4
0 0

[PATCH 4.14 000/248] 4.14.256-rc3 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.256 release. There are 248 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Nov 2021 16:04:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.256-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.256-rc3 Dmitry Osipenko <digetx(a)gmail.com> soc/tegra: pmc: Fix imbalanced clock disabling in error code path Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> usb: max-3421: Use driver data instead of maintaining a list of bound devices Takashi Iwai <tiwai(a)suse.de> ASoC: DAPM: Cover regression by kctl change notification fix Leon Romanovsky <leonro(a)nvidia.com> RDMA/netlink: Add __maybe_unused to static inline in C file Sven Eckelmann <sven(a)narfation.org> batman-adv: Don't always reallocate the fragmentation skb head Sven Eckelmann <sven(a)narfation.org> batman-adv: Reserve needed_*room for fragments Sven Eckelmann <sven(a)narfation.org> batman-adv: Consider fragmentation for needed_headroom Linus Lüssing <linus.luessing(a)c0d3.blue> batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh Linus Lüssing <linus.luessing(a)c0d3.blue> batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN Greg Thelen <gthelen(a)google.com> perf/core: Avoid put_page() when GUP fails hongao <hongao(a)uniontech.com> drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors Johan Hovold <johan(a)kernel.org> drm/udl: fix control-message timeout Nguyen Dinh Phi <phind.uet(a)gmail.com> cfg80211: call cfg80211_stop_ap when switch from P2P_GO type Sven Schnelle <svens(a)stackframe.org> parisc/sticon: fix reverse colors Nikolay Borisov <nborisov(a)suse.com> btrfs: fix memory ordering between normal and ordered work functions Rustam Kovhaev <rkovhaev(a)gmail.com> mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag Nathan Chancellor <nathan(a)kernel.org> hexagon: export raw I/O routines for modules Nicolas Dichtel <nicolas.dichtel(a)6wind.com> tun: fix bonding active backup with arp monitoring Alexander Antonov <alexander.antonov(a)linux.intel.com> perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server Alexander Antonov <alexander.antonov(a)linux.intel.com> perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server Lin Ma <linma(a)zju.edu.cn> NFC: reorder the logic in nfc_{un,}register_device Lin Ma <linma(a)zju.edu.cn> NFC: reorganize the functions in nci_request Michal Maloszewski <michal.maloszewski(a)intel.com> i40e: Fix NULL ptr dereference on VSI filter sync Jonathan Davies <jonathan.davies(a)nutanix.com> net: virtio_net_hdr_to_skb: count transport header in UFO Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' Randy Dunlap <rdunlap(a)infradead.org> mips: lantiq: add support for clk_get_parent() Randy Dunlap <rdunlap(a)infradead.org> mips: bcm63xx: add support for clk_get_parent() Colin Ian King <colin.i.king(a)googlemail.com> MIPS: generic/yamon-dt: fix uninitialized variable error Surabhi Boob <surabhi.boob(a)intel.com> iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset Pavel Skripkin <paskripkin(a)gmail.com> net: bnx2x: fix variable dereferenced before check Vincent Donnefort <vincent.donnefort(a)arm.com> sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() Randy Dunlap <rdunlap(a)infradead.org> mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set Randy Dunlap <rdunlap(a)infradead.org> sh: define __BIG_ENDIAN for math-emu Randy Dunlap <rdunlap(a)infradead.org> sh: fix kconfig unmet dependency warning for FRAME_POINTER Lu Wei <luwei32(a)huawei.com> maple: fix wrong return value of maple_bus_init(). Nick Desaulniers <ndesaulniers(a)google.com> sh: check return code of request_irq Michael Ellerman <mpe(a)ellerman.id.au> powerpc/dcr: Use cmplwi instead of 3-argument cmpli Chengfeng Ye <cyeaa(a)connect.ust.hk> ALSA: gus: fix null pointer dereference on pointer block Anatolij Gustschin <agust(a)denx.de> powerpc/5200: dts: fix memory node unit name Mike Christie <michael.christie(a)oracle.com> scsi: target: Fix alua_tg_pt_gps_count tracking Mike Christie <michael.christie(a)oracle.com> scsi: target: Fix ordered tag handling Bart Van Assche <bvanassche(a)acm.org> MIPS: sni: Fix the build Guanghui Feng <guanghuifeng(a)linux.alibaba.com> tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Yang Yingliang <yangyingliang(a)huawei.com> usb: host: ohci-tmio: check return value after calling platform_get_resource() Roger Quadros <rogerq(a)kernel.org> ARM: dts: omap: fix gpmc,mux-add-data type Guo Zhi <qtxuning1999(a)sjtu.edu.cn> scsi: advansys: Fix kernel pointer leak Yang Yingliang <yangyingliang(a)huawei.com> usb: musb: tusb6010: check return value after calling platform_get_resource() James Smart <jsmart2021(a)gmail.com> scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Michal Simek <michal.simek(a)xilinx.com> arm64: zynqmp: Fix serial compatible string Thomas Gleixner <tglx(a)linutronix.de> PCI/MSI: Destroy sysfs before freeing entries Sven Schnelle <svens(a)stackframe.org> parisc/entry: fix trace test in syscall exit path Paul Burton <paulburton(a)google.com> tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT Shaoying Xu <shaoyi(a)amazon.com> ext4: fix lazy initialization next schedule time computation in more granular unit Pali Rohár <pali(a)kernel.org> PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros Vineeth Vijayan <vneethv(a)linux.ibm.com> s390/cio: check the subchannel validity for dev_busid Michal Hocko <mhocko(a)suse.com> mm, oom: do not trigger out_of_memory from the #PF Vasily Averin <vvs(a)virtuozzo.com> mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc/bpf: Validate branch ranges Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com> powerpc/lib: Add helper to check if offset is within conditional branch range Arnd Bergmann <arnd(a)arndb.de> ARM: 9156/1: drop cc-option fallbacks for architecture selection Michał Mirosław <mirq-linux(a)rere.qmqm.pl> ARM: 9155/1: fix early early_iounmap() Johan Hovold <johan(a)kernel.org> USB: chipidea: fix interrupt deadlock Eiichi Tsukata <eiichi.tsukata(a)nutanix.com> vsock: prevent unnecessary refcnt inc for nonblocking connect Chengfeng Ye <cyeaa(a)connect.ust.hk> nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Eric Dumazet <edumazet(a)google.com> llc: fix out-of-bound array index in llc_sk_dev_hash() Miaohe Lin <linmiaohe(a)huawei.com> mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() Huang Guobin <huangguobin4(a)huawei.com> bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed Hans de Goede <hdegoede(a)redhat.com> ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses Maxim Kiselev <bigunclemax(a)gmail.com> net: davinci_emac: Fix interrupt pacing disable YueHaibing <yuehaibing(a)huawei.com> xen-pciback: Fix return in pm_ctrl_init() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Turn off target reset during issue_lip Jackie Liu <liuyun01(a)kylinos.cn> ar7: fix kernel builds for compiler test Ahmad Fatoum <a.fatoum(a)pengutronix.de> watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT Randy Dunlap <rdunlap(a)infradead.org> m68k: set a default value for MEMORY_RESERVE Lars-Peter Clausen <lars(a)metafoo.de> dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: fix OOB when mac header was cleared Geert Uytterhoeven <geert(a)linux-m68k.org> auxdisplay: ht16k33: Fix frame buffer device blanking Geert Uytterhoeven <geert(a)linux-m68k.org> auxdisplay: ht16k33: Connect backlight to fbdev Geert Uytterhoeven <geert(a)linux-m68k.org> auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string Claudiu Beznea <claudiu.beznea(a)microchip.com> dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro Evgeny Novikov <novikov(a)ispras.ru> mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() Jia-Ju Bai <baijiaju1990(a)gmail.com> fs: orangefs: fix error return code of orangefs_revalidate_lookup() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Fix deadlocks in nfs_scan_commit_list() Marek Behún <kabel(a)kernel.org> PCI: aardvark: Don't spam about PIO Response Status Alex Xu (Hello71) <alex_y_xu(a)yahoo.ca> drm/plane-helper: fix uninitialized variable reference Baptiste Lepers <baptiste.lepers(a)gmail.com> pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds Arnaud Pouliquen <arnaud.pouliquen(a)foss.st.com> rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined Tom Rix <trix(a)redhat.com> apparmor: fix error check Hans de Goede <hdegoede(a)redhat.com> power: supply: bq27xxx: Fix kernel crash on IRQ handler register error Geert Uytterhoeven <geert+renesas(a)glider.be> mips: cm: Convert to bitfield API to fix out-of-bounds access Anssi Hannula <anssi.hannula(a)bitwise.fi> serial: xilinx_uartps: Fix race condition causing stuck TX Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs42l42: Correct some register default values Leon Romanovsky <leonro(a)nvidia.com> RDMA/mlx4: Return missed an error if device doesn't support steering Dan Carpenter <dan.carpenter(a)oracle.com> scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() Jakob Hauser <jahau(a)rocketmail.com> power: supply: rt5033_battery: Change voltage values to µV Dan Carpenter <dan.carpenter(a)oracle.com> usb: gadget: hid: fix error code in do_config() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_dw: Drop wrong use of ACPI_PTR() Christophe Leroy <christophe.leroy(a)csgroup.eu> video: fbdev: chipsfb: use memset_io() instead of memset() Dongliang Mu <mudongliangabcd(a)gmail.com> memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> soc/tegra: Fix an error handling path in tegra_powergate_power_up() Andreas Kemnade <andreas(a)kemnade.info> arm: dts: omap3-gta04a4: accelerometer irq fix Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Reduce udelay() at SKL+ position reporting Dongliang Mu <mudongliangabcd(a)gmail.com> JFS: fix memleak in jfs_mount Jackie Liu <liuyun01(a)kylinos.cn> MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT Tong Zhang <ztong0001(a)gmail.com> scsi: dc395: Fix error case unwinding Peter Rosin <peda(a)axentia.se> ARM: dts: at91: tse850: the emac<->phy interface is rmii Jackie Liu <liuyun01(a)kylinos.cn> ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() Junji Wei <weijunji(a)bytedance.com> RDMA/rxe: Fix wrong port_cap_flags Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: Process crqs after enabling interrupts Daniel Jordan <daniel.m.jordan(a)oracle.com> crypto: pcrypt - Delay write to padata->info Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: phylink: avoid mvneta warning when setting pause parameters Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> net: amd-xgbe: Toggle PLL settings during rate change Wang Hai <wanghai38(a)huawei.com> libertas: Fix possible memory leak in probe and disconnect Wang Hai <wanghai38(a)huawei.com> libertas_tf: Fix possible memory leak in probe and disconnect Tiezhu Yang <yangtiezhu(a)loongson.cn> samples/kretprobes: Fix return value if register_kretprobe() failed Mark Rutland <mark.rutland(a)arm.com> irq: mips: avoid nested irq_enter() David Hildenbrand <david(a)redhat.com> s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi Anders Roxell <anders.roxell(a)linaro.org> PM: hibernate: fix sparse warnings Stefan Agner <stefan(a)agner.ch> phy: micrel: ksz8041nl: do not use power down mode Jonas Dreßler <verdre(a)v0yd.nl> mwifiex: Send DELBA requests according to spec Nathan Chancellor <nathan(a)kernel.org> platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: mxs-mmc: disable regulator on error and in the remove function Jakub Kicinski <kuba(a)kernel.org> net: stream: don't purge sk_error_queue in sk_stream_kill_queues() Dan Carpenter <dan.carpenter(a)oracle.com> drm/msm: uninitialized variable in msm_gem_import() Sven Eckelmann <seckelmann(a)datto.com> ath10k: fix max antenna gain unit Yang Yingliang <yangyingliang(a)huawei.com> hwmon: Fix possible memleak in __hwmon_device_register() Dan Carpenter <dan.carpenter(a)oracle.com> memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() Arnd Bergmann <arnd(a)arndb.de> memstick: avoid out-of-range warning Dan Carpenter <dan.carpenter(a)oracle.com> b43: fix a lower bounds test Dan Carpenter <dan.carpenter(a)oracle.com> b43legacy: fix a lower bounds test Markus Schneider-Pargmann <msp(a)baylibre.com> hwrng: mtk - Force runtime pm ops for sleep ops Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - disregard spurious PFVF interrupts Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - detect PFVF collision after ACK Linus Lüssing <ll(a)simonwunderlich.de> ath9k: Fix potential interrupt storm on queue reset Anel Orazgaliyeva <anelkz(a)amazon.de> cpuidle: Fix kobject memory leaks in error paths Colin Ian King <colin.king(a)canonical.com> media: cx23885: Fix snd_card_free call on null card pointer Kees Cook <keescook(a)chromium.org> media: si470x: Avoid card name truncation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' Pavel Skripkin <paskripkin(a)gmail.com> media: dvb-usb: fix ununit-value in az6027_rc_query Waiman Long <longman(a)redhat.com> cgroup: Make rebind_subsystems() disable v2 controllers all at once Sven Schnelle <svens(a)stackframe.org> parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Helge Deller <deller(a)gmx.de> task_stack: Fix end_of_stack() for architectures with upwards-growing stack Sven Schnelle <svens(a)stackframe.org> parisc: fix warning in flush_tlb_all Yang Yingliang <yangyingliang(a)huawei.com> spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Arnd Bergmann <arnd(a)arndb.de> ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Stephen Suryaputra <ssuryaextr(a)gmail.com> gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Masami Hiramatsu <mhiramat(a)kernel.org> ARM: clang: Do not rely on lr register for stacktrace Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> smackfs: use __GFP_NOFAIL for smk_cipso_doi() Johannes Berg <johannes.berg(a)intel.com> iwlwifi: mvm: disable RX-diversity in powersave Ye Bin <yebin10(a)huawei.com> PM: hibernate: Get block device exclusively in swsusp_check() Zheyu Ma <zheyuma97(a)gmail.com> mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Kalesh Singh <kaleshsingh(a)google.com> tracing/cfi: Fix cmp_entries_* functions signature mismatch Lasse Collin <lasse.collin(a)tukaani.org> lib/xz: Validate the value before assigning it to an enum variable Lasse Collin <lasse.collin(a)tukaani.org> lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Zheyu Ma <zheyuma97(a)gmail.com> memstick: r592: Fix a UAF bug when removing the driver Kees Cook <keescook(a)chromium.org> leaking_addresses: Always print a trailing newline André Almeida <andrealmeid(a)collabora.com> ACPI: battery: Accept charges over the design capacity as full Tuo Li <islituo(a)gmail.com> ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Steven Rostedt (VMware) <rostedt(a)goodmis.org> tracefs: Have tracefs directories not set OTH permission bits by default Anant Thazhemadam <anant.thazhemadam(a)gmail.com> media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPICA: Avoid evaluating methods too early during system resume Randy Dunlap <rdunlap(a)infradead.org> ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Rajat Asthana <rajatasthana4(a)gmail.com> media: mceusb: return without resubmitting URB in case of -EPROTO error. Nadezda Lutovinova <lutovinova(a)ispras.ru> media: s5p-mfc: Add checking to s5p_mfc_probe(). Tuo Li <islituo(a)gmail.com> media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Set capability in s_param Zheyu Ma <zheyuma97(a)gmail.com> media: netup_unidvb: handle interrupt properly according to the firmware Dirk Bender <d.bender(a)phytec.de> media: mt9p031: Fix corrupted frame after restarting stream Jonas Dreßler <verdre(a)v0yd.nl> mwifiex: Properly initialize private structure on interface type changes Jonas Dreßler <verdre(a)v0yd.nl> mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Peter Zijlstra <peterz(a)infradead.org> x86: Increase exception stack sizes Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> smackfs: Fix use-after-free in netlbl_catmap_walk() Peter Zijlstra <peterz(a)infradead.org> locking/lockdep: Avoid RCU-induced noinstr fail Aleksander Jan Bajkowski <olek2(a)wp.pl> MIPS: lantiq: dma: reset correct number of channel Aleksander Jan Bajkowski <olek2(a)wp.pl> MIPS: lantiq: dma: add small delay after reset Barnabás Pőcze <pobrn(a)protonmail.com> platform/x86: wmi: do not fail if disabling fails Wang ShaoBo <bobo.shaobowang(a)huawei.com> Bluetooth: fix use-after-free error in lock_sock_nested() Takashi Iwai <tiwai(a)suse.de> Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Johan Hovold <johan(a)kernel.org> USB: iowarrior: fix control-message timeouts Wang Hai <wanghai38(a)huawei.com> USB: serial: keyspan: fix memleak on probe errors Pekka Korpinen <pekka.korpinen(a)iki.fi> iio: dac: ad5446: Fix ad5622_write() return value Yang Yingliang <yangyingliang(a)huawei.com> pinctrl: core: fix possible memory leak in pinctrl_enable() Zhang Yi <yi.zhang(a)huawei.com> quota: correct error number in free_dqentry() Zhang Yi <yi.zhang(a)huawei.com> quota: check block number when reading the block in quota file Marek Behún <kabel(a)kernel.org> PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG Marek Behún <kabel(a)kernel.org> PCI: aardvark: Fix return value of MSI domain .alloc() method Pali Rohár <pali(a)kernel.org> PCI: aardvark: Do not unmask unused interrupts Pali Rohár <pali(a)kernel.org> PCI: aardvark: Do not clear status bits of masked interrupts Juergen Gross <jgross(a)suse.com> xen/balloon: add late_initcall_sync() for initial ballooning done Pavel Skripkin <paskripkin(a)gmail.com> ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume Takashi Iwai <tiwai(a)suse.de> ALSA: mixer: oss: Fix racy access to slots Pali Rohár <pali(a)kernel.org> serial: core: Fix initializing and restoring termios speed Xiaoming Ni <nixiaoming(a)huawei.com> powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found Henrik Grimler <henrik(a)grimler.se> power: supply: max17042_battery: use VFSOC for capacity when no rsns Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> power: supply: max17042_battery: Prevent int underflow in set_soc_threshold Eric W. Biederman <ebiederm(a)xmission.com> signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT Eric W. Biederman <ebiederm(a)xmission.com> signal: Remove the bogus sigkill_pending in ptrace_stop Alok Prasad <palok(a)marvell.com> RDMA/qedr: Fix NULL deref for query_qp on the GSI QP Benjamin Li <benl(a)squareup.com> wcn36xx: handle connection loss indication Reimar Döffinger <Reimar.Doeffinger(a)gmx.de> libata: fix checking of DMA state Jonas Dreßler <verdre(a)v0yd.nl> mwifiex: Read a PCI register after writing the TX ring write pointer Loic Poulain <loic.poulain(a)linaro.org> wcn36xx: Fix HT40 capability for 2Ghz band Austin Kim <austin.kim(a)lge.com> evm: mark evm_fixmode as __ro_after_init Johan Hovold <johan(a)kernel.org> rtl8187: fix control-message timeouts Ingmar Klein <ingmar_klein(a)web.de> PCI: Mark Atheros QCA6174 to avoid bus reset Johan Hovold <johan(a)kernel.org> ath10k: fix division by zero in send path Johan Hovold <johan(a)kernel.org> ath10k: fix control-message timeout Johan Hovold <johan(a)kernel.org> ath6kl: fix control-message timeout Johan Hovold <johan(a)kernel.org> ath6kl: fix division by zero in send path Johan Hovold <johan(a)kernel.org> mwifiex: fix division by zero in fw download path Eric Badger <ebadger(a)purestorage.com> EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled Zev Weiss <zev(a)bewilderbeest.net> hwmon: (pmbus/lm25066) Add offset coefficients Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost error handling when replaying directory deletes Dongli Zhang <dongli.zhang(a)oracle.com> vmxnet3: do not stop tx queues after netif_device_detach() Walter Stoll <walter.stoll(a)duagon.com> watchdog: Fix OMAP watchdog early handling Thomas Perrot <thomas.perrot(a)bootlin.com> spi: spl022: fix Microwire full duplex mode Dongli Zhang <dongli.zhang(a)oracle.com> xen/netfront: stop tx queues during live migration Lorenz Bauer <lmb(a)cloudflare.com> bpf: Prevent increasing bpf_jit_limit above max Randy Dunlap <rdunlap(a)infradead.org> mmc: winbond: don't build on M68K Arnd Bergmann <arnd(a)arndb.de> hyperv/vmbus: include linux/bitops.h Erik Ekman <erik(a)kryo.se> sfc: Don't use netif_info before net_device setup Zheyu Ma <zheyuma97(a)gmail.com> cavium: Fix return values of the probe function Dmitry Bogdanov <d.bogdanov(a)yadro.com> scsi: qla2xxx: Fix unmap of already freed sgl Zheyu Ma <zheyuma97(a)gmail.com> cavium: Return negative value when pci_alloc_irq_vectors() fails Sean Christopherson <seanjc(a)google.com> x86/irq: Ensure PI wakeup handler is unregistered before module unload Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Unconditionally unlink slave instances, too Wang Wensheng <wangwensheng4(a)huawei.com> ALSA: timer: Fix use-after-free problem Austin Kim <austin.kim(a)lge.com> ALSA: synth: missing check for possible NULL after the call to kstrdup Johan Hovold <johan(a)kernel.org> ALSA: line6: fix control and interrupt message timeouts Johan Hovold <johan(a)kernel.org> ALSA: 6fire: fix control and bulk message timeouts Johan Hovold <johan(a)kernel.org> ALSA: ua101: fix division by zero at probe Sean Young <sean(a)mess.org> media: ite-cir: IR receiver stop working after receive overflow Dan Carpenter <dan.carpenter(a)oracle.com> tpm: Check for integer overflow in tpm2_map_response_body() Helge Deller <deller(a)gmx.de> parisc: Fix ptrace check on syscall return Christian Löhle <CLoehle(a)hyperstone.com> mmc: dw_mmc: Dont wait for DRTO on Write RSP error Jan Kara <jack(a)suse.cz> ocfs2: fix data corruption on truncate Damien Le Moal <damien.lemoal(a)opensource.wdc.com> libata: fix read log timeout value Takashi Iwai <tiwai(a)suse.de> Input: i8042 - Add quirk for Fujitsu Lifebook T725 Phoenix Huang <phoenix(a)emc.com.tw> Input: elantench - fix misreporting trackpoint coordinates Todd Kjos <tkjos(a)google.com> binder: use cred instead of task for selinux checks Todd Kjos <tkjos(a)google.com> binder: use euid from cred instead of using task Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 7 ++ .../bindings/regulator/samsung,s5m8767.txt | 23 ++--- Makefile | 4 +- arch/arm/Makefile | 22 ++--- arch/arm/boot/dts/at91-tse850-3.dts | 2 +- arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- arch/arm/kernel/stacktrace.c | 3 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/mmu.c | 4 +- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 +- arch/hexagon/lib/io.c | 4 + arch/ia64/Kconfig.debug | 2 +- arch/m68k/Kconfig.machine | 1 + arch/mips/Kconfig | 4 + arch/mips/bcm63xx/clk.c | 6 ++ arch/mips/generic/yamon-dt.c | 2 +- arch/mips/include/asm/mips-cm.h | 12 +-- arch/mips/kernel/mips-cm.c | 21 ++--- arch/mips/kernel/r2300_fpu.S | 4 +- arch/mips/kernel/syscall.c | 9 -- arch/mips/lantiq/clk.c | 6 ++ arch/mips/lantiq/xway/dma.c | 14 ++- arch/mips/sni/time.c | 4 +- arch/parisc/kernel/entry.S | 4 +- arch/parisc/kernel/smp.c | 19 +++- arch/parisc/mm/init.c | 4 +- arch/powerpc/boot/dts/charon.dts | 2 +- arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- arch/powerpc/boot/dts/lite5200.dts | 2 +- arch/powerpc/boot/dts/lite5200b.dts | 2 +- arch/powerpc/boot/dts/media5200.dts | 2 +- arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- arch/powerpc/boot/dts/o2d.dts | 2 +- arch/powerpc/boot/dts/o2d.dtsi | 2 +- arch/powerpc/boot/dts/o2dnt2.dts | 2 +- arch/powerpc/boot/dts/o3dnt.dts | 2 +- arch/powerpc/boot/dts/pcm032.dts | 2 +- arch/powerpc/boot/dts/tqm5200.dts | 2 +- arch/powerpc/include/asm/code-patching.h | 1 + arch/powerpc/lib/code-patching.c | 7 +- arch/powerpc/net/bpf_jit.h | 33 ++++--- arch/powerpc/net/bpf_jit_comp64.c | 37 +++++--- arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +- arch/powerpc/sysdev/dcr-low.S | 2 +- arch/s390/mm/gmap.c | 5 +- arch/sh/Kconfig.debug | 1 + arch/sh/include/asm/sfp-machine.h | 8 ++ arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +- arch/x86/events/intel/uncore_snbep.c | 4 + arch/x86/include/asm/page_64_types.h | 2 +- arch/x86/kernel/irq.c | 4 +- crypto/pcrypt.c | 12 ++- drivers/acpi/acpica/acglobal.h | 2 + drivers/acpi/acpica/hwesleep.c | 8 +- drivers/acpi/acpica/hwsleep.c | 11 +-- drivers/acpi/acpica/hwxfsleep.c | 7 ++ drivers/acpi/battery.c | 2 +- drivers/acpi/pmic/intel_pmic.c | 51 +++++----- drivers/android/binder.c | 20 ++-- drivers/ata/libata-core.c | 2 +- drivers/ata/libata-eh.c | 8 ++ drivers/auxdisplay/ht16k33.c | 66 +++++++------ drivers/auxdisplay/img-ascii-lcd.c | 10 ++ drivers/char/hw_random/mtk-rng.c | 9 +- drivers/char/tpm/tpm2-space.c | 3 + drivers/cpuidle/sysfs.c | 5 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 13 +++ drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 ++ drivers/dma/at_xdmac.c | 2 +- drivers/dma/dmaengine.h | 2 +- drivers/edac/sb_edac.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 + drivers/gpu/drm/drm_plane_helper.c | 1 - drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/gpu/drm/udl/udl_connector.c | 2 +- drivers/hv/hyperv_vmbus.h | 1 + drivers/hwmon/hwmon.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 23 +++++ drivers/i2c/busses/i2c-xlr.c | 6 +- drivers/iio/dac/ad5446.c | 9 +- drivers/infiniband/hw/mlx4/qp.c | 4 +- drivers/infiniband/hw/qedr/verbs.c | 15 +-- drivers/infiniband/sw/rxe/rxe_param.h | 2 +- drivers/input/mouse/elantech.c | 13 +++ drivers/input/serio/i8042-x86ia64io.h | 14 +++ drivers/irqchip/irq-bcm6345-l1.c | 2 +- drivers/irqchip/irq-s3c24xx.c | 22 ++++- drivers/media/i2c/mt9p031.c | 28 +++++- drivers/media/pci/cx23885/cx23885-alsa.c | 3 +- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 27 +++--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 6 +- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- drivers/media/radio/si470x/radio-si470x-usb.c | 2 +- drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/usb/dvb-usb/az6027.c | 1 + drivers/media/usb/dvb-usb/dibusb-common.c | 2 +- drivers/media/usb/uvc/uvc_v4l2.c | 7 +- drivers/memory/fsl_ifc.c | 13 ++- drivers/memstick/core/ms_block.c | 2 +- drivers/memstick/host/jmb38x_ms.c | 2 +- drivers/memstick/host/r592.c | 8 +- drivers/mmc/host/Kconfig | 2 +- drivers/mmc/host/dw_mmc.c | 3 +- drivers/mmc/host/mxs-mmc.c | 10 ++ drivers/mtd/spi-nor/hisi-sfc.c | 1 - drivers/net/bonding/bond_sysfs_slave.c | 36 +++---- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 ++ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +++- .../net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +- drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +- drivers/net/ethernet/ibm/ibmvnic.c | 3 + drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +- drivers/net/ethernet/sfc/ptp.c | 4 +- drivers/net/ethernet/sfc/siena_sriov.c | 2 +- drivers/net/ethernet/ti/davinci_emac.c | 16 +++- drivers/net/phy/micrel.c | 5 +- drivers/net/phy/phylink.c | 2 +- drivers/net/tun.c | 5 + drivers/net/vmxnet3/vmxnet3_drv.c | 1 - drivers/net/wireless/ath/ath10k/mac.c | 6 +- drivers/net/wireless/ath/ath10k/usb.c | 7 +- drivers/net/wireless/ath/ath10k/wmi.h | 3 + drivers/net/wireless/ath/ath6kl/usb.c | 7 +- drivers/net/wireless/ath/ath9k/main.c | 4 +- drivers/net/wireless/ath/dfs_pattern_detector.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 4 +- drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++--- drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 + drivers/net/wireless/marvell/libertas/if_usb.c | 2 + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 + drivers/net/wireless/marvell/mwifiex/11n.c | 5 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +++---- drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++ drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++ drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +-- drivers/net/xen-netfront.c | 8 ++ drivers/nfc/pn533/pn533.c | 6 +- drivers/pci/host/pci-aardvark.c | 23 +++-- drivers/pci/msi.c | 24 ++--- drivers/pci/quirks.c | 1 + drivers/pinctrl/core.c | 2 + drivers/platform/x86/hp_accel.c | 2 + drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/platform/x86/wmi.c | 9 +- drivers/power/supply/bq27xxx_battery_i2c.c | 3 +- drivers/power/supply/max17042_battery.c | 8 +- drivers/power/supply/rt5033_battery.c | 2 +- drivers/regulator/s5m8767.c | 21 ++--- drivers/s390/cio/css.c | 4 +- drivers/scsi/advansys.c | 4 +- drivers/scsi/csiostor/csio_lnode.c | 2 +- drivers/scsi/dc395x.c | 1 + drivers/scsi/lpfc/lpfc_sli.c | 1 + drivers/scsi/qla2xxx/qla_gbl.h | 2 - drivers/scsi/qla2xxx/qla_mr.c | 23 ----- drivers/scsi/qla2xxx/qla_os.c | 27 +----- drivers/scsi/qla2xxx/qla_target.c | 14 +-- drivers/sh/maple/maple.c | 5 +- drivers/soc/tegra/pmc.c | 4 +- drivers/spi/spi-bcm-qspi.c | 5 +- drivers/spi/spi-pl022.c | 5 +- drivers/target/target_core_alua.c | 1 - drivers/target/target_core_device.c | 2 + drivers/target/target_core_internal.h | 1 + drivers/target/target_core_transport.c | 76 ++++++++++----- drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/serial_core.c | 16 +++- drivers/tty/serial/xilinx_uartps.c | 3 +- drivers/tty/tty_buffer.c | 3 + drivers/usb/chipidea/core.c | 19 +++- drivers/usb/gadget/legacy/hid.c | 4 +- drivers/usb/host/max3421-hcd.c | 25 +---- drivers/usb/host/ohci-tmio.c | 2 +- drivers/usb/host/xhci-hub.c | 3 +- drivers/usb/misc/iowarrior.c | 8 +- drivers/usb/musb/tusb6010.c | 5 + drivers/usb/serial/keyspan.c | 15 ++- drivers/video/console/sticon.c | 12 +-- drivers/video/fbdev/chipsfb.c | 2 +- drivers/watchdog/Kconfig | 2 +- drivers/watchdog/f71808e_wdt.c | 4 +- drivers/watchdog/omap_wdt.c | 6 +- drivers/xen/balloon.c | 86 ++++++++++++----- drivers/xen/xen-pciback/conf_space_capability.c | 2 +- fs/btrfs/async-thread.c | 14 +++ fs/btrfs/tree-log.c | 4 +- fs/ext4/super.c | 9 +- fs/jfs/jfs_mount.c | 51 +++++----- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfs/write.c | 17 +--- fs/ocfs2/file.c | 8 +- fs/orangefs/dcache.c | 4 +- fs/quota/quota_tree.c | 15 +++ fs/tracefs/inode.c | 3 +- include/linux/console.h | 2 + include/linux/filter.h | 1 + include/linux/libata.h | 2 +- include/linux/lsm_hooks.h | 28 +++--- include/linux/rpmsg.h | 2 +- include/linux/sched/task_stack.h | 4 + include/linux/security.h | 28 +++--- include/linux/virtio_net.h | 7 +- include/net/llc.h | 4 +- include/rdma/rdma_netlink.h | 2 +- include/target/target_core_base.h | 6 +- include/uapi/linux/pci_regs.h | 6 ++ kernel/bpf/core.c | 4 +- kernel/cgroup/cgroup.c | 31 ++++++- kernel/events/core.c | 10 +- kernel/locking/lockdep.c | 2 +- kernel/power/swap.c | 7 +- kernel/sched/core.c | 3 + kernel/signal.c | 19 +--- kernel/trace/trace.c | 62 ++++++++++--- kernel/trace/tracing_map.c | 40 ++++---- lib/decompress_unxz.c | 2 +- lib/xz/xz_dec_lzma2.c | 21 ++++- lib/xz/xz_dec_stream.c | 6 +- mm/oom_kill.c | 23 ++--- mm/slab.h | 2 +- mm/zsmalloc.c | 7 +- net/batman-adv/bridge_loop_avoidance.c | 103 +++++++++++++++++---- net/batman-adv/fragmentation.c | 26 ++++-- net/batman-adv/hard-interface.c | 3 + net/batman-adv/multicast.c | 31 +++++++ net/batman-adv/multicast.h | 15 +++ net/batman-adv/soft-interface.c | 5 +- net/bluetooth/l2cap_sock.c | 10 +- net/bluetooth/sco.c | 24 +++-- net/core/stream.c | 3 - net/core/sysctl_net_core.c | 2 +- net/ipv6/addrconf.c | 3 + net/netfilter/nfnetlink_queue.c | 2 +- net/nfc/core.c | 32 ++++--- net/nfc/nci/core.c | 11 ++- net/vmw_vsock/af_vsock.c | 2 + net/wireless/util.c | 1 + samples/kprobes/kretprobe_example.c | 2 +- scripts/leaking_addresses.pl | 3 +- security/apparmor/label.c | 4 +- security/integrity/evm/evm_main.c | 2 +- security/security.c | 14 +-- security/selinux/hooks.c | 31 +++---- security/smack/smackfs.c | 11 ++- sound/core/oss/mixer_oss.c | 43 +++++++-- sound/core/timer.c | 17 ++-- sound/isa/gus/gus_dma.c | 2 + sound/pci/hda/hda_intel.c | 28 +++++- sound/soc/codecs/cs42l42.c | 9 +- sound/soc/soc-dapm.c | 29 ++++-- sound/synth/emux/emux.c | 2 +- sound/usb/6fire/comm.c | 2 +- sound/usb/6fire/firmware.c | 6 +- sound/usb/line6/driver.c | 14 +-- sound/usb/line6/driver.h | 2 +- sound/usb/line6/podhd.c | 6 +- sound/usb/line6/toneport.c | 2 +- sound/usb/misc/ua101.c | 4 +- 269 files changed, 1681 insertions(+), 911 deletions(-)

3 years, 1 month

4
3
0 0

[PATCH AUTOSEL 4.4 1/6] net: return correct error code

by Sasha Levin

From: liuguoqiang <liuguoqiang(a)uniontech.com> [ Upstream commit 6def480181f15f6d9ec812bca8cbc62451ba314c ] When kmemdup called failed and register_net_sysctl return NULL, should return ENOMEM instead of ENOBUFS Signed-off-by: liuguoqiang <liuguoqiang(a)uniontech.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/ipv4/devinet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 2cb8612e7821e..35961ae1d120c 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2237,7 +2237,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name, free: kfree(t); out: - return -ENOBUFS; + return -ENOMEM; } static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf) -- 2.33.0

3 years, 1 month

1
5
0 0

[PATCH AUTOSEL 4.9 1/8] net: return correct error code

by Sasha Levin

From: liuguoqiang <liuguoqiang(a)uniontech.com> [ Upstream commit 6def480181f15f6d9ec812bca8cbc62451ba314c ] When kmemdup called failed and register_net_sysctl return NULL, should return ENOMEM instead of ENOBUFS Signed-off-by: liuguoqiang <liuguoqiang(a)uniontech.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- net/ipv4/devinet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 6f3c529431865..7a2442623d6a6 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2271,7 +2271,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name, free: kfree(t); out: - return -ENOBUFS; + return -ENOMEM; } static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf) -- 2.33.0

3 years, 1 month

1
7
0 0

[PATCH AUTOSEL 4.14 01/12] atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait

by Sasha Levin

From: Zekun Shen <bruceshenzk(a)gmail.com> [ Upstream commit b922f622592af76b57cbc566eaeccda0b31a3496 ] This bug report shows up when running our research tools. The reports is SOOB read, but it seems SOOB write is also possible a few lines below. In details, fw.len and sw.len are inputs coming from io. A len over the size of self->rpc triggers SOOB. The patch fixes the bugs by adding sanity checks. The bugs are triggerable with compromised/malfunctioning devices. They are potentially exploitable given they first leak up to 0xffff bytes and able to overwrite the region later. The patch is tested with QEMU emulater. This is NOT tested with a real device. Attached is the log we found by fuzzing. BUG: KASAN: slab-out-of-bounds in hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] Read of size 4 at addr ffff888016260b08 by task modprobe/213 CPU: 0 PID: 213 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] __kasan_report.cold+0x37/0x7c ? aq_hw_read_reg_bit+0x60/0x70 [atlantic] ? hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] kasan_report+0xe/0x20 hw_atl_utils_fw_upload_dwords+0x393/0x3c0 [atlantic] hw_atl_utils_fw_rpc_call+0x95/0x130 [atlantic] hw_atl_utils_fw_rpc_wait+0x176/0x210 [atlantic] hw_atl_utils_mpi_create+0x229/0x2e0 [atlantic] ? hw_atl_utils_fw_rpc_wait+0x210/0x210 [atlantic] ? hw_atl_utils_initfw+0x9f/0x1c8 [atlantic] hw_atl_utils_initfw+0x12a/0x1c8 [atlantic] aq_nic_ndev_register+0x88/0x650 [atlantic] ? aq_nic_ndev_init+0x235/0x3c0 [atlantic] aq_pci_probe+0x731/0x9b0 [atlantic] ? aq_pci_func_init+0xc0/0xc0 [atlantic] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 Reported-by: Brendan Dolan-Gavitt <brendandg(a)nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- .../ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c index 1fe016fc4bc70..5a7a1fd44d3fa 100644 --- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c @@ -209,6 +209,11 @@ static int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self, goto err_exit; if (fw.len == 0xFFFFU) { + if (sw.len > sizeof(self->rpc)) { + printk(KERN_INFO "Invalid sw len: %x\n", sw.len); + err = -EINVAL; + goto err_exit; + } err = hw_atl_utils_fw_rpc_call(self, sw.len); if (err < 0) goto err_exit; @@ -219,6 +224,11 @@ static int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self, if (rpc) { if (fw.len) { + if (fw.len > sizeof(self->rpc)) { + printk(KERN_INFO "Invalid fw len: %x\n", fw.len); + err = -EINVAL; + goto err_exit; + } err = hw_atl_utils_fw_downld_dwords(self, PHAL_ATLANTIC->rpc_addr, -- 2.33.0

3 years, 1 month

1
11
0 0

[PATCH AUTOSEL 4.19 01/15] gfs2: Fix length of holes reported at end-of-file

by Sasha Levin

From: Andreas Gruenbacher <agruenba(a)redhat.com> [ Upstream commit f3506eee81d1f700d9ee2d2f4a88fddb669ec032 ] Fix the length of holes reported at the end of a file: the length is relative to the beginning of the extent, not the seek position which is rounded down to the filesystem block size. This bug went unnoticed for some time, but is now caught by the following assertion in iomap_iter_done(): WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos) Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/gfs2/bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index 43f53020553b5..53ba5019ad063 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -943,7 +943,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, else if (height == ip->i_height) ret = gfs2_hole_size(inode, lblock, len, mp, iomap); else - iomap->length = size - pos; + iomap->length = size - iomap->offset; } else if (flags & IOMAP_WRITE) { u64 alloc_size; -- 2.33.0

3 years, 1 month

1
14
0 0

[PATCH AUTOSEL 5.4 01/19] gfs2: Fix length of holes reported at end-of-file

by Sasha Levin

From: Andreas Gruenbacher <agruenba(a)redhat.com> [ Upstream commit f3506eee81d1f700d9ee2d2f4a88fddb669ec032 ] Fix the length of holes reported at the end of a file: the length is relative to the beginning of the extent, not the seek position which is rounded down to the filesystem block size. This bug went unnoticed for some time, but is now caught by the following assertion in iomap_iter_done(): WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos) Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/gfs2/bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index aaec3c5b02028..dec5285a02e9d 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -940,7 +940,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, else if (height == ip->i_height) ret = gfs2_hole_size(inode, lblock, len, mp, iomap); else - iomap->length = size - pos; + iomap->length = size - iomap->offset; } else if (flags & IOMAP_WRITE) { u64 alloc_size; -- 2.33.0

3 years, 1 month

1
18
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2021