This is the start of the stable review cycle for the 4.4.294 release.
There are 52 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 08 Dec 2021 14:55:37 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.294-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.294-rc1
Pierre Gondois <Pierre.Gondois(a)arm.com>
serial: pl011: Add ACPI SBSA UART match id
Sven Eckelmann <sven(a)narfation.org>
tty: serial: msm_serial: Deactivate RX DMA for polling support
Maciej W. Rozycki <macro(a)orcam.me.uk>
vgacon: Propagate console boot parameters before calling `vc_resize'
Helge Deller <deller(a)gmx.de>
parisc: Fix "make install" on newer debian releases
Arnd Bergmann <arnd(a)arndb.de>
siphash: use _unaligned version by default
Zhou Qingyang <zhou1615(a)umn.edu>
net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
Randy Dunlap <rdunlap(a)infradead.org>
natsemi: xtensa: fix section mismatch warnings
Linus Torvalds <torvalds(a)linux-foundation.org>
fget: check that the fd still exists after getting a ref to it
Jens Axboe <axboe(a)kernel.dk>
fs: add fget_many() and fput_many()
Baokun Li <libaokun1(a)huawei.com>
sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
Baokun Li <libaokun1(a)huawei.com>
sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
Masami Hiramatsu <mhiramat(a)kernel.org>
kprobes: Limit max data_size of the kretprobe instances
Teng Qi <starmiku1207184332(a)gmail.com>
net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
zhangyue <zhangyue1(a)kylinos.cn>
net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
Mike Christie <michael.christie(a)oracle.com>
scsi: iscsi: Unblock session then wake up error handler
Vasily Gorbik <gor(a)linux.ibm.com>
s390/setup: avoid using memblock_enforce_memory_limit
Slark Xiao <slark_xiao(a)163.com>
platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
liuguoqiang <liuguoqiang(a)uniontech.com>
net: return correct error code
Mike Kravetz <mike.kravetz(a)oracle.com>
hugetlb: take PMD sharing into account when flushing tlb/caches
Juergen Gross <jgross(a)suse.com>
tty: hvc: replace BUG_ON() with negative return value
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't trust the backend response data blindly
Juergen Gross <jgross(a)suse.com>
xen/netfront: disentangle tx_skb_freelist
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't read data from request on the ring page
Juergen Gross <jgross(a)suse.com>
xen/netfront: read response from backend only once
Juergen Gross <jgross(a)suse.com>
xen/blkfront: don't trust the backend response data blindly
Juergen Gross <jgross(a)suse.com>
xen/blkfront: don't take local copy of a request from the ring page
Juergen Gross <jgross(a)suse.com>
xen/blkfront: read response from backend only once
Juergen Gross <jgross(a)suse.com>
xen: sync include/xen/interface/io/ring.h with Xen's newest version
Alexander Mikhalitsyn <alexander.mikhalitsyn(a)virtuozzo.com>
shm: extend forced shm destroy to support objects from several IPC nses
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: release pipe buf after last use
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: fix page stealing
Lin Ma <linma(a)zju.edu.cn>
NFC: add NCI_UNREG flag to eliminate the race
David Hildenbrand <david(a)redhat.com>
proc/vmcore: fix clearing user buffer by properly using clear_user()
Nadav Amit <namit(a)vmware.com>
hugetlbfs: flush TLBs correctly after huge_pmd_unshare
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Check pid filtering when creating events
Eric Dumazet <edumazet(a)google.com>
tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
Sreekanth Reddy <sreekanth.reddy(a)broadcom.com>
scsi: mpt3sas: Fix kernel panic during drive powercycle test
Takashi Iwai <tiwai(a)suse.de>
ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv42: Don't fail clone() unless the OP_CLONE operation failed
Alexander Aring <aahringo(a)redhat.com>
net: ieee802154: handle iftypes as u32
Takashi Iwai <tiwai(a)suse.de>
ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
Florian Fainelli <f.fainelli(a)gmail.com>
ARM: dts: BCM5301X: Add interrupt properties to GPIO node
Stefano Stabellini <stefano.stabellini(a)xilinx.com>
xen: detect uninitialized xenbus in xenbus_init
Stefano Stabellini <stefano.stabellini(a)xilinx.com>
xen: don't continue xenstore initialization in case of errors
Dan Carpenter <dan.carpenter(a)oracle.com>
staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
Takashi Iwai <tiwai(a)suse.de>
ALSA: ctxfi: Fix out-of-range access
Todd Kjos <tkjos(a)google.com>
binder: fix test regression due to sender_euid change
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: hub: Fix locking issues with address0_mutex
Mathias Nyman <mathias.nyman(a)linux.intel.com>
usb: hub: Fix usb enumeration issue due to address0 race
Mingjie Zhang <superzmj(a)fibocom.com>
USB: serial: option: add Fibocom FM101-GL variants
Daniele Palmas <dnlplm(a)gmail.com>
USB: serial: option: add Telit LE910S1 0x9200 composition
Lee Jones <lee.jones(a)linaro.org>
staging: ion: Prevent incorrect reference counting behavour
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/bcm5301x.dtsi | 2 +
arch/arm/include/asm/tlb.h | 8 +
arch/arm/mach-socfpga/core.h | 2 +-
arch/arm/mach-socfpga/platsmp.c | 8 +-
arch/ia64/include/asm/tlb.h | 10 +
arch/parisc/install.sh | 1 +
arch/s390/include/asm/tlb.h | 13 ++
arch/s390/kernel/setup.c | 3 -
arch/sh/include/asm/tlb.h | 10 +
arch/um/include/asm/tlb.h | 12 +
drivers/android/binder.c | 2 +-
drivers/ata/sata_fsl.c | 20 +-
drivers/block/xen-blkfront.c | 126 +++++++---
drivers/net/ethernet/dec/tulip/de4x5.c | 34 +--
drivers/net/ethernet/natsemi/xtsonic.c | 2 +-
.../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 10 +-
drivers/net/xen-netfront.c | 257 +++++++++++++--------
drivers/platform/x86/thinkpad_acpi.c | 12 -
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
drivers/scsi/scsi_transport_iscsi.c | 6 +-
drivers/staging/android/ion/ion.c | 6 +
drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 +-
drivers/tty/hvc/hvc_xen.c | 17 +-
drivers/tty/serial/amba-pl011.c | 1 +
drivers/tty/serial/msm_serial.c | 3 +
drivers/usb/core/hub.c | 23 +-
drivers/usb/serial/option.c | 5 +
drivers/video/console/vgacon.c | 14 +-
drivers/xen/xenbus/xenbus_probe.c | 27 ++-
fs/file.c | 19 +-
fs/file_table.c | 9 +-
fs/fuse/dev.c | 10 +-
fs/nfs/nfs42xdr.c | 3 +-
fs/proc/vmcore.c | 15 +-
include/asm-generic/tlb.h | 7 +
include/linux/file.h | 2 +
include/linux/fs.h | 4 +-
include/linux/ipc_namespace.h | 15 ++
include/linux/kprobes.h | 2 +
include/linux/sched.h | 2 +-
include/linux/shm.h | 13 +-
include/linux/siphash.h | 14 +-
include/net/nfc/nci_core.h | 1 +
include/net/nl802154.h | 7 +-
include/xen/interface/io/ring.h | 257 ++++++++++-----------
ipc/shm.c | 176 ++++++++++----
kernel/kprobes.c | 3 +
kernel/trace/trace_events.c | 7 +
lib/siphash.c | 12 +-
mm/hugetlb.c | 58 ++++-
net/ipv4/devinet.c | 2 +-
net/ipv4/tcp_cubic.c | 5 +-
net/nfc/nci/core.c | 19 +-
sound/pci/ctxfi/ctamixer.c | 14 +-
sound/pci/ctxfi/ctdaio.c | 16 +-
sound/pci/ctxfi/ctresource.c | 7 +-
sound/pci/ctxfi/ctresource.h | 4 +-
sound/pci/ctxfi/ctsrc.c | 7 +-
sound/soc/soc-topology.c | 3 +
60 files changed, 894 insertions(+), 462 deletions(-)
dma_fence_chain_find_seqno only ever returns the top fence in the
chain or an unsignalled fence. Hence if we request a seqno that
is already signalled it returns a NULL fence. Some callers are
not prepared to handle this, like the syncobj transfer functions
for example.
This behavior is "new" with timeline syncobj and it looks like
not all callers were updated. To fix this behavior make sure
that a successful drm_sync_find_fence always returns a non-NULL
fence.
v2: Move the fix to drm_syncobj_find_fence from the transfer
functions.
Fixes: ea569910cbab ("drm/syncobj: add transition iotcls between binary and timeline v2")
Cc: stable(a)vger.kernel.org
Signed-off-by: Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl>
---
drivers/gpu/drm/drm_syncobj.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index fdd2ec87cdd1..e772ca3e1e13 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -404,8 +404,17 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
if (*fence) {
ret = dma_fence_chain_find_seqno(fence, point);
- if (!ret)
+ if (!ret) {
+ /* If the requested seqno is already signaled
+ * drm_syncobj_find_fence may return a NULL
+ * fence. To make sure the recipient gets
+ * signalled, use a new fence instead.
+ */
+ if (!*fence)
+ *fence = dma_fence_get_stub();
+
goto out;
+ }
dma_fence_put(*fence);
} else {
ret = -EINVAL;
@@ -861,6 +870,7 @@ static int drm_syncobj_transfer_to_timeline(struct drm_file *file_private,
&fence);
if (ret)
goto err;
+
chain = kzalloc(sizeof(struct dma_fence_chain), GFP_KERNEL);
if (!chain) {
ret = -ENOMEM;
@@ -890,6 +900,7 @@ drm_syncobj_transfer_to_binary(struct drm_file *file_private,
args->src_point, args->flags, &fence);
if (ret)
goto err;
+
drm_syncobj_replace_fence(binary_syncobj, fence);
dma_fence_put(fence);
err:
--
2.34.1
Patch 1/2 fixes the issue reported by Nikita where a MAC address
wouldn't match if given as first field of a set, and patch 2/2 adds
the corresponding test.
Stefano Brivio (2):
nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit
groups
selftests: netfilter: Add correctness test for mac,net set type
net/netfilter/nft_set_pipapo_avx2.c | 2 +-
.../selftests/netfilter/nft_concat_range.sh | 24 ++++++++++++++++---
2 files changed, 22 insertions(+), 4 deletions(-)
--
2.30.2
This series fixes two bugs in aio poll, and one issue with POLLFREE more
broadly. This is intended to replace
"[PATCH v5] aio: Add support for the POLLFREE"
(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)
which has some bugs.
Careful review is appreciated; the aio poll code is very hard to work
with, and I don't know of an easy way to test it. Suggestions of any
aio poll tests to run would be greatly appreciated.
Note, it looks like io_uring has the same bugs as aio poll. I haven't
tried to fix io_uring.
This series applies to v5.16-rc4.
Changed v1 => v2:
- Added wake_up_pollfree().
- Various fixes to the aio poll fixes.
- Improved some comments in aio poll.
Eric Biggers (5):
wait: add wake_up_pollfree()
binder: use wake_up_pollfree()
signalfd: use wake_up_pollfree()
aio: keep poll requests on waitqueue until completed
aio: fix use-after-free due to missing POLLFREE handling
drivers/android/binder.c | 21 ++--
fs/aio.c | 184 ++++++++++++++++++++++++++------
fs/signalfd.c | 12 +--
include/linux/wait.h | 26 +++++
include/uapi/asm-generic/poll.h | 2 +-
kernel/sched/wait.c | 7 ++
6 files changed, 195 insertions(+), 57 deletions(-)
--
2.34.1