I'm announcing the release of the 4.9.282 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
arch/arc/kernel/vmlinux.lds.S | 2 ++
arch/x86/kvm/mmu.c | 11 ++++++++++-
drivers/block/floppy.c | 27 +++++++++++++--------------
drivers/infiniband/hw/hfi1/sdma.c | 9 ++++-----
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 +++++++----
drivers/usb/dwc3/gadget.c | 16 ++++++++--------
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
net/ipv4/ip_gre.c | 2 ++
net/rds/ib_frmr.c | 4 ++--
18 files changed, 79 insertions(+), 43 deletions(-)
Denis Efremov (1):
Revert "floppy: reintroduce O_NDELAY fix"
George Kennedy (1):
fbmem: add margin check to fb_check_caps()
Gerd Rausch (1):
net/rds: dma_map_sg is entitled to merge entries
Greg Kroah-Hartman (1):
Linux 4.9.282
Guenter Roeck (1):
ARC: Fix CONFIG_STACKDEPOT
Johan Hovold (1):
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Linus Torvalds (1):
vt_kdsetmode: extend console locking
Maxim Kiselev (1):
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Neeraj Upadhyay (1):
vringh: Use wiov->used to check for read/write desc order
Parav Pandit (1):
virtio: Improve vq->broken access to avoid any compiler optimization
Sasha Neftin (1):
e1000e: Fix the max snoop/no-snoop latency for 10M
Sean Christopherson (1):
KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
Shreyansh Chouhan (1):
ip_gre: add validation for csum_start
Stefan Mätje (1):
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Thinh Nguyen (1):
usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
Tuo Li (1):
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
Zhengjun Zhang (1):
USB: serial: option: add new VID/PID to support Fibocom FG150
I'm announcing the release of the 4.4.283 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/block/floppy.c | 27 +++++++++++++--------------
drivers/net/can/usb/esd_usb2.c | 4 ++--
drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
drivers/net/ethernet/marvell/mvneta.c | 2 +-
drivers/tty/vt/vt_ioctl.c | 11 +++++++----
drivers/usb/serial/ch341.c | 1 -
drivers/usb/serial/option.c | 2 ++
drivers/vhost/vringh.c | 2 +-
drivers/video/fbdev/core/fbmem.c | 4 ++++
drivers/virtio/virtio_ring.c | 6 ++++--
12 files changed, 51 insertions(+), 27 deletions(-)
Denis Efremov (1):
Revert "floppy: reintroduce O_NDELAY fix"
George Kennedy (1):
fbmem: add margin check to fb_check_caps()
Greg Kroah-Hartman (1):
Linux 4.4.283
Johan Hovold (1):
Revert "USB: serial: ch341: fix character loss at high transfer rates"
Linus Torvalds (1):
vt_kdsetmode: extend console locking
Maxim Kiselev (1):
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
Neeraj Upadhyay (1):
vringh: Use wiov->used to check for read/write desc order
Parav Pandit (1):
virtio: Improve vq->broken access to avoid any compiler optimization
Sasha Neftin (1):
e1000e: Fix the max snoop/no-snoop latency for 10M
Stefan Mätje (1):
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
Zhengjun Zhang (1):
USB: serial: option: add new VID/PID to support Fibocom FG150
ocfs2_data_convert_worker() is currently dropping any cached acl info
for FILE before down-converting meta lock. It should also drop for DIRECTORY.
Otherwise the second acl lookup returns the cached one (from VFS layer) which
could be already stale.
The problem we are seeing is that the acl changes on one node doesn't get
refreshed on other nodes in the following case:
Node 1 Node 2
-------------- ----------------
getfacl dir1
getfacl dir1 <-- this is OK
setfacl -m u:user1:rwX dir1
getfacl dir1 <-- see the change for user1
getfacl dir1 <-- can't see change for user1
Signed-off-by: Wengang Wang <wen.gang.wang(a)oracle.com>
---
fs/ocfs2/dlmglue.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 50a863fc1779..207ec61569ea 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3933,7 +3933,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
oi = OCFS2_I(inode);
oi->ip_dir_lock_gen++;
mlog(0, "generation: %u\n", oi->ip_dir_lock_gen);
- goto out;
+ goto out_forget;
}
if (!S_ISREG(inode->i_mode))
@@ -3964,6 +3964,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
filemap_fdatawait(mapping);
}
+out_forget:
forget_all_cached_acls(inode);
out:
--
2.21.0 (Apple Git-122.2)
sd and parent devices must not be removed as sd_open checks for events
sd_need_revalidate and sd_revalidate_disk traverse the device path
to check for event changes. If during this, e.g. the scsi host is being
removed and its resources freed, this traversal crashes.
Locking with scan_mutex for just a scsi disk open may seem blunt, but there
does not seem to be a more granular option. Also opening /dev/sdX directly
happens rarely enough that this shouldn't cause any issues.
The issue occurred on an older kernel with the following trace:
stack segment: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 121457 Comm: python3 Not tainted 4.14.238hyLinux #1
Hardware name: ASUS All Series/H81M-D, BIOS 0601 02/20/2014
task: ffff888213dbb700 task.stack: ffffc90008c14000
RIP: 0010:kobject_get_path+0x2a/0xe0
...
Call Trace:
kobject_uevent_env+0xe6/0x550
disk_check_events+0x101/0x160
disk_clear_events+0x75/0x100
check_disk_change+0x22/0x60
sd_open+0x70/0x170 [sd_mod]
__blkdev_get+0x3fd/0x4b0
? get_empty_filp+0x57/0x1b0
blkdev_get+0x11b/0x330
? bd_acquire+0xc0/0xc0
do_dentry_open+0x1ef/0x320
? __inode_permission+0x85/0xc0
path_openat+0x5cb/0x1500
? terminate_walk+0xeb/0x100
do_filp_open+0x9b/0x110
? __check_object_size+0xb4/0x190
? do_sys_open+0x1bd/0x250
do_sys_open+0x1bd/0x250
do_syscall_64+0x67/0x120
entry_SYSCALL_64_after_hwframe+0x41/0xa6
and this commit fixed that issue, as there has been no other such
synchronization in place since then, the issue should still be present in
recent kernels.
Signed-off-by: Christian Loehle <cloehle(a)hyperstone.com>
---
drivers/scsi/sd.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 610ebba0d66e..ad4da985a473 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1436,6 +1436,16 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
if (!scsi_block_when_processing_errors(sdev))
goto error_out;
+ /*
+ * Checking for changes to the device must not race with the device
+ * or its parent host being removed, so lock until sd_open returns.
+ */
+ mutex_lock(&sdev->host->scan_mutex);
+ if (sdev->sdev_state != SDEV_RUNNING) {
+ retval = -ERESTARTSYS;
+ goto unlock_scan_error_out;
+ }
+
if (sd_need_revalidate(bdev, sdkp))
sd_revalidate_disk(bdev->bd_disk);
@@ -1444,7 +1454,7 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -ENOMEDIUM;
if (sdev->removable && !sdkp->media_present && !(mode & FMODE_NDELAY))
- goto error_out;
+ goto unlock_scan_error_out;
/*
* If the device has the write protect tab set, have the open fail
@@ -1452,7 +1462,7 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -EROFS;
if (sdkp->write_prot && (mode & FMODE_WRITE))
- goto error_out;
+ goto unlock_scan_error_out;
/*
* It is possible that the disk changing stuff resulted in
@@ -1462,15 +1472,19 @@ static int sd_open(struct block_device *bdev, fmode_t mode)
*/
retval = -ENXIO;
if (!scsi_device_online(sdev))
- goto error_out;
+ goto unlock_scan_error_out;
if ((atomic_inc_return(&sdkp->openers) == 1) && sdev->removable) {
if (scsi_block_when_processing_errors(sdev))
scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
}
+ mutex_unlock(&sdev->host->scan_mutex);
return 0;
+unlock_scan_error_out:
+ mutex_unlock(&sdev->host->scan_mutex);
+
error_out:
scsi_disk_put(sdkp);
return retval;
--
2.32.0=
Hyperstone GmbH | Line-Eid-Strasse 3 | 78467 Konstanz
Managing Directors: Dr. Jan Peter Berns.
Commercial register of local courts: Freiburg HRB381782
This is the start of the stable review cycle for the 5.14.1 release.
There are 11 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 03 Sep 2021 12:22:41 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.1-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.14.1-rc1
Richard Guy Briggs <rgb(a)redhat.com>
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
Peter Collingbourne <pcc(a)google.com>
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
Eric Biggers <ebiggers(a)google.com>
ubifs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
f2fs: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
ext4: report correct st_size for encrypted symlinks
Eric Biggers <ebiggers(a)google.com>
fscrypt: add fscrypt_symlink_getattr() for computing st_size
Denis Efremov <efremov(a)linux.com>
Revert "floppy: reintroduce O_NDELAY fix"
Qu Wenruo <wqu(a)suse.com>
btrfs: fix NULL pointer dereference when deleting device by invalid id
DENG Qingfang <dqfext(a)gmail.com>
net: dsa: mt7530: fix VLAN traffic leaks again
Pauli Virtanen <pav(a)iki.fi>
Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
Linus Torvalds <torvalds(a)linux-foundation.org>
vt_kdsetmode: extend console locking
-------------
Diffstat:
Makefile | 4 ++--
drivers/block/floppy.c | 30 +++++++++++++++---------------
drivers/bluetooth/btusb.c | 22 ++++++++++++++--------
drivers/net/dsa/mt7530.c | 5 +----
drivers/tty/vt/vt_ioctl.c | 10 ++++++----
fs/btrfs/volumes.c | 2 +-
fs/crypto/hooks.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
fs/ext4/symlink.c | 12 +++++++++++-
fs/f2fs/namei.c | 12 +++++++++++-
fs/ubifs/file.c | 13 ++++++++++++-
include/linux/fscrypt.h | 7 +++++++
include/linux/netdevice.h | 4 ++++
kernel/audit_tree.c | 2 +-
net/socket.c | 6 +++++-
14 files changed, 134 insertions(+), 39 deletions(-)