I'm announcing the release of the 4.9.309 kernel.
All users of the 4.9 kernel series must upgrade.
The updated 4.9.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/x86/kernel/acpi/boot.c | 24 +++++++++
drivers/acpi/battery.c | 12 ++++
drivers/acpi/video_detect.c | 75 +++++++++++++++++++++++++++++
drivers/crypto/qat/qat_common/qat_crypto.c | 8 +++
drivers/nfc/st21nfca/se.c | 10 +++
drivers/staging/fbtft/fb_st7789v.c | 2
net/ipv6/ip6_output.c | 4 -
net/llc/af_llc.c | 49 ++++++++++++------
net/mac80211/cfg.c | 3 -
net/netfilter/nf_tables_core.c | 2
sound/core/pcm_native.c | 4 +
sound/pci/ac97/ac97_codec.c | 4 -
sound/pci/cmipci.c | 3 -
sound/usb/mixer_quirks.c | 7 +-
15 files changed, 178 insertions(+), 31 deletions(-)
Eric Dumazet (2):
llc: fix netdevice reference leaks in llc_ui_bind()
llc: only change llc->dev when bind() succeeds
Giacomo Guiduzzi (1):
ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
Giovanni Cabiddu (1):
crypto: qat - disable registration of algorithms
Greg Kroah-Hartman (1):
Linux 4.9.309
Jonathan Teh (1):
ALSA: cmipci: Restore aux vol on suspend/resume
Jordy Zomer (1):
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
Lars-Peter Clausen (1):
ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
Linus Lüssing (1):
mac80211: fix potential double free on mesh join
Mark Cilissen (1):
ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
Maximilian Luz (1):
ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
Oliver Graute (1):
staging: fbtft: fb_st7789v: reset display before initialization
Pablo Neira Ayuso (1):
netfilter: nf_tables: initialize registers in nft_do_chain()
Tadeusz Struk (1):
net: ipv6: fix skb_over_panic in __ip6_append_data
Takashi Iwai (1):
ALSA: pcm: Add stream lock during PCM reset ioctl operations
Werner Sembach (1):
ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
The bug is here:
return rule;
The list iterator value 'rule' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty or no element
is found.
To fix the bug, return 'rule' when found, otherwise return NULL.
Cc: stable(a)vger.kernel.org
Fixes: ae7a5aff783c7 ("net: dsa: bcm_sf2: Keep copy of inserted rules")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
---
drivers/net/dsa/bcm_sf2_cfp.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index a7e2fcf2df2c..edbe5e7f1cb6 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -567,14 +567,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv,
static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv,
int port, u32 location)
{
- struct cfp_rule *rule = NULL;
+ struct cfp_rule *rule;
list_for_each_entry(rule, &priv->cfp.rules_list, next) {
if (rule->port == port && rule->fs.location == location)
- break;
+ return rule;
}
- return rule;
+ return NULL;
}
static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port,
--
2.17.1
The bug is here:
if (!rdev)
The list iterator value 'rdev' will *always* be set and non-NULL
by rdev_for_each(), so it is incorrect to assume that the iterator
value will be NULL if the list is empty or no element found.
Otherwise it will bypass the NULL check and lead to invalid memory
access passing the check.
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'pdev' as a dedicated pointer to
point to the found element.
Cc: stable(a)vger.kernel.org
Fixes: 2aa82191ac36c ("md-cluster: Perform a lazy update")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
---
drivers/md/md.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4d38bd7dadd6..7476fc204172 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2629,14 +2629,16 @@ static void sync_sbs(struct mddev *mddev, int nospares)
static bool does_sb_need_changing(struct mddev *mddev)
{
- struct md_rdev *rdev;
+ struct md_rdev *rdev = NULL, *iter;
struct mdp_superblock_1 *sb;
int role;
/* Find a good rdev */
- rdev_for_each(rdev, mddev)
- if ((rdev->raid_disk >= 0) && !test_bit(Faulty, &rdev->flags))
+ rdev_for_each(iter, mddev)
+ if ((iter->raid_disk >= 0) && !test_bit(Faulty, &iter->flags)) {
+ rdev = iter;
break;
+ }
/* No good device found. */
if (!rdev)
--
2.17.1
The bug is here:
*dai_name = dai->driver->name;
For for_each_component_dais, just like list_for_each_entry,
the list iterator 'dai' will point to a bogus position
containing HEAD if the list is empty or no element is found.
This case must be checked before any use of the iterator,
otherwise it will lead to a invalid memory access.
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'dai' as a dedicated pointer
to point to the found element.
Cc: stable(a)vger.kernel.org
Fixes: 58bf4179000a3 ("ASoC: soc-core: remove dai_drv from snd_soc_component")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
---
sound/soc/soc-core.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 434e61b46983..064fc0347868 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3238,7 +3238,7 @@ int snd_soc_get_dai_name(const struct of_phandle_args *args,
ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name);
if (ret == -ENOTSUPP) {
- struct snd_soc_dai *dai;
+ struct snd_soc_dai *dai = NULL, *iter;
int id = -1;
switch (args->args_count) {
@@ -3261,12 +3261,19 @@ int snd_soc_get_dai_name(const struct of_phandle_args *args,
ret = 0;
/* find target DAI */
- for_each_component_dais(pos, dai) {
- if (id == 0)
+ for_each_component_dais(pos, iter) {
+ if (id == 0) {
+ dai = iter;
break;
+ }
id--;
}
+ if (!dai) {
+ ret = -EINVAL;
+ continue;
+ }
+
*dai_name = dai->driver->name;
if (!*dai_name)
*dai_name = pos->name;
--
2.17.1
.
I wish to invite you to participate in our Investment Funding Program,
get back to me for more details if interested please.
Regards.
Christopher Daniel.
My name is Alexei Navalny from Russia whom Vladimir Putin President of Russia the detects is jailing me because I'm against his evil war plans against Ukraine. killing of Russia people and the world in general.
You can read more with below links:
https://www.bbc.com/news/world-europe-16057045https://www.theguardian.com/world/2022/feb/15/alexei-navalny-faces-10-more-…
I will be happy to serve the 15 years in jail imposed by Putin but I need to assist Ukraine's displaced people around the world with the money I secretly deposited in one of the Turkish private banks, now such money will be returned to Russian because d western world has blocked Russia . If you agreed to assist me 25% of the total sum will be for your assistance and the 75% will be used to assist the Ukraine displaced by Putin war.
If you agreed and are also willing to keep this transaction confidential, I will send you all the details to approach the bank.
I contacted you because I need somebody out of Russia to do this job.
Please reply me here: aleshkanav(a)yandex.ru
Regards,
Alexei Navalny
The bug is here:
if (!encoder) {
The list iterator value 'encoder' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty or no element
is found.
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'encoder' as a dedicated pointer
to point to the found element.
Cc: stable(a)vger.kernel.org
Fixes: ec9eab097a500 ("drm/tilcdc: Add drm bridge support for attaching drm bridge drivers")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com>
---
drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.c b/drivers/gpu/drm/tilcdc/tilcdc_external.c
index 7594cf6e186e..3b86d002ef62 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_external.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_external.c
@@ -60,11 +60,13 @@ struct drm_connector *tilcdc_encoder_find_connector(struct drm_device *ddev,
int tilcdc_add_component_encoder(struct drm_device *ddev)
{
struct tilcdc_drm_private *priv = ddev->dev_private;
- struct drm_encoder *encoder;
+ struct drm_encoder *encoder = NULL, *iter;
- list_for_each_entry(encoder, &ddev->mode_config.encoder_list, head)
- if (encoder->possible_crtcs & (1 << priv->crtc->index))
+ list_for_each_entry(iter, &ddev->mode_config.encoder_list, head)
+ if (iter->possible_crtcs & (1 << priv->crtc->index)) {
+ encoder = iter;
break;
+ }
if (!encoder) {
dev_err(ddev->dev, "%s: No suitable encoder found\n", __func__);
--
2.17.1